Privacy Impact Assessment – Appeals Budget Control System (ABCs)
ABCs System Overview:
The Appeals Budget Control System (ABCs) is a web-based application that is used by Appeals to enhance the official IRS budget and finance system, Integrated Financial System (IFS). ABCs provides a vital function to the Appeals budget team by allowing them to track and manage remaining budgets through the end of the current accounting period based on estimated expenditures. It is mostly used as a forecast and planning tool, and not as an accounting tool.
ABCs is used within Appeals by less than 30 Budget personnel. ABCs has five primary modules:
1. Add Budget Item - Allows Representatives to enter new budget items.
2. Modify/Delete Budget Item - Allows a task to be updated for a budget item to be removed.
3. Generate Report - Allows two main types of reports to be generated.
4. Administration - Allows user accounts to be created, edited, and disabled. Account passwords may be reset using this module.
5. Create Office - Allows users to view tasks and entries nationwide.
Systems of Records Number(s):
Treasury .009 Treasury Financial Management Systems
Treasury/IRS 34.037 IRS Audit Trail and Security Records System
Data in the System
1. Describe the information (data elements and fields) available in the system in the following categories:
A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)
A. There is no Taxpayer information contained in the ABCs system.
B. Employee information in ABCs is limited to User ID, password, and Personal Identification Number (PIN).
C. Audit trail information in ABCs consists of
* Login - date
* Logoff - date
* Password change - date, time, and user ID (passwords are hashed)
* Record creation - date, time, user ID, and created record number
* Record modifications - date, time, user ID, and modified record number
D. “Other” information in ABCs pertains to the purchase orders themselves. This information includes: Purchase Order ID, Purchase Order Date, and Purchase Order Name.
2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)
A. Purchase Order ID, Purchase Order Date, and Purchase Order Name are obtained indirectly from Integrated Financial System (IFS). Users with input privileges enter pertinent data manually from IFS into ABCs.
Employee information (User ID, password, and PIN) in ABCs is brought in from OL-5081 via input from National Office Representatives.
B. N/A
C. All data is manually input by employees. Purchase order information is input by all levels of users who have input privileges. Employee information is input by National Office Representatives only.
D. N/A
E. N/A
F. N/A
3. Is each data item required for the business purpose of the system? Explain.
User information (User ID, password, Personal Identification Number (PIN), privilege level, Permissions granted) is needed to authenticate users and verify user levels and the need of that individual to access data in the system.
Purchase Order ID, Purchase Order Date, and Purchase Order Name serve a vital function to the Appeals budget team by allowing them to track and manage remaining budgets through the end of the current accounting period based on estimated expenditures. ABCs is primarily used as a forecast and planning tool, and not as an accounting tool.
4. How will each data item be verified for accuracy, timeliness, and completeness?
The information is being re-input from the Integrated Financial System (IFS). Because this system is used as a forecast and planning tool, there are no validity checks to make sure that the information that is input into the system is 100% accurate.
There is no automatic update to information contained in the system. IFS is monitored by ABCs users. As items are completed by IFS, users monitoring IFS assure that the change is reflected in ABCs in order to support forecasting accuracy.
5. Is there another source for the data? Explain how that source is or is not used.
No. The only source for data contained in the ABCs system is IFS, via manual input by users.
6. Generally, how will data be retrieved by the user?
ABCs is accessed over the IRS Intranet by appeals budget personnel (i.e., users) located throughout the IRS. Users may type the URL http://152.223.94.4/abcs to access the application.
Once a user opens the ABCs webpage they must enter their User ID and password to access the system. After accessing the system, users may view tasks and entries contained in ABCs.
7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier?
Data is not retrievable by any personal identifier. Data is retrieved only by entering either a Purchase Order ID, or a Purchase Order Name.
Access to the Data
8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?
There are currently 23 users on the ABCs system. Between these users, there are 4 levels of access:
* Office – Users with office access may view data, enter new budget items, modify/delete budget items, and generate reports for his or her respective office.
* Regional –Users with regional access may view data, enter new budget items, modify/delete budget items, and generate reports for his or her region. This includes each office within the region.
* National Team – Users with National Team access may view data, enter new budget items, modify/delete budget items, and generate reports from each region, (including the data of each office within that region). These users may not add manage user accounts, add offices, or add BOC/SOC codes.
* National Office Representative (Administrator) – Those with National Office access have administrative functions. They may add BOC/SOC codes, manage user accounts, and perform any action available to National Team users.
Each access level is broken into two privilege levels. Users have either “full-access”, as noted above or “View/Print only” privileges. This does not apply to National Office Representatives. National Office Representatives have only “full-access” accounts.
The Developer has access only to the non-production version of the server. On the production server, developers have only view/print access.
No contractors are able to access ABCs.
9. How is access to the data by a user determined and by whom?
For a user to gain access to ABCs, they must first request access by completing an OL-5081 request. After completing the OL-5081, the account request is vetted. The OL-5081 request for ABCs access is sent to the user's manager, who reviews the request based on the users' need-to-know. If the manager approves, the request is sent to the primary National Office Representative. The primary National Office Representative then reviews the account request, makes any modifications (such as changing privileges), and creates the account.
After an account is created, the user is sent an e-mail notifying them of their ABCs account creation (to the address they specified in the registration process) and the users' OL-5081 is updated. The primary National Office Representative also uses secure e-mail to inform the new user of their account creation and to provide the user with the default password, "password."
The National Office Representative (Administrator) controls all levels of access based on the need of the individual to access information for the performance of his or her job.
10. Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If NO, continue to Question 12.
ABCs has no interconnections with other systems. However, the purchase order data (Purchase Order ID, Purchase Order Date, and Purchase Order Name) in ABCs is gleaned from IFS and manually entered into ABCs by users.
11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?
IFS received an approved Security Certification on September 16, 2004. The Security Certification will expire on September 13, 2007. IFS received a signed Privacy Impact Assessment memorandum on November 8, 2005, expiring November 8, 2008.
12. Will other agencies provide, receive, or share data in any form with this system?
No. Other agencies do not provide, receive, or share data in any form with ABCs.
Administrative Controls of Data
13. What are the procedures for eliminating the data at the end of the retention period?
Four years worth of information is kept in ABCs. This includes the current fiscal year plus three previous fiscal years. Data for the most distant year is eliminated 3 years after end of the fiscal year in which a report was prepared, as prescribed in IRM section 1.15.10.
14. Will this system use technology in a new way? If "YES" describe. If "NO" go to Question 15.
No. This system will not use technology in a new way.
15. Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability.
No. This system will not be used to identify or locate individuals. ABCs allows the Audit Budget Team to track and manage remaining budgets through the end of the current accounting period based on estimated expenditures. It is primarily used as a forecast and planning tool. It is not designed to locate individuals or groups, and cannot be used for that purpose.
16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.
No. Aside from normal auditing functionality that records login, logoff, password change date, time, user ID, record creation, and record modifications information, there is no monitoring capability provided by the system.
17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain.
No. The system is used only for forecasting purposes. It cannot be used to treat employees or others differently.
18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?
N/A. The ABCs system is not used to make decisions that could result in a negative determination. It is a used to track and manage remaining budgets through the end of the current accounting period based on estimated expenditures. It is only used as a forecast and planning tool. It has no other capabilities.
19. If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors?
No. Although ABCs is a web-based program, it does not use persistent cookies or other tracking devises to identify web visitors.
|
