Privacy Impact Assessment – Audit Information Management System Reference (AIMSR)
AIMSR System Overview:
Audit Information Management System Reference (AIMSR) (formerly AIMS) is a legacy Tier I system that processes information related to examinations of taxpayer accounts. Accounts can be established, updated and closed online by authorized field personnel using Integrated Data Retrieval System (IDRS) Realtime Command Codes. Discriminant Function (DIF) Orders and the Automatic Selection process also send accounts to AIMS to establish open cases in inventories.
AIMSR receives information from Individual Master File (IMF), Business Master File (BMF), and Employee Plans Master File (EPMF) at the beginning of an audit and tracks the audit case through its various stages from beginning to end, and sends assessment information to these master files at the audit’s close. It produces taxpayer listings and statistical reports that enable the Area Offices to monitor and regulate their workload and their compliance with Examination's objectives. It also provides Examination data that is eventually incorporated into the Commissioner’s Annual Report.
The Realtime portion of AIMSR consists of 14 command codes that are used to establish cases on the AIMS database, update the status of these cases, close cases, and research case data.
System of Records Number(s):
Treasury/IRS 34.037 IRS Audit Trail and Security Records System
Treasury/IRS 42.008 Audit Information Management System
Data in the System
1. Describe the information (data elements and fields) available in the system in the following categories:
A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)
A. Taxpayer – AIMSR contains Taxpayer Identification Number (TIN), Master File Tax Account Code (MFT) and Tax Period (TXPD) derived from IDRS.
B. Employee – to access, the employee must be an approved IDRS user and enter IDRS logon and a password.
C. Audit Trail Information – AIMSR is a part of IDRS and IDRS maintains necessary and appropriate Audit Trails and strictly monitors access.
D. Other – None.
2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)
A. IRS – Taxpayer Information File (TIF) is obtained from IDRS, which consists of TIF 80 (taxpayer name, address, and TIN as derived from TIF records). These TIF records vary by type/functionality and depending upon their type are used by the Small Business/Self Employed (SB/SE) Operating Division, Large and Mid Size Business (LMSB) Operating Division, Tax Exempt and Government Entities (TE/GE)Operating Division and Wage & Investment (W&I) Operating Division.
B. Taxpayer – AIMSR contains taxpayer data information provided by IDRS via information taxpayers provide in their tax returns. The data includes Entity data, Tax Module data and IDRS data.
C. Employee – None. AIMSR does not collect employee data. AIMSR is part of IDRS; IDRS collects the employee data.
D. Other Federal Agencies – None. AIMSR does not obtain data from other federal agencies.
E. State and Local Agencies – None. AIMSR does not obtain data from state and federal agencies.
F. Other Third Party Sources – None. AIMSR does not obtain data from other third party sources.
3. Is each data item required for the business purpose of the system? Explain.
Yes. AIMSR allows the designated end-users/employees of the SB/SE Operating Division, LMSB Operating Division, Tax Exempt and Government Entities (TE/GE)Operating Division, and W&I Operating Division within the IRS who have been assigned a caseload related to their specific function (examination, audit, collection, etc.) to access the data they need to conduct review.
4. How will each data item be verified for accuracy, timeliness, and completeness?
The various programs and command codes within AIMSR have built in validity checks to help ensure accuracy. For example, there are validity checks to insure that a Social Security Number (SSN)/TIN when entered into an on-line application contains all numeric data. Product Assurance reviews the data as part of the case processing procedures also help to ensure accuracy, timeliness and completeness. There are a series of test performed on this data such as the Compatibility Test and the Final Integration test which insure the accuracy, timeliness and completeness of all IDRS data prior to its implementation during the annual Filing Season Start-up.
5. Is there another source for the data? Explain how that source is or is not used.
No. IDRS and its subset AIMSR is the only source for taxpayer data. It is provided by the taxpayer and/or subsequent transactions and is considered authoritative and accurate.
6. Generally, how will data be retrieved by the user?
Data is retrieved and displayed using command codes.
7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier?
Yes. Data is retrievable by TIN, but the system is designed to retrieve data based on command codes.
Access to the Data
8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?
Only authorized employees who. as a part of their duties. need access, (users, managers, system administrators, developers). All are IRS employees.
9. How is access to the data by a user determined and by whom?
Management determines which employees have access to AIMSR and for what purposes. Online (OL) Form 5081 documents at what levels users may view and use the data as a result of each employee who uses AIMSR having a profile that determines this level of access. Employee access is determined by specific need to access taxpayer data to perform assigned duties. OL 5081 is signed by the employee and the employee’s manager. By signing this document the user and manager is accountable for his/her misuse of the system.
10. Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If NO, continue to Question 12.
Yes, the following systems, all of which are strictly IRS systems and not systems under the purview of any other federal, state or local government entity, provide and/or receive and/or share data with the AIMSR:
IDRS, EPMP, Individual Retirement Account Files (IRAF), IMF, BMF, Examination Return Control System (ERCS), Remittance Processing System (RPS), Report Generation System (RGS), Midwest Automated Compliance System (MACS), Recruitment Initiative Tracking System (RITS) and Enforcement Revenue Information System (ERIS).
11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?
Yes, all systems listed above have current security and privacy certifications or are in the process of obtaining them.
12. Will other agencies provide, receive, or share data in any form with this system?
In general, no. However, TIGTA and The Government Accountability Office (GAO), in the course of their audit responsibilities, may be authorized to access IDRS and/or AIMSR data.
Administrative Controls of Data
13. What are the procedures for eliminating the data at the end of the retention period?
The procedures for eliminating the electronic TIF data at the end of the retention period is found in IRM 1.15.2. Information ages off (is deleted from) the database at varying intervals.
14. Will this system use technology in a new way? If "YES" describe. If "NO" go to Question 15.
No. AIMSR is not using technology in a new way.
15. Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability.
Yes. The TIF records allow designated and authorized IRS employees to identify and/or locate individuals and groups. For example, in an instance where a taxpayer applies for and is granted Innocent Spouse Relief, the data gleaned from a case where a couple filed their income tax return jointly would then be used to identify and locate the other spouse who is obligated to make the tax payment.
16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.
Yes, the system provides the capability to monitor individuals and groups through individual command codes. The purpose is to track the status of a taxpayer's account after it has been assigned as a case for audit, collection, appeal, etc. Audit trails exist that determine whether or not an IRS employee is authorized to have access to and use of the system. These audit trails are determined by assigned employee numbers, user-ids and passwords.
17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain. No.
18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?
Yes. AIMSR does not impact taxpayers’ due process rights or automatically make decisions regarding legal status.
19. If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors?
Not applicable. AIMSR is not web-based.
|
