Privacy Impact Assessment - AIMS Related Reports (ARR)
ARR System Overview:
AIMS Related Reports (ARR) is a system that produces statistical information reports and listings for use by management as well as external customers. It provides inventory and accomplishment information for all returns in Examination. The reports created from ARR contain accomplishment data such as source of return, results both dollars and hours, and disposition code information. Inventory reports provide management with a picture of the status of what is available for examination. Reports are also generated with information pertaining to applied time by examiners.
System of Records Number(s):
Treasury/IRS 34.037 IRS Audit Trail and Security Records System
Treasury/IRS 42.008 Audit Information Management System
Data in the System
1. Describe the information (data elements and fields) available in the system in the following categories:
A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)
A. Taxpayer (data from IDRS showing filing information and subsequent processing)
o Social Security Number
o Name
o Address
o Tax Payer codes
o Exam Codes
o Period of Tax Return
o Type of Return
B. Employee – No employee data is in the ARR System.
C. Audit Trail Information – Employee SEID used as authentication for audit trail verification.
D. Other – None
2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)
A.IRS
The information uploaded in ARR is from ERCS and ARP. The information in ERCS pertains to the time data associated with the examination (i.e. how much time was spent on the examination by the examiner). The information in ARP pertains to the case status (i.e. open, closed). ARR consolidates data from the two systems and produces reports.
B. Taxpayer – None directly.
C. Employee
Agent grade, time worked on case. Reports created from ARR do not have employee data.
D. Other Federal Agencies – None.
E. State and Local Agencies – None.
F. Other third party sources – None.
3. Is each data item required for the business purpose of the system? Explain.
Yes. ARR uses the data to create reports related to examination results. Data is also used to create the Open Case data file, Closed Case data file and SETTS data file. Reports created from ARR are Closure and Inventory data of returns and the results associated with those returns for use by management. There is no identifiable employee data.
4. How will each data item be verified for accuracy, timeliness, and completeness?
All data is validated against predetermined criteria such as time expended, grade levels, case coding. If there is a discrepancy, an error record is generated. The error record will not be included in the reports output.
5. Is there another source for the data? Explain how that source is or is not used. No.
6. Generally, how will data be retrieved by the user?
Data and Tables are supplied to A-CIS which is an ACCESS Database. Users who need the AIMS Related Reports and Datafiles are required to file an Online 5081 to gain access to their data. Reports are retrieved by report type or reporting criteria.
7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier?
No, reports in ARR are retrieved by report type or reporting criteria. However, data in the listing tables is retrievable by taxpayer name or SSN. The ARR system alone is not designed to retrieve by unique personal identifier.
Access to the Data
8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?
SBSE examination personnel who are system owners, system administrators and application developers. Application developers (IRS employees) have access for trouble shooting only.
9. How is access to the data by a user determined and by whom?
ARR identifies users by their unique IRS Standard Employee IDentifier number (SEID) and grants permissions to authenticated users based on the functional group(s) to which this SEID has been assigned. An Online 5081, signed by an immediate manager, is required of IRS users requesting access to ARR. Once forms are approved they are submitted to the system administrator, who adds the new user’s account into the system.
10. Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If NO, continue to Question 12.
Yes. ERCS and ARP provide data. The information in ERCS pertains to the time data associated with the examination (i.e. how much time was spent on the examination). The information in ARP pertains to the case status (i.e. open, closed). ARR consolidates data from the two systems and produces reports. ARR also creates the Open, Closed and SETTS data files which are supplied to A-CIS.
11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?
Yes, all systems either have Security Certifications and PIAs or they are currently in process.
12. Will other agencies provide, receive, or share data in any form with this system?
Data used to create ARR is often used for reporting Service wide statistical information in the aggregate to various internal and external customers. No personally identifiable or taxpayer information is provided to other agencies.
Administrative Controls of Data
13. What are the procedures for eliminating the data at the end of the retention period?
The retention period is ten years. Data on tape is erased, data maintained on disk is overwritten. The guidelines are contained in Records Management IRM 1.15.1 and IRM 1.15.2.
14. Will this system use technology in a new way? If "YES" describe. If "NO" go to Question 15. No.
15. Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability. No.
16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring. No.
17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain. No.
18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?
ARR has no negative effects on the due process rights of taxpayers or employees.
19. If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors? n/a
|
