Privacy Impact Assessment – Dynamic Review of Automated Work Schedules
DRAWS System Overview:
The Dynamic Review of Automated Work Schedules (DRAWS) program is the on-line system for reviewing work schedules and fiscal year workplans. Once the budget is converted from dollar resources to staff year/hour resources, these resources are planned out over the upcoming fiscal year’s three scheduling periods. These projections are, in part, based on known procedural or organizational changes, prior year history and work schedule data. DRAWS is the on-line system that allows users to access all the appropriate data and complete the review of a work schedule.
System of Record Number(s):
Treasury/IRS 22.034 Individual Returns Files, Adjustments and Miscellaneous Documents Files
Treasury/IRS 34.037 IRS Audit Trail and Security Records System
Data in the System
1. Describe the information (data elements and fields) available in the system in the following categories:
A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)
A. Taxpayer: None
B. Employee: USERID required for access to any IRS networked system and a listing of the employees with access to the system, and their assigned roles.
C. Audit Trail Information: None
D. Other: The primary data in the system is service center, organization, function and program codes that track the number of hours and/or the volumes of work performed in each scheduling period. Prior year history and the approved work plan hours, and/or volumes of work, are loaded into the system. The work plan projections are developed by the work schedulers in National Office and in field sites. Tables are used to track valid codes, with accompanying code names (i.e. Organization Code 31 = Receipt & Control Branch). Additional tables are maintained to help determine the quantities of hours and /or volumes to be scheduled (i.e. Overhead hours will be scheduled at 10% of total scheduled direct hours for an Organization).
2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)
A. IRS: PCB0340 OFP History Report
PCC6040 Manager’s Report
PCB0540 Weekly Workload and
Staffhours Schedule
PAWS data
SAWS data
B. Taxpayer: None
C. Employee: The SCHEDULER table retains the LOGIN (id), NAME (first, last and middle initial), SAL (role), OFFICE (code), ORG (code), ACCESSNUMBER (number of times the system has been accessed by that individual) and the ACCESSTIME (the date and time the system was last accessed by that individual) for each employee. The SCHEDULER table is used to associate the employee with the offices and organizations they are allowed to modify, and to identify what parts of the system they can access via their role assignments.
Employees who edit the data are required to provide a narrative explaining the change that was made to the data if the change results in an increase or decrease to planned hours which are outside preset quantities (i.e. +/- 250 hours in a single OOFP (Office, Organization, Function and Program codes) during July – Sep, but +/- 500 hours in a single OOFP during Jan – Jun). The employee’s name and the date and time are entered into the narrative by the system when the employee saves the narrative. This information is not readily researchable and is not cross referenced with any other tables. Employees enter data to the system based on their knowledge and management goals.
D. Other Federal Agencies: None
E. State and Local Agencies: None
F. Other third part sources: None
3. Is each data item required for the business purpose of the system? Explain.
Yes – DRAWS data is used to review the Work Schedules for an upcoming planning period, against the corresponding approved Work Plan. The process for planning the upcoming fiscal year’s workload involves multiple reviews of data by various levels of management, followed by negotiations between the various organizations involved. This entire process is captured in DRAWS, which is used for recording the various proposals and then evaluating those proposals within diverse parameters.
4. How will each data item be verified for accuracy, timeliness, and completeness?
The National Office Coordinators and Service Center Coordinators are charged with verifying the accuracy, timeliness and completeness of information in DRAWS.
DRAWS is designed to be a tool by which information from various sources can be aligned for easy comparison. Which pieces of information are relevant to the period currently under negotiation is determined by these coordinators.
5. Is there another source for the data? Explain how that source is or is not used.
No. All sources have been identified in this document.
6. Generally, how will data be retrieved by the user?
The primary data consists of hours and volume counts which the service tracks for budget purposes and workload planning purposes. This information is grouped at the branch level; therefore, no individual’s information is available.
This data is retrieved by a combination of codes for Office, Organization, Function and Program. These codes indicate where a document is being worked, what type of work is being done to it and what type of document it is. Some areas only use document counts, other areas use hours worked and some use the combination of document counts and hours worked.
Overhead hours, such as managerial and paid leave, are also available by Office and Organization.
Secondary information, which is used by the National Office Coordinators and Service Center Coordinators, is used for administering the DRAWS system. This secondary data contains user’s names and login codes for identifying what data they are able to access for either reading the primary data, or editing the primary data.
7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier?
Yes, the Coordinators who are responsible for assigning roles to each user can retrieve the users names and logins for purposes of adding or removing permissions.
Access to the Data
8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?
Users are assigned Roles:
NOAdmin Role
* Administers the database such as initializing the tables and loading files.
* Sets the cut-off dates for each of the work plan phases.
* Assign Ids and permissions.
SC Admin Role
* Assigns IDs and permissions for local users.
* Locks the Field Proposal field for organizations within their assigned Service Center.
Scheduler Role
* Does editing.
Public Role
* Gets reports.
Systems Administrators
* Access to data and audit trail records.
Developers
* Access to all tables
* Access to all stored procedures
9. How is access to the data by a user determined and by whom?
A user’s position and “need-to-know” determine the type of access to the data. The manager, functional security coordinator, and the system administrator/ security officer grant approval for system access. A user’s access to the data terminates when it is no longer required. Criteria, procedures, controls and responsibilities regarding access will be documented in the DRAWS Security Features User’s Guide.
10. Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If NO, continue to Question 12.
Provide Data:
PCB0340 OFP History Report
PCC6040 Manager’s Report
PCB0540 Weekly Workload and
Staffhours Schedule
PAWS Application
SAWS Application
Receive Data:
PAWS Application
SAWS Application
Statistical information on the number of hours and volumes of work being planned, scheduled or reviewed for a fiscal year are used by other systems. Any comments recorded by users in the negotiations phases can be transferred into and out of the PAWS and SAWS applications.
11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?
The WP&C system, which provides the PCB0340, PCB 0540, and PCC6040 runs, are outside the domain of this review. They are assumed to be certified.
The PAWS and SAWS applications have received approved Security Certification and Privacy Impact Assessments.
12. Will other agencies provide, receive, or share data in any form with this system?
No other agencies will provide, receive or share data in any form with this system.
Administrative Controls of Data
13. What are the procedures for eliminating the data at the end of the retention period?
DRAWS will retain data for a maximum period of 5 years. At the end of the retention period, the data will be automatically/systemically deleted from the system.
14. Will this system use technology in a new way? If "YES" describe. If "NO" go to Question 15. No.
15. Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability.
Yes. The DRAWS system identifies users by their logins to determine what the scope of access will be.
The business purpose for this capability is to restrict users from accessing or changing information that is not relevant to their positions and roles.
16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.
The system does not allow any monitoring of individuals or groups. The only data collected concerning individuals is their names, logins and permissions. This data is restricted to the Coordinators who are charged with assigning permissions to users.
17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain.
No – This system does not allow IRS to treat taxpayers, employees or others differently. DRAWS will not affect the equitable treatment of taxpayers/employees.
18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?
No parties are affected.
19. If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors?
DRAWS will not be web-based.
| 
