All systems and peripheral equipment must be kept in a controlled area, which can be monitored by authorized users during working hours and locked after hours.

Whenever a non-IRS person, such as a maintenance service employee, enters the controlled area, at least one IRS employee knowledgeable of the system will accompany the person and monitor his or her activity.

All users must be cleared to handle taxpayer data, but access to files will be limited, to those with a need to know. For example, data entry clerks will be permitted access only to those files which are necessary to their job.

Taxpayer data which is on magnetic media will be afforded appropriate security. Printed data will be kept secured until distributed or destroyed. Hard copy to be destroyed should be shredded, burned or otherwise rendered unreadable. Magnetic media containing taxpayer data which are to be discarded should be degaussed, shredded, burned or completely written over (zero filled).

Backups of application files will be taken as frequently as is prudent for a particular site, but at least monthly. A systems file backup and an application files backup will be stored away from the computer room so as to preclude total loss of data from a localized fire or other disaster. Original backups may be used for this purpose; duplicate backups are not required. All backups must be stored in locked containers to which keys and combinations are controlled.

Sensitive data will be cleared from the screen upon "logoff" or leaving a terminal.

Computer room(s) will be cleaned by janitorial service personnel only during working hours.

CASs will conduct evaluations of taxpayer’s computerized accounting systems. Initial evaluations will only be conducted when requested by the taxpayer. Reevaluations may be initiated by the CAS Territory Manager at times other than during an examination, if deemed appropriate.

Taxpayers whose records are processed by ADP service bureaus or time-sharing services are responsible for record retention the same as any other taxpayer.

During the course of every record evaluation, the evaluator shall inquire as to whether the taxpayer has considered filing returns and wage or information documents on magnetic tape or disk. All taxpayers who express an interest in this program should be referred to the appropriate magnetic tape coordinator.

In most cases, the record evaluation will show that audit efficiency can be increased using machine-sensible records. Discussions should be held with taxpayers or their representatives to gain cooperation in the use of computer assisted audit techniques and taxpayer computer facilities. After the discussions are concluded, the taxpayer must be furnished with either a confirmation letter or a notice, depending on whether the taxpayer agrees to comply, setting forth the specific record retention requirements resulting from the evaluation.

The group manager, team manager and/or territory manager with responsibility for the case must concur with the provisions incorporated in the agreement or notification. All speciality team managers involved should also review and approve the list of records identified for retention. All concurrences are to be in writing.

When an evaluation of a taxpayer’s records results in the need for changes to arrangements or record requirements previously agreed to, or set forth in a notification to the taxpayer, a new notification or agreement reflecting the changes or requirements will be issued.

Internal controls affecting record retention.

Evaluators should review examination historical files and consult with the examining agent, other specialists (engineer, international, economists, employment and excise), and the group or case manager to determine what records were used. The CAS should also review audit trails and record formats, and hold discussions with responsible officials, including representatives from the taxpayer’s data processing department.

Taxpayers should be asked to identify files which they deem appropriate not to retain.

Certain printed reports produced by a taxpayer are often critical to an examination and continually used by examiners. Since the taxpayer may change company policy and no longer produce a key report in the same format or media, consideration should be given to retaining machine-sensible records, which would permit the re-creation of such reports.

The following is a brief outline of some basic information useful in the evaluation of a taxpayer’s ADP system.

When discussions with the taxpayer result in an agreement to retain machine-sensible records, and cooperate in the use of computer-assisted techniques, or to use alternative procedures acceptable to the Service, a confirming letter will be issued to the taxpayer by the CAS territory manager setting forth what has been agreed to. This letter will be issued over the signature of the CAS territory manager.

When a taxpayer, after the records have been evaluated by the Service, is orally advised of record retention requirements but does not agree to comply or enter into an agreement, the CAS territory manager must issue a letter notifying the taxpayer that retention of the records specified therein is required. This letter is applicable only to those taxpayers whose records are acceptable under the guidelines in Rev. Proc. 98–25. Others will be handled under normal inadequate records procedures.

This notice will also be issued in cases where the taxpayer’s willingness to comply with the terms of a signed record retention limitation agreement is seriously questioned. This may be evidenced by the taxpayer’s failure to implement adequate internal controls to ensure that records identified in the agreement will actually be retained.

When it is determined that the accounting records processed by computer are not sufficiently voluminous or complex to warrant their retention in machine-sensible form, a letter will be issued to the taxpayer to confirm that a record evaluation has been made and that their present record retention practices will be adequate. This letter should be signed by the CAS Team Manager.

When a taxpayer agrees to comply with the requirements of Rev. Proc. 98–25 and the taxpayer has adequate internal controls, a letter will be issued to the taxpayer to confirm that a record evaluation has been made and that their present record retention practices will be adequate. This letter should be signed by the CAS Team Manager.

Consolidated Returns—One notice or confirmation letter to the common parent will serve as a notice to all members of the group. It may, of course, provide different retention requirements for different group members, as audit needs dictate.

Coordinated Industry Cases.

Other Affiliated Corporations—Notice or confirmation letter should be issued only after coordination action consistent with the provisions of the former IRM 4225.

Taxpayers subject to the mandatory record retention requirements must retain all machine-sensible records generated by all automated data processing systems unless the CAS Territory Manager has consented to limit the retention to certain specific records.

The limitation on machine-sensible records to be retained pursuant to a retention limitation agreement does not apply to subsidiary companies acquired, or to accounting and tax systems added, subsequent to the completion of the record evaluation or reevaluation upon which the agreement is based. All machine-sensible records produced by these companies or systems must be retained until such time as a reevaluation is conducted by the CAS Territory Manager.

Unless otherwise specifically agreed to by the CAS Territory Manager, taxpayers are required to:

The CAS Territory Manager may consent to limit the retention of records by entering into a record retention limitation agreement with a taxpayer. These agreements usually require the taxpayer to notify the CAS Territory Manager if changes are made to its ADP accounting systems or record formats that will affect the ability of the taxpayer to comply with the terms of the agreement.

The intent of the notification provision is to permit a taxpayer to make changes to an ADP system without influencing the agreement, provided the content of the files specified in the agreement has not changed. Changes which add or rearrange fields within a data record will not be considered to have changed the substance of an agreement if all fields that were in the records covered by the agreement are retained. Under these circumstances, the files created by the revised system may be retained in lieu of those specified in the agreement. Notification is not required.

A taxpayer who is unable to comply with the provisions of a record retention limitation agreement because of system changes has, in substance, created a new system. All records created by the replacement system must be retained until such time as a reevaluation is conducted by the CAS Territory Manager.

As the information specialist to the audit team, the CAS is responsible for obtaining accurate and complete computerized records that meet the requirements of Revenue Procedure 98-25.

Failure to comply with the provisions of Rev. Rul. 71–20 or Rev. Proc. 98–25 may result in the issuance of a Notice of Inadequate Records or the assertion of civil and/or criminal penalties. Refer to Rev. Proc. 98–25 and Rev. Rul. 81–205 for additional information.

If records are lost, destroyed, damaged, incomplete or materially inaccurate, the following steps should be followed by the CAS to the extent necessary to correct the noncompliance.

Careful consideration should be given to the issuance of an Inadequate Records Notice pursuant to Section 12 of Revenue Procedure 98-25 when the required records are either incomplete or non-existent. The taxpayer should be offered the opportunity to explain the reason for the missing records and to reconstruct the records.

It is the responsibility of the Industry Team Manager to issue an Inadequate Notice; however, it is the responsibility of the CAS and CAS Team Manager to make recommendations. If there is a disagreement between the Team Managers, the appropriate Territory Managers or other management officials should be involved to resolve the disagreement.