Tax Fraud and Noncompliance: IRS Could Further Leverage the Return Review Program to Strengthen Tax Enforcement

Tax noncompliance, including refund fraud, threatens the integrity of the tax system and costs the federal government hundreds of billions of dollars annually. RRP is IRS's primary pre-refund system for detecting and preventing the issuance of invalid refunds. IRS reported that between January 2015 and November 2017 RRP prevented the issuance of more than $6.51 billion in invalid refunds.

GAO was asked to examine RRP's capabilities. This report (1) describes how RRP detects and selects suspicious returns and prevents invalid refunds; (2) assesses how IRS monitors and adapts RRP; and (3) examines what else, if anything, IRS can do to strengthen RRP and use it to address other enforcement issues.

GAO reviewed IRS plans for RRP and documents on its performance. GAO compared IRS's efforts to federal internal control standards, GAO's Fraud Risk Framework and IRS's strategic plan. GAO interviewed IRS officials who work on and use RRP.

The Internal Revenue Service's (IRS) Return Review Program (RRP) detects and selects potentially fraudulent returns to prevent the issuance of invalid refunds. According to IRS, RRP uses advanced analytic techniques and various data sources, including prior-year tax returns, to assign multiple scores to individual returns based on characteristics of identity theft and other refund fraud.

GAO found that IRS routinely monitors RRP's performance and adapts RRP to improve detection and address evolving fraud threats. Each year IRS updates RRP's detection tools to improve accuracy for the next filing season.

IRS has plans to continue developing RRP to further prevent invalid refunds, including using RRP to analyze and detect fraudulent business returns. However, GAO identified other opportunities for IRS to improve RRP's fraud detection and to use RRP for other enforcement activities:

RRP's ability to accurately detect and select suspicious returns could benefit from having information on Forms W-2, Wage and Tax Statements (W-2) available for analysis more frequently. As of April 2018, IRS officials said they were drafting but had not yet approved a work request to load W-2s into RRP daily instead of weekly for the 2019 filing season.

IRS could collect more information electronically from paper filers. One approach IRS evaluated in 2012 is to digitize some paper returns using barcoding technology, but it has not updated that analysis or expanded it to consider other digitizing technologies. IRS requested that Congress require that returns prepared electronically but filed on paper include a scannable code printed on the return, but Congress had not done so as of May 2018.

IRS could apply RRP's capabilities to improve other tax enforcement activities, such as audit selection or underreporting detection. Individuals' underreporting of tax liabilities accounts for hundreds of billions in lost tax revenue. Until IRS evaluates the costs and benefits of expanding RRP to analyze returns not claiming refunds, IRS will not have the information needed to make decisions that could help streamline processes for detecting and treating additional types of noncompliance and fraud.

GAO suggests Congress consider legislation to require that returns prepared electronically but filed on paper include a scannable code. GAO is also making five recommendations to IRS, including that IRS take action to make incoming W-2s available to RRP more frequently, update and expand a 2012 analysis of the costs and benefits of digitizing returns filed on paper, evaluate the costs and benefits of expanding RRP to analyze returns not claiming refunds, and take any appropriate action based on those evaluations. IRS agreed with GAO's recommendations.

The Internal Revenue Service (IRS) faces an ongoing challenge to detect  and prevent noncompliance with tax laws. Noncompliance and fraud  threaten the integrity of the tax system, costing the federal government  billions of dollars annually. Every year taxpayers willfully or unintentionally  fail to pay hundreds of billions of dollars owed in taxes. This  noncompliance includes individuals who make inadvertent mistakes and  fraudsters who intentionally seek to evade taxes and obtain invalid  refunds.

IRS’s enforcement of tax laws has been on our High-Risk List since the  list was first established in 1990.

In 2015 we added IRS’s efforts to address identity theft (IDT) tax refund  fraud to the high-risk area.

IDT tax refund fraud occurs when a fraudster seeking a tax refund files a  fraudulent tax return using a legitimate taxpayer’s identifying information.  Detecting fraudulent tax returns has become increasingly difficult for IRS  as fraudsters gain access to more personal and financial information,  which they use to file returns that appear legitimate. IRS estimated that at  least $12.2 billion in IDT tax refund fraud was attempted during 2016.  IRS estimated that it prevented at least $10.6 billion (86 percent) of that  amount but paid at least $1.7 billion in invalid refunds.

One of IRS’s preventive tools is the Return Review Program (RRP), a  pre-refund system that screens individual returns claiming refunds using  characteristics predictive of IDT and other refund fraud. IRS began  developing RRP in 2009 to replace the Electronic Fraud Detection  System, which IRS built in the 1990s (see appendix I for more  information).

Given the importance of RRP for preventing billions of dollars in invalid  refund payments, you asked us to examine RRP’s capabilities. This  report (1) describes how RRP detects and selects suspicious returns to  prevent invalid refunds; (2) assesses how IRS monitors and adapts RRP;  and (3) examines what else, if anything, IRS can do to strengthen RRP  and use it to address other enforcement issues.

To describe how RRP detects and selects suspicious returns to prevent  invalid refunds, we reviewed IRS documents and procedures related to  RRP development and capabilities. We reviewed IRS documents  analyzing RRP’s performance detecting and selecting fraudulent returns  during the filing season. We reviewed IRS’s replacement plans for its  legacy fraud detection system and release plans outlining requirements  and capabilities for RRP. We reviewed reports from the Treasury  Inspector General for Tax Administration (TIGTA) on IRS’s development  of RRP and RRP’s capabilities. We interviewed IRS officials involved in  the development and operation of RRP, including officials from IRS’s  Information Technology (IT) organization and Wage and Investment and  Criminal Investigation divisions.

To assess IRS’s efforts to monitor and adapt RRP, we reviewed IRS  documents outlining IRS’s process for updating RRP, reports analyzing  RRP performance for the 2017 and 2018 filing seasons, and IRS reports  describing changes or adjustments to RRP. We reviewed TIGTA reports  and IRS documents outlining IRS’s process for evaluating and updating  RRP. We interviewed IRS officials overseeing and evaluating RRP’s  performance to determine how officials use the reports and analysis to  manage RRP. We compared IRS’s efforts to the Standards for Internal  Control in the Federal Government that directs officials to establish and  operate ongoing monitoring activities to determine the effectiveness of  systems such as RRP and take corrective action as appropriate. We also  assessed IRS’s monitoring and evaluation of RRP against leading  practices to combat fraud in a strategic, risk-based manner as identified in  the Framework for Managing Fraud Risks in Federal Programs (the Fraud  Risk Framework).

To evaluate what else, if anything, IRS can do to strengthen RRP  detection and use it to address other tax enforcement issues, we  reviewed IRS documentation describing RRP’s current state and planned  development and our prior work evaluating IRS’s development of RRP  and other major IT investments. We also reviewed our prior work and  recommendations related to IRS’s tax enforcement activities. We  interviewed IRS officials involved in developing and managing RRP to  discuss planned development and uses of RRP. We also interviewed  officials from the Small Business and Self-Employed division responsible  for enforcement activities, such as auditing individual tax returns to detect  misreporting, and officials from the Office of Research, Applied Analytics,  and Statistics who conduct IRS’s research on noncompliance and IRS’s  enforcement strategies. We compared IRS’s efforts to goals and  objectives identified in its Strategic Plan: FY2018-2022, such as  encouraging compliance through tax administration and enforcement and  increasing operational efficiency and effectiveness. We also compared  IRS’s actions to the federal standards for internal control and the Fraud  Risk Framework, which direct management to evaluate the costs and  benefits of using systems to inform resource allocation decisions and  achieve agency objectives.

We conducted this performance audit from June 2017 to July 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Noncompliance, including fraud, does not have a single source, but  occurs across different types of taxes and taxpayers. It includes  unintentional errors as well as intentional evasion, such as intentionally  underreporting income, intentionally over-reporting expenses, and  engaging in abusive tax shelters or frivolous tax schemes. IRS uses many  approaches to address noncompliance, from sending notices to taxpayers  to conducting complex audits. Many of these approaches can be  burdensome to IRS and to taxpayers since they may occur years after  taxpayers file their return.

We have long highlighted the importance of strong preventive controls for  detecting fraud because preventing payment of invalid refunds is easier  and more cost-effective than trying to recover revenue through the pay- and-chase model of audits. IRS uses pre-refund compliance checks to  confirm taxpayers’ identities, quickly and efficiently correct some clerical  and mathematical errors, and detect possible fraud and noncompliance.  As shown in figure 1, RRP analyzes individual tax returns claiming  refunds and identifies characteristics predictive of IDT and other refund  fraud before IRS issues refunds for those returns.

IRS reported that between January 2015 and November 2017, RRP  prevented the issuance of more than $6.51 billion in invalid refunds. As of  March 30, 2018, IRS reports spending about $419 million developing and  operating RRP. For fiscal year 2019, IRS requested $106 million to  operate and further develop RRP.

According to IRS, RRP supports data, analytical, and case processing  activities conducted by employees working in revenue protection,  accounts management, taxpayer communications, and criminal  prosecution. IRS employees from across these areas coordinate to  oversee the development and operation of the system (see fig. 2).

Four IRS divisions work with IRS’s Information Technology (IT)  organization and Office of Research, Applied Analytics, and Statistics  (RAAS) to develop, maintain, and operate RRP. The Wage and  Investment (W&I) division leads the management of RRP with IRS’s IT  offices. W&I’s audit programs cover mainly refundable credits claimed on  individual income tax returns and the division develops policy and  guidance for RRP and other pre-refund programs that detect suspicious  returns. Coordinating with other IRS divisions, W&I and IT update RRP  as needed to reflect any new business rules or changes to existing  business rules, for example. The Large Business and International  division provides RRP with business requirements specific to large  corporations. The Criminal Investigation division reviews and analyzes  tax returns throughout the filing season to identify fraudulent patterns and  trends to incorporate into RRP. The Small Business and Self-Employed  division audits individual and business tax returns to detect  misreporting. RAAS leads development of some of RRP’s predictive  models and IDT filters.

The Return Review Program Aims to Detect, Select, and Prevent Invalid Refunds More Accurately and Efficiently

As IRS’s primary pre-refund system for detecting IDT and other refund  fraud, RRP performs three major activities (see fig. 3).

Detection: RRP Uses Multiple Data Sources and Predictive Models, Among Other Techniques, to Detect Suspicious Returns

According to IRS, RRP uses advanced analytic techniques and evaluates  data from various sources to assign multiple scores to individual returns  claiming refunds. The scores are based on characteristics of IDT and  other refund fraud known to IRS. Higher fraud scores indicate the return’s  greater potential for refund fraud. IRS officials told us that RRP’s design  helps IRS identify increasingly sophisticated tax fraud. RRP’s analytic  techniques include the following:

Predictive models. IRS develops many different models that help  detect emerging fraud, outliers, and taxpayer behavior inconsistencies  in returns claiming refunds. These models also mine data and help  IRS seek out patterns predictive of IDT and other refund fraud. For  example, a model may use a combination of existing variables from  the 1040 individual tax return, such as tax credits claimed and  income.

Business rules. RRP contains over 1,000 rules (a “yes” or “no”  outcome) developed by IRS to flag returns for evidence of anomalous  behavior. For example, RRP uses a business rule to distinguish  between returns for which it has received an associated Form W-2,  Wage and Tax Statement (W-2), from those which it has not.

Clustering. RRP uses a tool that reveals patterns and relationships in  masses of data allowing RRP to identify clusters of returns that share  traits predictive of schemes and refund fraud. For example, IRS could  use clustering to identify groups of returns that share the same  geographic location, among other traits. According to IRS, this  technique was developed to automate certain aspects of Criminal  Investigation’s identification of fraud schemes.

A number of systems connect to RRP and provide additional taxpayer  data or third-party information for RRP to analyze. RRP contains  taxpayers’ prior three years’ filing history and third parties—employers,  banks, and others—file information returns to report wages, interest, and  other payment information to taxpayers and IRS. For example, the  Social Security Administration sends W-2s to IRS. The W-2 information is  loaded regularly into RRP, along with other information returns, to  validate wage and income information reported on individual returns  claiming refunds—a process IRS calls systemic verification.

Selection: RRP Filters Select Suspicious Returns for Further Action or Review

RRP has filters that combine results from the analytic techniques to  automatically make a selection decision and then a treatment decision  before the return can move to the next processing step and a refund can  be issued. Returns not selected by RRP continue through the pipeline  process.

Selection decision. Returns with fraud scores above thresholds— and meeting other criteria set by IRS management—will automatically  be selected by RRP filters for further action or review. According to  IRS, the agency’s capacity to review selected returns is part of the  automated selection decision, as are other criteria that weigh the cost  and risk to IRS. IRS reports that for the 2017 filing season, RRP  selected 857,438 returns as potential IDT refund fraud and 219,210  returns as potential other refund fraud. This is less than 1 percent of  almost 158 million individual returns filed that year.

Treatment decision. RRP automatically assigns selected returns to  the appropriate treatment based on the characteristics of IDT or other  refund fraud RRP detected. Examples of treatments include the  following:  Identity theft refund fraud. Returns selected by an IDT filter are  automatically assigned for treatment in the Taxpayer Protection  Program. IRS notifies taxpayers that they must authenticate their  identity before IRS will process the return or issue a refund.  Taxpayers can verify their identity by calling an IRS telephone  center, visiting a Taxpayer Assistance Center, or in some cases,  authenticating online or via mail. If the taxpayer does not  respond to the letter or fails to authenticate, the return is  confirmed to be IDT refund fraud.

Other refund fraud. If a return is selected by one of RRP’s non- identity theft filters, RRP automatically assigns the return, based  on the characteristics of fraud identified, to the Integrity and  Verification Operations (IVO) function within W&I’s Return Integrity  and Compliance Services office for further action or review. For  example, RRP may select a return as potential refund fraud  because it is missing verification of income for a refundable tax  credit, such as the Earned Income Tax Credit. IVO tax  examiners may then, for example, contact employers to confirm  the income and withholding amounts reported on the return.

Frivolous returns. RRP selects returns that contain certain  unsupportable arguments to avoid paying taxes or reduce tax  liability. If IRS determines these returns to be frivolous, the  taxpayer may be subject to penalty. RRP assigns potentially  frivolous returns to IVO for review and to notify the taxpayer.

Non-workload returns. RRP’s non-workload filters select returns  that, according to IRS, score just below the thresholds for RRP’s  other filters described above. IRS officials told us that RRP loops  these returns for additional scoring and detection.

Prevention: RRP Freezes Selected Returns and Improves Detection and Enforcement Efforts Across IRS

RRP supports IRS’s efforts to prevent issuing invalid refunds in the  following ways:

Freezing refunds. RRP connects directly to IRS’s systems for  processing individual tax returns and issues transaction codes directly  to the Individual Master File depending on the type of refund fraud  RRP detected. IRS reports that for the 2017 filing season, RRP  prevented IRS from issuing about $4.4 billion in invalid refunds. Of  that amount, $3.3 billion was attributed to IDT refund fraud and $1.1  billion to other refund fraud.

When RRP selects a return as potential IDT refund fraud, RRP will  simultaneously assign the return for treatment and issue a transaction  code telling IRS’s processing systems to freeze the refund until the  case is resolved. As a result, IRS can protect the refund until the  review is complete or a legitimate taxpayer has authenticated his or  her identity, at which point IRS will release the return.

If RRP’s non-identity theft filters select the return because of  characteristics predictive of other refund fraud, RRP issues a  transaction code to freeze the return for 14 days while IVO examiners  have the opportunity to screen the return. After 14 days, the return  automatically resumes processing and the refund may be released.  Accordingly, IRS officials told us that RRP prioritizes IDT treatment  and if a return is selected by both IDT and other refund fraud filters,  RRP will automatically assign the return to the Taxpayer Protection  Program and freeze the refund.

IRS officials told us that when RRP’s non-workload filters select a  return, RRP will issue a transaction code that delays the payment of  the refund associated with the return for 1 week. According to IRS  officials, this delay provides IRS an opportunity to manually review  returns that contain suspicious characteristics.

Incorporating treatment results. IRS integrates the results from  each return review into its analytic techniques to improve RRP’s  detection ability and accuracy on an ongoing basis. For the 2018 filing  season, IRS officials told us they were able to add functionality that  uses real-time case feedback data to automatically improve the  accuracy of some of RRP’s IDT fraud filters. IRS officials can also  change RRP’s selection criteria or filters during the filing season  based on emerging fraud or workload concerns.

Detailed data and analysis. With RRP, all available taxpayer  information is linked together and available for analysis and queries  by IRS employees for post-refund enforcement activities, such as  criminal investigations. RRP creates and distributes a report with the  results of RRP’s clustering analysis to analysts in Criminal  Investigation. IRS employees are also able to search RRP and  analyze data relevant to their specific enforcement activities. Criminal  Investigation officials told us they use RRP reports to identify  suspicious returns that were not selected by RRP and flag them for  further post-refund review.

IRS Routinely Monitors RRP’s Performance and Adapts RRP to Improve Detection and Address Evolving Fraud Threats

As the primary system for detecting IDT and other refund fraud and  preventing IRS from paying invalid refunds, RRP is an integral part of  IRS’s ability to process returns during the filing season. Therefore,  monitoring and evaluation activities that rely on quality information to  identify, analyze, and respond to changes—such as emerging fraud  trends—are critical to ensure that RRP is operating effectively. Federal  standards for internal control and the Fraud Risk Framework highlight the  importance of monitoring and incorporating feedback on an ongoing basis  so the system remains aligned with changing objectives, environments,  laws, resources, and risks. Consistent with these practices, IRS follows  an industry-standard process to conduct a range of monitoring and  evaluation activities for RRP throughout the year (see fig. 4).

According to IRS officials, each year beginning in February, IRS  evaluates and updates RRP to improve detection and accuracy for the  next filing season. A leading practice in the Fraud Risk Framework is for  managers to use the results of monitoring, evaluations, and investigations  to improve fraud prevention, detection, and response. A more accurate  RRP helps IRS use its resources more effectively. For example, if RRP  automatically detects fraudulent returns previously identified by manual  processes or post-refund enforcement activities, IRS can redirect those  enforcement resources to identifying new and emerging fraud schemes.  Further, as RRP selects fewer legitimate returns as suspicious, IRS  employees are able to devote more of their time to identifying fraudulent  returns.

IRS officials stated that to improve RRP’s accuracy, IRS incorporates  information about all refund fraud and noncompliance detected by other  enforcement activities into RRP’s detection tools. IRS also uses  information from its research efforts and external entities, as described  below.

Other enforcement activities. These activities include the Fraud  Referral and Evaluation program, where, according to IRS, analysts  manually review select tax returns that scored just below RRP’s  selection thresholds. Another enforcement activity is the Dependent  Database, a pre-refund screening system that identifies potential  noncompliance related to the dependency and residency of children.  IRS staff told us they evaluate refund fraud detected by the  Dependent Database and Fraud Referral and Evaluation program that  RRP missed and update RRP’s analytic techniques for the next year.  Third, investigators in Criminal Investigation told us that they work  with other IRS offices to incorporate new and emerging refund fraud  patterns, such as those identified as a result of external data  breaches, into RRP’s detection tools. To ensure that the updates are  operating effectively, IRS staff track the percentage of invalid returns  that RRP automatically selected that were previously detected by  other IRS processes.

IRS research. IRS officials stated that the agency uses information  from a number of research efforts to inform updates or adaptations to  RRP. For example, for the 2018 filing season, IRS changed RRP’s  filters and selection criteria to automatically select returns that IRS  held manually in 2017. IRS officials told us they made these changes  after researching taxpayer behavior in noncompliant claims of the  Earned Income Tax Credit and Additional Child Tax Credit during the  2017 filing season.

Third-party information. IRS collaborates with external entities to  strengthen IRS’s defenses against paying invalid refunds. IRS officials  told us they use information from their collaborative efforts to update  RRP’s detection tools for the upcoming filing season. These efforts  include the External Leads Program, where participating financial  institutions provide leads to IRS regarding deposits of suspicious  refunds, and the Opt-In Program, a voluntary program where  participating financial institutions flag and reject refunds issued by IRS  via direct deposit if they find that certain characteristics do not match.  IRS reported that in 2017, banks recovered 144,000 refunds with a  value of $204 million. IRS has also used information from the Security  Summit to improve RRP’s detection of IDT refund fraud. The Security  Summit is a partnership between IRS, the tax preparation industry,  and state departments of revenue to improve information sharing  around IDT refund fraud. For the 2017 filing season, IRS  incorporated a number of data elements into RRP’s detection tools  that were identified by the Security Summit.

IRS also incorporates legislative changes into RRP for the upcoming filing  season. IRS officials told us in March 2018 that they are working to  determine all the updates and changes they need to make to RRP’s  analytic techniques for the 2019 filing season to ensure that RRP will  make appropriate selections in accordance with Pub. L. No. 115-97, “An  act to provide for reconciliation pursuant to titles II and V of the concurrent  resolution on the budget for fiscal year 2018.”

Prior to the Filing Season, IRS Tests RRP and Establishes Selection Criteria

Between September and December each year, IRS tests RRP to ensure  that the system’s updated detection tools meet objectives to increase  detection and accuracy for the upcoming filing season. A key factor is  setting RRP’s thresholds used to trigger if a return will be selected by  RRP. For a given set of rules and criteria, as a threshold is lowered, the  number of returns that RRP selects as suspicious will increase, including  both fraudulent and legitimate returns. During this testing period, IRS  officials determine appropriate threshold settings for RRP given IRS’s  fraud detection objectives and IRS resources available to review selected  returns. IRS management uses this process to inform its risk tolerance  and fraud risk profile. According to the Fraud Risk Framework, effective  managers of fraud risks use the program’s fraud risk profile to help decide  how to allocate resources.

IRS officials told us they test RRP’s analytic techniques and filters by  running a random sample of prior-year returns through numerous  iterations using different settings. This testing produces various  outcomes. According to documents we reviewed and IRS officials, IRS  management evaluates the outcomes using the following measures:

Selection volume: the number of returns that RRP selects as  potentially fraudulent and requiring further action or review by IRS  analysts and examiners to confirm the return as fraudulent or  legitimate. IRS uses this measure to gauge the workload resulting  from certain combinations of settings in RRP.

Accuracy: the percent of selected returns confirmed to be legitimate  (the false detection rate). IRS uses this measure to evaluate the effect  RRP’s settings may have on legitimate taxpayers whose refund may  be delayed because their return was inaccurately selected.

Revenue protected: the value of refunds associated with returns  selected by RRP that IRS confirmed to be fraudulent. This measure  can provide an estimate of RRP’s return on investment based on  different combinations of settings in RRP.

During the Filing Season IRS Monitors and Adapts RRP

After IRS updates RRP and establishes selection criteria, RRP is ready to  operate during the filing season. To ensure that RRP is performing as  expected, IRS managers collect and analyze performance reports, meet  weekly during the filing season, and adapt RRP to address emerging  fraud or make other adjustments. We reviewed the various reports  produced by RRP and IRS staff and determined that the information is  reliable, relevant, and timely, as required by federal standards for internal  control. IRS officials told us that daily reports highlighting RRP’s  selections are helpful, especially during the first weeks of the filing  season, to ensure that systems are operating effectively.

Consistent with federal standards for internal control and the Fraud Risk  Framework, we found that RRP is designed to be flexible and adaptive,  and IRS can adjust RRP during the filing season to respond to emerging  threats or other concerns. IRS officials told us they made several  adjustments to RRP during the 2017 filing season:  IRS adjusted the selection thresholds for one of RRP’s IDT filters after  observing that the number of selections was exceeding projections,  resulting in more selections than IRS officials expected and possibly a  higher rate of legitimate returns being incorrectly selected. According  to IRS officials, adjusting selection thresholds takes approximately 24  hours. To respond to an external data breach, for example, IRS  officials told us they might lower RRP’s selection thresholds so that  RRP selects more returns for review.

IRS reported that it disabled a rule that it determined was incorrectly  selecting legitimate tax returns. IRS officials told us they could  address selection errors or respond to new or emerging fraud patterns  by modifying RRP’s analytic techniques, such as its business rules  and models. According to IRS officials, these types of changes require  approval of the business rules governance board and take, on  average, 10 business days.

According to IRS documents we reviewed, early in the 2017 filing  season, IRS discovered that RRP did not issue appropriate  transaction codes to the Individual Master File to freeze about 11,000  returns selected as potential IDT refund fraud. As a result, some of  these returns posted and refunds may have been issued incorrectly.  IRS told us they fixed this error within 3 days of identifying it.

As IRS Continues to Develop the Return Review Program, Additional Opportunities Exist to Improve Enforcement

IRS Plans to Expand RRP Capabilities to Further Prevent Invalid Refunds

IRS plans to continue developing RRP to expand its capabilities to detect  refund fraud on business and partnership returns, as well as on individual  returns that improperly claim nonrefundable tax credits. According to IRS,  continued development of RRP will automate previously manual  processes, eliminate duplicative efforts, and achieve greater efficiency.

Business returns and partnership returns. IRS officials told us in  January 2018 that they are currently working to develop rules,  models, and filters in RRP to detect noncompliance and fraud in  business and partnership returns. According to IRS, identity thieves  have long used stolen business information to create and file fake W- 2s along with fraudulent individual tax returns. However, identity  thieves are now using this information to file fraudulent business  returns. In May 2018, IRS reported a sharp increase in the number of  fraudulent business and partnership returns in recent years.

Nonrefundable tax credits. IRS plans to develop models and rules in  RRP to detect refund fraud on individual returns that improperly claim  nonrefundable tax credits. A nonrefundable tax credit is limited to the  taxpayer’s tax liability, which means the credit can be used to offset  tax liability, but any excess of the credit over the tax liability is not  refunded to the taxpayer. Examples of nonrefundable credits include  the Child Tax Credit, Foreign Tax Credit, and Mortgage Interest  Credit. According to IRS officials, IRS currently relies on a number of  systems, including the Dependent Database, to screen returns for  noncompliance associated with tax credits.

IRS’s management of other major investments will affect the agency’s  ability to realize the full potential of RRP’s current and planned  capabilities because RRP interfaces with numerous legacy systems. For  example, RRP obtains taxpayer information from the Individual Master  File, which IRS has been working to replace with a modern database, the  Customer Account Data Engine 2 (CADE 2). According to IRS, CADE 2  will provide RRP with additional taxpayer history data and more frequent  data updates, improving RRP’s detection capabilities. However, as we  reported in June 2018, IRS delivered only 46 percent of planned scope  for CADE 2 during the time period we reviewed and paused a number of  CADE 2 projects. As of June 2018, a completion date is uncertain.

RRP’s effectiveness is limited by the system’s dependence on a legacy  case management system. In 2015, IRS approved plans to implement an  enterprise-wide case management system to consolidate and replace  over 60 legacy systems IRS currently uses. IRS reports a number of  limitations with the current systems, including redundancies between  systems and limited visibility between programs. However, IRS  encountered challenges with the investment, and in 2017 IRS paused  development activities. As of June 2018, IRS is working to acquire  another product to serve as the platform for IRS’s enterprise-wide case  management system.

Our prior work has identified actions that Congress could take that would  improve IRS’s ability to administer the tax system and enforce tax laws.  These actions could also improve IRS’s ability to further leverage RRP’s  capabilities. For example, in August 2014 we suggested that Congress  provide the Secretary of the Treasury with the regulatory authority to  lower the threshold for requiring employers to electronically file W-2s from  250 returns annually to between 5 to 10 returns, as appropriate. Under  current law, employers who file 250 or more W-2s annually are required  to file W-2s electronically, while those who file fewer may opt to file on  paper. Without this change, some employers’ paper W-2s are unavailable to RRP for matching before IRS issues refunds due to the  additional time the Social Security Administration needs to process paper  forms. Lowering the threshold would help IRS use RRP to verify returns  before issuing refunds. This proposed change has been included in H.R.  5444. As of June 2018, H.R. 5444 passed the House and was being  considered by the Senate Finance Committee.

We have also suggested that Congress grant IRS broader math error  authority, with appropriate safeguards against misuse of that authority, to  correct taxpayer errors during tax return processing. IRS officials told us  that this type of corrective authority would allow IRS to develop more  efficient treatments for returns selected by RRP with obvious errors.  Although the Consolidated Appropriations Act, 2016 gave IRS additional  math error authority, it is limited to certain circumstances. Giving IRS  broader math error authority or correctible error authority with appropriate  controls would enable IRS to correct obvious noncompliance, would be  less intrusive and burdensome to taxpayers than audits, and would  potentially help taxpayers who underclaim tax benefits to which they are  entitled. As of June 2018, Congress had not provided Treasury with such  authority.

IRS Has Not Fully Considered Opportunities to Improve Data Available to RRP

IRS has additional opportunities to improve data available to RRP to  enhance RRP’s detection and accuracy. As described above, RRP’s  analytic techniques depend on taxpayer data and information from  numerous IRS systems and external entities. RRP’s access to useful and  timely information enables IRS to more fully utilize RRP’s analytic  techniques to detect suspicious returns, leading to more accurate  selection and treatment decisions. Given RRP’s importance to IRS’s  mission, it is critical that IRS considers and addresses risks that could  affect the accuracy and effectiveness of RRP’s detection and selection  activities.

According to the Office of Management and Budget, risks include not only  threats but also opportunities that could affect an agency’s ability to  achieve its mission. IRS and Congress have previously considered  opportunities and taken steps to enhance some data made available to  RRP. For example:  IRS expanded RRP’s use of relevant data from electronically filed  returns and information returns. For example, as mentioned  previously, IRS incorporated a number of data elements identified  through the Security Summit into RRP. In 2016 and 2017, IRS used  these data elements to develop additional business rules and models  specific to electronically filed returns. IRS also expanded RRP analytic  techniques to incorporate data from Forms 1099-MISC, which  taxpayers may use to report non-employee compensation.

Consistent with our prior reporting, in 2015 Congress enacted  legislation to help IRS prevent invalid refunds associated with IDT and  other refund fraud. This change allows IRS more time to use RRP to  match wage information to tax returns and to identify any  inconsistencies before issuing refunds. Since 2017, employers have  been required to submit W-2s to the Social Security Administration by  January 31, about 1 to 2 months earlier than in prior years. The act  also required IRS to hold refunds for all taxpayers claiming the Earned  Income Tax Credit or the Additional Child Tax Credit. In 2018 we  made recommendations that IRS fully assess the benefits and costs  of using existing authority to hold additional taxpayer refunds as well  as extending the date for releasing those refunds until it can verify  wage information. IRS outlined a number of actions it plans to take to  address these recommendations. Taking these actions could prevent  IRS from issuing millions of dollars in invalid refunds annually.

IRS officials told us that they are taking steps to enhance RRP’s  ability to detect fraudulent returns filed using prisoners’ Social Security  numbers. To do this, IRS is working to load updated prisoner data into  RRP more frequently and developing additional business rules. The  Treasury Inspector General for Tax Administration (TIGTA) has  reported that refund fraud associated with prisoner Social Security  numbers is a significant problem for tax administration, accounting for  IRS’s issuance of potentially fraudulent refunds worth tens of millions  of dollars in 2015.

Based on our prior work, we found that there may be additional  opportunities for IRS to enhance RRP by improving data made available  to it:

Making W-2 information available more frequently. In January  2018, we reported that IRS’s ability to verify information on tax returns  early in the filing season was affected by limitations with its IT  systems. IRS receives and maintains information return data,  including W-2 and 1099-MISC forms, through the Information Return  Master File (IRMF) system. IRMF then makes the data available to  RRP for systemic verification, the automated process that uses W-2s  to verify that taxpayers accurately reported their income and other  information on their tax returns. IRS receives the W-2 data from the  Social Security Administration daily—up to 25 million W-2s per day— but only loads the data into IRMF and RRP weekly. According to IRS,  to add new information returns to IRMF, IRS staff need to reload all  existing information at the same time. As employers and financial  institutions send more documents to IRS during the filing season,  reloading IRMF can take 3 days or more because updates take more  time as IRMF’s file increases in size, ultimately containing billions of  information returns.

IRS officials told us that having W-2s available for analysis sooner  would benefit RRP detection and selection of fraudulent returns. In  addition, matching W-2 information can also provide sufficient  assurance of a valid return, even if characteristics of the return might  otherwise raise suspicion. According to our analysis of RRP data for  the 2017 filing season, matching available W-2s resulted in RRP  excluding 367,027 electronically filed returns that RRP otherwise  would have selected as suspicious. Having W-2 information loaded  more frequently and available for RRP’s systemic verification helps  IRS improve its use of limited enforcement resources by more  accurately identifying fraudulent returns and excluding legitimate  returns.

As of April 2018, IRS officials had drafted but not yet approved a work  request to send IRMF data to RRP daily between January and March  during the 2019 filing season. In preparing the draft request, IRS  officials told us they are assessing how frequently the agency can  efficiently load data into IRMF as the filing season progresses.  Federal standards for internal control require federal managers to  analyze and address risks to agency objectives. As noted  previously, risks include not only threats but also opportunities.  Leading practices in fraud risk management further state that  managers should take into account external risks that can impact the  effectiveness of fraud prevention efforts. Until IRS makes incoming  employer W-2s available to RRP more frequently, IRS will not address  an opportunity to expand the use of RRP’s systemic verification  process to more accurately detect and select invalid refund returns for  additional action.

Making more information available electronically from returns  filed on paper. RRP’s analytic techniques could be strengthened if  the program had electronic access to additional information from filers  of paper returns. While about 90 percent of individual taxpayers file  their returns electronically, over 19 million taxpayers filed on paper in  2017. To control costs, IRS transcribes a limited amount of  information provided by paper filers into its computer databases. This  practice limits the amount of information readily available for  enforcement and other tax administration activities that rely on  digitized information. We also reported that according to IRS officials,  digitizing and posting more comprehensive information provided by  paper filers could facilitate enforcement efforts, expedite contacts for  faster resolution, reduce handling costs, and increase compliance  revenue.

In October 2011 we found that IRS considered a number of options to  make more information from paper returns available electronically,  including increasing manual transcription, optical character  recognition technology, and barcoding technology. An optical  character recognition system would read text directly from all paper  returns using optical scanners and recognition software and convert  the text to digital data. A 2-D bar code is a black and white grid that  encodes tax return data allowing IRS to scan the bar code to digitize  and import the data into IRS’s systems, such as RRP. We  recommended in 2011 that IRS determine whether and to what extent  the benefits of barcoding would outweigh the costs. In response to  our recommendations, in 2012 IRS updated an earlier evaluation of  implementing barcoding technology for paper returns. The agency  estimated that implementing and using barcoding technology over a  10-year period from fiscal years 2015 to 2025 would yield about $109  million in benefits, compared to about $13 million in costs—a  substantial return on investment. IRS estimated benefits based on  anticipated reductions in staff hours dedicated to the coding, editing,  transcription, and error resolution functions of paper return  processing.

However, because of statutory limitations, a legislative change is  necessary to require individuals, estates, and trusts to print their  federal income tax returns with a scannable bar code. In each of its  congressional justifications for fiscal years 2012 to 2016, IRS  requested that Congress require returns prepared electronically but  filed on paper include a scannable code printed on the return. The  National Taxpayer Advocate made a similar legislative proposal in  2017. As of June 2018, Congress had not taken action on the  proposal.

In addition to barcoding, there are other technologies IRS could use to  digitize more information from paper returns to further improve tax  administration and enforcement activities. However, as of June 2018,  IRS had not taken any additional steps to further evaluate the costs  and benefits of digitizing individual return information, taking into  consideration new technology or additional benefits associated with  RRP’s enhanced enforcement capabilities.

IRS’s strategic plan identifies expanding the agency’s use of digitized  information as a key activity toward its goal to increase the efficiency  and effectiveness of IRS operations. Updating and expanding its  2012 analysis of the costs and benefits of digitizing returns to consider  any new technology or additional benefit to RRP would provide IRS  managers and Congress with valuable information to implement the  most cost-effective options for making additional, digitized information  available for enforcing and administering taxes. This information could  help IRS make progress toward its mission by improving RRP’s  detection and selection of suspicious returns. In addition, greater  efficiency in the paper return transcription process could free  additional resources for enforcement and administration activities.

IRS Has Not Fully Considered Opportunities to Use RRP to Improve Other Tax Enforcement Activities

IRS has not yet evaluated the costs and benefits of expanding RRP to  improve other tax enforcement activities, such as compliance checks or  audits, for returns not claiming refunds. All individual returns (Forms  1040) are loaded into RRP as part of return processing. However, RRP is  used to prevent IRS from paying invalid refunds as part of IRS’s pre- refund enforcement activities and, therefore, according to IRS officials,  RRP has been limited to detecting and selecting individual returns  claiming refunds. Currently, IRS does not use RRP to support other  enforcement activities that detect misreporting or noncompliance on  individual tax returns not claiming refunds, which also contribute to the tax  gap—the difference between taxes owed and what are paid on time.

Underreporting of income represents the majority of the tax gap, with the  average annual underreporting of individual income tax on both refund  and non-refund returns for tax years 2008 to 2010 estimated by IRS to be  about $264 billion or 57 percent of the total gross tax gap of $458 billion.

Given the large amount of revenue lost each year due to underreporting,  it is important that IRS consider opportunities to improve its enforcement  efforts and promote compliance. IRS’s enforcement of tax laws helps fund  the U.S. government by collecting revenue from noncompliant taxpayers  and, perhaps more importantly, promoting voluntary compliance by giving  taxpayers confidence that others are paying their fair share.

According to IRS officials, RRP has benefited IRS’s pre-refund  enforcement activities by enhancing detection of IDT and other refund  fraud, providing more cost-effective treatment, and enhancing data  analytics for improved enforcement. Based on this review of RRP’s  capabilities and our prior work on tax enforcement and administration, we  identified a number of activities and processes that could be improved  and enhanced if IRS expanded RRP to analyze returns not claiming  refunds, in addition to returns with refunds. For example:

Enhanced detection and selection of potential noncompliance.

IRS reported that RRP significantly enhanced its detection of IDT and  other refund fraud over prior systems. In January 2018 we  recommended—and IRS outlined planned actions—that IRS assess  the benefits and costs of additional uses and applications of W-2 data  for pre-refund compliance checks, such as underreporting,  employment fraud, and other noncompliance. Underreporting occurs  when a taxpayer underreports income or claims unwarranted  deductions or tax credits. As previously noted, underreporting  accounts for the largest portion of the tax gap. To detect  underreporting by individuals, after the filing season and after refunds  have been issued, IRS uses its Automated Underreporter (AUR)  program to electronically match income information reported to IRS by  third parties, such as banks and employers, against information that  taxpayers report on their tax returns. During our review, we found that  this process of matching income information is similar to RRP’s pre- refund systemic verification process that occurs during return  processing, but only applies to returns claiming refunds. IRS should  consider expanding RRP’s capabilities to use RRP as a platform to  perform AUR matching on all individual returns during return  processing and post-processing, as more information returns are  available for matching. In May 2018, IRS officials told us that, in  response to our January 2018 recommendation, IRS is assessing the  possibility of using RRP to perform some AUR checks. However, until  IRS expands RRP to analyze returns not claiming refunds, these  compliance checks will not cover all potential underreporting.

During this review of RRP, we also found that IRS could implement  predictive models of noncompliance in RRP to select returns for  audits. Audits are an important enforcement tool for IRS to identify  noncompliance in reporting tax obligations and to enhance voluntary  reporting compliance. IRS’s Small Business and Self-Employed  (SB/SE) division conducts audits of individual taxpayers after the  return has been processed. SB/SE staff review the returns identified  for potential audit by various processes. One of these audit selection  processes is a computer algorithm—discriminant function (DIF)—that  uses models to score all individual returns (with and without refunds)  for their likelihood of noncompliance, an indicator of their audit  potential. The DIF models are developed from a unique data set and  include variables IRS has found to be effective in predicting the  likelihood that a return would have a significant tax change if  audited. The additional information available in RRP, such as  taxpayer history, has the potential to improve the DIF models and  therefore the DIF scoring. IRS officials told us that they plan to  examine opportunities to use RRP for some SB/SE audit selection  processes, such as incorporating DIF scoring into RRP. However, as  of April 2018 IRS had not taken any action.

More efficient and effective treatment of potentially noncompliant  returns. IRS reported that RRP automated and streamlined many of  IRS’s selection and treatment processes for preventing the issuance  of invalid refunds. Using RRP to improve IRS’s detection and  selection of potentially noncompliant returns during return processing  could lead IRS to consider treatment options, such as soft notices,  that engage taxpayers earlier, to help IRS and taxpayers resolve  issues more quickly. A soft notice does not always require a response  from the taxpayer; instead, it provides information about a potential  error and asks taxpayers to review their records. Consequently, soft  notices can be more efficient than other treatments, such as  telephone calls or in-person interactions. This treatment option is  consistent with IRS’s strategic objective to reduce the time between  filing and resolution of compliance issues. One strategy IRS highlights  to achieve this objective is to review and refine IRS’s risk-based  systems, like RRP, to detect potential issues early.

Currently, IRS’s enforcement activities, including SB/SE audits and  AUR, occur after the return has been processed and the filing season  ends. For example, AUR begins matching information returns to  individual tax returns in July after the filing season has ended, and  according to TIGTA, routinely identifies more than 20 million individual  tax returns with discrepancies each year. In 2013 we reported that  IRS took on average, over 1 year—2 years in some cases—to notify  taxpayers about discrepancies. These delays are a challenge for  IRS and the taxpayer. For example, when additional tax is owed, as  time passes taxpayers may be less likely, or less able, to pay the  original debt owed and any associated penalties that may have  accrued since the time of filing. Taxpayers may also be less likely to  have the relevant tax records needed to respond to IRS questions.  Notifying taxpayers earlier of a potential error could help bring them  into compliance more effectively than other enforcement options.

We found that IRS could also expand RRP’s capabilities to use RRP  to identify and generate soft notices for taxpayers that do not pay  taxes owed at the time of return processing. IRS does not contact  electronic filers with an unpaid tax balance until mid-May, weeks after  the April payment deadline. This treatment option could help IRS  collect taxes owed and also help taxpayers by making them aware of  payment options earlier and allowing them to avoid interest and  penalties. IRS officials agreed that it is more likely to recover any debt  owed if the taxpayer is notified earlier.

Enhanced data analytics for improved enforcement. Just as IRS is  using RRP data and reporting capabilities to better target resources  for enforcement activities associated with refund returns, we found  that IRS could increase its access to useful data if it expanded RRP to  analyze returns not claiming refunds. For example, using RRP’s  enhanced data analytics, including access to multiple data sources,  IRS could better identify characteristics of other types of  noncompliance to improve detection and enforcement. This approach  is consistent with IRS’s strategic goal to advance data analytics to  inform decision making and improve operational outcomes. Officials  from IRS’s Office of Research, Applied Analytics, and Statistics told  us that RRP is a valuable data source for research on IDT and other  refund fraud. However, until IRS expands RRP to analyze and score  individual returns not claiming refunds, IRS will be limited in its ability  to use RRP’s data analytics to help IRS address other types of  noncompliance and fraud.

Evaluating the costs and benefits of expanding RRP to analyze individual  returns not claiming refunds to support other tax enforcement activities is  consistent with the goals and objectives outlined in IRS’s Strategic Plan to  encourage compliance through tax administration and enforcement and  increase operational efficiency and effectiveness. IRS has identified and  implemented opportunities to expand RRP to better detect IDT and other  refund fraud in individual and business returns. However, until IRS  evaluates the costs and benefits of expanding RRP to support other  enforcement activities, IRS may be missing opportunities to realize  operational efficiencies by streamlining the detection and treatment of  other types of noncompliance and fraud. Additionally, IRS may be missing  an opportunity to promote voluntary compliance with tax laws and make  progress toward closing the estimated $458 billion average annual gross  tax gap.

Noncompliance, including tax fraud, has been a long-standing challenge  for IRS. More recently, IDT refund fraud has emerged as a costly and  evolving threat to taxpayers and the tax system. As part of IRS’s effort to  strategically address these challenges, RRP provides opportunities for  IRS to operate more efficiently, increase taxpayer compliance, and  combat refund fraud. IRS has plans to continue developing and  enhancing RRP, including analyzing business returns for fraud. However,  IRS has not fully examined opportunities to improve the availability of  information that RRP’s analytic tools rely on.

These opportunities include examining the costs and benefits of making  more information from paper returns available electronically and making  W-2 information available to RRP for income verification more frequently.  Until IRS conducts such analyses, the agency will be missing  opportunities to improve RRP’s detection and accuracy and prevent  paying invalid refunds. These evaluations can also inform Congress’s  decisions on requiring scannable codes on some printed tax returns, as  well as issues we highlighted in our previous work, including lowering the  e-file threshold for employers filing W-2s and expanding IRS’s correctible  error authority. Congressional action on these issues would help IRS  better leverage RRP’s capabilities.

Further, RRP has the potential to improve tax enforcement in other areas  such as underreporting and audit selection if IRS can successfully expand  RRP’s detection and selection capabilities to analyze individual tax  returns, including those not claiming refunds, for fraud and  noncompliance. Earlier detection of anomalies and notification can  increase compliance and collection rates.

Congress should consider legislation to require that returns prepared  electronically but filed on paper include a scannable code printed on the  return. (Matter for Consideration 1)

We are making the following five recommendations to IRS.

The Commissioner of Internal Revenue should increase the frequency at  which incoming W-2 information is made available to RRP.  (Recommendation 1)

The Commissioner of Internal Revenue should update and expand a  2012 analysis of the costs and benefits of digitizing returns filed on paper  to consider any new technology or additional benefits associated with  RRP’s enhanced enforcement capabilities. (Recommendation 2)

Based on the assessment in recommendation 2, the Commissioner of  Internal Revenue should implement the most cost-effective method to  digitize information provided by taxpayers who file returns on paper.  (Recommendation 3)

The Commissioner of Internal Revenue should evaluate the costs and  benefits of expanding RRP to analyze individual returns not claiming  refunds to support other enforcement activities. (Recommendation 4)

Based on the assessment in recommendation 4, the Commissioner of  Internal Revenue should expand RRP to support identified activities.  (Recommendation 5)

We provided a draft of this report to the Commissioner of Internal  Revenue for review and comment. In its written comments, which are  summarized below and reprinted in appendix II, IRS agreed with our five  recommendations stating that it is taking action to address them and will  provide a more detailed corrective action plan.

IRS agreed with our recommendations aimed at improving information  available to RRP to enhance detection of fraudulent returns. IRS stated  that it is evaluating the frequency at which W-2 data is made available to  RRP and options for digitizing returns filed on paper. IRS further noted  that it is evaluating other associated information provided to RRP for  detection. As stated earlier, efforts to improve RRP’s detection and  accuracy will protect additional federal revenue.

IRS agreed with our recommendations to evaluate options for expanding  RRP to improve tax enforcement and compliance. IRS stated that its  objective is to make RRP the primary detection system for pre- and post- refund processing across the agency.

IRS stated that to expand RRP to analyze returns not claiming refunds, a  legislative change requiring all information returns to be filed electronically  will be necessary to achieve maximum benefit from RRP. In this report,  we highlight legislative issues from our prior work, including lowering the  e-file threshold for employers filing W-2s and expanding IRS’s correctible  error authority, to help IRS better leverage RRP’s capabilities. However,  we are confident that even under current conditions, IRS could use RRP  to further improve compliance and its enforcement efforts. For example,  with the current electronic filing requirements, RRP could help IRS detect  and resolve individual underreporting earlier in the process.

IRS stated its intention to collaborate with GAO and other organizations to  determine appropriate actions after assessing the results of its analyses.

As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the  appropriate congressional committees, the Commissioner of Internal  Revenue, and other interested parties. In addition, the report will be  available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512- 9110 or mctiguej@gao.gov. Contact points for our  offices of Congressional Relations and Public Affairs are on the last page  of this report. GAO staff who made key contributions to this report are  listed in appendix III.

Appendix I: Return Review Program Investment Summary

The Return Review Program (RRP) is one of the Internal Revenue  Service’s (IRS) major information technology investments. IRS began  developing RRP in 2009 to improve its ability to detect fraudulent returns.  In October 2016, RRP replaced IRS’s legacy system, the Electronic  Fraud Detection System (EFDS) as IRS’s primary fraud detection system.  IRS originally planned for RRP to be operating by 2014 because IRS had  determined that by 2015 EFDS would not be reliable. However, in 2014,  IRS paused RRP’s development to reconsider RRP’s capabilities within  IRS’s strategic fraud detection goals. The year-long pause delayed EFDS  replacement and retirement until 2016. RRP operated as IRS’s primary  system for detecting identity theft and other refund fraud beginning with  the 2017 filing season. Figure 5 is a timeline of IRS’s development of  RRP.

Appendix II: Comments from the Internal Revenue Service

Appendix III: GAO Contact and Acknowledgments

In addition to the contact named above, Neil Pinney (Assistant Director),  Margaret M. Adams (Analyst-in-Charge), Michael Bechetti, Mark Canter,  Pamela Davidson, Robert Gebhart, James A. Howard, Jesse T. Jordan,  Paul Middleton, Sabine Paul, J. Daniel Paulk, and Bradley Roach, made  significant contributions to this report.

The Return Review Program is one of IRS's key systems for detecting tax fraud and preventing bad refunds—preventing about $4.4 billion in bad refunds during the 2017 filing season.

IRS monitors the program's performance and adjusts it to address new threats, but we found ways to improve and expand use of the program.

For example, we recommended ways to increase the amount of data available to the program, including loading W-2 data into it more frequently and digitizing paper returns. We also recommended using the program for other tax enforcement activities such as selecting returns for audits or checking them for underreported income.