Tax Debt Collection Contracts: IRS Analysis Could Help Improve Program Results and Better Protect Taxpayers

IRS attempts to collect tax debts to promote tax compliance but does not have resources to pursue all debts. A 2015 law required IRS to contract with private collection agencies for certain tax debts. However, stakeholders such as the National Taxpayer Advocate have noted that safeguards are needed to protect taxpayers from risks, such as scammers impersonating collection agencies.

GAO was asked to review IRS's PDC program. This report assesses the extent to which IRS (1) documented program objectives and measures, (2) documented revenue collection and cost results data, (3) used data to improve the program and meet its objectives, and (4) addressed risks to prevent or address scams and other harmful effects on taxpayers. GAO analyzed IRS's documents on PDC program administration and planning; collections and costs reporting; and managing risks. GAO interviewed officials from IRS and external groups that represent taxpayer interests.

The Internal Revenue Service (IRS) documented objectives and proposed measures for its private debt collection (PDC) program for sending tax debt cases to private collection agencies, but the objectives are not clearly defined and their linkages with program measures are unclear. For example, one objective is to provide taxpayers an opportunity to understand and resolve their tax debts, but the proposed measure focuses on taxpayer satisfaction with collection agencies rather than taxpayers' understanding. The objectives also do not include some key program risks, such as scams. Without clearly defined objectives and measures, IRS will have limited ability to assess program results.

IRS's reports to Congress on the PDC program have not provided complete financial information. For example, as of September 2018, IRS reported program revenue collections of about $89 million and costs of $67 million, suggesting a positive balance of $22 million for the general fund of the Treasury (the Treasury). However, the report did not clarify that about $51 million collected went to the Treasury and the remaining $38 million were retained by IRS in two special funds to pay current and future program costs. Without this information, Congress has an incomplete picture of the program's true costs and revenues.

IRS has not analyzed PDC program results to identify the types of cases that should not be assigned to collection agencies because they do not result in collections. GAO's analysis of IRS data shows that between April 2017 and September 2018 about 73,000 of 111,000 cases closed by collection agencies had little or no revenue collected because the collection agencies were unable to contact the taxpayer or collect the debt, among other reasons. Given the costs associated with managing these cases, without such analyses, IRS may continue to use resources inefficiently and assign cases with little or no potential for revenue collection, or miss opportunities to assign other cases that could produce more revenue.

IRS has identified and taken steps to mitigate some PDC program risks that could harm taxpayers. However, IRS has not completed the process of identifying and documenting all risks nor has it fully assessed risks to taxpayers from the program or its response to these risks. Specifically, GAO found that

IRS identified and documented 6 taxpayer risks related to the PDC program, such as scammers impersonating collection agencies, but had not identified an additional 10 risks that GAO did, such as taxpayers agreeing to debt payments they cannot afford.

IRS had not consistently assessed the impact or likelihood of the identified risks. As a result, IRS's responses to mitigate risks were broad in nature, and were not prioritized or aligned to address specific risks.

IRS monitors a sample of collection agencies' telephone calls with taxpayers and reviews taxpayer complaints, but these methods do not provide information on whether IRS's responses to risks are effective.

Without addressing these risk management issues, IRS cannot ensure it has fully identified PDC program risks and effectively responded to protect taxpayers from them.

GAO makes 12 recommendations, including that IRS improve PDC program objectives and measures, revenue and cost reporting, analysis to assign cases, and management of taxpayer risks. IRS agreed with nine recommendations, partially agreed with GAO's recommendation on improving objectives—which GAO clarified in response—and disagreed with two recommendations to include certain costs in reporting and analyze data to identify cases not collectible. GAO maintains the recommendations would more fully report PDC program federal costs and prevent waste.

The Internal Revenue Service (IRS) attempts to collect unpaid tax debts  to promote voluntary compliance. IRS efforts are intended to give all  taxpayers confidence that everyone is paying their fair share and to also  help reduce the tax gap. The tax gap—the difference between tax  amounts that taxpayers should pay and what they actually pay voluntarily  and on time—was, on average, $458 billion for tax years 2008 to 2010,  according to a 2016 IRS estimate. IRS estimated that about $39 billion of  the tax gap was owed by taxpayers who filed returns on time, but paid  less than they owed, creating a tax debt. For fiscal year 2017, IRS  estimated that taxpayers had $197 billion in tax debts of which IRS  considered $52 billion (26 percent) to be collectible. IRS does not have  resources to pursue all tax debts, so it treats some debts that may be  potentially collectible as inactive. However, as required by a December  2015 law, IRS began assigning certain types of inactive tax debt cases to  contracted private collection agencies in April 2017 under its private debt  collection program (PDC) as a way to help collect these debts that IRS is  not actively pursuing.

Some stakeholders, including the National Taxpayer Advocate (NTA),  have raised concerns about the PDC program, including potential effects  on taxpayers such as related tax collection scams. Specifically, before  the program started in April 2017, according to the Department of the  Treasury Inspector General for Tax Administration (TIGTA), from October  2013 to March 2017, more than 10,300 people were scammed out of over  $55 million by persons impersonating IRS employees. To prevent  possible confusion or scams involving impersonation of collection  agencies, stakeholders including NTA and TIGTA have recognized that  safeguards are needed to protect taxpayers.

You asked us to review the PDC program. This report assesses the  extent to which IRS has (1) documented program objectives and  measures; (2) documented data on PDC revenue collection and cost  results, and used these data to improve the program and meet its  objectives; and (3) addressed PDC program risks to prevent or address  scams or other harmful effects on taxpayers.

To assess the extent to which IRS documented program objectives and  measures, we compared PDC program documents on the program’s  objectives and proposed measures to Standards for Internal Control in  the Federal Government. To assess IRS’s documentation of PDC  revenue collection and costs, we compared IRS’s reporting of such data  to federal internal control standards (e.g., use quality data to achieve  objectives). To assess the extent to which IRS is using revenue collection  and cost data, we compared IRS’s analysis plans to IRS’s strategic plan  and PDC program documents, and federal internal control standards on  using data to achieve objectives. To evaluate the extent to which IRS is  addressing PDC taxpayer risks, we interviewed groups that represent  taxpayer interests, including potentially vulnerable taxpayers such as  those who are older or low income, on potential taxpayer risks posed by  the PDC program. We reviewed the extent to which IRS addressed  taxpayer risks for PDC by using enterprise risk management (ERM)  criteria, which generally applies to the risks associated with achieving  programmatic outcomes. We did not assess IRS’s overall approach to  ERM or PDC risks beyond those affecting taxpayers. We reviewed IRS’s  contracts with the private collection agencies and PDC program  documents to determine taxpayer risks IRS had identified and the  responses to address them. We also interviewed program officials,  including the Director of Headquarters Collection and PDC Program  Manager in IRS’s Small Business/Self-Employed operating division. For  details on our objectives, scope, and methodology, see appendix I.

We conducted this performance audit from January 2018 to March 2019  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

IRS’s process for collecting unpaid tax debts includes:

Notice Phase: IRS sends the taxpayer an automatically-generated  series of letters about unpaid debts or delinquent returns to prompt  payment or response if the taxpayer disagrees with the balance due  or is unable to pay the amount owed.

Automated Collection System: IRS attempts to have telephone  contact with the taxpayer to discuss the debt and prompt full payment  or set up a payment installment agreement. According to IRS officials,  telephone contact generally happens when taxpayers call IRS in  response to IRS enforcement notices or actions, such as filing a lien  against the taxpayer’s property or levying financial assets.

Field Collection: IRS revenue officers attempt in-person contact with  taxpayers to prompt a payment or take enforcement action such as  those described above with the Automated Collection System.

According to IRS, its collection efforts focus on the potentially collectible  inventory. IRS attempts to prioritize the debts it believes it will most likely  be able to collect, based on an analysis of factors such as the debt  amount and the taxpayer’s ability to pay it.

In 1995, Congress authorized IRS to contract with private debt collectors  to collect unpaid tax debts. In 1997 we reported IRS data showing that  the program cost about $21.1 million and collected about $3.1 million.  The program was canceled, in part, because of the net loss.

In October 2004, Congress granted discretionary authority to IRS for  creating a PDC program to collect some portion of unpaid taxes. The  program enabled IRS to contract with private collection agencies to  collect tax debts and pay them from a revolving fund of the revenue  collected. IRS said it would study the comparative performance of private  collection agencies versus the agency in collecting unpaid taxes because  of concerns that the program might cost more than using IRS resources  to collect the debts. IRS began assigning cases to private collection  agencies in September 2006. It began the study at that time too. In March  2009, IRS released its study, which concluded that IRS was more cost  effective than collection agencies in collecting tax debts when working  similar cases. As a result, IRS announced that it would not renew  expiring contracts with the private collection agencies.

Laws Covering the Current PDC Program and Related Funding

The Fixing America’s Surface Transportation (FAST) Act in 2015  mandated that IRS assign inactive tax debt cases to private collection  agencies. Inactive cases are those that IRS includes in its potentially  collectible inventory but is not actively pursuing. Congress defined three  types of inactive tax debt cases that must be assigned to the collection  agencies, which are those:  removed from active inventory due to a lack of IRS resources or  inability to contact a taxpayer; not assigned for collection to an IRS employee and more than one- third of the period of applicable statute of limitation has lapsed; and assigned for collection and more than 365 days have passed without  any interaction with the taxpayer or a third party for purposes of  furthering collection.

The act also excluded certain taxpayer accounts from being assigned to a  collection agency. Specifically, accounts are to be excluded if the  taxpayer is deceased; under the age of 18; in designated combat zones;  a victim of tax-related identity theft; under examination, litigation, criminal  investigation or levy; subject to pending or active offers in compromise,  an installment agreement, or a right of appeal; or involved in an innocent  spouse case.

The American Jobs Creation Act and the FAST Act together created two  funds which allow IRS to retain up to 50 percent of the amounts collected  by private collection agencies. Specifically, IRS can retain up to 25  percent of the amounts that collection agencies collect in each of these  funds:

Cost of Services fund to pay collection agencies’ commissions.

Special Compliance Personnel Program fund to pay costs of  administering the collection agency contracts and costs of adding  collection staff.

IRS’s Approach for Assigning Cases to Collection Agencies under the PDC Program

According to IRS officials, IRS’s approach for implementing the PDC  program is to roll out cases over time in three major phases, moving from  simpler to more complex cases. The first phase (April 2017) included  the simplest types of cases in which individual taxpayers had agreed to  the debt owed. The second phase (March 2018) added individual tax  debts from IRS compliance activities—such as auditing the accuracy of  filed tax returns—where taxpayers have not agreed with the debt owed  and unfiled tax returns (i.e., from individuals who did not file tax returns as  required). The third phase (planned for March 2019) is to add business  tax debt cases and unfiled business tax returns. As shown in figure 1,  since first assigning cases to collection agencies in April 2017, IRS has  increased the number and types of tax debt cases. By the end of fiscal  year 2019, IRS plans to have assigned about 2.4 million cases that it  expects to be eligible for the PDC program.

IRS Has Not Clearly Defined PDC Program Objectives, Measures, and Targets

IRS has not clearly defined program objectives, measures, and targets for  the PDC program. According to federal internal control standards,  management should define objectives clearly to enable the identification  of risks and define risk tolerances. Objectives should be defined in  specific and measurable terms to enable design of internal control for  related risks. Establishing measures and related targets also allows  assessment of program performance and helps ensure that objectives are  achieved.

Although IRS started sending cases to collection agencies under the PDC  program in April 2017, IRS did not document the program’s objectives  and their links to related proposed measures until October 2018. IRS  officials explained that they wanted to get some experience with the  program before establishing its objectives and measures, so in June 2018  and August 2018, officials held working sessions to draft the program’s  mission, vision, and values statements, and link performance metrics to  them. The resulting proposed mission statement was to “provide  taxpayers an opportunity to understand and resolve their tax obligations  and apply tax laws in a manner that is consistent with IRS collection  practices.” The sessions also yielded the following statements under  related categories that according to IRS officials are the PDC program’s  three program objectives.

Taxpayer Protection—Apply tax laws in a manner that is consistent

Taxpayer Experience/Satisfaction—Provide taxpayers an opportunity  to understand and resolve their tax obligations

Private Collection Agency Operational Success—Resolve tax  obligations by utilizing private collection agencies  According to the working sessions’ documents, officials also proposed  PDC measures. However, our review found that these measures did not  clearly link to two of the three PDC objectives—applying tax laws  consistently with IRS collection practices and providing taxpayers an  opportunity to understand and resolve their tax obligations. Table 1 shows  our analysis of the clarity of the links between the objectives and  proposed measures, and the lack of targets for each of the objectives and  measures.

In addition, based on our discussions with IRS officials and review of PDC  program documents, IRS’s three program objectives do not acknowledge  all key program-related risks. For example, because high costs put  previous PDC programs at risk, IRS officials said they designed program  procedures to control costs and compare these costs to revenue  collections. However, none of the objectives or measures addresses  costs compared to revenue collections. Similarly, IRS has acknowledged  the risks of scams and created risk responses but none of the three  objectives focuses on protecting taxpayers from the risks of scams.

Our review of IRS documentation also shows that IRS has used  inconsistent terms to communicate the program’s objectives. Specifically,  IRS’s fiscal year 2019 communication plan for the PDC program states  different program objectives than those in the working session  documents. This document states the program’s objectives as: help America’s taxpayers settle their debt and come into compliance; ensure the safety and security of taxpayers and their data; and ensure that all taxpayers contacted by private collectors are treated  with fairness and respect by monitoring the program.

These objectives do not include terms used in the objectives stated in  table 1, such as applying tax laws consistently with collection practices  while they introduce new terms such as compliance, safety and security,  and fairness and respect. Although the two sets of objectives do not  necessarily conflict, their differing, inconsistent terms contribute to the  stated program objectives being unclear.

According to IRS officials, the objectives defined by the working sessions  are the objectives for the PDC program. They said that IRS needs more  time to finalize the program objectives and measures and develop related  targets. The officials said their efforts and resources until recently had  been directed toward implementing the PDC program. However, they do  not expect to finish refining the objectives, measures, and targets until  fiscal year 2020 or later, when they will use program data that may be  available then.

Until program objectives are clearly defined and consistently stated, IRS  cannot ensure that appropriate controls will be in place to address risks  and achieve the desired results of the PDC program. Also, without  measures and targets that are clearly linked to the objectives, IRS will be  limited in its ability to assess and assure that the program is making  progress in achieving its objectives.

IRS Reporting on PDC Program Results Is Incomplete and IRS Has Not Analyzed Ways to Improve These Results

IRS Reporting of PDC Program Revenue Collection and Costs Results is Not Complete

According to federal internal control standards, management should  externally communicate complete, quality information necessary to  achieve objectives. Ways to carry this out include using and reporting  complete financial information. However, we found that IRS’s reporting  on the PDC program to Congress did not provide complete, quality  financial information on some of the program’s results for revenue  collected and costs.

Specifically, IRS’s reporting did not clarify how much of the collected  revenue went to the general fund of the Treasury (the Treasury) rather  than to IRS for two special funds. For example, from fiscal year 2016  when IRS started to develop the program through September 2018, IRS’s  report to Congress in October 2018 showed program revenue collections  of $88.8 million and costs of $66.5 million—a program balance of $22.3  million. While suggesting this positive program balance to the Treasury,  the report did not clarify that about $50.9 million of the $88.8 million went  to the Treasury and about $37.8 million went to the two IRS special  funds—about $18.9 million for each—to pay current and future related  IRS costs (see table 2 in appendix II). The report included the required  information on the collected revenue retained in the two special funds.

We analyzed the status of the two funds as of September 2018 (see table  3 in appendix II). The $18.9 million that IRS retained to pay the costs for  commissions to the contracted collection agencies had a balance of $2.9  million; the $18.9 million that IRS retained to pay costs to administer the  PDC contracts and hire and train additional staff for IRS collection  activities had a balance of $14.6 million. IRS officials said IRS used this  fund to hire 100 additional collection staff in October 2018. The officials  said that information system improvements will allow IRS to track the  revenue collections and costs related to those additional staff pursuing  tax debts.

IRS officials said in September 2018 that they plan for future reports to  include a program balance table and retained fund balance tables.  However, they said IRS does not plan to include a table on the amount of  collected revenue that went to the Treasury because IRS is not required  to include this in the report. Full reporting of revenue and costs can help  stakeholders better understand and assess program results. Without  clearly reported data, stakeholders are challenged to know how much of  the collected revenue went to the Treasury rather than to IRS’s two funds.

Nor did IRS’s reporting to Congress include all PDC program costs. As  discussed above, ways for management to meet internal control  standards include using and communicating quality information on  achieving program objectives. IRS has not included the costs incurred by  the Treasury Inspector General for Tax Administration’s (TIGTA) Office of  Investigation to operate the system for taxpayer complaints about  collection agencies, which is part of the PDC program (see table 4 in  appendix II for IRS’s reported costs). IRS officials said that IRS did not  include TIGTA’s program costs because IRS does not typically include  costs incurred by TIGTA or other agencies in its program costs. However,  by not including TIGTA’s operational costs, as opposed to its audit costs,  Congress is not informed of full PDC program costs.

IRS Does Not Plan to Conduct Analyses to Improve PDC Program Results

Our work has shown that using performance data helps agencies achieve  better results. Federal internal control standards also require that  management use quality information to achieve objectives. The  standards also point out that management is responsible for an effective  internal control system that minimizes the waste of resources. In addition,  an IRS strategic goal includes analyzing data to improve decision-making  and program results. However, IRS does not have plans to analyze data  to identify ways to improve the results of the PDC program by using this  information to guide the types of cases sent to collection agencies.

We found that IRS has not conducted any analysis of PDC results to  determine which types of cases are not potentially collectible and should  not be assigned to collection agencies because they result in little or no  collected revenue. Our analysis of IRS data showed that certain cases  assigned to collection agencies generally have had limited results.  Specifically, from April 2017 to September 2018, collection agencies had  only  collected $88.8 million of the $5.7 billion assigned—1.6 percent—in  about 730,000 cases.  closed about 111,000 cases, of which about 38,000 were closed as  either fully paid or with an installment agreement, while about 56,000  were recalled by IRS and 17,000 were returned by collection agencies  with little or no revenue collected.

IRS officials said that these recalled and returned cases may have  generated some revenue but did not know how much. Although revenue  amounts were not known, IRS fiscal year 2018 data showed that  collection agencies returned 288 cases (1.7 percent of about 17,000  cases returned in 2018) with a partial debt payment. In addition, our  review of IRS’s data indicated that most returned cases would not have  had collected revenue. According to these fiscal year 2018 data, more  than 95 percent of the 17,000 cases—involving $183 million in tax debt— were returned because the collection agencies indicated that:  they were unable to collect on the debt or contact the taxpayer, or  the taxpayer received Social Security supplemental or disability  income payments (which are to be returned because these taxpayers  have limited resources or ability to pay, according to IRS officials),  asked the collection agency to cease contact, or had died.

When we shared our analysis with IRS officials, they said they were not  surprised by these limited PDC collection results because IRS considers  them to have low collection potential. Furthermore, many taxpayers may  not be able to pay because they have low income. In September 2018,  TIGTA reported that 54 percent of taxpayer accounts assigned to  collection agencies had a low income indicator. By pursuing such cases  that produce little or no revenue, IRS increases PDC program costs to  manage the cases being sent and returned as well as the burdens for  taxpayers who have to respond to collection agencies’ contacts.  However, IRS officials said that they have not analyzed these results and  do not have data on either the costs or the burdens associated with these  cases.

We also found that IRS does not have plans to analyze PDC program  results and inactive debt cases to identify cases that IRS will not pursue  that could be added to the PDC inventory. These cases could have higher  collection potential than many of the current PDC cases that are  collecting little or no revenue even though this potential has not been high  enough to be actively pursued by IRS. For example, IRS could use its  discretion to assign cases before they meet the FAST Act’s case age  requirements criteria for collection agency assignment. Assigning such  cases earlier could improve PDC program results because of the debt  collection principle that collection success generally worsens as cases  age. Similarly, IRS does not have plans to analyze PDC results to  identify characteristics of cases with the highest collection results and use  that analysis to find other types of inactive cases with similar  characteristics that could be included in the PDC inventory. IRS officials  said they are not conducting or planning such analyses because their priority is to fully implement the program and assign the types of cases to  collection agencies that the FAST Act mandates. They said that they may  consider expanding the types of cases sent to collection agencies after  March 2019 and that they do not know whether they will do related  analyses or when any decision will occur. However, for both the debt  cases that could be excluded or added, IRS has existing discretionary  authority to revise the PDC inventory. For example, IRS has authority to  exclude cases from the PDC program if IRS determines they are not  potentially collectible. Furthermore, prior law grants IRS the discretion to  assign collection agencies cases beyond the three types of cases  specified by the FAST Act. Even so, IRS officials said that they have no  plans to analyze data on whether to revise the PDC inventory to reduce  costs or maximize revenue collection.

By not analyzing the results of the PDC cases, IRS risks continuing to  send cases to collection agencies that collect little or no revenue and  incur costs that waste federal resources as well as burden taxpayers. If  most of the more than 2 million cases slated for collection agency  assignment into 2019 collect little or no revenue, the accumulated IRS  costs as well as burdens imposed on taxpayers could be significant.  Similarly, by not analyzing new types of cases that could be assigned to  private collection agencies, IRS could miss opportunities to assign cases  that collect more revenue than cases that these agencies currently return  with little or no revenue.

IRS Has Established a Risk Management Process to Address PDC Risks to Taxpayers but the Process Is Not Complete

IRS Has Addressed Some Taxpayer Risks but Has Not Fully Implemented All Elements of Its Risk Management Process for Its PDC Program

As shown in figure 2 and as described in greater detail below, IRS has  made progress in implementing elements of a risk management process  for its PDC program but has not completed full implementation of the  process.

IRS has involved leadership in supporting the risk management process  but has not aligned the process with objectives for protecting taxpayers in  the PDC program. We previously reported that agency officials should  engage leadership and regularly consider risks and how they could affect  achievement of objectives. IRS’s initial discussions of risk—including  taxpayer risks—involved PDC leadership and internal stakeholders, and  followed guidance from the Office of Chief Risk Officer, according to IRS  officials. IRS created a risk register to track the status of PDC risks. PDC  leadership and IRS stakeholders continue to update these risks biweekly,  according to IRS officials. In addition, IRS has developed a program  mission statement and draft objectives. However, IRS has not aligned its  risk management process for the PDC program with an objective for  protecting taxpayers because, as discussed earlier in this report, IRS has  not yet finalized its objectives for the PDC program.

IRS has taken some steps to identify risks; however, we found various  weaknesses in its implementation of this risk management element.  According to our 2016 report on risk management, agencies should  assemble a comprehensive list of risks that could affect achievement of  goals and objectives. IRS’s risk register includes taxpayer risks that IRS  internal stakeholders initially identified and continue to update biweekly,  according to IRS officials. IRS assigned each of these a risk category— such as taxpayer rights and protection—and most risks have an IRS  official assigned to manage them. Our prior work found that clearly  documenting actions taken in a risk management process—such as in a  risk register—facilitates systematic risk review to help accomplish an  agency’s mission.

However, we found that IRS has not documented a comprehensive list of  specific risks to taxpayers in the risk register. IRS’s risk register identified  6 taxpayer risks but we identified another 10 risks by reviewing other PDC  documentation, such as the Policy and Procedures Guide, and by  interviewing external stakeholders, as shown in figure 3. For example,  IRS did not identify in the risk register the risk that taxpayers may agree  to debt payments they cannot afford. Also, IRS has not aligned the  taxpayer risks with one or more PDC objectives because IRS has not yet  finalized the objectives, as previously discussed.

IRS officials said they did not list all taxpayer risks in the risk register  because they covered many of these risks in other PDC program  documents. Even so, not documenting risks and aligning them with the  objectives in the risk register will make it more difficult to properly manage  all taxpayer risks.

Furthermore, based on our review, the register identified many risks that  are broad and unclear. For example, IRS’s description of a taxpayer  rights risk is broad and unclear on which rights are at risk given the 10  taxpayer rights in the Taxpayer Bill of Rights. For other risks, we found  that IRS did not clearly state the risk to taxpayers. For example, IRS  identified certain taxpayer risks with a focus on: giving taxpayers an opportunity to agree to pay their tax debts through  a series of payments rather than the effects on taxpayers if they are  unable to make all payments; and harming IRS’s reputation if collection agencies do not follow IRS  standards rather than clarifying any specific risks to taxpayer rights.

While IRS identified some taxpayer risks, the lack of completeness and  clarity in IRS’s risk register limits its effectiveness as a tool for tracking  taxpayer risks. As a result, IRS does not have reasonable assurance that  it has fully identified and addressed all taxpayer risks from the PDC  program.

IRS has not consistently documented its assessment of taxpayer risks  from the PDC program, making it unclear how risks will be prioritized. Our  2016 report on risk management describes the importance of assessing  the impact and likelihood of risks so risks can be prioritized. This step is  necessary to guide decisions on how to respond to risks. Before  implementing the PDC program in April 2017, IRS assessed potential  risks and developed sections in the risk register on risk impacts,  likelihood, and responses that IRS would use to address each risk.  However, IRS has not clearly documented the impacts for each risk in the  risk register. We found that the column in the risk register designated for  capturing risk impact was generally blank or contained just a date. We  also found that IRS did not fully capture information on the severity of a  risk’s impact. For example, in a column for recording severity in the risk  register, we found information on the implementation status of a risk  response instead. Further, although IRS officials said they continue to  monitor “closed” risks, we found that the register recorded no information  about the severity of the risk impact after IRS implemented a response.   Instead, the register recorded the risk as “closed.”

We also found that IRS had not clearly documented the likelihood of each  risk in the risk register, making it difficult to understand how likely each  risk is to occur after IRS responds to and closes a risk. For example, the  PDC program and taxpayers could be harmed if scammers find a way to  impersonate collection agencies. IRS set up a Taxpayer Authentication  Number to allow taxpayers to verify that a phone call is from a collection  agency and not a scammer, and closed the risk involving scams.  However, the risk register is unclear on how IRS estimates the likelihood  this risk could occur or on how this response would reduce the likelihood  of scams.

IRS officials said quantifying the impacts and likelihood of some risks is  difficult. Even so, without clear documentation on the risk impacts and  likelihood, it will be difficult for IRS to prioritize the risks. Without a  reasonable measure of the impact’s severity, IRS may be unable to  properly select responses to mitigate the potential impacts from the risks.

IRS has developed many responses to broadly address taxpayer risks in  the PDC program, but has not clearly documented and aligned the  responses to address specific risks. Our 2016 report on risk management  suggests as a good practice selecting risk responses based on a  prioritized list of risks. IRS established risk categories and risk  responses that broadly respond to taxpayer risks in the PDC program,  such as the quality review process to measure how well collection agency  employees properly follow IRS procedures. However, IRS has not  addressed all of the elements we described in our 2016 report for  selecting responses to risks—in part because identified risks and  responses are broad—as IRS has not completed all the steps for risk  identification and assessment, as previously discussed.

In addition, we found that the risk register did not clearly document the  responses chosen to mitigate some stated risks. First, IRS did not always  clearly document in the register column for responding to risks how its  many responses aligned with a specific risk. For example, the register  aligned a response on tracking taxpayer complaints with the risk on  protecting taxpayer rights but not with the risk of scams, even though IRS  officials said that they rely on TIGTA to monitor taxpayer complaints for  PDC-related scams. Second, the register did not include some taxpayer  protection responses. Specifically, we identified taxpayer protection  responses in the collection agency contracts that were not included in the  risk register, such as 1) ensuring that collection agency employees are  not paid based on how much they collect, or 2) relying on taxpayers to  inform collection agencies if debt payments would cause a hardship.

IRS officials acknowledged that their risk register does not align all of its  responses with specific risks, but said they created many responses to  generally protect taxpayers, although we did not find many of these  responses documented in the risk register. Without thorough risk  identification and assessment or clear documentation in the risk register  of how all risk responses align with specific risks, IRS does not have  reasonable assurance that it has properly selected risk responses for  each taxpayer risk.

IRS has developed monitoring efforts for major taxpayer risk responses  for the PDC program, but lacks assurance that specific responses are  working effectively to mitigate specific risks. Our prior work encourages  agencies to monitor how risks change and how well risk responses  work. IRS monitoring includes:  reviewing the quality of a statistically reliable sample of calls between  collection agencies and taxpayers,  reviewing monthly reports from collection agencies on their  compliance and behaviors involving taxpayers, periodically visiting collection agencies to review program compliance, acting on referrals from Treasury Inspector General for Tax  Administration’s (TIGTA) investigation of complaints, and  tracking taxpayer satisfaction through a customer satisfaction survey.

However, we found that IRS’s broad monitoring efforts provide limited  information on whether or how effectively the responses are addressing  taxpayer risks in the PDC program. For example:  IRS monitors calls and scores collection agencies’ accuracy in  following various collection procedures, but this measure provides  little information on how well specific risks in the PDC program are  addressed to protect taxpayers. For fiscal year 2017, the quality  scores indicated that collection agencies scored at least 98 percent  accuracy. However, IRS focuses on this overall score rather than  monitoring individual components that make up the overall score,  which could serve as possible indicators of taxpayer risks, such as  unauthorized disclosures of taxpayer information. IRS documentation  showed that IRS is still identifying which components of the quality  score apply to collection agency performance on taxpayer rights  protection, but IRS officials said they do not plan to finalize the  program’s performance measures until fiscal year 2020.

IRS has not documented how it uses its customer satisfaction survey  measure to monitor specific risks to taxpayer rights. IRS reports that  taxpayers’ satisfaction scores for interacting with collection agencies  exceed 93 percent overall. However, this overall score does not  provide specific information about risks to taxpayers or related risk  responses. Some survey questions—such as on collection agency  professionalism—could provide information about specific taxpayer  risks. IRS has plans to consider using other survey questions as  measures and, in October 2018, officials said they are planning  analysis in fiscal year 2019 to inform and implement survey changes  by fiscal year 2020.

IRS expects taxpayers to tell the collection agency if they cannot  afford a debt payment, but does not track whether this risk response  is effective. If a taxpayer reports to a collection agency that debt  payments would cause economic hardship, that they have a medical  hardship, or that they receive Social Security Disability Insurance  (SSDI) or Supplemental Security Income (SSI), the collection agency  is required to return the case to IRS. To start such tracking, IRS  officials said they were open to possibly analyzing which types of  taxpayers pay or do not pay, as well as the voluntary payment rate on  installment agreements for PDC taxpayers.

As of October 2018, IRS documentation showed ongoing  development of measures for monitoring taxpayer complaints that  TIGTA receives and investigates. It showed that IRS proposes to  establish thresholds for the number of actionable complaints and  unauthorized disclosures a collection agency needs to report before  IRS takes corrective action.

In addition to TIGTA complaints, we found that IRS has other sources of  taxpayer complaints available that it was not using to monitor changes in  taxpayer risk. The Federal Trade Commission’s (FTC) Consumer Sentinel  Database received a number of taxpayer complaints about collection  agencies and possible scams, but we found that IRS did not ask FTC for  these data. FTC gathers data on complaints from the public, the Better  Business Bureau, and IRS and other federal and state agencies. We  analyzed FTC data from about the first 15 months of the PDC program  and identified 20 PDC-related taxpayer complaints. More than half of the  complaints indicated taxpayer confusion after being contacted by a  collection agency; of these, seven taxpayers mistook the collection  agencies for scammers. In addition, six cases were possible scams, and  in three cases taxpayers reported harassment by the collection agency.  When we shared our analysis with IRS officials, they agreed that the FTC  data would be valuable to them and said they plan to work with TIGTA’s  Office of Investigations to incorporate these data into their monitoring of  taxpayer complaints by the end of March 2019.

Although IRS has developed methods to monitor its risk responses  involving taxpayer risks and taxpayer rights violations, IRS’s monitoring  provides broad indicators rather than specific measures on how well  responses address each risk in the PDC program. Although officials are  considering changes to IRS’s monitoring and have plans to conduct data  analysis in fiscal year 2019 to inform decisions about possible customer  satisfaction survey changes, until these changes are implemented, IRS  will have limited assurance that it has effective responses to address  each risk in the PDC program.

IRS informs internal stakeholders and Congress about taxpayer risks in  the PDC program, but has not fully engaged external stakeholder groups  that represent taxpayers’ interests to learn about risks. Our 2016 report  on risk management discussed the need to inform internal and external  stakeholders about program risks and risk response performance, and to  seek feedback on risks from stakeholders.

We found that IRS followed some of these practices and conducted  outreach to some internal and external stakeholders. For example, PDC  management engages regularly with IRS stakeholders, and produces  annual reports to Congress on PDC performance including taxpayer  protection. IRS officials said that IRS staff regularly meet with the  Taxpayer Advocate Service (TAS) staff on PDC. However, TAS has  recommended that it be involved in overseeing taxpayer protection  procedures by reviewing collection agency calls with taxpayers. IRS  officials said they also reached out to external stakeholders such as  practitioner groups and Low-Income Taxpayer Clinics through  conferences and the Office of National Public Liaison, and participated in  Nationwide Tax Forums to provide “limited talking points” about the PDC  program. IRS provided documents showing prior outreach to these  groups as well as AARP about the PDC program. In addition, IRS  provided documents showing planned outreach to external stakeholders  for fiscal year 2019, including TAS, Congress, tax preparers, and tax  professional groups.

IRS officials said they welcome feedback about taxpayer risks, but  documents they provided showed limited efforts to solicit feedback from  external stakeholders about the PDC program. For example, between  May 2016 and October 2018, IRS anonymously recorded 26 questions  from external stakeholders through its Stakeholder Liaison office, which is  designated to communicate with stakeholders. Ten of these questions  were recorded after April 21, 2017, when collection agencies started  contacting taxpayers directly about their tax debts. Because the identities  of stakeholders submitting questions are kept anonymous, we could not  follow up with stakeholders about IRS’s responses. IRS officials said they  had not received any direct feedback from Low Income Taxpayer Clinics,  but that any such feedback would be shared through TAS.

Our interviews with external stakeholders from practitioner groups and  groups that represent taxpayer interests indicated that IRS had not  offered them clear opportunities to provide feedback. For example,  several Low Income Taxpayer Clinic officials informed us that they did not  perceive that IRS was soliciting their feedback when the PDC topic was  discussed at conferences and meetings they attended. We received  similar comments that feedback opportunities were lacking or unclear  from representatives at AARP, the American Bar Association, and other  groups, raising questions about how fully IRS solicited feedback while  conducting its outreach on the PDC program.

As previously mentioned, we learned about taxpayer risks IRS did not  include in its risk register and the experiences of vulnerable groups by  reaching out to stakeholders and listening to their stories (see figure 3).  For example, some stakeholders expressed concerns that using  collection agencies could increase scam risk and make it more difficult to  advise taxpayers on how to avoid scams. They also identified a range of  risks to various types of vulnerable taxpayers. For example, stakeholders  told us that low-income taxpayers can be risk averse and will try to pay,  and may be unaware they do not have to pay the debt if it will cause a  hardship. According to some of the groups we interviewed, some elderly  taxpayers are particularly vulnerable to scams and could be easier for  collection agencies to pressure into payment arrangements; other types  of taxpayers might be confused and believe that a legitimate collection  agency call is actually a scam.

While we did not encounter clear examples of taxpayer mistreatment by  collection agencies or scammers impersonating collection agencies, the  concerns stakeholders raised suggest they can provide IRS with  feedback and insights about taxpayer risks—particularly to vulnerable  groups—that IRS may not identify on its own. Without ensuring that it has  fully solicited feedback and conducted outreach to stakeholders, IRS  does not have assurance that it has identified specific risks to taxpayers  and appropriately responded to them.

IRS Has Identified Scams as a Risk, but Has Not Identified and Assessed Other Program Fraud Risks

IRS identified scams as a risk to the PDC program and taxpayers. In  response to the scam risk, IRS established a Taxpayer Authentication  Number to help taxpayers and collection agencies verify each other’s  identities, provided authentication guidance to taxpayers with cases  assigned to collection agencies, and posted scam alerts and press  releases on its website. In addition, TIGTA monitors taxpayer complaints  to identify instances of scams, according to IRS officials. Beyond this  step, IRS has not identified other fraud risks, such as those internal to the  operation of PDC.

To help agencies better address fraud, we issued A Framework for  Managing Fraud Risks in Federal Programs (Fraud Risk Framework),  which includes a comprehensive set of leading practices to combat fraud  in a strategic, risk-based manner. These practices include:  identifying and assessing inherent fraud risks—including fraud risks  within the program, examining the suitability of existing fraud controls, and documenting the program’s fraud risk profile.

IRS did not have information to demonstrate a formal fraud risk  assessment for the PDC program. IRS officials said they did not conduct  and document a formal fraud risk assessment because they considered  fraud risk as part of their risk management process for the PDC program.  However, IRS’s risk register did not identify fraud types beyond scams,  and our review of other IRS risk management documents found that they  had no clear information about consideration of other external or internal  fraud risks, such as from collection agency employees. In addition, IRS  did not document responses to address fraud risks beyond the Taxpayer  Authentication Number and scam-related complaints monitoring. Without  information on IRS’s assessment and responses to fraud risks it is not  clear that IRS fully considered internal and external fraud risks, or  developed appropriate responses to those risks, meaning IRS cannot  provide assurance it is effectively managing fraud risks to taxpayers and  the program.

IRS Provided Inconsistent Guidance on Taxpayer Protections, Possibly Creating Confusion and Raising Risks for Some Vulnerable Taxpayers

IRS assures taxpayers that they can expect the same level of service and  protections from collection agencies as they do from IRS collections.  However, we identified two inconsistencies in IRS guidance on taxpayer  protections for the PDC program, which could increase confusion among  taxpayers or risks to taxpayers. In response to our findings, IRS is  revising its guidance to address one of these issues but the other has not  been addressed.

Responding to suicidal taxpayers: IRS guidance for its collection  employees requires them to take all taxpayer suicide threats  seriously, keep the taxpayer on the phone, and act quickly to report  the incident to authorities to locate and help the taxpayer. However,  IRS guidance for collection agency staff allowed debt collectors to first  use judgment to try and determine if the suicide threat was sincere  before taking steps to help the taxpayer. When we pointed out this  discrepancy to IRS officials, they acknowledged it and, in October  2018, issued revised guidance to collection agencies that removed  collector discretion to judge whether suicide threats are valid before  taking actions to help the taxpayer.

Reporting scams to TIGTA: IRS instructs taxpayers to call TIGTA if  they suspect a scam. IRS information mailed to taxpayers and on the  main PDC program website includes contact information for TIGTA,  but does not say to call TIGTA to report a scam. This information is  found separately on IRS’s website for scams—which can be accessed  through the main PDC program website—but this may not be clear to  all taxpayers in the PDC program. IRS officials acknowledged that  their mailed publications do not instruct taxpayers to contact TIGTA to  report scams, but said they encourage taxpayers to visit IRS.gov to  keep informed about scams. External stakeholders including AARP  and the National Center on Elder Abuse said that older Americans  generally trust and rely more upon the mail than the internet. In  addition, because older Americans are more likely to watch televised  news, they may not necessarily see IRS website scam alerts and  therefore may be less aware of these scams. They also said that not  all taxpayers—in particular elderly taxpayers—use the internet, and  thus rely on printed guidance or the telephone for information about  reporting scams. Without clear guidance, taxpayers will not know how  to report scams. Thus, TIGTA and IRS may be unaware of and unable  to appropriately respond to them. IRS officials said it would be  possible to update the printed guidance provided to taxpayers with  information about contacting TIGTA to report scams, but that such  revisions could take up to a year to implement.

The PDC program can contribute to IRS’s enforcement efforts to assure  taxpayer compliance and help address the tax gap. However, without  program objectives that are clearly defined and consistently stated, IRS  cannot assure that appropriate controls will be in place to address risks.  Also, without measures and targets that are clearly linked to program  objectives, IRS will be limited in assessing progress and assuring that the  program achieves its objectives.

Without complete reporting on the PDC program revenue collection  results, Congress is not fully informed on the amounts of collected  revenue sent to the general fund of the Treasury and amounts retained by IRS to pay costs. In addition, IRS’s not reporting TIGTA’s costs to  administer the PDC taxpayer complaint system means Congress is not  informed of full PDC program costs. Furthermore, because IRS does not  have plans to analyze data to identify ways to improve the results of the  PDC program by using its discretion to revise the types of tax debt cases  it sends to collection agencies, IRS risks continuing to send cases to  collection agencies that incur costs but collect little or no revenue. IRS  may also miss opportunities to assign cases that collect more revenue to  more efficiently and effectively address the gap between what taxpayers  owe and pay.

IRS’s incomplete documentation of how taxpayer risks align with program  objectives, identification of risks, and risk assessment make it difficult for  IRS to prioritize risks, and does not provide reasonable assurance that  IRS properly selected risk responses to address each risk. Similarly, not  fully documenting how IRS is monitoring taxpayer risks and related  responses means that IRS has limited assurance that each response is  effective in addressing the risk. Taxpayers may face increased risk if IRS  guidance to taxpayers is unclear, such as how to report scams. Lastly,  more fully soliciting feedback from external stakeholders to learn about  taxpayer risks—particularly to vulnerable groups—would provide  assurance that IRS has identified and appropriately responded to  taxpayer risks.

We are making the following 12 recommendations to the Commissioner  of Internal Revenue:

The Commissioner of Internal Revenue should finalize the PDC  program objectives so that they are clearly defined in consistent  terms, and assure that the key program risks, measures, and targets  are linked with the objectives. (Recommendation 1)

The Commissioner of Internal Revenue should include TIGTA costs in  IRS’s reporting of PDC program costs. (Recommendation 2)

The Commissioner of Internal Revenue should report the amount of  collected revenue sent to the general fund of the Treasury and  amounts retained by IRS to pay its costs. (Recommendation 3)

The Commissioner of Internal Revenue should analyze PDC program  results to identify the types of cases that are not potentially collectible  and should not be assigned to collection agencies. (Recommendation  4)

The Commissioner of Internal Revenue should analyze PDC program  results and the cases not assigned to the PDC program to identify the  types of inactive cases IRS will not pursue that could be assigned to  collection agencies to improve PDC program results.  (Recommendation 5)

The Commissioner of Internal Revenue should clearly document and  distinguish the complete list of identified risks to taxpayers in the PDC  program risk register, and align the risks with PDC program  objectives. (Recommendation 6)

The Commissioner of Internal Revenue should clearly document the  severity of impacts of the taxpayer risks, as well as the likelihood of  each taxpayer risk after responding to it, in the PDC program risk  register, and use this information to prioritize risks to address and  guide selection of risk responses. (Recommendation 7)

The Commissioner of Internal Revenue should clearly document how  each risk response aligns with specific taxpayer risks in the PDC  program risk register. (Recommendation 8)

The Commissioner of Internal Revenue should document how IRS’s  monitoring of the PDC program provides information on specific  taxpayer risks and how well specific responses are working to  address each risk, and should supplement IRS’s monitoring of  taxpayer complaints with FTC complaint data. (Recommendation 9)

The Commissioner of Internal Revenue should more fully seek and  document feedback from external stakeholders representing  vulnerable taxpayers to identify and appropriately respond to possible  PDC taxpayer risks. (Recommendation 10)

The Commissioner of Internal Revenue should clearly document an  assessment of fraud risks related to the PDC program.  (Recommendation 11)

The Commissioner of Internal Revenue should ensure that its printed  guidance to PDC taxpayers includes information about reporting  scams to TIGTA. (Recommendation 12)

We provided a draft of this report to the Commissioner of Internal  Revenue for comment. IRS provided written comments, which are  reproduced in appendix III. Of our twelve recommendations, IRS partially  agreed with one and disagreed with two.  IRS agreed with the remaining  nine recommendations and outlined actions to implement them. Of these  nine recommendations, IRS said it already implemented one and planned  to implement another, even though IRS disagreed with part of the related  finding.

IRS partially agreed with our recommendation on defining PDC program  objectives related to key risks and developing related measures and  targets (Recommendation 1). IRS said it would use consistent terms in  developing measures that link to its PDC program objectives, but did not  agree that program objectives are necessarily framed in terms of program  risks. IRS said its approach to risk management is consistent with GAO’s  Standards for Internal Control in the Federal Government, which is to  identify objectives before identifying risks to achieving those objectives.

However, IRS did not document the program’s objectives until October  2018, about two years after it validated identified PDC program risks, and  did not expect to finalize the objectives and related measures and targets  until fiscal year 2020 or later. Further, as discussed in the report, IRS’s  stated objectives did not acknowledge all key PDC program risks, such as  scams and high costs compared to revenue collected. We revised the  recommendation to more clearly address our intent that whenever IRS  finishes defining the PDC program objectives, IRS should ensure that  they include objectives that are linked with key program risks.

IRS disagreed with our recommendation that IRS include TIGTA costs in  reporting program costs (Recommendation 2). IRS said that doing so  would be inconsistent with legislative requirements that define program  costs as IRS’s costs and with IRS cost-accounting practices. However,  the FAST Act set minimum reporting requirements to which IRS can add  more information.  Also, the existing cost accounting standards and  practices to which IRS refers govern IRS’s accounting for and reporting of  costs incurred by IRS. However, our intent is to ensure fuller reporting of  the PDC program’s cost to the federal government. Therefore we stand  by our recommendation because without such reporting Congress is not  informed of full PDC program costs.

IRS also disagreed that it should analyze PDC program results to identify  the types of cases that are not potentially collectible and therefore should  not be assigned to collection agencies (Recommendation 4). IRS said the  PDC statute requires the assignment of all inactive tax receivables to  collection agencies and therefore no collectability analysis is required or  necessary.  However, as we discuss in our report, the statute defines  “inactive tax receivables” as being in “potentially collectible inventory” but  does not define “potentially collectible inventory.” We also noted that IRS  has the discretion to define “potentially collectible inventory” under its  general rulemaking authority in 26 U.S.C. § 7805 and can use this  authority to determine which cases are potentially collectible and which  are not.

IRS also said it questioned whether the analysis we recommend would  improve efficiency and said there is very little cost associated with  assigning additional cases to collection agencies. During our review, we  asked IRS for such cost information and IRS officials said they did not  know the costs to send or to handle returned PDC cases. As we noted in  our report, IRS has incurred tens of millions of dollars in costs with little or  no revenue collected for most of the PDC cases that IRS has closed.

IRS analysis to improve PDC case assignment could improve efficiency.   Under its general rulemaking authority, IRS is authorized to make rules it  deems necessary for the efficient administration of the tax code. We  added language in the report to emphasize IRS’ management  responsibility to assure efficient program operations. Without the analysis  we recommend, IRS could continue assigning uncollectible debts to  PCAs that generate IRS costs and waste federal resources.

IRS agreed that it should analyze PDC program results and the cases not  assigned to the PDC program to identify the types of inactive cases that  could be assigned to collection agencies to improve PDC program results  (Recommendation 5). IRS said it had already built this analysis into its  current shelving process, as the statue addresses inactive cases that are  shelved due to lack of resources. However, it is not clear that the analysis  embedded into IRS’s shelving process identifies cases that IRS will not  pursue and assigns them to collection agencies before the 52-week  shelving threshold, or before the FAST Act’s case age requirements, as  we discuss in the report.

Similarly, it is not clear that IRS’s shelving process includes analysis of  PDC results to identify characteristics of cases with the highest collection  results and uses that analysis to find inactive cases with similar  characteristics that could be assigned to collection agencies, as we  discuss in the report. We look forward to IRS taking actions that will  address our findings. Without such analyses, IRS could miss  opportunities to assign cases that collect more revenue than cases that  collection agencies return with little or no revenue collected.

Finally, although IRS agreed with our recommendation that it report the  amount of collected revenue sent to the general fund of the Treasury and  amounts retained by IRS to pay its costs (Recommendation 3), IRS said it  disagreed that its reports to Congress on the PDC program have not  provided complete financial information and said such reporting followed  statutory requirements.

As we state in our report, IRS has documented PDC revenue collections  and costs in its annual report to Congress as required by the FAST Act.  However, although not required by the Act, IRS has reported the program  balance measure—program revenue less cost—without clarifying how  much revenue goes to the general fund of the Treasury (the Treasury)  rather than to IRS’s two funds.  We appreciate IRS’s agreement with this  recommendation as well as its plans to report PDC revenue amounts  going to the Treasury and to IRS’s retained funds.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the  appropriate congressional committees, the Secretary of the Treasury, the  Commissioner of Internal Revenue, and other interested parties. In  addition, the report will be available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-9110 or at lucasjudyj@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix IV.

The objectives of this report were to assess the extent to which the  Internal Revenue Service (IRS) has (1) documented Private Debt  Collection (PDC) program objectives and measures; (2) documented data  on PDC revenue collection and cost results, and used these data to  improve the program and meet its objectives; and (3) addressed PDC  program risks to prevent or address scams or other harmful effects on  taxpayers. We limited the scope of our analysis to PDC program planning  and implementation, PDC program data on costs and revenues, and risks  to taxpayers in the PDC program.

To assess the extent to which IRS documented PDC program objectives  and measures, we reviewed PDC program management documents and  interviewed IRS officials—including the Director of Headquarters  Collection and the PDC Program Manager—to identify the stated  objectives and proposed measures to support identification of program  risks and assess program performance. We compared the program  objectives and measures to criteria in federal internal control standards  for defining objectives, including standards that objectives be clearly  defined to enable risk identification in specific and measurable terms with  measures and related targets to allow assessment of program  performance. We assessed the clarity of links between the IRS’s stated  PDC program objectives and proposed program performance measures.  We also interviewed IRS officials and reviewed program documents to  assess the extent to which PDC program objectives were linked to  acknowledged key program risks. Finally, we compared IRS’s  documented objectives statements to assess consistency in their terms.

To assess the extent to which IRS has documented data on PDC revenue  collections and costs, we compared IRS’s reporting of PDC costs and  revenue collections data to criteria in federal internal control standards,  including standards that management should externally communicate  complete, quality information necessary to achieve objectives, including  objectives for reporting financial information. We assessed the extent to  which IRS’s reporting of its program balance measure was complete in  reporting program’s results for revenue collected and costs to include how  much of the collected revenue goes to the general fund of the Treasury,  and how much IRS is retains to pay for related costs. We also assessed  the completeness of IRS cost reporting to include the Treasury Inspector  General for Tax Administration costs for administering the system for  taxpayer complaints about collection agencies. To assess the extent to  which IRS is using costs and revenue collect data to improve the PDC  program and meet objectives, we compared IRS’s program administration  plans to criteria in federal internal control standards that management use  quality data to achieve objectives, our work showing that using  performance data helps agencies achieve better results, and IRS  strategic goals. We also assessed the extent to which IRS had legal  authority to revise the types of cases it assigns to collection agencies,  and to what extent it had plans to analyze data to revise case  assignments to minimize costs and maximize collection revenue results.

To assess the extent to which the PDC program addressed risks to  taxpayers, we reviewed risk management criteria from one of our  previous publications on enterprise risk management (ERM), guidance  from the Office of Management and Budget Circular A-123, the Fraud  Reduction and Data Analytics Act, and our Fraud Risk Framework. We  then applied these criteria to the PDC program risk register for the  taxpayer risks. We believe this was appropriate because IRS follows an  ERM process to manage taxpayer risks as well as other program risks  that were not part of our work. We did not assess IRS’s overall approach  to applying its ERM process.

To identify taxpayer risks and understand the program’s risk responses,  we reviewed the risk register, the collection agency Policy and  Procedures Guide, collection agency contracts, and other program  documentation and analyzed data on cases collection agencies returned  to IRS. We also interviewed IRS officials involved in PDC, including the  Director of Headquarters Collection and PDC Program Manager in IRS’s  Small Business/Self-Employed operating division, and solicited feedback  from external stakeholders—such as Low-Income Taxpayer Clinics and  groups dealing with elder fraud and abuse issues—that represent  vulnerable taxpayers to learn about risks, and analyzed FTC data on  taxpayer complaints. We also reviewed PDC program performance data  on quality reviews, taxpayer satisfaction, and taxpayer complaints to  understand how IRS monitors taxpayer risks and responses. Lastly, while  reviewing program documents, we noted inconsistencies between PDC  program guidance for collection agencies and IRS collection procedures  that arose during our review, and verified these inconsistencies with IRS  officials.

We conducted this performance audit from January 2018 to March 2019  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Appendix II: Data on the IRS Private Debt Collection Program’s Revenue Collections to Various Funds and Costs

Table 2 shows the overall private debt collection (PDC) program’s  revenue collections and cost data the Internal Revenue Service (IRS)  used to calculate and report the PDC program balance measure through  September 30, 2018, along with additional detailed information (in bold)  that IRS did not include in the program balance table it reported to  Congress. The added information shows the amounts that went to the  general fund of the Treasury and the amounts of commissionable  collections that went to IRS to pay costs to contract for PDC and hire  additional collection staff in the future.

Table 3 shows the status of the two IRS retained funds for fiscal years  2017 and 2018; these funds had no activity during fiscal year 2016  because IRS had not yet sent any cases to the private collection agencies  to be worked.

Table 4 shows IRS’s reporting of its PDC program costs for fiscal years  2016 through 2018, including the costs that IRS incurred before IRS  started sending tax debt cases to private collection agencies in April  2017.

Appendix III: Comments from the Internal Revenue Service

Appendix IV: GAO Contact and Staff Acknowledgments

Jessica Lucas-Judy, (202) 512-9110 or lucasjudyj@gao.gov.

In addition to the contact named above, Tom Short (Assistant Director),  Ronald W. Jones (Analyst-in-Charge), Carole J. Cimitile, Charles Fox,  Robert Gebhart, James Andrew Howard, Edward Nannenhorn, William M.  Reinsberg, Robert Robinson, Cynthia Saunders, Rebecca Shea, Margie  K. Shields, and Adam Windram made key contributions to this report.

IRS's new program pursues the tax debts that IRS's collectors aren't—by contracting with private collection agencies. This program raises concerns about effectiveness and taxpayer risk, as did similar programs in the past.

For example, IRS's private collectors recovered less than 2% of over $5 billion in debts. Analyzing these results could help IRS make the program more effective.

IRS also hasn't fully assessed potential taxpayer risks. It has documented 6 risks, including "imposter scams," in which scammers pose as private collectors. We identified 10 additional risks.

We recommended 12 ways to improve the program and protect taxpayers.