1.4.30  Monitoring Internal Control Planned Corrective Actions

Manual Transmittal

April 26, 2013

Purpose

(1) This transmits new IRM 1.4.30, Monitoring Internal Control Planned Corrective Actions.

Material Changes

(1) This IRM contains roles and responsibilities to assist managers and senior-level officials in structuring their organizations for effective monitoring and implementation of planned corrective actions (PCAs) affecting IRS internal controls. It also contains detailed guidance for administering and updating the Treasury Joint Audit Management Enterprise System (JAMES) audit tracking system with information on recommendations and PCAs resulting from audits conducted by the Government Accountability Office (GAO) and Treasury Inspector General for Tax Administration (TIGTA).

Effect on Other Documents

None

Audience

All IRS Executives, Managers, and JAMES Audit Coordinators

Effective Date

(04-26-2013)

Pamela J. LaRue
Chief Financial Officer

1.4.30.1  (04-26-2013)
Overview

  1. It is essential that all managers, senior-level officials, and audit coordinators understand their roles, responsibilities, and requirements for monitoring planned corrective actions (PCAs) in the Treasury Joint Audit Management Enterprise System (JAMES) audit tracking system.

  2. This IRM provides roles and responsibilities and guidance for maintaining the Treasury JAMES audit tracking system.

  3. The Chief Financial Officer (CFO): Corporate Planning and Internal Control Unit (CPIC): Office of Internal Control (OIC), developed and maintains this IRM.

1.4.30.2  (04-26-2013)
Background

  1. Internal control, which is synonymous with management control, is a major part of managing an organization. It comprises the plans, methods, and procedures used to meet missions, goals, and objectives; and in doing so, supports performance-based management. It also serves as the first line of defense in safeguarding assets and preventing and detecting errors and fraud. It helps government program managers achieve desired results through effective stewardship of public resources. Systems of internal control provide reasonable assurance that the following objectives are being achieved:

    1. Effectiveness and efficiency of operations

    2. Reliability of financial reporting

    3. Compliance with applicable laws and regulations

  2. The IRS is subject to annual audits conducted by the Government Accountability Office (GAO) and the Treasury Inspector General for Tax Administration (TIGTA) to ensure its programs and activities operate according to established policies and procedures. Tracking issues, findings, recommendations, and the current status of PCAs resulting from annual audits is mandatory to comply with the intent of the standards of internal control. Treasury implemented the JAMES audit tracking system for use by all bureaus to track, monitor, and report the status of internal control audit results.

1.4.30.3  (04-26-2013)
Authorities

  1. The following statutes and regulations are the most significant congressional acts that affect the management controls program at the IRS:

    1. Federal Managers' Financial Integrity Act of 1982 (FMFIA)

    2. Federal Financial Management Improvement Act of 1996 (FFMIA)

    3. Chief Financial Officers Act of 1990

    4. Office of Management and Budget (OMB) Circular A-123, Management Accountability and Control

    5. Treasury Directive 40-04, issued January 4, 2001

    6. Inspector General Act 1978, as amended

  2. OMB, Treasury, GAO, TIGTA, the Financial and Management Controls Executive Steering Committee (FMC ESC), and the IRS CFO set standards and establish policy and procedures for the management controls program. The CFO's OIC, administers the IRS management control program.

1.4.30.4  (04-26-2013)
Acronyms

  1. This IRM contains the following acronyms and their meanings:

    Acronym Meaning
    ACFO Associate Chief Financial Officer
    BOD Business Operating Division
    BPO Bureau Program Office
    CFO Chief Financial Officer
    CPIC Corporate Planning and Internal Control
    CUI Controlled Unclassified Information
    FARS Financial Analysis and Reporting System
    FFMIA Federal Financial Management Improvement Act of 1996
    FMFIA Federal Managers' Financial Integrity Act of 1982
    FMC ESC Financial Management Controls Executive Steering Committee
    GAO Government Accountability Office
    JAC JAMES Audit Coordinator
    JAMES Joint Audit Management Enterprise System
    LOU Limited Official Use
    MW Material Weakness
    OIC Office of Internal Control
    OIG Office of the Inspector General
    OMB Office of Management and Budget
    OS Operations Support Organization
    PCA Planned Corrective Action
    PO Program Office
    REM Remediation Plan
    SE Services and Enforcement Organization
    SBU Sensitive But Unclassified
    SD Significant Deficiency
    SOP Standard Operating Procedures
    TIGTA Treasury Inspector General for Tax Administration
    UWR Unified Work Request

1.4.30.5  (04-26-2013)
Roles and Responsibilities

  1. The Department of the Treasury (Department) is responsible for:

    1. Overseeing the agency's internal controls program to ensure compliance with applicable laws, policies, and procedures.

    2. Working with IRS management when they cannot reach agreement on TIGTA audit recommendations.

    3. Making final management decisions on audit recommendations when disagreement exists and resolution could not be reached between TIGTA and the IRS.

    4. Ensuring that audit follow-up is an integral part of the Department’s FMFIA compliance.

    5. Monitoring and tracking all agency action plans for material weaknesses (MW), significant deficiencies (SD), remediation plans (REM), and audit report findings and recommendations in the Department’s JAMES audit tracking system, and assessing the quality of performance and the effectiveness of internal controls.

    6. Evaluating and making recommendations to strengthen the management controls program.

    7. Preparing reports for the Secretary of the Treasury, OMB, and Congress that contain data required by Section 5 of the Inspector General (IG) Act, and other reports required by statute or regulation.

  2. The IRS Commissioner has overall organizational responsibility for:

    1. Ensuring the IRS internal controls system adheres to statutory and regulatory standards related to internal controls.

    2. Ensuring that the performance plans for each Senior Executive Service (SES) member or equivalent employee having significant responsibilities for internal control contain appropriate performance requirements and expectations for such responsibilities.

    3. Ensuring that recommendations are implemented, PCAs are taken in a timely fashion through independent verification, and that validation occurs.

    4. Submitting statements to the appropriate congressional committees and/or the Director of OMB, as required by statute or regulation for audit reports issued by GAO.

    5. Designating an Internal Control Officer to administer the internal control processes for their respective organization.

    6. Designating an Audit Follow-up Officer.

  3. The Chief Financial Officer is the IRS Internal Control Officer and Audit Follow-up Officer and has responsibilities consisting of:

    1. Overseeing the internal control program for the IRS.

    2. Evaluating all systems of internal control on an ongoing basis and ensuring that audits, internal control reviews, risk assessments, and other evaluations are coordinated to complement one another with minimum duplication of effort.

    3. Planning, directing, and evaluating implementation of the provisions in Treasury Directives, OMB Circulars, and FMFIA and FFMIA regulations and standards.

    4. Reporting to Treasury all management control deficiencies identified in audit reports, internal reviews, and from other sources that have the potential of meeting departmental material weakness criteria.

    5. Ensuring timely correction and validation of all identified program and operational deficiencies, both material and nonmaterial.

    6. Ensuring that detailed procedures, documentation, training, and reporting requirements related to the internal controls program are issued and implemented.

    7. Ensuring that appropriate IRS officials and the FMC ESC are informed of situations that may jeopardize significant corrective action plan implementation.

    8. Providing timely responses to Treasury, OMB, GAO, TIGTA, and IRS management.

    9. Evaluating the program's performance and ensuring that management control evaluations are an integral part of the IRS internal control program.

    10. Reporting quarterly progress on remediation plans to OMB to achieve FFMIA compliance.

    11. Representing the IRS in the audit resolution process where there is disagreement with an audit recommendation to attempt to negotiate and resolve differences before referral to the Deputy Secretary of the Treasury.

    12. Advising and consulting with the Treasury Deputy Chief Financial Officer whenever a matter will be referred to the Deputy Secretary for resolution.

    13. Coordinating the IRS response according to policies for corresponding with GAO. See Treasury Directive 40-02, Corresponding with the General Accountability Office (GAO).

  4. The Associate CFO for Corporate Planning and Internal Control (ACFO for CPIC) is designated by the CFO to carry out the responsibility for administering the IRS internal control program. In addition to being the IRS FMC ESC program executive, the ACFO for CPIC has audit follow-up responsibilities, which include:

    1. Coordinating the IRS written response with the responsible program office and the issuing audit organization no later than 30 days following the receipt of the draft report, which should include agreement or disagreement with recommendations contained in the draft audit report.

    2. Submitting written responses to audit recommendations issued by TIGTA, identifying PCAs, due dates, and other milestones for achieving results.

    3. Ensuring that appropriate IRS officials and the FMC ESC are informed of situations that may significantly jeopardize implementation of a PCA.

    4. Providing timely responses for program information to Treasury, OMB, GAO, TIGTA, and IRS management.

    5. Providing information on the progress or issues regarding the remediation plan.

    6. Ensuring that the content of JAMES is complete, that is, the database is updated timely and accurately with specific data on material weaknesses, significant deficiencies, remediation plans, GAO and TIGTA audit findings, related recommendations, and action plans.

  5. Office of Internal Control (OIC) reports to the ACFO for CPIC and is responsible for carrying out the day-to-day internal control program, including audit follow-up. In accordance with Treasury, OMB, GAO, TIGTA, and IRS policy and procedures, OIC's audit follow-up responsibilities include:

    1. Acting as the IRS Responsible Official by administering and approving all IRS account authorizations for JAMES users.

    2. Providing basic training on an as-needed basis to all JAMES users.

    3. Entering, monitoring, and tracking material weaknesses, significant deficiencies, and GAO/TIGTA audit report findings, recommendations, and PCAs into JAMES.

    4. Preparing the JAMES A6 Audit Summary Report when a new audit is issued. See IRM 1.4.30.6.7 for more on the JAMES A6 Audit Summary Report.

    5. Reviewing and validating all status updates entered into JAMES by the JAMES Audit Coordinators (JACs).

    6. Requesting that Treasury makes special JAMES changes such as reopening closed recommendations or reopening closed PCAs.

    7. Maintaining complete and accurate records of IRS management updates and responses to the FMFIA and remediation plan corrective actions.

    8. Providing direction and assistance to JACs and their managers, as needed.

    9. Preparing, maintaining, providing guidance, and recommending policy and procedures for the internal control program.

    10. Overseeing the FMFIA Annual Assurance Process.

    11. Preparing reports as required by Treasury, OMB, and IRS management on internal controls.

    12. Rejecting a PCA status and notifying the Program Office (PO) user if executive certification is not submitted for implemented PCAs within five work days of the due date.

    13. Providing final approval and submission to Treasury for new JAMES users and informing Treasury to close inactive accounts.

    14. Preparing the annual remediation plan call memorandum for the required quarterly report.

  6. JAMES Audit Coordinators (JACs) are responsible for assisting management with the internal controls program and serving as their function's primary liaison with the OIC. JACs assist management with meeting their reporting requirements under FMFIA, FFMIA, and/or other audit reporting requirements. JACs ensure that action plans for material weaknesses, significant deficiencies, the remediation plan, and audit findings and recommendations are appropriate. They also ensure that the most current status of these action plans are posted in JAMES and that PCAs are implemented timely.

  7. Management in each Business Operating Division (BOD) should designate a JAMES primary audit coordinator and a JAMES secondary audit coordinator, as needed. This will allow the OIC staff to have one central point of contact for each BOD. Depending on the BOD, these duties can be performed by the Division Audit Coordinator(s). The JAMES primary audit coordinator's responsibilities include:

    1. Providing technical assistance to management and review teams in the evaluation of controls.

    2. Preparing and submitting verification of the completion of PCAs for significant deficiencies, material weaknesses, remediation plans, and GAO/TIGTA audit reports to the OIC.

    3. Monitoring and updating the status of PCAs for material weaknesses, significant deficiencies, and GAO/TIGTA issued audit findings and recommendations into JAMES, as appropriate.

    4. Reviewing new GAO and TIGTA audits entered into JAMES to ensure the accuracy of the findings, recommendations, PCAs, due dates, potential and actual monetary benefits, and assignments of responsibility.

    5. Notifying the OIC when there are errors or problems in JAMES that may need further investigation, correction, or resolution through the A6 Audit Summary Report verification process.

    6. Establishing and maintaining control records to monitor the remediation plan, material weaknesses, significant deficiencies, and PCAs.

    7. Following up with management to ensure that the status of each PCA is reported timely.

    8. Entering the status of PCAs into JAMES when actions are completed, need to be extended or delayed, or have a change in status in a timely manner.

    9. Uploading the required executive certifications via executive memorandum or Form 13872, Planned Corrective Action (PCA) Status Update for TIGTA/GAO/MW/SD/TAS/REM Reports.

    10. Assisting management in obtaining the appropriate concurrence to reject a recommendation, transfer responsibility, or cancel/revise a previously approved PCA.

    11. Maintaining complete FMFIA, FFMIA, and other audit files to include documentation of corrective actions taken, executive certification of status updates, and concurrence memoranda.

    12. Entering into JAMES the realized/unrealized monetary benefits for implemented PCAs that have potential monetary benefits, and uploading the required executive certification of the status updates via memorandum or Form 13872.

    13. Serving as liaison between BOD management and the OIC for issue resolution.

    14. Providing guidance to enable management to comply with internal policy and procedures to fulfill their reporting responsibilities.

    15. Assisting management with the preparation of responses to draft audit reports to ensure issues are addressed, PCAs are concise and clear, proposed implementation dates are realistic, and ownership is accurately assigned.

    16. Ensuring status updates are concise, clear, and comply with reporting requirements.

    17. Preparing required briefing materials for FMC ESC meetings.

    18. Ensuring PCAs address material weaknesses and significant deficiencies.

    19. Ensuring status of implemented actions are entered into JAMES before or within five work days of the due date to be considered timely, and that all extended actions are entered and updated in JAMES on or before the due date.

    20. Ensuring the action status and due dates of the material weakness, significant deficiency, remediation plan, or audit report agree.

    21. Obtaining approval of the FMC ESC or their designated official to cancel or significantly revise a material weakness, significant deficiency, PCA, or action plan.

      Note:

      It is especially important that all PCAs are entered and/or closed timely in JAMES in order for the IRS to achieve “Green” on the Treasury Scorecard Report.

1.4.30.6  (04-26-2013)
The Joint Audit Management Enterprise System (JAMES)

  1. JAMES is Treasury’s web-based audit tracking system. JAMES tracks issues, findings, and recommendations extracted from the Office of the Inspector General (OIG), GAO and TIGTA audit reports. It also tracks the current status of PCAs for related material weaknesses, significant deficiencies, and remediation plans. In order to comply with the intent of FMFIA, OMB Circulars, and Treasury Directives, tracking these audits and PCAs is mandatory.

    Note:

    The IRS is primarily audited by GAO and TIGTA.

  2. The information contained in JAMES is used by Treasury to assess the effectiveness and progress of bureaus in correcting their internal control deficiencies and implementing audit recommendations. PCAs are entered into JAMES and must be updated on or before their scheduled due date to reflect their current status.

  3. JAMES allows bureau users to run reports to assess the effectiveness of programs, query by topic, and create management ad hoc reports.

  4. JAMES tracks status updates to support timely completion of PCAs for:

    1. Audit reports (OIG, TIGTA and GAO)

    2. Material Weaknesses

    3. Significant Deficiencies and existing Reportable Conditions

    4. FMFIA Remediation Plan Actions

  5. The Department of the Treasury upgrades the Disaster Recovery (DR) servers annually. This requires OIC to test and verify access before and after Treasury has completed the server upgrade to ensure that all JAMES users can access the new URL with little or no interruptions. This also requires that all user IDs and passwords are active while in the DR environment. OIC works with the IT organization help desk to resolve any discrepancies. This exercise usually last about two weeks.

1.4.30.6.1  (04-26-2013)
JAMES Users, Account Access, and Recertifications

  1. Effective February 1, 2012, Treasury automated the Financial Analysis and Reporting System (FARS) e-Form, which is required to obtain JAMES access. The FARS e-Form is an electronic version of the paper-based FARS access request form. The FARS e-Form is integrated within the FARS application and is only accessible to the FARS designated Responsible Officials and the FARS Helpdesk team. This form allows designated Responsible Officials to electronically submit and track all new and modified requests for JAMES access and allows Treasury to improve the cycle time for completing requests.

  2. To request access to JAMES, the JACs are responsible for providing the following user information to the designated IRS Responsible Official in the OIC:

    1. Name

    2. E-mail Address

    3. Telephone Number

    4. Level of Access/User Role: Bureau PO User (update Planned Corrective Actions) or Bureau PO Read Only (read and run reports)

    5. Account Type: New Account or Modify Account

    6. Office Organizational Symbols (e.g. OS:CFO:CPIC)

  3. The IRS Responsible Official will complete and submit the FARS e-Form to Treasury electronically. The Treasury FARS Helpdesk will establish the user account and notify the user by e-mail, providing a user ID and temporary password. When new users log into JAMES for the first time, they will be prompted to read and acknowledge the FARS Rules of Behavior document before gaining access to the application.

  4. To remove or modify JAMES accounts, the designated JAC must send an e-mail to the designated IRS Responsible Official in the OIC, providing the user’s name to be removed and/or the requested account modification.

  5. JAMES training material and on-line help information is located on the JAMES Home Page.

    Note:

    You must have a JAMES account to access this page.

  6. JAMES Recertification – Treasury requires JAMES users to recertify their access annually by submitting a copy of their most recent ELMS Information Security Briefing Certificate to the IRS Responsible Official in the OIC. The IRS Responsible Official will initiate this process, and during this time, users may also inform the IRS Responsible Official if they no longer need their account. The OIC will notify Treasury of the results by the response due date.

1.4.30.6.2  (04-26-2013)
JAMES User Roles

  1. JAMES employs specific profile settings to control access and information updating privileges to its database. The three main profiles and privileges are presented below.

  2. Bureau Central Editor (The OIC Role). The Bureau Central Editor is able to read all data for the bureau and perform the following actions:

    1. Enter material weaknesses, significant deficiencies, reportable conditions, remediation plans, and GAO/TIGTA audit reports findings, recommendations, and corrective actions into JAMES.

    2. Validate status updates entered by program users.

    3. Reject status updates if they do not meet all reporting requirements, and notifying the PO user that the status was rejected and the reason for the rejection.

    4. Provide basic JAMES training to new users.

  3. Bureau Program Office (BPO) Users (referred to as JACs): The BPO has the capability to update planned corrective actions when required. The validation of updates to a planned corrective action is validated/approved by a Bureau Central Editor user.

  4. The BPO cannot view Limited Official Use (LOU), Controlled Unclassified Information (CUI), or Sensitive But Unclassified (SBU) audit reports unless the planned corrective action under review is assigned to their organization. The BPO is allowed to:

    1. Enter PCA status updates into JAMES - Entry of status updates by the JAMES program user is mandatory. The OIC will only enter a status update under extraordinary circumstances and will require supervisory approval.

    2. Review new reports entered into JAMES - JAMES is programmed to send an automated e-mail notification to inform the OIC Bureau Central Editor that a status update is available for review in JAMES.

  5. Bureau Program Office Read Only: This role provides read-only access to the JAMES database, except for LOU, CUI, or SBU audit reports.

1.4.30.6.3  (04-26-2013)
JAMES Audit Report Numbering

  1. Each TIGTA and GAO audit is assigned a unique “Audit Number.” This is the number assigned to the final report and is the number entered in JAMES for tracking and reporting purposes.

    1. TIGTA Audit Report Number – Each report number begins with the complete fiscal year and is followed by subject and audit identifying numbers (for example, 2002-10-053).

    2. GAO Audit Report Number – Each report is assigned an identification number (for example, AIMD-98-100). The two middle digits represent the fiscal year (for example, GAO-02-001, the 02 represents the year 2002).

1.4.30.6.4  (04-26-2013)
Numbering for Findings, Recommendations, and PCAs

  1. For each audit report, JAMES tracks the findings, the recommendations/issues for each finding, and the planned corrective actions that address the recommendation/issue. The numbering in JAMES is displayed as one-digit numbers for findings, recommendations, and PCAs, which will not tie back to the audit report number.

    1. Finding – The Finding is the first number in a three-digit series when referring to the recommendation or corrective action of a GAO or TIGTA audit report, e.g., 1-1-1, 2-1-1 , 3-1-1. The Finding describes the deficiency or opportunity for improvement in the remediation plan or audit report.

    2. Issue – The Issue, which is also referred to as the Recommendation, is the second number in the three-digit series following the Finding number when referring to the recommendation or corrective action, e.g., 1-1-1 , 1-2-1, 3-1 -1. It reads, Finding 1, Recommendation [Issue] 1, Finding 1, Recommendation [Issue] 2, Finding 3, Recommendation [Issue] 1. A Finding may have more than one Recommendation [Issue]. The Recommendation [Issue] addresses the material weakness or significant deficiency for the preceding Finding.

    3. Planned Corrective Action (PCA) – The PCA is the third number in the three-digit series, e.g., 1-1-1, 2-1-1, 3-1-1, which reads: Finding 1 – Recommendation 2 – Planned Corrective Action 1. The PCA description contains the details of the management corrective action or how management will implement a recommendation to address the issue and to correct the weakness. The description also shows measures taken to address audit findings and recommendations, including due dates and responsible officials. A Recommendation [Issue] may have more than one PCA.

1.4.30.6.5  (04-26-2013)
Important Data Fields and Terms

  1. Actual Better Used Funds - Funds to the nearest dollar actually resulting in revenue enhancements.

    Note:

    (Refer to Funds Put to Better Use below for clarification)

  2. Actual Revenue Funds - Funds to the nearest dollar actually resulting from revenue enhancements due to implementation of an audit recommendation.

  3. Audit Report Issue Date – The date the final report was issued by the originator.

  4. Description - A brief presentation that describes the material weakness or significant deficiency.

  5. Disallowed Cost – Refers to a questioned cost identified by the auditors that management has agreed should not be charged to the government. This cost needs to be reimbursed by repayment, reduction of costs, or offset.

  6. Entry Date –The date the report was entered into JAMES.

  7. Finding – A Finding Number is the first number in a series when referring to the recommendation or planned corrective action that is assigned an identification number (for example, 1, 2, 3). This field also contains a concise description of the audit issue such as a deficiency or opportunity for improvement in the remediation plan or audit report.

  8. Funds Put to Better Use – Complete this field when closing a PCA with the actual savings or revenue amount expected to be realized by the BOD. This only appears in audit recommendations indicating that funds could be used more efficiently if management took steps to implement and complete the recommendations. Specific examples include the following:

    1. Reducing outlays

    2. De-obligating funds from programs or operations

    3. Implementing recommendations for improvements to operations resulting in cost savings

    4. Avoiding unnecessary expenditures noted in pre-award reviews of contract agreements

    5. Preventing erroneous payment for refundable credits such as the Earned Income Tax Credit or Child Tax Credit

    6. Identifying savings

  9. Internal Revenue Manuals (IRMs) and Standard Operating Procedures (SOPs) – Indicates IRMs and/or SOPs should be created or revised to address audit recommendations. PCAs which contain IRM or SOP actions may be closed in JAMES once the documents have been sent for publication. However, the OIC requires that supporting documentation be indicated in JAMES PCA status and on Form 13872, such as:

    1. The date the document was sent for publication.

    2. Documentation that illustrates that the end-users have received notification of the guidance change through a memorandum or hot topic alert.

    3. A receipt from Publishing indicating that the IRM/SOP was timely received by their office.

  10. Issue - The issue is the second number in a series (for example, 1-1, 1-2). The Issue addresses the corresponding corrective actions in a material weakness or significant deficiency.

    Note:

    A Finding may have more than one Issue.

  11. Management Decision – Discusses the management decisions made in response to TIGTA and GAO audit reports and includes actions identified to address the audit findings and recommendations.

  12. Monetary Benefits – PCAs containing monetary benefits must include the dollar amount and an explanation of what management did to realize the savings. If only a portion of the monetary benefits was realized, indicate the amount that was not realized in the status update along with a brief justification. Stating the monetary benefit amount without a justification is not acceptable.

  13. Planned Corrective Action (PCA) – A planned corrective action is the third number in the series (for example, 1-2-1, which reads: Finding 1 – Recommendation 2 – Corrective Action 1). This field contains a concise description of each management corrective action to address the issue, to correct the weakness, or to implement a recommendation. It also shows measures taken to address audit findings and recommendations, including due dates and responsible officials.

  14. Potential and/or Realized Monetary Benefits – Reflects the potential monetary benefits identified by TIGTA and the amount that could be realized when the recommendation is implemented.

  15. Potential Better Used Funds – Reports recommendation by audit entity that funds could be more efficiently used if management took actions to implement and complete the recommendation. This will be specified as a dollar amount and provided by either GAO or TIGTA management. Some specific types of actions are:

    1. Reductions in outlays.

    2. De-obligation of funds from programs or operations.

    3. Withdrawal of interest subsidy costs on loans, or loan guarantees, insurance, or bonds.

    4. Not incurring costs by implementing recommended improvements related to the operations of the IRS, a contractor or grantee.

    5. Any other savings that are specifically identified.

  16. Questioned Costs – Contains costs identified in the audit report that are in question due to:

    1. An alleged violation of a provision of a law, regulation, contract, or other requirement governing the expenditure of funds.

    2. An audit finding that the cost is not supported by adequate documentation (an unsupported cost). Unsupported costs are recorded rounded to the nearest dollar.

    3. An audit finding that expenditure of funds for the intended purpose is unnecessary or unreasonable.

    Note:

    The phrase "disallowed cost" means a questioned cost that management has sustained or agreed should not be charged to the government.

  17. Report Title – Shows the title of the material weakness, significant deficiency, remediation plan, or audit report.

  18. Responsible Employee – Shows the organization(s) name and symbols responsible for managing and updating the planned corrective action, e.g., OS:CFO:CPIC:IC.

  19. Responsible Organization – Shows the organization(s) responsible for receiving and analyzing audit reports, providing timely responses to the audit organization, and taking corrective action, when appropriate. It lists the IRS organizational symbols for the responsible organization at the highest executive level, as well as the organization responsible for establishing the planned corrective actions. Use the organizational symbols for the responsible organization (for example, OS:CFO).

  20. Status Date – The date that the corrective action was last updated. For implemented or cancelled actions, the status date is the close date. This does not necessarily reflect the actual date the action was completed. The actual completion date will be contained in the text of the narrative of Form 13872.

  21. Status Description - Contains a concise description of the action taken and its actual completion date, a reason for delaying completion of an action (when appropriate), and a current status update.

  22. Unified Work Requests (UWRs) - Shows if UWRs for information technology services are involved in the completion of a PCA. The UWR must be implemented (implementation date must be included) before the OIC may close a related PCA. Submission of the UWR does not constitute closure. A UWR might be required when issuing Regulations, Notices, Announcements, configuring software and hardware for IRS systems and products and, designing and developing new or enhanced systems.

    Note:

    For PCAs that involve UWRs, the act of filing a UWR does not close the PCA since the element of risk has not been fully resolved/addressed until the UWR has been implemented.

1.4.30.6.6  (04-26-2013)
Due Date Requirements

  1. Original Due Date – This is the original due date that management expects to implement the action, which is taken from the corrective action plan. If management does not provide a specific proposed implementation date for a corrective action, the OIC will assign an arbitrary original due date. For material weaknesses, reportable conditions, and remediation plans, this will not be done without prior notification to the coordinator.

  2. JAMES Due Date – A corrective action must have an original due date. JAMES will not accept:

    1. Corrective action(s) without an original due date.

    2. Proposed implementation dates with "To Be Determined."

  3. "Ongoing" may be used in unusual circumstances, such as when legislative changes could take several years to implement. If the action is ongoing, the implementation date will be the date that the action or procedure started, with an explanation that it is an ongoing action.

    Note:

    Dates should be realistic and allow sufficient time for implementation, review, verification of status, timely submission to the OIC, and entry into JAMES. Due dates should be scheduled for the last business day prior to (or) on the 15th of the month.

  4. For reporting to be considered timely, all status updates to implement PCAs must be completed and reported in JAMES within five working days of the scheduled due date. Extended PCAs must be reported in JAMES on or before the due date, and executive certification must be uploaded into JAMES during the same time period.

  5. Assignment of a Due Date by the OIC – When warranted, the OIC will assign the original due date to the PCA that is different from the date provided by management when the due date:

    1. Is prior to the issue date of the audit report.

    2. Is prior to the month the report was entered into JAMES.

    3. Falls in the same month the report was entered into JAMES.

    4. Falls in the month after the report was entered into JAMES.

  6. The OIC assigns new dates to allow management sufficient reporting time to avoid being penalized for not having met the due date.

  7. Completed Planned Corrective Action (Implementation Date) – For a PCA completed prior to an audit report issue date, the JAMES original due date and completion date is the report entry date. If the report issue date is 05/06/2012 and OIC entered the report on 05/15/12, the original due date and completion date would be 05/15/2012.

  8. Open Planned Corrective Actions – For open PCAs that do not have specific due dates or have due dates prior to, during, or after the audit report issue date, the original due date assigned will be the last business day prior to or on the 15th day of the second month following the JAMES entry month. If the report issue date is 06/27/2012, the OIC assigned due date would be 08/15/2012.

    Note:

    Choose due dates carefully. Only Treasury can change an original due date after it is entered into JAMES, and only legitimate entry errors will be submitted to Treasury for correction.

  9. Status Dates for Actions Implemented after Entry into JAMES - Implemented actions must be closed on or before the scheduled due date and entered into JAMES within the five work-day time frame to meet the scheduled due date. Supporting documentation must be uploaded into JAMES during the same time period. The OIC will backdate the status date to reflect the current due date and validate implementation, if the above certification data has been submitted during the five work-day time period.

  10. All Other Implemented Actions - For all other implemented actions, the close date will be the status date the PO user updated the corrective action. The OIC will validate the status if all of the reporting requirements are met and an executive certification memorandum or Form 13872 is completed and loaded into JAMES.

  11. Reject Status - The OIC will reject the status of a corrective action if executive certification has not been uploaded within five work days of the entry date, signatures are missing or invalid, or the status does not adequately address the PCA. The OIC will immediately contact the program user of any errors found and request corrections be made promptly in order for the PCA to be considered as recorded timely. Subsequently, the program user will receive an automatic e-mail notification that the PCA has been rejected.

1.4.30.6.7  (04-26-2013)
Entering New Audit Entries into JAMES

  1. The OIC enters all GAO and TIGTA audit reports into JAMES.

  2. GAO Audit Reports – When GAO issues an audit report, they will send the OIC an e-mail notification that a new report has been issued and is posted on their website. The OIC will enter the findings and recommendations and notify the responsible JAC that the report has been entered into JAMES.

  3. Legislative Affairs 60-Day Letter – The IRS Commissioner must submit a written statement to Congress on actions taken to address recommendations contained in a final GAO report. These are due 60 calendar days from the date of public release of the report. This report is known as the "60-Day Letter."

  4. Approved 60-Day Letter – Corrective actions are due when the 60-Day Letter has been approved. Legislative Affairs will provide the OIC with a copy of the 60-Day Letter stating the IRS agreement/disagreement with the GAO recommendation(s) and will include the corrective action for the agreed-to recommendation(s). The JAC may also provide the OIC with a copy of the 60-Day Letter as soon as it has been signed. The 60-Day Letter is retained with the audit file and is used to verify that management has submitted the originally agreed-to action plans to the OIC. The OIC will enter the PCAs into JAMES with the due dates provided in the 60-Day Letter and will upload a copy of the 60-Day Letter into JAMES. Corrective actions are due based on the dates they are assigned in the 60-Day Letter.

  5. Review of New GAO Actions in JAMES – Once the OIC has entered the corrective actions into JAMES, the JAC will be notified by e-mail and provided with an A6 Audit Summary Report. The JAC will review the data on the report to ensure that the corrective actions, due dates, and the assignment of responsibility are accurate. The OIC must be notified of any errors as soon as possible.

  6. TIGTA Audit Reports – When TIGTA issues audit reports, they provide the OIC with the corresponding audit abstract known as a Corrective Action Form (CAF). Hard copies of TIGTA audit reports can be printed from the TIGTA website. The OIC will:

    1. Review the TIGTA report and CAF to ensure they are in agreement. Finding(s), recommendation(s), corrective action(s), responsible official(s), and any potential and actual monetary benefits that are identified are entered into JAMES from the audit abstract.

    2. Notify the JAC that the report has been entered into JAMES. The JAC will review the entry for accuracy, due dates, monetary benefits, and assignment of responsibility. Errors must be reported to the OIC as soon as possible. In situations where IRS management agreed with draft TIGTA audit report recommendations related to monetary benefits but later disagreed with the recommendations in the TIGTA audit extract, an executive signature is required.

    3. Request a management decision in response to the TIGTA audit report be provided within the required 30 days from the issuance of the draft report. If management has not responded or an action plan is missing for the agreed-to recommendations, the OIC will report the pending action plans as past due. When TIGTA receives the IRS response with an action plan, they will provide a revised audit abstract containing the IRS corrective action and any TIGTA comments. Any past due corrective action plans will be entered into JAMES and the JAC will be notified.

      Note:

      Management decisions that disagree with TIGTA audit findings and recommendations require TIGTA written concurrence/non-concurrence. A copy must be provided to the OIC.

  7. Review of New TIGTA Audit Entries in JAMES – At the end of the month, the OIC will notify the JAC by e-mail and provide a copy of the A6 Audit Summary Report containing Findings, Recommendations and PCAs entered into JAMES. The JAC will review the JAMES data to ensure that the corrective actions, due dates, and the assignment of responsibility are accurate and notify the OIC of any errors as soon as possible. The JAC will review new reports and action plans carefully to ensure:

    1. Each recommendation is associated with the appropriate finding. The numbering of the recommendations for a particular finding always starts with the numbering sequence of 1, 2, 3. For example, you will find that the recommendation number in JAMES does not match the recommendation number in the final audit report. The audit report may number recommendations in sequential order irrespective of their relationship to the findings. The same is true for PCAs.

    2. Each PCA is associated with a recommendation. JAMES requires that all PCAs for a particular recommendation begin with the number one (1).

  8. Reviewing A6 Audit Summary Reports – At the end of each month, the OIC sends an A6 Audit Summary Report to the JAC to verify information entered into JAMES for new TIGTA and/or GAO Audit Reports. Generally, the information is entered verbatim from the TIGTA CAF Abstract. However, the OIC will make corrections to typographical errors such as misspellings and errors that significantly change the intent or meaning of the finding, recommendation or PCA. When verifying the A6 Audit Summary report, the JAC will ensure the:

    1. JAMES (Corrective Action) Due Date is correct.

    2. Finding, Recommendation, and PCA are as stated in the audit report.

    3. PCA is aligned with the appropriate recommendation.

    4. Status Date is correct.

    5. Management agrees to potential "Monetary Benefits," if identified.

      Note:

      A tracking method is in place to account for the realized/unrealized benefit when the recommendation is implemented. Any disagreement must be addressed in the IRS official response to TIGTA. A concurrence memorandum, signed by a responsible official at the executive level, is only required if there is a substantial disagreement or if monetary benefits have been identified. Disagreements require TIGTA's written concurrence/nonconcurrence and a copy must be provided to the OIC. If the information contained in JAMES is correct, the JAC will send the OIC an e-mail of concurrence by the response due date.

1.4.30.6.8  (04-26-2013)
Audit Reporting, Monitoring, and Requirements

  1. All implemented status updates must be uploaded and entered into JAMES within five work days of the due date. The due date is considered “Day One.” Any extended/delayed corrective actions must be reported in JAMES on or before the scheduled due date and executive certification must be uploaded into JAMES during the same time period.

  2. Scorecard Reporting Definitions:

    1. MET - PCAs that were implemented on or before the scheduled PCA due date.

    2. MISSED - PCAs that were never implemented or that were implemented, cancelled, or extended after the scheduled PCA due date.

    3. CANCELLED - PCAs that were cancelled on or before the scheduled PCA due date.

    4. EXTENDED/DELAYED - PCAs that were extended on or before the scheduled PCA due date and the final implementation was not accomplished by the due date established by the responsible organization.

    See IRM 1.4.30.8 for JAMES statistical analyses tables

  3. JACs are responsible for monitoring PCAs and for performing the following tasks:

    1. Verifying the accuracy of the report content and providing a signed memorandum back to the OIC with the updated status within five work days of the due date for each PCA due.

    2. Ensuring that status updates are prepared and uploaded into JAMES when PCAs are due (the OIC will receive an e-mail indicating that a PO user has updated a PCA in JAMES).

    3. Setting due dates for new or extended/delayed corrective actions that are realistic and allow sufficient time for review, and verification of status and uploading into JAMES for timely submission to the OIC.

    4. Obtaining the appropriate concurrence when rejecting a previously agreed-to recommendation, canceling or revising a corrective action, or transferring responsibility to another functional area.

    5. Ensuring that proper documentation to verify implementation of the corrective action is maintained.

    6. Entering the current status into JAMES for the OIC validation.

      Note:

      Responses received via Form 13872 will be accepted in lieu of a signed memorandum and must be uploaded into JAMES.

  4. Required Documents: To update PCAs, an executive memorandum or Form 13872 must be completed and contain the following:

    1. The official signature of the executive, responsible official, or their designee. Electronic signatures on Form 13872 are acceptable; however, signatures shown as "/s/" are not acceptable.

    2. Identification of the audit report number, report title, recommendation, and corrective action number.

      Note:

      Failure to comply with reporting requirements will result in the response being rejected. This could result in late action plans or a "missed" on Treasury’s Performance Measures Scorecard.

  5. Uploading and Attaching Documents into JAMES

    1. It is mandatory that all supporting documentation be stored in JAMES. The completed, signed, and dated PCA Status Update Form 13872 or other executive certification document must be uploaded and attached in JAMES at the time the PCA is updated. This also includes material weaknesses, significant deficiencies, and remediation plan actions. (These are discussed further in IRM 1.4.30.6.10).

    2. The OIC recommends that data entered into JAMES be the same as the narrative provided on Form 13872 or other executive certification documentation, such as an executive memorandum that contains all the information required by JAMES. The Form 13872 must be completed accurately and all signatures and dates must be present. Both handwritten and electronic signatures are acceptable.

      Note:

      An "/s/" on the signature line indicating a signature of approval is not considered acceptable for official approval. This will result in the documentation being sent back to the JAC for a proper signature(s).

  6. Uploading Documentation into JAMES - The following steps should be followed whenever uploading/attaching supporting documentation for PCAs in JAMES:

    1. Click "Update PCA" to save the status changes.

    2. Click "Supporting Documentation" at the bottom right.

    3. Provide a description of the document in the supporting documentation box and provide the date you are attaching it (e.g., 13872 - 8/10/12).

    4. Click "Browse," choose a file, and select the document to be attached (make sure the file name includes the date.).

    5. Click "Load" and you will see the document that you uploaded in the box at the bottom of your screen.

    6. Click "Back to PCA" to return to the original PCA screen.

    7. Click "Update PCA" to finalize all changes.

  7. Timeliness of JAMES Reporting - PCAs are considered completed timely when the:

    1. PCA was completed on or before the assigned due date in JAMES.

    2. Description of the action taken addresses the specific issues of the PCA.

    3. Action agrees with the stated corrective action and is fully implemented.

  8. Tracking and Reporting Monetary Benefits

    1. Monetary benefits must be addressed before a corrective action can be closed. A statement explaining what was done to realize the amount (e.g., $0 or a calculated dollar amount) must be included when the PCA is updated and noted on Form 13872. Simply indicating $0 without an explanation is not acceptable and will not be validated by the OIC.

    2. In the event that management disagrees with the TIGTA potential benefits estimate, the disagreement must be stated in the IRS official response to the draft audit report. When monetary benefits are not addressed by management in the final response, it is concluded that the IRS is in agreement.

    3. Any disagreement after the final report is issued must have a signed concurrence from TIGTA (either original or electronic) to close the recommendation/PCA without addressing the realized benefits, and a copy must be provided to the OIC.

    4. To document disagreement with TIGTA’s stated potential monetary benefits, the OIC will enter $1 in JAMES in the realized monetary benefits field as notification to the Department of the Treasury that management disagreed with TIGTA regarding the estimated monetary benefits. If TIGTA and management cannot reach an agreement over potential benefits, the issue may be elevated to the Department of the Treasury for further discussion and/or resolution.

    5. If a portion of the dollar amount was realized, indicate the amount realized in the appropriate box in JAMES and provide an explanation in the status field that describes the basis for the amount realized and/or a reason, if appropriate, for the amount not realized.

    6. If monetary benefits have been identified and a PCA contains more than one responsible official, management should determine during the draft stage of the audit report response who will report on the potential benefits.

    7. If a recommendation contains multiple PCAs and monetary benefits have been identified for one of the PCAs, the other PCAs related to that recommendation will be affected in JAMES. The responsible official for the PCA containing the monetary benefits must address the benefits before the PCA can be closed in JAMES.

    8. The responsible official for the remaining PCAs will enter $0 in the appropriate box and report in the status field that monetary benefit has been or will be addressed in the PCA by another named official.

    9. If management disagreed with the benefits, $1 will appear in JAMES for all related PCAs associated with that recommendation.

    10. If TIGTA issues an audit report where the PCA has been implemented but the recommendation contains monetary benefits, the OIC will notify the BOD(s) that the recommendation is closed but management still needs to address the monetary benefits.

    11. If management cannot provide the realized monetary benefits amount upon request, a due date must be provided indicating when the monetary benefit information will be provided.

    12. If management cannot timely address the monetary benefits and does not provide a due date, the OIC will enter a two-month due date for management to provide the necessary data, even though the PCA is considered closed.

    13. Outcome measures responsibilities must be addressed during the draft audit stage, not when being entered into JAMES.

    14. Outcome measures must be entered into JAMES as a whole dollar amount (e.g. $2,500,000); do not use decimals (e.g. 2.5 mil).

    15. If cost savings cannot be realized, enter $0 in the appropriate box. This indicates that management agrees with the amount of the questioned costs, but the cost cannot be reimbursed or offset. This should also be reflected on Form 13872 with an explanation stating why the cost cannot be reimbursed.

    16. If a unique situations occur, they will be handled on a case-by-case basis involving all parties concerned.

      Note:

      When addressing PCAs, the narrative on Form 13872 should match the narrative input into JAMES by the JACs.

  9. Extended/Delayed Due Dates - When updating JAMES to extend due dates, provide the:

    1. Extended completion date. Remember to set a realistic due date when completing, implementing, or closing the action.

    2. Description of the reason for the delay in closing or implementing the action.

    3. Form 13872 or other documentation, signed and downloaded into JAMES.

  10. Cancelled/Rejected TIGTA Audit Recommendations: BOD management should submit requests for cancellations or rejections of PCAs directly to TIGTA. Any related correspondence must be sent to the OIC JAMES staff and uploaded into JAMES as back-up documentation.

    1. TIGTA written concurrence is required for recommendations and corrective actions agreed to in the final report to be cancelled in JAMES.

    2. The BOD cancellation request must identify the report, finding, recommendation, and PCA, if appropriate.

    3. The request must include the reason the corrective action or recommendation will not be implemented and the effective date for the cancellation or rejection.

    4. The JAC, along with the responsible function, can work with TIGTA before the official memo is sent because they can require information before agreeing to cancel the PCA.

  11. Cancelled/Rejected GAO Audit Recommendations: BOD management should submit requests for cancellations or rejections of PCAs directly to GAO. Any related correspondence must be sent to the OIC JAMES staff and uploaded into JAMES as back-up documentation.

    1. The BOD provides GAO written concurrence to cancel a corrective action that was originally agreed to in a 60-Day Letter.

    2. The BOD request should be presented to GAO, via memorandum or e-mail, identifying the report, finding, recommendation, and PCA or recommendation. The request must include the reason the corrective action or recommendation will not be implemented and the effective date for the cancellation or rejection. The JACs along with the responsible functions can work with GAO before the official memo is sent as they can require information before agreeing to cancel the PCA.

    3. If a concurrence is received, the JACs will enter the status into JAMES and the OIC will validate the cancellation.

  12. Transfer of Responsibility for Audit Recommendations Resolution (Transfer of PCA Resp. Org./Resp. Emp. from one BOD to a different BOD):

    1. A PCA being transferred to a different BOD must have signed concurrence from the executive or management official accepting responsibility for the PCA. An e-mail from the accepting executive or management official is sufficient.

    2. The transferring official will provide the new responsible official with the necessary JAMES reports and any other pertinent documentation to ensure timely reporting.

    3. Senior executives can make transfers of responsibility within their functional area without the required concurrence of the accepting official. When this occurs, the senior executive and/or JACs will need to notify the OIC of this change, so that the responsibility codes can be changed in JAMES.

  13. Revised Corrective Actions: Whenever BOD management requests a revised due date or revision to a PCA, the following must be applied to each particular type of audit report:

  14. TIGTA Audit Reports - TIGTA concurrence is required for significant revisions. BODs should send their request to TIGTA and include the:

    1. Reason the action is being revised

    2. Description of the new action

    3. Revised due date, unless the original due date is still applicable

    Note:

    The signed TIGTA concurrence should be sent to the OIC via Form 13872 or memorandum for review and entry into JAMES.

  15. GAO Audit Reports - Revisions to corrective actions originally agreed to in the 60-Day Letter require the OIC program executive concurrence. The same request and notification procedures outlined above in the Cancelled/Rejected Audit Recommendations category apply to revisions. BODs should include the:

    1. Reason the action is being revised

    2. Description of the new action

    3. Revised due date, unless the original due date is still applicable

    Note:

    The signed GAO concurrence should be sent to the OIC via Form 13872 or memorandum for review and entry into JAMES.

  16. Adding or Closing an Implemented PCA - In order to add or close a PCA that has been implemented, the changes should include:

    1. A concise description of the action

    2. A proposed implementation date

    3. The current status of the PCA.

      Note:

      Set realistic due dates and completion dates. If the corrective action has been implemented, any realized "Monetary Benefits" that were identified in the recommendation should be noted.

  17. Requesting an Extension for PCA Due Date - An extension occurs when management has determined that the PCA cannot be completed by the scheduled due date. Therefore, a new due date should be established to allow enough time for management to close the PCA. When a BOD executive determines that they will need to request an extension of a PCA due date, the following steps should be taken:

    1. The BOD executive submits documentation via memorandum citing the reasons for the delay and requests an extension.

    2. The BOD JAC enters the information from the documentation into JAMES.

    3. The JAC must have the PCA extension request in JAMES on or before the PCA due date and executive certification must be uploaded into JAMES during the same time period.

    4. The BOD JACs will upload the documentation into JAMES and select the reason for the extension using the reasons listed in IRM 1.4.30.6.9, Category for Delays/Extensions in JAMES.

    5. Once the OIC approves/disapproves the extended due date, the action is automatically updated in JAMES as well.

      Note:

      An extension of a PCA due date does not negate a "Missed" due date for tracking purposes on the Treasury Performance Measures Scorecard.

  18. OIC Weekly Audit Reporting - The OIC prepares weekly statistics to keep management informed of the progress of PCAs. These statistics reflect weekly and year-to-date percentages on how well the BODs are doing in responding to their PCAs. The monthly year-to-date report indicates a red, yellow, or green performance score.

  19. Quarterly Forecasts - The OIC prepares a quarterly forecast of PCAs to project whether BODs plan to meet or extend any PCA due dates. In addition, the BODs identify PCAs that require IT involvement, providing clarifying information (i.e. Work Request, Work Order #, and points of contact) that would allow IT staff members to research and identify the status of the action item and determine potential impact (if any) to successfully complete the PCA. It also requires the BODs to assess whether the IT action will prevent closure of the PCA. See IRM 1.4.30.8 for 4th Quarter PCA projections table.

  20. FMC ESC Reporting - The OIC prepares statistics for the quarterly FMC ESC Subgroup meetings and for the quarterly FMC ESC meetings, to keep executives apprised of any possible issues that may need their attention. The year-to-date report indicates a red, yellow, green performance score. See IRM 1.4.30.8 for YTD Analysis and IT Involvement tables.

1.4.30.6.8.1  (04-26-2013)
Treasury Monthly Reporting

  1. Treasury prepares various performance reports that reflect monthly and year-to-date PCA audit follow-up activities, as well as the total number of PCAs due in upcoming quarters. Treasury sets yearly goals for the percent expected to be timely closed and provides the IRS a performance score of red, yellow, and green. This performance report receives a great amount of attention from senior management across the Department of the Treasury including the Deputy Secretary. The OIC reviews the IRS audit activity for the stated reporting periods for accuracy in anticipation of questions from upper management. Due to heightened awareness and the overall impact to the Treasury scorecard, it is critical to establish realistic due dates and timely implement planned corrective actions.

1.4.30.6.9  (04-26-2013)
Category for Delays/Extensions in JAMES

  1. Both the IRS and Treasury departmental offices track extension activities in JAMES. The PO is required to use the appropriate reason for delay when completing Form 13872, Planned Corrective Action (PCA) Status Update, to extend PCAs in JAMES. If a PO provides an extension request via an executive certification memorandum, the PO must ensure that the appropriate reason is included in the documentation and select the appropriate box in JAMES. The list below provides all of the reasons with a brief definition. These reasons may also be found on Form 13872 in item 4c and in the drop down menu box on the JAMES PCA data entry screen:

    1. Research/Analyze Data – Delays in implementation in order to perform additional analysis or studies.

    2. Publishing – Delays in issuing or publishing guidance or manuals.

    3. Concurrence – Delays due to PCAs that are coordinated with other offices before the action could be implemented, closed, or cancelled.

    4. Monetary Benefits – Delays to address associated actual monetary benefits.

    5. Legal – Delays due to waiting for the resolution of a legal issue.

    6. Clearance – Routing delays for comments or reviews (supporting documentation must show that it is in the final stage of the review process).

    7. Budget – Delays due to waiting for the approval of funding.

    8. Resources – Delays due to the lack of sufficient resources due to budget constraints.

    9. Contracting – Delays due to waiting for contract awards or when procurement activities are not complete.

    10. Information Technology – Unforeseen release delays due to programming or hardware/software issues.

1.4.30.6.10  (04-26-2013)
Reporting Procedures for Updating and Tracking Material Weaknesses, Significant Deficiencies, and Remediation Plans

  1. This information is provided for JACs who may have additional PCAs related to a specific material weakness or significant deficiency that are duplicated in a remediation plan and also tracked in JAMES. These PCAs are handled separately and currently are not reported in the Treasury Performance Measures Scorecard.

  2. Once the FMC ESC approves the final corrective action plan for a material weakness, the OIC will enter the description, issues, and corrective actions into JAMES. A copy of the plan will be forwarded to the JAC to review for accuracy. Any errors must be reported to the OIC for correction in a timely manner.

  3. The responsibilities outlined below are addressed from the material weakness and significant deficiency perspective, since the same data is used to update the remediation plans. Unique remediation plan requirements are identified separately. The material weakness and significant deficiency plans are monitored by the FMC ESC and the committee is briefed as needed. The remediation plans are updated quarterly for submission to Treasury and OMB.

    Note:

    See IRM 1.4.2, Resource Guide for Managers, Monitoring and Improving Internal Control for further information on the FMC ESC program.

    1. Report Number – The report number contains the assigned material weakness, significant deficiency, audit report number, and remediation plan number. A report cannot be accessed in JAMES for status update unless the correct report number is entered in the Data Entry screen. The OIC assigns these numbers for material weaknesses, significant deficiencies, and remediation plans.

    2. Material Weaknesses and Significant Deficiencies – Each material weakness or significant deficiency is assigned an identification number (for example, IRS-2A-12-01). "IRS" identifies the agency; "2A" identifies the type of weakness or deficiency (financial or administrative); "12" identifies the fiscal year; and "01" is specific to that weakness or deficiency.

    3. Remediation Plan Number – Each remediation plan is assigned an identification number (for example, IRS-REM-12-1, IRS-REM-12-2).

  4. Reporting Procedures: Status updates and executive certification information (i.e., supporting documentation and Form 13872) must be entered into JAMES no later than five work days from the due date to be considered timely.

    Note:

    The due date is considered day one.

  5. Reporting by Memorandum or Form 13872:

    1. The only exception to this rule is material submitted for FMC ESC meetings.

    2. Identify the material weakness/significant deficiency issue and PCA being updated.

    3. Identify the other action plan, finding, and corrective action being simultaneously updated. Separate memoranda for each action plan are not required or recommended.

    4. Provide status updates (see paragraph 3 above and "Status Updates" below).

    5. Responses must be updated in JAMES with the proper documentation and uploaded at the same time.

      Note:

      If a PCA is also duplicated in the remediation plan or an audit report, you may report the status for all action plans with one submission.

  6. Status Updates – If responsibility for an action is shared by another BOD, you must coordinate your status updates with the other responsible official in order to ensure the accuracy of content, due dates, and resources.

  7. If the status is completed, the criteria below must be included when updating material weaknesses and/or significant deficiencies.

    1. Actual completion date.

    2. A brief description of the action taken.

    3. The action must agree with the stated corrective action and be implemented.

  8. If the status was extended or delayed, the criteria below must be included when updating material weaknesses and/or significant deficiencies.

    1. A revised estimated completion date.

    2. A brief justification for the delay in implementing the PCA.

    3. A proposed new due date when the BOD will expect to have the PCA completed timely.

  9. If the status is cancel/significant revision, the criteria below must be included when updating material weaknesses and/or significant deficiencies.

    1. Approval is required from the appropriate executive committee or designee.

    2. The request and justification for the cancellation or revision must be submitted to the OIC. JAMES must be updated and the justification uploaded into JAMES.

    3. Check your material weakness and/or significant deficiency to see if the corrective action you are canceling is duplicated in the remediation plan.

    4. Requests to cancel an action must include an effective cancellation date.

    5. The OIC will present the request to cancel/revise to the appropriate official(s) and notify management regarding the approval/disapproval to cancel.

    6. The OIC will also notify Treasury to make the approved changes in JAMES.

  10. If the status is transfer of responsibility, the criteria below must be included when updating material weaknesses and/or significant deficiencies.

    1. Signed concurrence from the official accepting responsibility is required.

    2. The transferring official should provide the new responsible official with the necessary JAMES reports and any other pertinent documentation to ensure timely reporting.

  11. Add a Planned Corrective Action (PCA):

    1. A concise description of the PCA.

    2. A proposed implementation date or completion date if the PCA has already been implemented.

    3. Current status.

    4. Responsible officials(s)

    5. Identify any corresponding audit finding, recommendation, corrective action, or remediation plan corrective action that may be duplicated or needs to be added to the corresponding action plans.

    6. For newly identified issues, provide a brief description of the issue. Long-term actions may require interim actions and due dates.

  12. Remediation Plan Reporting and Procedures

    1. Agencies that are not in substantial compliance with FFMIA must develop a remediation plan to achieve compliance. The plan must include resources, planned remedial actions, and intermediate target dates necessary to bring the financial management system into substantial compliance.

    2. The Deputy Commissioner, Operations Support, has overall responsibility for the remediation plan. The FMC ESC monitors the plan and the OIC tracks the plan in JAMES.

      (See IRM 1.4.2, Resource Guide for Managers, Monitoring and Improving Internal Control for further guidance)

  13. OIC Responsibilities: In addition to their responsibilities outlined in IRM 1.4.30.5, the OIC is responsible for the following issues regarding the FMC ESC in JAMES:

    1. Monitoring and tracking the remediation plan in JAMES.

    2. Preparing the annual call memorandum for the required quarterly report.

    3. Verifying the accuracy of status updates and resources and preparing a final quarterly report for submission to OMB, Treasury, and GAO.

    4. Coordinating FMC ESC briefings four times (at the discretion of the FMC ESC) per fiscal year on the current status and progress of the remediation plan.

    5. Elevating significant issues or requests reported by management to the appropriate IRS official.

  14. JAMES Audit Coordinators (JAC): In addition to their responsibilities outlined in IRM 1.4.30.5, JACs are responsible for the following issues regarding the FMC ESC in JAMES:

    1. Ensuring that the remedies address the financial system weaknesses identified by GAO or TIGTA.

    2. Setting realistic due dates for new or extended/delayed remedies that allow sufficient time for implementation, review, verification of status, and timely submission to the OIC. Scheduling briefings as needed with the FMC ESC to present requests to approve additional corrective actions.

    3. Alerting the OIC when any significant issues arise that may impede timely implementation of the remediation plan and ask for an extension of time to complete the PCA.

    4. Ensuring that proper documentation to verify implementation of the remedy is maintained.

    5. Obtaining the approval of the appropriate executive committee or a designated official when canceling or significantly revising a remedy.

    6. Responsible Official briefing the FMC ESC (when required) on the current status and progress of the remediation plan(s).

      Note:

      All actions due must be entered into JAMES with the proper documentation having been forwarded to the OIC. This requirement is due to the short turn-around required by Treasury and OMB for the remediation plan. The “five work day rule” to enter this information into JAMES will not apply.

  15. Reporting Procedures for Memorandum/Form 13872

    1. All status updates must be submitted via a signed executive memorandum or through Form 13872.

    2. Identify the remediation plan (administrative or custodial), finding(s), recommendation(s), and remedies being updated.

      Note:

      If a remedy is duplicated in another material weakness, significant deficiency, or audit report, you may report the status for all action plans with one submission. Identify the other action plans(s) and actions(s) being simultaneously updated. Separate memoranda for each action plan are not required or recommended.

1.4.30.8  (04-26-2013)
FMC ESC JAMES Statistical Analyses Tables

  1. The following statistical tables show sample JAMES reporting analyses prepared weekly for the CFO in monitoring organizational performance and presented in the FMC ESC quarterly meetings. These tables identify the PCA status for the business units and use the following definitions:

    1. Met - PCAs that the BODs project should be implemented in the upcoming quarter; PCAs that were implemented on or before the scheduled PCA due date.

    2. Extended/Delayed - PCAs that the BODs project could possibly be extended in the upcoming quarter; PCAs that were extended on or before the scheduled PCA due date and the final implementation was not accomplished by the due date established by the responsible organization.

  2. The organization symbols used in the JAMES analyses tables are:

    Organizational Symbol


    Organization Title
    AP Chief, Appeals
    OS:A Chief, Agency-Wide Shared Services
    OS:CFO Chief Financial Officer
    OS:CTO Chief Technology Officer
    OS:HC IRS Human Capital Officer
    OS:P Director, Privacy, Government Liaison & Disclosure
    SE:ACA Director, Affordable Care Act Office
    SE:CI Chief, Criminal Investigation
    SE:LB Commissioner, Large Business and International Division
    SE:OLS Director, Office of Online Services
    SE:RPO Director, Return Preparer Office
    SE:S Commissioner, Small Business/Self Employed Division
    SE:T Commissioner, Tax Exempt and Government Entities Division
    SE:W Commissioner, Wage and Investment Division
    SE:WO Director, Whistleblower Office

  3. 4th Quarter PCA Projections either "Met" or "Extended":

    Responsible Organization

    Extended


    Met


    Grand Total
    AP   1 1
    OS:A   2 2
    OS:CFO   2 2
    OS:CTO 1 8 9
    OS:HC   1 1
    OS:P   1 1
    SE:ACA   1 1
    SE:CI   5 5
    SE:LB   13 13
    SE:OLS 2   2
    SE:RPO 2 3 5
    SE:S 1 13 14
    SE:T 2 3 5
    SE:W   19 19
    SE:WO   6 6
    Grand Total 8 78 86
    Performance 9.30% 90.70%  

  4. Year-To-Date (YTD) Analysis:


    Organization

    Extended

    Met

    Grand Total
    Percentage (%) Met
    Color Score
    AP   4 4 100% Green
    OS:A 4 59 64 92.19% Green
    OS:CFO   8 8 100% Green
    OS:CTO 6 63 69 91.30% Green
    OS:HC 1 12 13 100% Green
    OS:P   2 2 100% Green
    RAS   4 4 100% Green
    SE:ACA   2 2 100% Green
    SE:CI   6 6 100% Green
    SE:LB 3 9 12 75% Yellow
    SE:OLS   2 2 100% Green
    SE:RPO   10 10 100% Green
    SE:S 5 57 62 91.94% Green
    SE:T   7 7 100% Green
    SE:W 2 117 119 98.32% Green
    SE:WO 3   3 0.00% Red
    TA 3 2 5 40% Red
    Grand Total 28 364 392    
    Performance 7.14% 92.86%      

  5. 4th Quarter PCAs with IT Involvement:




    Organization



    IT Involvement
    IT Involvement Impact Ability to Implement PCA

    Total PCAs Due 4th Quarter
    AP 1 1 1
    OS:A 0 0 2
    OS:CFO 1 1 2
    OS:CTO 9 2 9
    OS:HC 0 0 1
    OS:P 0 0 1
    SE:ACA 0 0 1
    SE:CI 0 0 5
    SE:LB 0 0 13
    SE:OLS 2 2 2
    SE:RPO 2 2 5
    SE:S 1 1 14
    SE:T 0 0 5
    SE:W 2 2 19
    SE:WO 0 0 6
    Grand Total 18 11 86
    Performance 20.93% 12.79%  


More Internal Revenue Manual