The IRS authenticates millions of individuals each year through telephone, online, in-person, remote in-person, and correspondence channels to ensure the individuals are who they claim to be. Taxpayers, representatives, and other third-parties use multiple service channels to interact with the IRS. The IRS must ensure its authentication processes are assessed for risk and those risks are appropriately addressed. The NDARA evaluates the risks associated with authentication through all non-digital service channels. This policy applies NIST Risk Management Framework concepts as the baseline for assessing program risks.

Relevant federal guidelines include:

U.S. code section 6103 and confidentiality regulations and other Federal guidelines require the IRS to authenticate the identity of individuals with whom it exchanges sensitive but unclassified (SBU) information (including personally identifiable information (PII) and tax information), regardless of the channel. Management officials bear the responsibility to conduct risk assessments of factors, procedures, and processes used to authenticate taxpayers, representatives or other third-parties interacting with the IRS.

The Identity Assurance Associate Director, within Privacy, is responsible for the NDARA process.

Organization executives and management officials who lead programs described in this policy are responsible for these guidelines for continuous monitoring of new and ongoing authentication policies related to these channels.

Executives of each IRS organization are responsible for ensuring an NDARA is completed every three years for each of their respective programs related to these channels. Any risks identified should be documented, mitigated and monitored.

Each IRS organization is responsible for establishing internal processes for managing their risk assessment procedures and monitoring based upon this guidance.

A copy of approved assessments will be emailed to: *PGLD IA Omni-Innovations , for policy team review and coordination on any identified risks.

The Identity Assurance branch manages and reviews the Authentication Risk Assessments in Non-Digital Channels Program.

Management officials must assess the risks associated with authenticating taxpayers, representatives, and other third parties. Refer to Form 15295, Non-Digital Authentication Risk Assessment (NDARA). After submitting an NDARA for review, management officials must reassess their findings based on the status of identified risks and mitigation efforts. The reassessment timeframe depends on whether acceptable mitigations have resolved the identified risks. If all identified risks have been resolved, then the next NDARA must be completed within three years. If identified risks remain when the NDARA is submitted, then management officials must reassess the NDARA every six months until the risk mitigations are accepted and the risks are resolved.

When risk assessments are completed and signed, they become an official record and must be maintained in accordance with Document 12829, General Records Schedule (GRS) 5.7 Item 020. Each office is responsible for reports and audits identifying internal administrative program weaknesses and risks, mitigation action plans, corrective actions, tracking records, correspondence, and other records held by the office responsible for coordinating internal control functions including risks. Destroy records five years after no further corrective action is needed.

The tables lists commonly used terms and definitions:

The table lists commonly used acronyms and definitions:

The Non-Digital Authentication Risk Assessment Form 15295 may be accessed at https://core.publish.no.irs.gov/forms/internal/pdf/f15295--2026-05-00.pdf

Privacy Act of 1974 (as amended)

IRC 6103, Confidentiality and Disclosure of Returns and Return Information

NIST Special Publication 800-37, Risk Management Framework

GAO 15-593SP, A Framework for Managing Fraud Risks in Federal Programs

Form 15295 is structured into sections that correspond to the steps in this IRM (Program Identification, Preparation, Categorize, Select, Implement, Monitoring, Assess, and Authorization). The following sections in this IRM explain what is needed to document the processes within each step/phase. The non-digital risk assessment process may begin at any of the steps described in this IRM. Where the risk assessment process begins will be dependent upon the reason for assessment. However, for any initial review under this policy, of either an existing process or a newly developed customer contact channel, the steps must be followed in order.

The purpose of this step is to prepare for the assessment by identifying information and resources needed to effectively evaluate risks.

The purpose of this step is to consider the components of the customer contact and categorize risks within the process accordingly.

The purpose of this step is to select, tailor, and document the controls in place to mitigate any process risks. When identifying controls for the process, consider:

The purpose of this step is to implement the selected controls and document their effectiveness. For the purposes of this risk assessment, the reviewer will be assessing the effectiveness of the implementation of controls identified in the select step.

Using the most current annualized data available, review annual trends from the previous three years to determine whether unauthorized disclosure rates have increased, decreased, or remained unchanged. Calculate the unauthorized disclosure rate by dividing the number of unauthorized disclosures by the total number of disclosures. For example, one unauthorized disclosure divided by 100 total disclosures equals a rate of 1%. Explain the process used to monitor error rates and regularly review performance.

The purpose of this step is to ensure continuous monitoring of the processes. Continuous monitoring should occur at a frequency matching the risk and sensitivity of information exchanged within the process.

Describe the activities the business unit performs, monitoring risks to ensure timely detection and proactive mitigation. Examples of continuous monitoring include regular risk reviews, key performance indicators (KPIs) to alert early warning signals, data analytics and reporting, periodic audits, quality reviews, etc.

Describe how results from monitoring activities are communicated to key process stakeholders.

Indicate if there are any automated systems or reports used for monitoring risks, identify report(s), system(s) and frequency of use.

The purpose of this step is to identify if the current procedures provide enough guidance and/or mitigate the risk, then identify the procedures and/or mitigation that ensure authentication is secure.

Determine if the policies and procedures governing the process are sufficient to address and mitigate risks or challenges for effective authentication. If it is determined that the policies and processes are effective, then enter ‘Yes’, otherwise enter ‘No’.

If the response to (2) is ‘No’, then describe procedures that will be reviewed and/or modified to address shortfalls, and the expected timeframe to address them. Examples of process modifications include implementing new technology, adjustments to existing procedures, or the development of new policies and processes. Document any deviations from acceptable levels of risk. Risk acceptance criteria should be based on the business unit’s risk tolerance.

After all mitigations are in place to address identified risks, determine whether any residual risk remains and whether the potential outcomes are acceptable to your program. Refer to your business unit’s risk management guidance for the program’s risk acceptance criteria. If the residual risk is acceptable, enter “Yes.” If the residual risk is not acceptable, enter “No.”

Use the following guidelines to determine the next assessment due date:

Obtain the required approvals for accepting the risk and save copies of the approved document following the organization's document retention rules.

Once this assessment is completed and signed, it becomes an official record and must be maintained in accordance with General Records Schedule (GRS) 5.7 Item 020. (Reports and audits identifying internal administrative program weaknesses and risks, mitigation action plans, corrective actions, tracking records, correspondence, and other records are held by the office responsible for coordinating internal control functions including risks. Destroy the assessment after five years if no further corrective action is needed).

Email the completed and signed form to *PGLD IA Omni-Innovations. In your email, include a brief message such as: