internal control systems are not functioning as intended (e.g., goals and objectives are not being met; integrity cases, security violations, or other infractions do or can easily occur; loss of assets or resources happen or are likely to happen). If there are no indications of material internal control system weakness or failures based on prior reviews or integrity cases, most or many controls are automated, and management’s oversight of the internal control program is good, then this factor would be rated as low or no risk. There are quantifiable indications that the internal control systems are functioning as intended. For additional guidance on information systems and controls for assessing audit risk during planning, see the Government Auditing Standards paragraphs 6.23-6.27. All audits must document a risk assessment of the internal controls dependent on information systems processing. Prior Findings This risk factor also considers the significance and date of prior audit findings (e.g., the OA, the GAO, the Treasury Inspector General (IG), etc.) related to IRS processes. This analysis will be limited to the prior three fiscal years. Findings from internal task groups or studies, employee concerns and suggestions, results from local internal audits, should etc., also be considered. Past findings that have a major tax administration impact and recommendations that have not been implemented or have been partially implemented would be rated as extreme or high risk. Past findings that have some tax administration impact and recommendations that have not been implemented or have been partially implemented would be rated as medium risk. Past findings that have little tax administration impact, past recommendations that have been implemented, or if there have been no prior findings, would be rated as low or no risk. Last Audit Coverage The length of time since the audit has been performed in this area (includes audits performed by the OA, the GAO and the Treasury IG, etc.) should be considered. If no audit reports were issued within the last five fiscal years, then this would be rated as extreme or high risk. If no audit reports were issued within the last three to four fiscal years, this would be considered medium risk. Audit reports issued within the last two fiscal years would make this a low or no risk factor.
internal control systems are not functioning as intended (e.g., goals and objectives are not being met; integrity cases, security violations, or other infractions do or can easily occur; loss of assets or resources happen or are likely to happen). If there are no indications of material internal control system weakness or failures based on prior reviews or integrity cases, most or many controls are automated, and management’s oversight of the internal control program is good, then this factor would be rated as low or no risk. There are quantifiable indications that the internal control systems are functioning as intended. For additional guidance on information systems and controls for assessing audit risk during planning, see the Government Auditing Standards paragraphs 6.23-6.27. All audits must document a risk assessment of the internal controls dependent on information systems processing. Prior Findings This risk factor also considers the significance and date of prior audit findings (e.g., the OA, the GAO, the Treasury Inspector General (IG), etc.) related to IRS processes. This analysis will be limited to the prior three fiscal years. Findings from internal task groups or studies, employee concerns and suggestions, results from local internal audits, etc., should also be considered. Past findings that have a major tax administration impact and recommendations that have not been implemented or have been partially implemented would be rated as extreme or high risk. Past findings that have some tax administration impact and recommendations that have not been implemented or have been partially implemented would be rated as medium risk. Past findings that have little tax administration impact, past recommendations that have been implemented, or if there have been no prior findings, would be rated as low or no risk. Last Audit Coverage The length of time since the audit has been performed in this area (includes audits performed by the OA, the GAO and the Treasury IG, etc.) should be considered. If no audit reports were issued within the last five fiscal years, then this would be rated as extreme or high risk. If no audit reports were issued within the last three to four fiscal years, this would be considered medium risk. Audit reports issued within the last two fiscal years would make this a low or no risk factor.