GAO: IRS Not Capturing the True Cost of its Legacy IT Footprint
A GAO report released Tuesday said the IRS has yet to finalize plans to dispose of legacy IT systems as part of its modernization efforts. STEFANI REYNOLDS / GETTY IMAGES
An oversight report requested by Rep. Gerry Connolly found that the tax agency lacks timelines for decommissioning decades-old legacy systems and isn't tracking how much they are paying for upkeep of out-of-date software.
The IRS is lagging in efforts to modernize its technology infrastructure, in part because the tax agency had to reprogram funds to accommodate a staffing crunch during the most recent tax season.
But with $80 billion in funding over 10 years from the Inflation Reduction Act – including $4.8 billion for business systems modernization and $25.3 billion for operations support – the IRS appears poised to make good on promises to update its aging systems, including the 60-year-old Customer Account Data Engine 2.
The tax agency has some work to do to set out timelines for decommissioning legacy systems and addressing customer experience and user needs of cloud-based systems as part of its overall modernization effort, according to a Government Accountability Office report publicly released on Tuesday.
Rep. Gerry Connolly (D-Va.), the ranking member of a House Oversight subcommittee focusing on cybersecurity and information technology, commissioned the report last year.
"The report reaffirms that the IT challenges at the IRS are substantial and it provides further detail on where we can focus our oversight," Connolly said in a statement. "First, the IRS does not even have its arms around its legacy IT problem. Legacy IT costs are still unknown, modernization plans lack timelines for the disposition of legacy systems, nearly a quarter of the agency’s software inventory is legacy software, and the effort to replace the 60-year-old Individual Master File is on hold with no definitive end in sight."
The report tried to quantify the legacy IT woes at the tax agency. According to GAO, the IRS has about 23% of its software inventory qualifies as legacy. Additionally, about 32% of that legacy inventory is four or more updates behind the current commercially available version. The IRS also tags about 8% of its hardware – servers, switches, workstations, mainframes – as legacy tech. However the IRS declined to permit GAO to include a detailed breakdown of its legacy hardware profile in the report because it was "too sensitive to publicly report."
Jeffrey Tribiano, the IRS deputy commissioner for operations support, wrote in reply to the GAO report that the IRS expects to complete a modernization plan this month to hit "the long-term goal of transforming taxpayer service, enforcement and technology with the [Inflation Reduction Act] funding Congress made available through the end of FY 2031."
The IRS also plans to look beyond its current IT cost accounting to use a new tool to provide more detail on the true costs of operating legacy systems. That data is not captured via the Technology Business Management approach to measuring IT costs – an approach that is mandated by the Office of Management and Budget.
The tax agency agreed with all nine recommendations from the report, including setting timelines for decommissioning legacy systems that play a part in all its multiple modernization programs as well as taking steps to standardize service level agreements with cloud providers and to follow governmentwide policy on securing high value assets in the cloud.
Right now, as Tribiano noted in his reply comments, none of high-value assets owned by the IRS is hosted in a cloud environment.