Some IRS new hires in 2020 and 2021 had access to sensitive information including taxpayer data while preemployment fingerprinting and in-person verification of their identification documents had been deferred because of the COVID-19 pandemic. The result, according to a Treasury Inspector General for Tax Administration (TIGTA) report, was a potential risk of exposing taxpayer data.

The IRS has made progress in making sure the security protocols were followed up later and documented, TIGTA said in the report, which was released Monday. No resulting security breach was reported.

Normal procedures for all prospective IRS employees include an FBI background investigation, which includes checking for criminal histories using the individuals’ fingerprints. In addition, the IRS and other agencies generally must physically inspect new employees’ identification documents as part of completing U.S. Citizenship and Immigration Services Form I-9, Employment Eligibility Verification, at a new employee’s orientation or within three days of when they start work.

In March 2020, however, as the pandemic prompted the IRS and most other federal offices to close and shift employees’ duties where possible to remote work, the Office of Personnel Management allowed agencies to delay fingerprinting while temporary guidance was in effect. The IRS applied the exception to new employees it ranked as posing a low or moderate risk to the public trust. And the Service continued to perform criminal background checks using the employees’ names.

At the same time, the Department of Homeland Security allowed agencies to delay the Form I-9 requirement that new workers’ identification and employment authorization documents be physically inspected in person. New employees were still required to show the documents by video link, fax, or email, and the agencies were required to retain copies, but TIGTA noted that the documents could thereby have more easily been falsified.

Once normal operations in an agency resumed, employees were required to present the identification documents in person within three business days. Employees required to be physically present at a work location were not covered by the exception. Those guidelines are still in effect until Oct. 31, 2022.

Of the approximately 12,000 hires TIGTA reviewed, about half were subject to the deferred identification procedures, and, in many cases, the delay exceeded one year, TIGTA reported. TIGTA’s initial review in August 2021 indicated nearly 2,900 employees’ documents were not yet inspected. By May 2022, that number had been reduced to about 400, according to an IRS official’s memo in response to the TIGTA report.

Some employees began and ended employment without ever having to show their original documents, TIGTA found. Of a sample of 38 hires, TIGTA counted 11 such employees, or 29% of the sample, who worked between eight and 371 calendar days before separating from the IRS.

“Therefore, the IRS hired individuals to fill positions, such as collection representative, contact representative, and tax examining technician, the majority of which would have had access to taxpayer data, yet the IRS never verified whether those individuals were eligible for Federal employment in the United States,” TIGTA stated.

Moreover, the IRS did not always accurately or completely track follow-up inspections of the identification documents, TIGTA said. The Service has made progress entering previously missing dates for inspections, although they are still missing for about 1,900 individuals, TIGTA said.

Likewise, the IRS is catching up on fingerprinting, TIGTA reported. The deferral affected about one-quarter of the 12,000 hires, or 3,000 individuals. As of January 2022, when normal fingerprinting procedures resumed, only about 113 individuals remained from the deferral period who had not been fingerprinted.

“Most of those individuals fill positions the IRS categorized as low risk,” in the Wage and Investment Division, TIGTA said. However, 65 individuals left the IRS before being fingerprinted, and for 29, fingerprinting had been deferred for over a year.

TIGTA recommended that the IRS periodically review its records of deferred document presentations and issue follow-up reminders to hiring officials, plus ensure the records are properly updated, all of which the IRS agreed to do. The Service also indicated that physical inspection of the documents again became the norm after employees fully returned to offices on June 25, 2022.

— To comment on this article or to suggest an idea for another article, contact Paul Bonner at [email protected]