A shuttered IRS office focused on retiring and replacing legacy technology should be reopened, an audit has concluded, so that the US tax collection agency can get a firm grip on replacing its aging tech stack.

The report, from the Treasury Inspector General for Tax Administration (TIGTA), credits the IRS with fully implementing two out of four previous tech modernization recommendations, though argues the other two recommendations were ineffectively implemented.

Those failures include the agency's decision in 2023 to scrap its own Technology Retirement Office, which stood up in 2021 "to strategically reduce the [IRS' IT] footprint." 

Without that office, "there is no enterprise-wide program to identify, prioritize, and execute the updating, replacing, or retiring of legacy systems" at the IRS, the inspector general declared, adding the unit should be reestablished or brought back in some similar form.

There is no enterprise-wide program to identify, prioritize, and execute the updating, replacing, or retiring of legacy systems

The closure of the retirement office, in the eyes of the TIGTA, is part of the IRS's failure to properly identify and plan for shutting down legacy systems and possibly replacing them with something modern.

According to the audit report, the IRS identified 107 of its 334 legacy systems as up for retirement, yet only two of those 107 have specific decommissioning plans. The TIGTA would like to see clear plans for all of those identified systems, and had hoped the retirement office (or similar) would provide them.

Then there's the second incomplete recommendation, which the IG said is the IRS' failure to properly apply its own definition of a legacy system to all of its tech. 

According to the report - which gets the heart of the matter with the title: "The IRS does not have specific plans to replace and decommission legacy systems" - the IRS defines legacy systems as those using outdated technology that's still critical to its day-to-day operations.

That definition can include hardware, software, or programming languages, further stating that systems with "an application age of 25 years or older" and those using obsolete languages apply.

The TIGTA said that definition has been poorly applied, leading to the IRS incorrectly identifying five systems as legacy that weren't, a failure the tax collectors blamed on "a query programming error which has since been corrected." How apt.

In addition, the IG's own analysis using the IRS' definition of legacy systems uncovered 344 of them - ten more than the IRS said it was aware of. 

"A subsequent review … found two additional systems that had not been identified as legacy but should have been, bringing the total number of legacy systems to 346," the IG report added. 

All of that poor legacy tech management has caused the IRS' IT infrastructure spending to jump by 35 percent from $2 billion in 2019 to $2.7 billion in 2023, which the IG report expects to continue increasing until more legacy systems are retired.

To its credit, the IRS did properly implement previous recommendations to construct an as-built architecture (ABA) system to track existing IT assets, and ensured that specific system data in the ABA was complete. 

Progress in the right direction

In its response to the IG report, the IRS said it had largely addressed the two incomplete recommendations, though not entirely as the Inspector General might want. 

Of the first request, that the IRS reestablish the Technology Retirement Office, the tax service said it didn't have any intention to do so. It does, however, plan to roll those responsibilities into its Transformation and Strategy Office - but it doesn't intend to implement those changes until September 2025, when it publishes its next Inflation Reduction Act transformation road-map.

"The roadmap will reflect a shift in the legacy modernization strategy," the IRS said in its response letter (included in the report). "The IRS no longer intends to rewrite and retire all systems that are identified as legacy in the ABA."

Instead, the IRS said, legacy systems will be replaced as and when its transformation steering committees identify suitable "enterprise common platforms" to implement in their place.

So, there is a general will within the IRS to replace aging stacks with modern offerings, and there is a foundation plan in place driving that, it's just not terribly specific right now as those details need to be developed as teams figure out a way ahead, judging from the audit write-up and response.

One might say the IRS is taking this on a case-by-case basis, as there is a concern that whatever replaces the legacy IT is truly up to the job, which is reasonable.

We believe management's response meets the intent of our recommendation

"Although the IRS only partially agreed with our recommendation, we believe management's response meets the intent of our recommendation," the IG said in reply. 

As for the issue with identifying legacy systems, the IRS agreed with the recommendation and promised to get better. 

The IRS' Taxpayer Advocate's office told Congress in its FY 2025 report, published in June, that the IRS was still struggling to modernize its tech, but was making progress. 

"Did the IRS do a perfect job? No," National Taxpayer Advocate Erin Collins wrote in the preface to the report. "But I believe the IRS has turned the corner… particularly for Taxpayer Services and information technology (IT) modernization." 

We've reached out to the IRS and the TIGTA for further comment. ®

https://www.theregister.com//2024/08/14/irs_legacy_tech/