TIGTA Report 2022-16-039 — Fingerprinting and Employment Eligibility Verification Delays Due to COVID-19 May Increase Taxpayer Data Exposure Risks

Record facts

Summary

A final audit report of the Treasury Inspector General for Tax Administration, Report Number 2022-16-039, issued July 7, 2022 to the Commissioner of Internal Revenue. It examines whether temporary hiring practices during the COVID-19 pandemic presented security risks, covering approximately 12,000 individuals hired from March 23, 2020 through July 17, 2021. It finds that as of January 2022 approximately 1,900 were listed as not yet having employment eligibility documents physically inspected, down from almost 2,900 as of August 2021, and that 113 individuals had not been fingerprinted. From 38 judgmentally selected Form I-9 records it identifies 11 individuals who worked between eight and 371 calendar days and then separated without physical inspection. It makes one recommendation to the Chief Human Capital Officer, which the IRS agreed to.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

1 
 
 
 
 
 
 
Fingerprinting and Employment Eligibility 
Verification Delays Due to the COVID-19 Pandemic  
May Increase Taxpayer Data Exposure Risks 
 
 
July 7, 2022 
 
Report Number:  2022-16-039 
 
 
 
 
 
 
 
 
. 
TIGTACommunications@tigta.treas.gov   |   www.treasury.gov/tigta 
 
TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION 

HIGHLIGHTS:  Fingerprinting and Employment Eligibility Verification Delays  
Due to the COVID-19 Pandemic May Increase Taxpayer Data Exposure Risks 
Final Audit Report issued on July 7, 2022 
Report Number 2022-16-039 
 
 
Why TIGTA Did This Audit 
This audit was initiated because 
new IRS employees hired during 
the Coronavirus Disease 2019 
(COVID-19) pandemic may have 
had their fingerprinting or 
employment eligibility verification 
delayed in accordance with newly 
established hiring policies.  
However, prolonged delays could 
increase the exposure of taxpayer 
data to potential bad actors. 
The overall objective of this review 
was to determine whether 
temporary personnel hiring 
practices during the COVID-19 
pandemic presented potential 
security risks by assessing the 
effectiveness of fingerprinting and 
hiring activities, including 
inspection of employment 
eligibility documents. 
Impact on Tax Administration 
From March 23, 2020, through 
July 17, 2021, the IRS hired 
approximately 12,000 individuals 
under the temporary COVID-19 
pandemic hiring policies.  New 
employees who are given access to 
sensitive information and have not 
been fingerprinted or have not had 
their employment eligibility 
documents physically inspected 
could result in the exposure of 
sensitive information.  
 
 
 
 
 
 
 
 
 
What TIGTA Found 
Although the IRS has made progress in reducing the number of new 
employees hired during the COVID-19 pandemic without identity 
documents inspected or getting fingerprinted, the delays put the IRS 
at risk of potential exposure of taxpayer data. 
Temporary Federal guidance allowed the IRS to defer physical 
inspection of employment eligibility documents for new employees.  
IRS records as of January 2022 showed that approximately 
1,900 individuals hired from March 23, 2020, through July 17, 2021, 
are listed as not yet having employment eligibility documents 
physically inspected.  Of the 1,900 individuals, over 1,200 started 
working in Calendar Year 2020. 
In addition, the IRS’s Form I-9 SharePoint site as of August 2021 did 
not accurately reflect whether hiring officials completed the physical 
inspection of new employees’ Form I-9, Employment Eligibility 
Verification, identity documents.  TIGTA judgmentally selected and 
reviewed 38 records from the Form I-9 SharePoint site for which 
there was no indication that the hiring officials had physically 
inspected the new employees’ verifying documents.  Our review 
found that five of the forms had hiring official notations indicating 
that a physical inspection of the documents had taken place, even 
though the IRS’s Form I-9 SharePoint site was not updated timely to 
reflect that physical inspection occurred. 
Temporary Federal guidance also allowed deferred fingerprints for 
some employees.  Approximately one quarter of the individuals who 
were hired from March 23, 2020, through July 17, 2021, filled 
positions that qualified for the fingerprint deferral.  As of 
January 2022, IRS records show 113 individuals still have not been 
fingerprinted, 29 of whom started working in Calendar Year 2020. 
TIGTA also identified 11 individuals who were hired, worked for the 
IRS between eight and 371 calendar days, and then separated from 
the IRS without ever having their identity documents physically 
inspected.  Therefore, the IRS hired individuals to fill positions the 
majority of which would have had access to taxpayer data yet never 
verified whether those individuals were eligible for Federal 
employment in the United States. 
What TIGTA Recommended 
TIGTA recommended that the Chief Human Capital Officer conduct 
periodic reviews of the Form I-9 SharePoint site and provide periodic 
reminders to hiring officials responsible for completion of the Forms 
I-9 to determine whether or not those individuals are still pending 
physical inspection and update the records based upon the results of 
that review to ensure that the Form I-9 SharePoint site is a complete 
and accurate representation of the status of the deferred physical 
inspections.  The IRS agreed with TIGTA’s recommendation and plans 
to take corrective action. 
 

U.S. DEPARTMENT OF THE TREASURY 
WASHINGTON, D.C.  20024 
TREASURY INSPECTOR GENERAL 
FOR TAX ADMINISTRATION 
 
 
 
July 7, 2022 
 
 
MEMORANDUM FOR: COMMISSIONER OF INTERNAL REVENUE 
    
 
FROM: 
Heather M. Hill 
 
Deputy Inspector General for Audit 
 
SUBJECT: 
Final Audit Report – Fingerprinting and Employment Eligibility 
Verification Delays Due to the COVID-19 Pandemic May Increase 
Taxpayer Data Exposure Risks (Audit # 202210615) 
 
This report presents the results of our review of whether temporary personnel hiring practices 
during the Coronavirus Disease 2019 pandemic presented potential security risks by assessing 
the effectiveness of fingerprinting and hiring activities, including inspection of employment 
eligibility documents.  This review is part of our Fiscal Year 2022 Annual Audit Plan and 
addresses the major management and performance challenge of Human Capital.  
Management’s complete response to the draft report is included as Appendix III. 
Copies of this report are also being sent to the Internal Revenue Service managers affected by 
the report recommendation.  If you have any questions, please contact me or Bryce Kisler, 
Acting Assistant Inspector General for Audit (Management Services and Exempt Organizations).  
 
 
 

 
 
Fingerprinting and Employment Eligibility Verification Delays Due to  
the COVID-19 Pandemic May Increase Taxpayer Data Exposure Risks 
Table of Contents 
Background .....................................................................................................................................Page 1 
Results of Review .......................................................................................................................Page 3 
Progress Is Being Made Inspecting Identity Documents ......................................Page 3 
Recommendation 1: ...................................................................Page 5 
Fingerprinting Activities That Were Delayed Are Now 
Progressing .............................................................................................................................Page 6 
Appendices 
Appendix I – Detailed Objective, Scope, and Methodology ................................Page 8 
Appendix II – Outcome Measures .................................................................................Page 10 
Appendix III – Management’s Response to the Draft Report .............................Page 11 
Appendix IV – Abbreviations ...........................................................................................Page 13 
 
 
 
 

 
Page  1 
Fingerprinting and Employment Eligibility Verification Delays Due to  
the COVID-19 Pandemic May Increase Taxpayer Data Exposure Risks 
Background 
All prospective Internal Revenue Service (IRS) employees (new hires, contractors, students, 
unpaid volunteers, etc.) must undergo background investigations, including criminal history 
checks conducted by the Federal Bureau of Investigation (FBI), using fingerprint information.  
However, on March 25, 2020, the Office of Personnel Management issued temporary guidance 
to allow agencies that are unable to collect and process fingerprints due to measures associated 
with Coronavirus Disease 2019 (COVID-19)1 (e.g., closure of offices that take fingerprints) and 
wish to proceed with onboarding to delay fingerprinting until fingerprint processing is feasible, 
but no later than the date of termination of the temporary guidance.  The Office of Personnel 
Management did not establish a fixed expiration date in this guidance but instead clarified that 
the guidance is effective until agencies are otherwise notified in writing.  Agencies were 
permitted to delay reporting the final adjudication of the background investigation until a 
fingerprint check was completed and considered. 
Further, on March 30, 2020, the Defense Counterintelligence and Security Agency (DCSA) 
published guidance that outlined the process by which DCSA customer agencies can temporarily 
submit investigative requests to the DCSA without an associated fingerprint submission to 
support mission-critical onboarding.2  When the DCSA receives a case for which the collection of 
fingerprints to support a background investigation request is not possible due to the impact of 
COVID-19, it conducts a name-based check of FBI criminal history records.  The name-based 
check does not include files at the FBI that can only be searched using biometrics.3 
Figure 1 provides a description of the five investigative tiers, which were established by the 
Office of Personnel Management, as described in official IRS policy.  There are five tiers of 
positions that agency heads can designate as low to high risk based on the position’s potential 
for adverse impact to the efficiency or integrity of the organization.  The IRS applied the 
fingerprinting exception guidance only for Low Risk (Tier 1) and some Moderate Risk (Tier 2) 
positions. 
                                                 
1 On January 21, 2020, the Centers for Disease Control and Prevention reported the first case of COVID-19 in the 
United States, and on March 11, 2020, the World Health Organization officially declared COVID-19 a pandemic. 
2 The DCSA is the security agency within the Federal Government responsible for personnel vetting (i.e., background 
investigations) and critical technology protection.  It performs approximately 95 percent of the background 
investigations for Federal new hires. 
3 Biometrics include measurable physical characteristics or personal behavioral traits used to recognize the identity, or 
verify the claimed identity, of an applicant.  Facial images, fingerprints, and iris scan samples are all examples of 
biometrics. 

 
Page  2 
Fingerprinting and Employment Eligibility Verification Delays Due to  
the COVID-19 Pandemic May Increase Taxpayer Data Exposure Risks 
Figure 1:  Investigative Tiers Descriptions 
Tier Level 
Description 
Tier 1 
Positions designated as low risk. 
Tier 2 
Nonsensitive positions designated as moderate-risk public trust positions. 
Tier 3 
National security positions designated as noncritical sensitive and/or 
requiring access to Confidential or Secret information. 
Tier 4 
High-risk public trust positions. 
Tier 5 
National security positions – top secret, sensitive compartmented 
information, critical sensitive, and special sensitive. 
Source:  Internal Revenue Manual 10.23.3.6, Investigative Tiers (May 9, 2019). 
Another part of the hiring process requires the IRS to physically inspect identification 
documents.  The IRS uses the Form I-9, Employment Eligibility Verification, to document that 
new employees may work in the United States.4  Section 2 of Form I-9 outlines acceptable 
documents to be reviewed to verify a new employee’s identity and employment authorization 
(hereafter referred to as Section 2 documents).5 
Original identity documents must be verified at orientation or within three business days of the 
enter-on-duty date unless a waiver is granted by the Department of Homeland Security (DHS) or 
the Office of Personnel Management.  On March 20, 2020, the DHS announced that it would 
defer the physical presence requirements associated with the Form I-9.6  The DHS has extended 
the temporary deferral several times, with the latest deferral extending to October 31, 2022.  
Employers with employees taking physical proximity precautions due to COVID-19 were 
required to review the newly hired employee’s identity and employment authorization 
documents remotely but were not required to review them in the employee’s physical presence.  
Once normal operations resume, all employees who were onboarded using remote verification 
must report to their employer within three business days for in-person verification of identity 
and employment eligibility documentation for the Form I-9.  This provision only applies to 
employers and workplaces that are operating remotely.  There are no exceptions for employees 
physically present at a work location. 
                                                 
4 Since November 6, 1986, Form I-9 is used to verify the identity and employment authorization of individuals hired in 
the United States.  All U.S. employers must properly complete the Form I-9 for each individual they hire. 
5 Section 2 documents may include one document that establishes both identity and employment authorization.  
These may include a U.S. Passport or U.S. Passport Card, Permanent Resident Card or Alien Registration Receipt Card, 
etc.  Section 2 documents may also include a combination of one document that establishes identify and 
one document that establishes employment authorization.  These may include a Driver’s license or State identification 
card, Social Security card, voter’s registration card, U.S. citizen identification card, etc. 
6 Under authority granted in provisions of Section 274A of the Immigration and Nationality Act:  8 U.S.C. § 1324a 
(2004). 

 
Page  3 
Fingerprinting and Employment Eligibility Verification Delays Due to  
the COVID-19 Pandemic May Increase Taxpayer Data Exposure Risks 
Results of Review 
From March 23, 2020, through July 17, 2021, the IRS hired 
approximately 12,000 individuals under the temporary 
COVID-19 pandemic hiring policies.  Although we found 
many instances in which new IRS employees have not had 
their Form I-9 employment eligibility documents physically 
inspected timely, and several employees hired in Calendar 
Year 2020 have no date of physical inspection on the report 
the IRS Human Capital Office (HCO) is using to track those 
delays, the IRS has made progress inspecting identity documents. 
Progress Is Being Made Inspecting Identity Documents 
The IRS has made progress in reducing the number of new IRS employees hired during the 
COVID-19 pandemic who had their Form I-9 physical inspection of employment eligibility 
documents delayed.  However, we identified inaccuracies with the data the IRS used to track 
whether individuals have had their identity documents physically inspected.  In addition, we 
identified individuals who were hired, worked for the IRS for a time, and then separated from the 
IRS without ever having their identity documents physically inspected. 
Physical inspection of identity documents were delayed 
Of the new IRS employees hired during the COVID-19 pandemic, we found that approximately 
half have had their Form I-9 physical inspection of identity documents delayed, and in many 
cases, that delay extended past one year.  The IRS maintains a listing of individuals hired during 
the pandemic whose Form I-9 Section 2 verifying documents were not physically inspected.  For 
the IRS employees hired from March 23, 2020, through July 17, 2021, we reviewed IRS records 
maintained on the IRS HCO Form I-9 SharePoint site that tracks the date of the physical 
inspection for all new employees hired under the temporary deferral.  Our initial review of this 
listing as of August 2021 identified almost 2,900 individuals who were listed as not yet having 
their verifying documents physically inspected.  Of the 2,900 individuals, over 1,700 started 
working in Calendar Year 2020. 
However, we have since reviewed updated records and found that the IRS is making progress 
in inspecting identity documents.  As of January 2022, the IRS has reduced the number of 
individuals listed as still not having their verifying documents inspected from almost 2,900 to 
approximately 1,900.  Of the 1,900 individuals, over 1,200 started working in Calendar Year 2020.   
Further, our analysis of the 1,900 individuals indicate that there is a significant variance, by 
location, of physical inspection of identity documents.  For example, the Submission Processing 
function has over 92 percent of its new hire physical inspections completed, but the Campus 
Collection function still has approximately 47 percent of its new hires pending physical 
inspection.  Some IRS operations are not fully remote, and the IRS may hire seasonal/temporary 
appointments to fill the increased need during the filing season (e.g., processing of physical tax 
returns at campuses).  For these new hires, the IRS has a limited amount of time to complete 
physical inspection.  Our review of 38 judgmentally sampled IRS records from the Form I-9 
Several employees hired in 
Calendar Year 2020 have no 
date of physical inspection 
on the report the IRS HCO is 
using to track those delays. 

 
Page  4 
Fingerprinting and Employment Eligibility Verification Delays Due to  
the COVID-19 Pandemic May Increase Taxpayer Data Exposure Risks 
SharePoint site as of August 2021 identified 11 individuals (29 percent) who were hired, worked 
for the IRS between eight and 371 calendar days, and then separated from the IRS without ever 
having their identity and employment eligibility documents physically inspected.7  Therefore, the 
IRS hired individuals to fill positions, such as collection representative, contact representative, 
and tax examining technician, the majority of which would have had access to taxpayer data yet 
the IRS never verified whether those individuals were eligible for Federal employment in the 
United States. 
The DHS authorized the hiring flexibility for employers with employees taking physical proximity 
precautions due to COVID-19, but employers must inspect the Section 2 documents remotely 
(e.g., over video link, fax, e-mail) and obtain, inspect, and retain copies of the documents.  The 
current expiration date of this flexibility is October 31, 2022.  The IRS issued guidance that its 
new hires not on 100 percent telework must report for physical verification of documents within 
three business days of their enter-on-duty date.  Employees who are 100 percent teleworking 
must report no later than three days after the expiration date for physical inspection.  The 
Form I-9 SharePoint site does not track whether or not employees are 100 percent teleworking, 
but as of January 2022, IRS records showed almost 6,500 individuals had physical inspection 
dates within three days of their enter-on-duty date. 
The COVID-19 pandemic has had a significant impact on in-person operations.  Offices were 
closed so that new employees could not report in person for their first day of work as they 
would normally.  These limitations have lessened, but there is still an ongoing impact to  
in-person activities.  Physical inspection of employment eligibility documents during the  
Form I-9 verification process is an important step in determining the identity of an individual 
and whether they are eligible for Federal employment in the United States.  Many employment 
eligibility documents have security features (e.g., color-changing ink, raised seals) that cannot be 
validated properly using just a scanned copy.  Further, advanced editing software could create a 
convincing facsimile that looks like a scan of a real document.  Without in-person verification, 
the IRS could hire individuals who provide false identity information or are not eligible for 
Federal employment in the United States.  
Tracking of identity documents’ physical inspection was unreliable 
We found that the Form I-9 SharePoint site as of August 2021 did not accurately reflect whether 
IRS hiring officials completed the physical inspection of new employees’ Form I-9 identity 
documents.  The Form I-9 SharePoint site was created to track which new employees’ identity 
documents still need to be physically reviewed.  Our analysis revealed 722 duplicate entries in 
which an individual’s name appeared more than once.  We transmitted the list of duplicates we 
identified to the IRS and obtained agreement that the entries are duplicates and should be 
removed.  There were also 253 entries for IRS Chief Counsel employees.  IRS HCO 
representatives informed us that they do not hire for Chief Counsel, and those employees 
should not have been listed in the Form I-9 SharePoint site.  The January 2022 analysis showed 
that these 975 erroneous entries had been removed from the Form I-9 SharePoint site. 
                                                 
7 We initially selected 50 cases to review from a listing of approximately 3,800 records.  During our analysis, we 
identified Chief Counsel employees (IRS HCO does not hire for Chief Counsel) and duplicate entries.  As a result, we 
reviewed 38 unique employee entries from a population of approximately 2,900.  A judgmental sample is a 
nonprobability sample, the results of which cannot be used to project to the population. 

 
Page  5 
Fingerprinting and Employment Eligibility Verification Delays Due to  
the COVID-19 Pandemic May Increase Taxpayer Data Exposure Risks 
Further, we judgmentally selected and reviewed 38 Form I-9 SharePoint site records from the 
almost 2,900 individuals for which there was no indication that the hiring officials had physically 
inspected the new employees’ verifying documents.  Each Form I-9 contains a section in which 
the IRS hiring official who performed a physical inspection of the Section 2 documents was to 
note that the inspection took place and the date of the inspection.  We found that five of the 
forms we reviewed had hiring official notations indicating that physical inspection of the 
Section 2 documents had taken place, even though the IRS’s Form I-9 SharePoint site was not 
updated timely to reflect that physical inspection occurred.  As such, the Form I-9 SharePoint 
site listing of individuals hired during the pandemic, which the IRS uses to track those 
employees still needing physical verification of their Form I-9 Section 2 documents, was not 
complete and accurate. 
The DHS waiver allowed for agencies to remotely inspect the Section 2 documents until normal 
operations resume and documents can be physically reviewed.  The IRS HCO established a 
SharePoint site to contain the list of new hires that started working on March 23, 2020, or later.  
Once physical review is completed, the manager or other individual who completed the review 
of the new employee’s identity documents must document completion in the Form I-9 
SharePoint site. 
This new process created confusion among reviewing officials who must log in and manually 
enter the dates on the Form I-9 SharePoint site as opposed to an automated process that would 
import the physical inspection dates from an official IRS hiring records database.  The duplicate 
records and the erroneous inclusion of the IRS Chief Counsel employees occurred due to errors 
when importing data from other systems as well as from the manual addition of records.  
Further, some IRS operations are not fully remote (e.g., processing of physical tax returns at 
campuses), so new hires in those activities do not qualify for the deferral and should have had 
their identity documents physically inspected on the first day they reported for work.  These 
hiring managers may have not realized that all new hires are included in the Form I-9 SharePoint 
site and that they would still need to enter the physical inspection date.  IRS management also 
stated that geographical separation (i.e., a manager and the new hire are stationed at different 
IRS locations) is contributing to the difficulty in coordinating a time for some to complete the 
physical inspection of identity documents. 
Although dates are still missing for approximately 1,900 individuals, a January 2022 extract 
from the Form I-9 SharePoint site showed progress had been made in completing physical 
inspections and entering dates previously missing from the tracking site.  Incomplete 
and inaccurate tracking increases the likelihood the IRS may not be compliant with the 
DHS October 31, 2022, due date.  IRS HCO management has sent out periodic notifications to 
remind hiring officials of their responsibilities to update the information in the Form I-9 
SharePoint site.  These notifications included links to relevant guidance as well as highlighted 
the deadline for employees who are 100 percent teleworking. 
Recommendation 1:  The Chief Human Capital Officer should conduct periodic reviews of the 
Form I-9 SharePoint site and provide periodic reminders to hiring officials responsible for 
completion of Forms I-9 to determine whether or not those individuals are still pending physical 
inspection and update the records based upon the results of that review to ensure that the 
Form I-9 SharePoint site is a complete and accurate representation of the status of the deferred 
physical inspections. 

 
Page  6 
Fingerprinting and Employment Eligibility Verification Delays Due to  
the COVID-19 Pandemic May Increase Taxpayer Data Exposure Risks 
 
Management’s Response:  The IRS agreed with our recommendation and indicated it 
will provide periodic reminders to business unit facilitators and coordinate with business 
units to verify they update the records on the Form I-9 SharePoint site to ensure that it is 
a complete and accurate representation of the status of the deferred physical 
inspections.  Management’s response also indicated they will discontinue use of the 
virtual inspection of employment eligibility documents and SharePoint tracking for 
employees hired after they fully return to the office on June 25, 2022. 
Fingerprinting Activities That Were Delayed Are Now Progressing 
The IRS reduced the number of new employees who were not fingerprinted timely.  
Approximately one quarter of new IRS employees hired from March 23, 2020, through 
July 17, 2021, filled positions that qualified for the fingerprinting deferral.  IRS records showed 
that approximately 3,200 employees hired during that period qualified for the delayed 
fingerprinting.  Our reviews of IRS Automated Background Investigation System8 records in 
September 2021 and January 2022 showed an increase in fingerprinting efforts, and as of the 
middle of January 2022, approximately 113 individuals remain from that period who have not 
been fingerprinted, 29 of whom started working in Calendar Year 2020.  The majority of the 
individuals pending fingerprinting, 102 (90 percent) of the 113, work in the Wage and 
Investment Division, and most of those individuals fill positions the IRS categorized as low risk.  
In addition, the IRS informed us that 65 individuals separated from the IRS prior to completing 
fingerprinting. 
The Office of Personnel Management issued a memorandum authorizing the temporary deferral 
of the fingerprinting requirement for new hires, and the Department of the Treasury established 
that option for mission-critical positions.  IRS officials determined that the only positions that 
qualify for this deferral are those with risk designations in the two lowest tiers (i.e., Tier 1 and 
Tier 2 of the five tiers).  Any higher risk positions (Moderate Risk – Tier 3 and above) still 
required fingerprinting.  These deferrals allowed the IRS to hire individuals for mission-critical 
positions while delaying fingerprinting until that processing is feasible. 
The COVID-19 pandemic has had a significant impact on in-person operations, which 
included closing offices that process fingerprinting activities.  Beyond our review period of 
March 23, 2020, through July 17, 2021, the IRS has continued to hire employees that qualify 
for the fingerprinting deferral.  The latest IRS HCO policy issued states that the normal 
fingerprinting processes resumed as of January 2022.  The IRS HCO stated that they run a  
biweekly report for all fingerprint deferrals and focus on employees who are in moderate-risk 
positions first and then low-risk following. 
An FBI criminal records check helps to identify an individual with a history that would otherwise 
disqualify that individual from Federal service.  The delayed fingerprinting, although Federally 
authorized, limited the background investigation process because FBI criminal records searches 
were limited to only records that could be found without fingerprints.  Within the IRS, the FBI 
                                                 
8 The Automated Background Investigations System is used to process and store requests for national security 
clearances and personnel security investigations conducted for suitability and security determination purposes on 
IRS employees, contractors, and other Department of the Treasury employees and employees of other agencies 
conducted under reimbursable agreements. 

 
Page  7 
Fingerprinting and Employment Eligibility Verification Delays Due to  
the COVID-19 Pandemic May Increase Taxpayer Data Exposure Risks 
criminal record check is used to reduce the risk of granting individuals with criminal records 
access to taxpayer data.  Further fingerprinting delays may increase the exposure of taxpayer 
data to potential bad actors. 

 
Page  8 
Fingerprinting and Employment Eligibility Verification Delays Due to  
the COVID-19 Pandemic May Increase Taxpayer Data Exposure Risks 
Appendix I 
Detailed Objective, Scope, and Methodology 
The overall objective of this review was to determine whether temporary personnel hiring 
practices during the COVID-19 pandemic presented potential security risks by assessing the 
effectiveness of fingerprinting and hiring activities, including inspection of employment 
eligibility documents.  To accomplish our objective, we: 
• 
Identified, through research of authoritative Federal Government data sources, newly 
established policies and guidance implemented to facilitate hiring during the COVID-19 
pandemic. 
• 
Obtained extracts of external new hires from March 23, 2020, through July 17, 2021, for 
whom either fingerprinting was deferred or Form I-9 physical inspection of identity 
documents was deferred. 
• 
Reviewed a judgmental sample1 of 38 Form I-9 records from the almost 2,900 individuals 
for which there was no indication that the hiring officials had physically inspected the 
new employees’ verifying documents.  We initially selected 50 cases to review from a 
listing of approximately 3,800 records.  During our analysis, we identified Chief Counsel 
employees (IRS HCO does not hire for Chief Counsel) and duplicate entries.  As a result, 
we reviewed the remaining 38 unique employee entries from a population of 
approximately 2,900.  We determined that the judgmental sample was sufficient to show 
a control weakness and prompt management to take corrective action as well as satisfy 
our objective of identifying problems with the potential accuracy and completeness of 
the Form I-9 SharePoint site used for tracking physical inspections. 
• 
Determined whether hiring records complied with the requirements of the newly 
established policies and guidance implemented to facilitate hiring during the COVID-19 
pandemic. 
Performance of This Review 
This review was performed with information obtained from the Office of the Chief Human 
Capital Officer located in Washington, D.C., during the period August 2021 through 
February 2022.  We conducted this performance audit in accordance with generally accepted 
government auditing standards.  Those standards require that we plan and perform the audit to 
obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objective.  We believe that the evidence obtained provides a 
reasonable basis for our findings and conclusions based on our audit objective. 
Major contributors to the report were Bryce Kisler, Acting Assistant Inspector General for Audit 
(Management Services and Exempt Organizations); LaToya P. George, Director; Seth Siegel, 
Audit Manager; Nathaniel Russell, Lead Auditor; and Jody-Ann Sommerville, Auditor. 
                                                 
1 A judgmental sample is a nonprobability sample, the results of which cannot be used to project to the population. 

 
Page  9 
Fingerprinting and Employment Eligibility Verification Delays Due to  
the COVID-19 Pandemic May Increase Taxpayer Data Exposure Risks 
Validity and Reliability of Data From Computer-Based Systems  
We performed tests to assess the reliability of data from the IRS HCO Form I-9 SharePoint site 
and the Automated Background Investigation System.  We evaluated the data by (1) performing 
electronic testing of required data elements and (2) interviewing agency officials knowledgeable 
about the data.  We determined that the data were sufficiently reliable for purposes of this 
report. 
Internal Controls Methodology 
Internal controls relate to management’s plans, methods, and procedures used to meet their 
mission, goals, and objectives.  Internal controls include the processes and procedures for 
planning, organizing, directing, and controlling program operations.  They include the 
systems for measuring, reporting, and monitoring program performance.  We determined 
that the following internal controls were relevant to our audit objective:  authoritative 
Federal Government data sources and newly established policies and guidance implemented to 
facilitate Federal hiring during the COVID-19 pandemic.  To assess these controls, we selected 
and reviewed extracts of information for external new hires from March 23, 2020, through 
July 17, 2021, and met with IRS management to discuss our results. 

 
Page  10 
Fingerprinting and Employment Eligibility Verification Delays Due to  
the COVID-19 Pandemic May Increase Taxpayer Data Exposure Risks 
Appendix II 
Outcome Measures 
This appendix presents detailed information on the measurable impact that our recommended 
corrective action will have on tax administration.  These benefits will be incorporated into our 
Semiannual Report to Congress. 
Type and Value of Outcome Measure: 
• 
Reliability of Information – Actual; 975 inaccurate records removed from the Form I-9 
SharePoint site (See Recommendation 1). 
Methodology Used to Measure the Reported Benefit: 
We analyzed all the records from the Form I-9 SharePoint site for individuals hired from 
March 23, 2020, through July 17, 2021, as of August 2021 and January 2022.  Our analysis 
identified 722 entries in which an individual’s name appeared more than once.  We transmitted 
the list of duplicates we identified to the IRS and obtained agreement that the entries are 
duplicates and should be removed.  Additionally, we identified 253 IRS Chief Counsel 
employees.  IRS HCO representatives informed us that they do not hire for Chief Counsel and 
these employees should not have been listed in the Form I-9 SharePoint site.  Our analysis of the 
January 2022 extract shows these records have been removed.  The reported benefit is based 
upon the actual duplicate entries and actual entries for IRS Chief Counsel employees that the IRS 
agreed should be removed from the Form I-9 SharePoint site. 
Type and Value of Outcome Measure: 
• 
Reliability of Information – Actual; five Forms I-9 with physical inspection dates that were 
not previously entered on the Form I-9 SharePoint site (See Recommendation 1). 
Methodology Used to Measure the Reported Benefit: 
We judgmentally selected for further review 38 Form I-9 SharePoint site records from the almost 
2,900 individuals who, as of August 2021, were listed as not yet having their verifying documents 
physically inspected.1  Our review found that five of the forms had hiring official notations 
indicating that a physical inspection of the Section 2 documents had taken place, even though 
the IRS’s Form I-9 SharePoint site was not updated timely to reflect that physical inspection 
occurred.  A January 2022 extract from the Form I-9 SharePoint site showed that the physical 
inspection dates from the five Forms I-9 had been entered.  The reported benefit is based upon 
the actual forms for which the Form I-9 we reviewed had the hiring official’s notations that a 
physical inspection had occurred but that date was missing from the Form I-9 SharePoint site. 
                                                 
1 A judgmental sample is a nonprobability sample, the results of which cannot be used to project to the population. 

 
Page  11 
Fingerprinting and Employment Eligibility Verification Delays Due to  
the COVID-19 Pandemic May Increase Taxpayer Data Exposure Risks 
Appendix III 
Management’s Response to the Draft Report 
 
 
 

 
Page  12 
Fingerprinting and Employment Eligibility Verification Delays Due to  
the COVID-19 Pandemic May Increase Taxpayer Data Exposure Risks 
 
 

 
Page  13 
Fingerprinting and Employment Eligibility Verification Delays Due to  
the COVID-19 Pandemic May Increase Taxpayer Data Exposure Risks 
Appendix IV 
Abbreviations 
COVID-19 
Coronavirus Disease 2019 
DCSA 
Defense Counterintelligence and Security Agency 
DHS 
Department of Homeland Security 
FBI 
Federal Bureau of Investigation 
HCO 
Human Capital Office 
IRS 
Internal Revenue Service 
 

 
 
 
 
 
 
 
To report fraud, waste, or abuse,  
call our toll-free hotline at: 
(800) 366-4484 
By Web: 
www.treasury.gov/tigta/ 
Or Write: 
Treasury Inspector General for Tax Administration 
P.O. Box 589 
Ben Franklin Station 
Washington, D.C. 20044-0589 
 
 
Information you provide is confidential, and you may remain anonymous.

File and source

File

REPORT_TIGTA_fingerprinting-and-employment-eligibility-verification-delays-due-to-t_2022-07-07.pdf

Size

603,488 bytes

SHA-256

a8de7975e40062591b8e4b8d4d91eada29701a6e313e22309473fe636a31b18f

Our copy

REPORT_TIGTA_fingerprinting-and-employment-eligibility-verification-delays-due-to-t_2022-07-07.pdf

Original

www.oversight.gov