Further Improvements Are Needed to Strengthen the Controls for Issuing Employer Identification Numbers (Treasury Inspector General for Tax Administration)
Summary
The Treasury Inspector General for Tax Administration's report 2025-400-036, issued July 25, 2025, follows up on its February 2018 review of how the IRS issues Employer Identification Numbers through the Modernized Internet EIN system. It found the IRS again rated the system's identity proofing and authentication requirements at Level 1 in December 2024 without acknowledging the change in the environment, namely the pandemic and the potential for pandemic-related fraud. Reviewers identified more than 8,000 EINs issued to the same responsible party on the same day and 9 Social Security Numbers used to apply for more than 10,000 EINs with similar business characteristics. The report cites a TIGTA investigation that helped prevent $3.5 billion from potentially being paid to fraudsters. TIGTA made 12 recommendations, and the IRS agreed with all of them; parts of the report are redacted.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Full text
TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION
Further Improvements Are Needed to
Strengthen the Controls for Issuing
Employer Identification Numbers
July 25, 2025
Report Number: 2025-400-036
This report has cleared the Treasury Inspector General for Tax Administration disclosure review process and information
determined to be restricted from public release has been redacted from this document.
1
TIGTACommunications@tigta.treas.gov | www.tigta.gov
HIGHLIGHTS: Further Improvements Are Needed to Strengthen
the Controls for Issuing Employer Identification Numbers
Final Audit Report issued on July 25, 2025 Report Number 2025-400-036
Why TIGTA Did This Audit
In February 2018, we reported that
actions were needed to reduce the
risk of fraudulent use of Employer
Identification Numbers (EIN) and
improve the effectiveness of the
Modernized Internet EIN (Mod IEIN)
system. The IRS addressed some
of our concerns by updating
programing to prevent an EIN from
being listed as a responsible party,
requiring an estate or trust
application to include a responsible
party, and updating alerts for error
codes associated with the Mod IEIN
system.
This audit followed-up on our prior
recommendations and evaluated
the effectiveness of the IRS’s
controls for processing EIN
applications.
Impact on Tax Administration
An EIN is a nine-digit number
assigned by the IRS to identify a
business entity. They are used by
employers, sole proprietors,
corporations, partnerships,
nonprofit associations, and trusts,
and for non-tax purposes.
EINs are targeted and used by
unscrupulous individuals to commit
fraud. In July 2021, we reported that
there were hundreds of potentially
fraudulent claims for employer tax
credits that were all filed using a
*****2**********. Further, in
April 2024, our Office of
Investigations announced that it
helped prevent $3.5 billion from
potentially being paid to fraudsters.
Our special agents identified a
scheme where individuals obtained
an EIN for the sole purpose of filing
business tax returns to improperly
claim pandemic-related tax credits.
What TIGTA Found
Management should raise the identity assurance level for the
Mod IEIN system. In December 2024, the IRS completed the annual
reassessment of the Mod IEIN system. The IRS rated the identity
proofing and authentication requirements at Level 1 (the same level
as the initial assessment in January 2020). However, the IRS’s
justification did not acknowledge the change in the environment,
namely the pandemic and the potential for pandemic-related fraud.
The IRS justified the Level 1 rating of the Mod IEIN system because
there was no known fraudulent activity and there were
compensating controls. This is despite our previously reported
concern that applicants appeared to be bypassing one of the
Mod IEIN system’s compensating controls. This situation continues
to occur as discussed in this report. Additionally, our Office of
Investigations and the Department of Justice identified fraud
associated with the issuance of EINs.
The Mod IEIN system has controls in place to prevent unscrupulous
individuals from abusing the system. However, applicants have been
able to circumvent some of the controls. Our review identified more
than 8,000 EINs issued to the same responsible party on the same
day, nearly 4,000 EINs issued with ***********2********************
****2*****, and 9 Social Security Numbers used to apply for more
than 10,000 EINs with similar business characteristics.
Additionally, ***2*** continue to be allowed as a responsible party
for an EIN. We previously recommended that the IRS develop
programming to reject applications for which the responsible party
is a ***2***. However, the IRS disagreed with the recommendation
stating there was no ****2**** requirement to obtain an EIN. We
identified more than 77,000 EINs that were issued to ***2*** from
January 2018 through December 2023. Specifically, there were
31 ***2** assigned 10 or more EINs.
We also determined that the IRS needs to take additional actions to
address recommendations from our prior report. For example,
programming has not been implemented to prevent sole
proprietors from receiving multiple EINs; estates do not have a date
of death for the decedents; and manual processing errors are
allowing businesses to be listed as a responsible party and to list
deceased taxpayers as a responsible party.
What TIGTA Recommended
We made 12 recommendations to improve the processing of EIN
applications, including to raise the identity assurance level for the
Mod IEIN system, update programming to prevent the
circumvention of controls, implement systemic processes to detect
and prevent abuse of the Mod IEIN system, require and capture
******2************* information for applications submitted by
***2*** and update forms and internal guidance.
The IRS agreed with all of our recommendations.
U.S. DEPARTMENT OF THE TREASURY
WASHINGTON, D.C. 20024
TREASURY INSPECTOR GENERAL
FOR TAX ADMINISTRATION
July 25, 2025
MEMORANDUM FOR: COMMISSIONER OF INTERNAL REVENUE
FROM: Diana M. Tengesdal
Acting Deputy Inspector General for Audit
SUBJECT: Final Audit Report – Further Improvements Are Needed to Strengthen
the Controls for Issuing Employer Identification Numbers
(Audit No.: 2024400013)
This report presents the results of our review to evaluate the effectiveness of the Internal
Revenue Service’s (IRS) controls for processing Employer Identification Number (EIN)
applications and to follow up on prior report recommendations.1 This review is part of our Fiscal
Year 2025 Annual Audit Plan and addresses the major management and performance challenge
of Protection of Taxpayer Data and IRS Resources.
Management’s complete response to the draft report is included as Appendix IV. If you have any
questions, please contact me or Deann Baiza, Acting Assistant Inspector General for Audit
(Returns Processing and Account Services).
1
TIGTA, Report No. 2018-40-013, Actions Are Needed to Reduce the Risk of Fraudulent Use of Employer
Identification Numbers and to Improve the Effectiveness of the Application Process (February 2018).
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
Table of Contents
Background .....................................................................................................................................Page 1
Results of Review .......................................................................................................................Page 2
Management Should Raise the Identity Assurance Level
for the Online System Used to Obtain an Employer Identification
Number....................................................................................................................................Page 2
Recommendation 1:...........................................................................Page 4
Additional Enhancements Are Needed to Strengthen Existing
Systemic Controls.................................................................................................................Page 4
Recommendations 2 and 3: ............................................................Page 5
Recommendations 4 and 5: ............................................................Page 6
***2*** Continue to Be Allowed As a Responsible Party Associated
With an Employer Identification Number...................................................................Page 6
Recommendation 6:...........................................................................Page 7
Recommendations 7 through 9: ...................................................Page 8
Additional Actions Are Needed to Address Prior
Recommendations...............................................................................................................Page 8
Recommendations 10 through 12: ..............................................Page 10
Appendices
Appendix I – Detailed Objectives, Scope, and Methodology..............................Page 11
Appendix II – Outcome Measures .................................................................................Page 13
Appendix III – Prior Recommendations Where Additional Action Is
Not Needed or That Were Not Evaluated ..................................................................Page 15
Appendix IV – Management’s Response to the Draft Report.............................Page 19
Appendix V – Glossary of Terms ....................................................................................Page 27
Appendix VI – Abbreviations ...........................................................................................Page 29
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
Background
An Employer Identification Number (EIN) is a nine-digit number (in the format of XX-XXXXXXX)
assigned by the Internal Revenue Service (IRS) and used to identify a business entity.1 EINs are
used by employers, sole proprietors, corporations, partnerships, nonprofit associations, and
trusts, and for non-tax purposes. An EIN is permanently assigned to the entity and will never be
reassigned.
There are multiple methods to receive an EIN including fax, mail, and telephone but most are
received online. Online applications are processed through the Modernized Internet Employer
Identification Number (Mod IEIN) system. This program uses an interview-style online
application with embedded help topics, keywords, and definitions. Information is validated as it
is entered, and an EIN is issued immediately once the application is completed. In Fiscal
Year 2024, the IRS issued more than 8.2 million EINs. Of these, about 7.2 million (87 percent)
were processed through the Mod IEIN system.
When individuals or entities apply for an EIN, they are required to provide information such as
the entity’s legal name, mailing address, type of entity, business start or acquisition date, and
reason they are applying for the EIN, e.g., started a new business or initially hired employees. In
addition, most EIN applicants must disclose the name and Taxpayer Identification Number (TIN)
of the principal officer, general partner, grantor, owner, or trustor associated with the entity.2
The IRS defines these individuals or entities as the “responsible party,” and they are the ones
who control, manage, or direct the applicant entity and the disposition of its funds and assets. If
there is more than one responsible party, the entity may list whichever party the entity wants the
IRS to recognize as the responsible party.
This audit is a follow up to our prior report where we made 18 recommendations to the IRS, that
if implemented, would help reduce the risk of fraudulent use of EINs and improve the
effectiveness of the Mod IEIN system.3 This review assessed the IRS’s actions taken to address
the prior recommendations and determined whether actions were needed on the disagreed
recommendations.4
The IRS took the following actions in response to our previously reported concerns:
· Updated programming to prevent an EIN from being listed as the responsible party.
· Required an estate or trust application to include a responsible party.
· Updated alerts for error codes within the Mod IEIN system to identify systemic issues.
1
See Appendix V for a glossary of terms.
2
This is not required when a foreign individual or business requests the EIN.
3
TIGTA, Report No. 2018-40-013, Actions Are Needed to Reduce the Risk of Fraudulent Use of Employer
Identification Numbers and to Improve the Effectiveness of the Application Process (February 2018).
4
See Appendix III for a summary of the 13 recommendations not included in this review.
Page 1
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
· Matched responsible parties on the Suspicious EIN Listing with the Business Master File
to identify additional associated EINs.5
In November 2024, the IRS implemented a paperless workflow to improve the processing of EIN
applications received via fax. Additionally, the IRS plans to modernize the Mod IEIN system. This
modernization effort includes updating the look and feel of the system to align with other
applications, making it Section 508 compliant, and implementing outstanding programming
changes from our prior report.
Results of Review
Management Should Raise the Identity Assurance Level for the Online System
Used to Obtain an Employer Identification Number
In December 2024, the IRS completed the annual reassessment of the Mod IEIN system using
the Digital Identity Risk Assessment (DIRA) process. The IRS rated the identity proofing and
authentication requirements at Level 1 (the same level as the initial assessment in January 2020).
However, the IRS’s DIRA justification did not acknowledge the change in the environment,
namely the pandemic and the potential for pandemic-related fraud.
The IRS’s internal guidance states that the DIRA process must follow risk assessment guidelines
from the National Institute of Standards and Technology (NIST) when determining the
appropriate assurance level for an application.6 This includes ensuring that a reassessment is
completed annually or when an event-based trigger, e.g., change in the risk environment, occurs
to ensure that the data and information in the DIRA is current. Figure 1 provides the three
identity assurance levels (IAL) established by NIST that can be assigned, along with their
description.
Figure 1: NIST Identity Assurance Levels
No requirement to link the applicant to a specific
IAL 1 real-life identity.
Evidence supports the real-world existence of
IAL 2 the claimed identity.
Physical presence (or supervised remote) is
IAL 3 required for identity proofing.
Source: NIST Special Publication 800-63 Revision 3, Digital
Identity Guidelines.
5
Suspicious EINs are identified by the IRS when examiners contact businesses to verify the tax withholding amounts
claimed on certain Forms W-2, Wage and Tax Statement. They can also be identified when the IRS corresponds with
certain businesses deemed as potentially fabricated by the IRS. If the IRS receives information that a business is
fabricated or bogus, because of contacts or correspondence, the business’s EIN is added to the list.
6
NIST Special Publication 800-63 Revision 3, Digital Identity Guidelines (June 2017), provides standards that address
identity proofing and authentication of users, e.g., employees, contractors, and private individuals who interact with
federal government information systems over open networks such as the internet.
Page 2
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
The IRS’s DIRA justified the Level 1 rating of the Mod IEIN system because there was no known
fraudulent activity and there were compensating controls. These controls include a systemic
check to limit the issuance of one EIN per responsible party per day and manual processes to
ensure that EINs are not issued to the ***************2*************************. However, we
previously reported that applicants appeared to be bypassing one of the Mod IEIN system’s
compensating controls.7 This situation continues to occur as discussed later in this report.
TIGTA and the Department of Justice also identified fraud associated with the issuance of EINs.
In March 2021, the Department of Justice issued a press release updating the public about its
ongoing criminal and civil efforts to combat fraud coinciding with the pandemic.8 The press
release noted that fraudsters targeted the Economic Injury Disaster Loan Program by applying
for advances and loans on behalf of newly created businesses. Later that year, we reported that
there were hundreds of potentially fraudulent claims for employer tax credits, all filed using a
********2**********.9
Further, in April 2024, our Office of Investigations announced that it helped prevent $3.5 billion
from potentially being paid to fraudsters.10 Our special agents identified a scheme where
individuals obtained an EIN for the sole purpose of filing business tax returns to improperly
claim pandemic-related tax credits.
Finally, IRS data shows a 31 percent increase in EIN issuances from Fiscal Years 2020 to 2021
coinciding with the financial relief offered to businesses during the pandemic by the Coronavirus
Aid, Relief, and Economic Security (CARES) Act legislation.11 Figure 2 shows the volume of EINs
issued from Fiscal Years 2018 through 2024.
7
TIGTA, Report No. 2018-40-013, Actions Are Needed to Reduce the Risk of Fraudulent Use of Employer
Identification Numbers and to Improve the Effectiveness of the Application Process (February 2018).
8
U.S. Department of Justice, Office of Public Affairs press release “Justice Department Takes Action Against COVID-19
Fraud” (March 2021), available at https://www.justice.gov/archives/opa/pr/justice-department-takes-action-against-
covid-19-fraud (last visited Feb. 25, 2025).
9
TIGTA, Report No. 2021-46-043, Implementation of Tax Year 2020 Employer Tax Credits Enacted in Response to the
COVID-19 Pandemic (July 2021).
10
TIGTA, Office of Investigations press release “TIGTA Identifies Fraud Scheme, Alerts IRS to Prevent $3.5 Billion in
Potentially Improper Pandemic Tax Credits” (April 2024), available at TIGTA Identifies Fraud Scheme, Alerts IRS to
Prevent $3.5 Billion in Potentially Improper Pandemic Tax Credits | U.S. Treasury Inspector General for Tax
Administration OIG (last visited March 13, 2025).
11
Pub. L. No. 116-136, 134 Stat. 281 (2020) (codified as amended in scattered sections of 2, 5, 12, 15, 20, 21, 29, 42,
and 45 U.S.C.).
Page 3
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
Figure 2: EINs Issued From Fiscal Years 2018 Through 2024
8.2 M
8.0 M
8.2 M
7.9 M
5.9 M Start of pandemic
6.1 M
5.7 M
FY 2018 FY 2019 FY 2020 FY 2021 FY 2022 FY 2023 FY 2024
Source: Taxpayer Services Division provided statistics as of December 2023 and
January 2025. FY = Fiscal Year.
EINs are targeted and used by unscrupulous individuals to commit fraud. For this reason, we
believe the IRS needs to raise the identity Mod IEIN system assurance level to ensure that
individuals accessing the system are subjected to authentication prior to accessing the system.
Recommendation 1: The Chief, Taxpayer Services, should increase the identity assurance level
for the Mod IEIN system to Level 2.
Management’s Response: The IRS agreed with the recommendation and will complete
annual evaluations of the Mod IEIN system and increase the identity assurance to Level 2
if supported by the determination.
Additional Enhancements Are Needed to Strengthen Existing Systemic
Controls
The Mod IEIN system has controls in place to prevent unscrupulous individuals from abusing the
system. For example, the IRS’s guidelines limit individuals to one EIN per responsible party per
day. However, applicants have been able to circumvent some of the controls. Our review of
Mod IEIN applications from December 2020 through December 2023 identified 8,206 EINs
issued to the same responsible party on the same day. IRS management noted that the EINs
were requested ******************2**********************************, thus bypassing the control
to prevent multiple EINs from being issued to the same taxpayer. Further, the IRS explained that
the control does not occur until *************2**********************************, allowing multiple
EINs to be ********************2***********************************.
After completion of our audit work, the IRS notified us of a policy change to the number of EINs
per responsible party per day. As a result of an IRS Advisory Committee recommendation made
in November 2022, the IRS decided to increase the number of EINs allowed for each responsible
party to 10 EINs per day. The IRS Advisory Committee stated that there are many situations
where entities must be formed quickly in various states for regulatory or business purposes. A
new business may need to set up an entity in each state it operates in for various reasons,
Page 4
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
e.g., payroll taxes and liquor licenses. The IRS plans to implement the change in October 2025.
However, we remain concerned about responsible parties receiving more EINs per day than
allowed.
We also identified 3,924 EINs issued from December 2020 through December 2023 with
**********2********************************. This occurred despite the presence of validation
controls intended to prevent an individual from requesting an EIN with a *********2*************
*************2************************************. The IRS explained that the validation control
failed due to **********************************2************************************************
**2**. For example, once the EIN is issued by the Mod IEIN system, ***********2**************
***************************2****************************************************. According to the
IRS, if an individual requests an EIN with a ***************************2************************
*****2*****, the Mod IEIN system will **********************2**********************************
***2***.
In addition, our review of the Business Master File identified 9 Social Security Numbers (SSN)
that were used to apply for 10,271 EINs from January 2018 through December 2023. Many of
the EIN applications used ****************************2********************************
****************************2************************************************. This is similar to an
issue we reported in February 2018 where we noted that the IRS’s processes needed to be
strengthened to identify applicants abusing the Mod IEIN system. During our prior review, we
identified a large number of application requests from the ***********2**********************
which appeared to have bypassed the IRS’s controls of one EIN per responsible party per day.
Recommendation 2: In September 2024, we alerted the IRS of the 9 SSNs that received
10,271 EINs identified as potential waste and abuse due to using the **************2**********
***************************************2**********************************************************
****2******* We expressed concerns about the accessibility of the Mod IEIN system, ****2*****
******************2********************************* fraud, waste, and abuse. We recommended
that the IRS consider limiting or performing additional reviews of applications where the
*****************2******************************** of assigned entities and conduct data analysis
to detect cases of fraud, waste, and abuse.
Management’s Response to Alert: The IRS agreed with the recommendation and upon
completion of their review on September 23, 2024, the nine SSNs were added to a list
that is updated weekly and shared with the Mod IEIN team to prevent the individuals
from obtaining additional EINs.
Office of Audit Comment: While the IRS did not comment on our
recommendation to perform reviews to identify similar scenarios, the IRS’s plans
to implement our other recommendations should provide added controls to limit
this type of abuse of the Mod IEIN system.
The Chief, Taxpayer Services, should:
Recommendation 3: Update programming to prevent an individual from receiving more EINs
per day than allowed by the policy in effect.
Management’s Response: The IRS agreed with the recommendation. This is an action
that has been pursued since October 2022; however, limited resources and competing
Page 5
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
priorities have impeded implementation. Based on discussions with Information
Technology staff, the IRS expects implementation in January 2027.
Recommendation 4: Develop a process to identify and prevent the assignment of EINs with the
****************************************************2**********************************************
*****2******
Management’s Response: The IRS agreed with the recommendation and will develop
an action plan to address the vulnerability presented by the *********2*****************
*****2*******when reviewing records.
Recommendation 5: Implement systemic processes to detect abuse of the Mod IEIN system
and prevent the identified SSNs from requesting additional EINs.
Management’s Response: The IRS agreed with the recommendation and will perform a
review and analysis to determine if the existing treatment for SSNs suspected of
obtaining EINs for potentially fraudulent purposes can and should be incorporated into
systemic processing to stop the application process. The IRS’s review will consider
applicable legal authorities, taxpayer rights, and best business practices.
***2*** Continue to Be Allowed As a Responsible Party Associated With an
Employer Identification Number
We previously recommended that the IRS develop
programming to reject applications for which the
Our analysis identified
responsible party is a **2**. The IRS disagreed, stating
31 ***2* that were assigned
that there is no *******2************* to obtain an EIN 10 or more EINs from
and there are several valid reasons a ***2** would need January 2018 through
an EIN, for example a **2** who is engaged in business December 2023.
activities or ********2************ investing funds. We
identified more than 77,000 EINs issued from
January 2018 through December 2023 that have a ***2*** designated as the responsible party.12
For example, we found:
· More than 2,000 ***1** have more than 1 EIN.
· 31 ***1*** have 10 or more EINs.
· *********1***********
While we understand there may be instances when a ***2*** needs to have an EIN, our analysis
highlights instances that do not appear reasonable and indicate potential fraud or abuse.
Figure 3 shows the number of EINs listing a ***2*** as the responsible party ******2****** at the
time the EIN was established.
12
This number does not include EINs assigned to ***2** designated as Home Care Service Recipients or entities
identified as estates, trusts, or other, except Limited Liability Companies.
Page 6
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
Figure 3: EINs Held by *****2****** at Establishment
Source: Analysis of information in the Business Master File and
National Account Profile data from January 2018 through
December 2023. K = thousands.
The IRS’s internal guidance requires reporting the SSN of the **********2**********************
*******2****************. According to the Internal Revenue Code, any income tax assessed
against a ***********************************2***********************. However, neither the
Form SS-4, Application for Employer Identification Number, nor the Mod IEIN system has an
entry to provide this information. In February 2022, and in response to our prior
recommendation, IRS management stated that they were unable to add a field to the Business
Master File to capture another TIN because of character space limitations. The IRS’s Inflation
Reduction Act Strategic Operating Plan includes plans to modernize the Business Master File in
Fiscal Year 2027.13 However, the office responsible for monitoring and tracking the efforts of the
Strategic Operating Plan – the Transformation and Strategy Office – was eliminated in
March 2025.
Since the IRS has space limitations in the Business Master File, we believe that the ******2****
****************************************2*********************************************************. At
that time, the entity information can be updated to reflect the *****2******* as the responsible
party. Allowing the designation of a **2** as the responsible party creates uncertainty when
there are tax return filings or other tax-related obligations of the entity. This is because it is
difficult to identify the **************2************** without having their name, address, or TIN
recorded in the system.
The Chief, Taxpayer Services, should:
Recommendation 6: Update the Form SS-4 and related instructions to require a ****2******
*****2***** name and SSN when an EIN application for ****2*** is submitted.
Management’s Response: The IRS agreed with the recommendation and will update
Form SS-4 and related instructions, with the next publishing cycle.
13
IRS Publication 3744, IRS Inflation Reduction Act Strategic Operating Plan, p. 87 (April 2023).
Page 7
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
Recommendation 7: Coordinate with the Information Technology organization to include fields
that will capture two TINs associated with an EIN when the Business Master File is modernized.
Management’s Response: The IRS agreed with the recommendation and in conjunction
with changes to Form SS-4, will develop commensurate business requirements for the
capture of the additional data fields.
Recommendation 8: Update internal guidance to capture the ******2*********** SSN as the
responsible party when EIN applications ****2***** are submitted.
Management’s Response: The IRS agreed with the recommendation and will update
internal guidance to clarify documentation requirements for responsible parties when
EIN applications are submitted ****2****.
Recommendation 9: Update the Mod IEIN system programming to capture the ****2****
****2*****SSN as the responsible party for applications submitted ****2******.
Management’s Response: The IRS agreed with the recommendation and will develop
and submit business requirements for programming updates that will capture
responsible party information for applications submitted ****2****.
Additional Actions Are Needed to Address Prior Recommendations
Figure 4 summarizes the prior recommendations agreed to by the IRS that still require
additional action.14 For the remaining recommendations, we either determined that no
additional actions were needed or deemed them low risk.15
Figure 4: Prior IRS Agreed Recommendations Where Additional Action Is Needed
Recommendation
Recommendation Actions Taken
Number
#3 Correct programming to The IRS partially implemented this recommendation. The
(page 9) reject EIN applications programming for sole proprietors with a date of death
when an EIN has previously was implemented in October 2017.
been assigned to the same
Audit Note: Our current analysis of sole proprietors
sole proprietor and to reject
determined that they are still receiving multiple EINs.
applications when IRS data
indicates that the sole
proprietor is deceased.
#9 Develop programming to The IRS agreed with this recommendation and planned
(page 14) reject estate applications if to implement required programming changes subject to
the decedent TIN is not that budgetary constraints, limited resources, and competing
of a deceased individual. priorities.
Audit Note: Our current analysis of estates identified that
there is no date of death on file for some decedent
accounts.
14
TIGTA, Report No. 2018-40-013, Actions Are Needed to Reduce the Risk of Fraudulent Use of Employer
Identification Numbers and to Improve the Effectiveness of the Application Process (February 2018).
15
See Appendix III for a summary of the 13 recommendations not included in this review. Additionally, we reported
the recommendation on ****2**in a separate finding because the IRS disagreed with this recommendation.
Page 8
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
Recommendation
Recommendation Actions Taken
Number
#12 Revise procedures to not The IRS updated the Form SS-4 and instructions in
(page 14) allow applicants to December 2017 and implemented programming
designate another business updates for the Mod IEIN system in May 2019.
as the responsible party.
Audit Note: Our current analysis determined that
businesses are still being designated as the responsible
party due to manual processing errors.
#14 Develop processes and The IRS reviewed a sample of 307 paper processed
(page 17) procedures to ensure that Forms SS-4 for accuracy and found that 291 forms were
tax examiners accurately processed correctly. The remaining 16 forms did not
process paper Forms SS-4. indicate any error trends. The IRS stated they will
This should include continue to monitor and review quality reports, provide
additional employee guidance when error trends are identified, and offer the
training and performing annual refresher training.
additional management
Audit Note: Our current analysis identified EINs that were
quality reviews.
issued to deceased taxpayers due to manual processing
errors.
Source: Review of actions taken in response to recommendations made in prior report.
Programming has not been implemented to prevent sole proprietors from receiving
multiple EINs
The IRS agreed to correct programming to prevent sole proprietors from being issued additional
EINs if they already had one. However, IRS management noted that the programming update
was based upon available funding. Our review identified that approximately 34,000 sole
proprietors were issued more than 1 EIN from January 2018 through December 2023, for a total
of more than 69,000 EINs. IRS management noted that they will implement programming to
correct this issue.
Estates do not have a date of death for the decedent
The IRS agreed to implement programming to reject estate applications if the decedent TIN
does not have a date of death. However, IRS management noted that the programming update
was based on available funding. Our review identified over 54,000 EINs issued to estates from
January 2018 through December 2023 where the decedent TIN does not have a date of death
on file. IRS agreed that these EINs were issued in error and noted that they will implement
programming that will correct this issue.
Businesses continue to be listed as the responsible party due to manual processing
errors
The IRS agreed to revise its procedures and not allow EIN applicants to designate a business as
the responsible party. The IRS updated the Form SS-4 and instructions, along with its internal
guidance to state that the responsible party must be an individual, noting an exception for a
government entity. In May 2019, the IRS updated the Mod IEIN programming to no longer allow
an EIN to be designated as the responsible party. Our analysis of entity records for EINs issued
from June 2019 through December 2023 identified more than 126,000 EINs with another EIN
designated as the responsible party.
Page 9
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
We provided the list of identified EINs to the IRS for review. The IRS reviewed a sample of the
EINs and determined that each of the records reviewed was established or updated by an IRS
employee following the filing of a form or tax return. Management indicated that there are
conflicting instructions for updating responsible party information that led to instances of the
EINs being listed as the responsible party.
Businesses allowed to list deceased taxpayers as responsible party due to manual
processing errors
The IRS agreed to correct its programming to reject applications when a sole proprietor is
deceased. The IRS implemented programming updates in October 2017, which appear to be
effective. However, our review identified 1,545 EINs (325 sole proprietors) issued from
January 2018 through December 2023 where the taxpayer account had a date of death on file at
the time the EIN was issued. The IRS reviewed a sample of the EINs and determined that
employees manually entered the responsible party after receiving forms with missing EINs or
after receiving updated responsible party information. This should not have occurred because
employees have access to a tool that displays the date of death of the taxpayer when they are
processing an EIN application. This tool should prompt the employee to refer to internal
guidance to determine if an EIN can be issued.
The Chief, Taxpayer Services, should:
Recommendation 10: Ensure that the Mod IEIN system programming updates from the prior
recommendations are implemented during the planned modernization.
Management’s Response: The IRS agreed with the recommendation and the
programming updates associated with previous recommendations are expected to be
implemented in July 2025.
Recommendation 11: Update all instructions and internal guidance used by employees when
issuing an EIN to note that another EIN cannot be designated as the responsible party.
Management’s Response: The IRS agreed with the recommendation and will review
instructions and internal guidance and update it, as needed, to prevent the designation
of another EIN as the responsible party.
Recommendation 12: Remind employees to follow internal guidance when the tool displays
information, such as a date of death, for their consideration prior to issuing an EIN.
Management’s Response: The IRS agreed with the recommendation and on
May 16, 2025, the Servicewide Electronic Research Program Alert number 25A0139 was
issued to employees to remind them to follow internal guidance when the tool displays
information, such as a date of death, for their consideration prior to issuing an EIN.
Page 10
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
Appendix I
Detailed Objectives, Scope, and Methodology
Our overall objectives were to evaluate the effectiveness of the IRS’s controls for processing EIN
applications and to follow up on prior report recommendations.1 To accomplish our objectives,
we:
· Assessed the IRS’s processing of paper and faxed EIN applications by interviewing
personnel and completing a walk-through of the process. We followed up with the IRS to
ensure that modernization of the faxed application process was deployed on schedule.
· Assessed the IRS’s electronic processing of EIN applications by interviewing personnel,
reviewing system processes and controls, and examining datasets and audit logs.
· Reviewed the IRS’s processes and procedures for identifying and minimizing invalid or
fraudulent EIN applications. We did this by interviewing personnel, reviewing security
assessments and standards, and checking data for suspected or known instances of fraud
and identity theft.
· Determined whether the IRS addressed the recommendations from our prior report by
reviewing corrective actions and testing controls for effectiveness. We reviewed EIN
application data for issues identified in the prior audit to ensure that controls were put in
place and are operating effectively.
Performance of This Review
This review was performed with information obtained from IRS personnel within the Accounts
Management office located in Covington, Kentucky; Taxpayer Services Division in
Atlanta, Georgia; and Information Technology organization in Washington, D.C., during the
period October 2023 through March 2025. We conducted this performance audit in accordance
with generally accepted government auditing standards. Those standards require that we plan
and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis
for our findings and conclusions based on our audit objective. We believe that the evidence
obtained provides a reasonable basis for our findings and conclusions based on our audit
objective.
Data Validation Methodology
During this review we obtained data from the IRS’s Business Master File, the Mod IEIN system,
and National Account Profile databases. We evaluated the data by performing electronic testing
of required data elements, reviewing existing information about the data and the system that
produced them, and selecting random samples to verify the data against the source data, i.e.,
the Integrated Data Retrieval System. We determined that the data were sufficiently reliable for
purposes of this report.
1
TIGTA, Report No. 2018-40-013, Actions Are Needed to Reduce the Risk of Fraudulent Use of Employer
Identification Numbers and to Improve the Effectiveness of the Application Process (February 2018).
Page 11
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
Internal Controls Methodology
Internal controls relate to management’s plans, methods, and procedures used to meet their
mission, goals, and objectives. Internal controls include the processes and procedures for
planning, organizing, directing, and controlling program operations. They include the systems
for measuring, reporting, and monitoring program performance. We determined that the
following internal controls were relevant to our audit objective: control activities and monitoring.
We evaluated these controls by reviewing Internal Revenue Manual (IRM) 21.7.13, Assigning
Employer Identification Numbers (EINs); processes and procedures for identifying and
minimizing fraud, waste, and abuse related to the EIN application process; the Joint Audit
Management Enterprise System documentation to determine whether prior recommendations
to improve the process have been effectively implemented; and NIST Special Publication 800-63
Revision 3, Digital Identity Guidelines.
Page 12
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
Appendix II
Outcome Measures
This appendix presents detailed information on the measurable impact that our recommended
corrective actions will have on tax administration. These benefits will be incorporated into our
Semiannual Report to Congress.
Type and Value of Outcome Measure:
· Protection of Resources – Potential; 10,271 EINs identified as waste and abuse because
of using the ********************************2******************************************
******************2************************************ (see Recommendation 2).
Methodology Used to Measure the Reported Benefit:
Our review of the Business Master File identified 9 SSNs that were used to apply for 10,271 EINs
from January 2018 through December 2023. Many of the EIN applications used *****2*******
********************************************2******************************************************
*************2******. In September 2024, we alerted the IRS to the potential waste and abuse. As
a result, the IRS blocked the SSNs identified from obtaining additional EINs through the
Mod IEIN system.
Type and Value of Outcome Measure:
· Protection of Resources – Potential; 8,206 EINs issued to the same responsible party on
the same day (see Recommendation 3).
Methodology Used to Measure the Reported Benefit:
Our review of Mod IEIN applications from December 2020 through December 2023 identified
8,206 instances of an EIN being issued to the same responsible party on the same day. The IRS’s
guidelines limit individuals to one EIN per responsible party per day. When we asked IRS
management to explain how this occurred, management noted that these individuals
circumvented the controls because the EINs were requested ***************2*****************
******2*****************. The IRS further explained that the control preventing multiple EINs from
being issued to the same taxpayer does not occur until *******************2******************
*****2*********, allowing multiple EINs to be *************************2*************************
****2******
Type and Value of Outcome Measure:
· Protection of Resources – Potential; 3,924 EINs issued with *********************2*********
*****2**** (see Recommendation 4).
Methodology Used to Measure the Reported Benefit:
We identified 3,924 EINs issued from December 2020 through December 2023 *******2**********
********2**************************. This occurred despite the presence of validation controls
Page 13
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
intended to prevent an individual from requesting an EIN with **************2*******************
***************2******************************. When we brought this concern to management’s
attention, management explained that the validation control failed due to the *****2**********
*******************2**********************************************. For example, once the EIN is
issued by the Mod IEIN system, *****************************2***********************************
**************2**************************. According to the IRS, if an individual requests an EIN
with a ******************2*********************************************, the Mod IEIN system will
**************2****************.
Page 14
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
Appendix III
Prior Recommendations Where Additional Action Is Not Needed or
That Were Not Evaluated
Recommendation
Recommendation IRS Response/Action Taken
Number
#1 Place an indicator on the The IRS disagreed with this recommendation. IRS
(page 7) tax account of those EINs management responded that there are valid reasons
*****2************ why a filing requirement is not assigned during the EIN
***2* that can be used to application process. For example, tax exempt entities do
identify when these EINs not have a filing requirement until their application of
are used to file business recognition has been formally accepted. Sole proprietors
tax returns or other tax may have a need to issue Form 1099 which requires
documents, such as them to have an EIN. While there are no studies to
Forms W-2, Wage and Tax indicate EINs not ******2************ are more
Statement, or Forms 1099, likely to be used to commit fraud, the IRS has two
Miscellaneous Income, to existing programs that look to identify these types of
ensure the validity of these entities when tax returns and/or information documents
filings. are filed. The Entity Fabrication Program has several
filters that run against certain business forms claiming
refunds. These filters look specifically for ***2***
***2** that have a ***2*** and newly **2******
****2** that have never been ***2**.
TIGTA comment to disagreement: When the IRS
processes an EIN application, it already assigns those
businesses that will be required to file a business tax
return a “filing requirement.” Adding an ****2*****
***2**** to the tax accounts associated with those
EINs issued *********2******** would allow the
IRS to identify subsequent tax returns filed using EINs
originally issued for reasons that did not ***2*****
****2*******. The IRS could then identify and assess
the subsequent filing of a tax return and/or information
return to ensure they are valid.
#2 Expand fraud filters to The IRS agreed with this recommendation and
(page 8) identify potentially responded that it currently has a process in place to
fraudulent tax return filings identify ****2***** used to report potentially
that use an ***2**** to fraudulent income and withholding.
report income and
Action taken: In October 2017, the IRS updated the IRM
withholding.
to include additional procedures for the Entity
Fabrication Program and identity theft filters for the
Business Taxpayer Protection Program.
Page 15
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
Recommendation
Recommendation IRS Response/Action Taken
Number
#4 Review the 206,920 EINs The IRS agreed with this recommendation and planned
(page 9) incorrectly assigned as to research a statistical sample to determine if some
duplicates to sole EINs should be merged or deactivated and take
proprietors and the 20,437 appropriate actions based on its findings.
assigned to sole proprietors
Action taken: The IRS took a statistical sample from each
who were deceased and
population and reviewed the EIN accounts for accuracy.
determine if the EINs
Some of the specific issues identified in the samples
should be merged or
were addressed, e.g., deactivating confirmed duplicate
deactivated.
EINs to sole proprietors and updating incorrect
responsible parties identified. No action was taken on
the whole populations.
#5 Perform an assessment to The IRS agreed with this recommendation and planned
(page 13) determine how an to review the process to determine if an additional field
additional field could be can be added to capture the decedent’s SSN and the
added to the Business responsible party TIN. However, the implementation of
Master File so that both the required programming changes to accomplish this
decedent SSN and a objective are subject to budgetary constraints, limited
responsible party TIN can resources, and competing priorities.
be captured for estates and
Action taken: The IRS reported it is unable to include
trusts.
both the decedent’s SSN and responsible party’s TIN to
the business file due to character space limitations.
#6 Revise internal procedures, The IRS agreed with this recommendation and planned
(page 13) application instructions, to update the appropriate procedures and instructions
etc., to require that estate once the required programming changes have been
and trust applicants implemented.
applying on paper provide a
Actions taken: The IRS made updates to the IRM in
responsible party.
July 2019 requiring a name and TIN for the responsible
party for estates and trusts and updated instructions for
contacting a taxpayer when information is missing. In
December 2019, the IRS made updates to the
Form SS-4 instructions regarding a decedent estate.
#8 Ensure the validity of the The IRS agreed with this recommendation and planned
(page 14) 71,633 EINs we identified to review a statistical sample of EINs to ensure their
that were assigned to validity.
responsible parties who are
Actions taken: The IRS took a statistical sample from the
***2***.
population and reviewed the EIN accounts for accuracy.
EINs with an incorrect responsible party identified in the
sample were updated. No action was taken on the whole
population.
#10 Ensure the validity of the The IRS agreed with this recommendation and planned
(page 14) 26,889 EINs we identified to review a statistical sample of EINs to determine their
as being assigned to validity.
estates for which the
Actions taken: The IRS took a statistical sample from the
decedent TIN was that of a
population and reviewed the EIN accounts for accuracy.
living individual.
Specific issues identified in the sample were addressed.
No action was taken on the whole population.
Page 16
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
Recommendation
Recommendation IRS Response/Action Taken
Number
#11 Establish systemic The IRS agreed with this recommendation and planned
(page 14) processes for the Mod IEIN to seek a feasible process for the Mod IEIN system to
system to alert system alert system administrators when error code counts
administrators when error reach certain thresholds based on historical trends.
code counts reach certain
Actions taken: In February 2019, the IRS put an error
thresholds based on
threshold notification in place. In our discussions, the
historical trends.
IRS stated that ***********2****************
*****2******
#13 Update internal guidelines The IRS disagreed with this recommendation. IRS
(page 17) to require ****2***** management responded that this recommendation,
*******2********* whether foreign or U.S. formed entities, will place undue
*******2********* burden upon ******2****** when applying for an
*******2******** to EIN.
provide additional
TIGTA Comment to disagreement: At no point during our
information on the
discussions with IRS management did they indicate or
application to receive an
substantiate that requiring additional information would
EIN.
place an undue burden on ******2*****. In fact, they
indicated that they would consider requiring information
that could be used to verify ******2******.
#15 Update internal guidelines The IRS agreed with this recommendation and planned
(page 17) to include procedures for to determine if procedural changes are necessary based
processing EIN applications on its review under Recommendation 8.
associated with
Actions taken: In July 2018, the IRS updated the IRM to
Form 1041, U.S. Income
add a filing requirement exemption for Form 1041 when
Tax Return for Estates and
the taxpayer indicates “Widely Held Investment Trust.”
Trusts, and requests for
EINs from individuals who
are ***2***
#16 Develop processes to The IRS agreed with this recommendation. However, IRS
(page 19) *******2********** management stated that **********2**********
*******2********** ******************2*********************
*******2********** ******************2*********************
*****2**** and refer any ******************2*********************
matches to the Criminal *********2********. IRS management plans to
Investigation Division for explore the possibility of establishing a ****2******
further review. **************2************************
************2*******.
Actions taken: IRS analysis determined that
implementation would not be cost effective or beneficial.
#17 Develop processes to The IRS agreed with this recommendation and planned
(page 19) match responsible parties to add the cross-reference TIN associated with
associated with suspicious suspicious EINs to its current review process. IRS
EINs, when added to the management stated they will complete any necessary
Suspicious EIN Listing, treatment, e.g., adding any additional EINs to the
against the IRS’s Business Suspicious EIN Listing, identified during this review.
Master File to identify
Actions taken: The IRS implemented a process to match
instances in which the
responsible parties associated with suspicious EINs to
same responsible parties
the Business Master File for review. The IRM was
are associated with
updated with new procedures in June 2018.
additional EINs, i.e., not on
the list, and determine if
these additional EINs
should be added to the list.
Page 17
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
Recommendation
Recommendation IRS Response/Action Taken
Number
#18 Refer the 20,609 entities The IRS agreed with this recommendation and planned
(page 19) that contain responsible to review the identified entities for possible inclusion in
party TINs associated with the Compromised/Suspicious EIN Listing.
suspicious EINs to the IRS’s
Actions taken: The IRS reviewed the entities for referral
Return Integrity and
and determined that approximately 2 percent of the
Compliance Services
population met the Entity Fabrication criteria. Of those,
function to determine if any
one-third already had an indicator on their account.
of these entities should be
added to the Suspicious
EIN Listing.
Source: Review of actions taken in response to recommendations made in Report No. 2018-40-013,
Actions Are Needed to Reduce the Risk of Fraudulent Use of Employer Identification Numbers and to
Improve the Effectiveness of the Application Process (February 2018).
Page 18
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
Appendix IV
Management’s Response to the Draft Report
Page 19
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
2
In addition to systemic and procedural changes, we are ensuring our frontline employees
have all the tools and support necessary to deliver high-quality service while
simultaneously protecting the integrity of the EIN assignment process and adhering to
statutory requirements. We do not have the legal authority to limit or reject applications for
EINs by ****2****. Procedures require employees to enter ***2****** SSN in the
remarks field when assigning an EIN to a **2**, which helps in identifying potentially
fraudulent activity. Servicewide alerts are issued to notify employees of emerging fraud
schemes and to communicate procedural updates. These efforts, along with additional
corrective actions, support continuous improvement and reinforce the safeguards that
protect both taxpayer data and public trust.
IRS responses to the recommendations are enclosed. If you have any questions, please
contact me, or a member of your staff may contact, Joseph Dianto, Director, Customer
Account Services, at 470-639-3504.
Attachment
Page 20
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
RECOMMENDATION 2
In September 2024, we alerted the IRS of the 9 SSNs that received 10,271 EINs
identified as potential waste and abuse due to using the *******************
***************************2**************************************
*****2********. We expressed concerns about the accessibility of the Mod IEIN
system, ***************2********************************** fraud, waste,
and abuse. We recommended that the IRS consider limiting or performing additional
reviews of applications where the *************2*********************** of
assigned entities and conduct data analysis to detect cases of fraud, waste, and abuse.
CORRECTIVE ACTION
We agree. Upon completion of our review on September 23, 2024, the nine Social
Security Numbers (SSNs) were added to a list that is updated weekly and shared with the
Mod IEIN team to prevent the individuals from obtaining additional Employer
Identification Numbers (EINs).
IMPLEMENTATION DATE
Implemented
RESPONSIBLE OFFICIAL
Director, Accounts Management, Customer Account Services, Taxpayer Services
Division
Page 21
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
RECOMMENDATION 4
Develop a process to identify and prevent the assignment of EINs with the same
****************************2**************************************
******2***.
CORRECTIVE ACTION
We agree. We will develop an action plan to address the vulnerability presented by the
***********2********************* when reviewing records.
IMPLEMENTATION DATE
January 15, 2026
RESPONSIBLE OFFICIAL
Director, Accounts Management, Customer Account Services, Taxpayer Services Division
Page 22
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
RECOMMENDATION 6
Update the Form SS-4 and related instructions to require a ******2********** name
and SSN when an EIN application for a **2** is submitted.
CORRECTIVE ACTION
We agree. We will update Form SS-4, Application for Employer Identification Number,
and related instructions, with the next publishing cycle.
IMPLEMENTATION DATE
October 15, 2026
RESPONSIBLE OFFICIAL
Director, Accounts Management, Customer Account Services, Taxpayer Services
Division
CORRECTIVE ACTION MONITORING PLAN
We will monitor this corrective action as part of our internal management control system.
Page 23
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
RECOMMENDATION 8
Update internal guidance to capture the *******2*********** SSN as the responsible
party when EIN applications for **2** are submitted.
CORRECTIVE ACTION
We agree. We will update internal guidance to clarify documentation requirements for
responsible parties when EIN applications are submitted by **2**.
IMPLEMENTATION DATE
December 15, 2025
RESPONSIBLE OFFICIAL
Director, Accounts Management, Customer Account Services, Taxpayer Services Division
CORRECTIVE ACTION MONITORING PLAN
We will monitor this corrective action as part of our internal management control system.
RECOMMENDATION 9
Update the Mod IEIN system programming to capture the *******2************** as
the responsible party for applications submitted ***2****.
Page 24
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
5
CORRECTIVE ACTION
We agree. We will develop and submit business requirements for programming updates
that will capture responsible party information for applications submitted ***2***.
Page 25
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
Page 26
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
Appendix V
Glossary of Terms
Term Definition
*********************************2*********************************************
********2********
*****************************2*********************************.
The IRS database that consists of federal tax-related transactions and
Business Master File accounts for businesses. These include employment taxes, income taxes on
businesses, and excise taxes.
This process identifies the risks to system security and determines the
Digital Identity Risk
probability of occurrence, the resulting impact, and the additional
Assessment
safeguards that would mitigate the impact.
A refundable tax credit for certain eligible businesses and tax-exempt
Employee Retention Credit
organizations that had employees and were affected during the pandemic.
Employer Identification
A unique, nine-digit number used to identify a taxpayer’s business account.
Number
Any yearly accounting period, regardless of its relationship to a calendar
Fiscal Year year. The federal government’s fiscal year begins on October 1 and ends on
September 30.
Verifying the claimed identity of an applicant by collecting and validating
Identity Proofing sufficient information, e.g., identity history, credentials, and documents,
about a person.
Integrated Data Retrieval An IRS computer system capable of retrieving or updating stored
System information. It works in conjunction with a taxpayer’s account records.
The primary source of instructions to employees relating to the
Internal Revenue Manual administration and operation of the IRS. The Manual contains the directions
employees need to carry out their operational responsibilities.
****************************************2**************************************
**********2*************** *************************************2**************************************
***************2************.
The process of updating, improving, and bringing in line with modern
Modernization
standards.
Modernized Internet
An online application for EINs in a question-and-answer format that
Employer Identification
replaced the online Form SS-4 in 2007.
Number
A compilation of selected entity data from various IRS Master Files and the
National Account Profile
Social Security Administration.
A part of the Department of Commerce that is responsible for developing
National Institute of
standards and guidelines to provide adequate information security for all
Standards and Technology
federal agency operations and assets.
Page 27
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
Term Definition
The principal officer, general partner, grantor, owner, trustor, or executor
Responsible Party who controls, manages, or directs the applicant entity and the disposition
of its funds and assets.
A part of the Rehabilitation Act of 1973, requiring federal agencies to make
Section 508 their electronic and information technology accessible to people with
disabilities.
A nine-digit number issued to an individual by the Social Security
Social Security Number Administration. The IRS uses this number to process tax documents and
returns.
A nine-digit number assigned to taxpayers for identification purposes.
Taxpayer Identification
Depending upon the nature of the taxpayer, it can be an EIN, an SSN, or an
Number
Individual Taxpayer Identification Number.
Page 28
Further Improvements Are Needed to Strengthen the
Controls for Issuing Employer Identification Numbers
Appendix VI
Abbreviations
CARES Coronavirus Aid, Relief, and Economic Security
DIRA Digital Identity Risk Assessment
EIN Employer Identification Number
IAL Identity Assurance Level
IRM Internal Revenue Manual
IRS Internal Revenue Service
Mod IEIN Modernized Internet Employer Identification Number
NIST National Institute of Standards and Technology
SSN Social Security Number
TIGTA Treasury Inspector General for Tax Administration
TIN Taxpayer Identification Number
Page 29
To report fraud, waste, or abuse,
contact our hotline on the web at
https://www.tigta.gov/reportcrime-misconduct.
To make suggestions to improve IRS policies, processes, or systems
affecting taxpayers, contact us at www.tigta.gov/form/suggestions.
Information you provide is confidential, and you may remain anonymous.
File and source
- File
- 2025400036fr.pdf
- Size
- 3,231,533 bytes
- SHA-256
- 15115cd9283d8a25ca116177ea27b8511811939cb6325c734f4c7bcbfed0f08d
- Our copy
- 2025400036fr.pdf
- Original
- No public link identified.