Actions Are Needed to Improve the Safeguarding of Taxpayer Information at Volunteer Program Sites

The Commissioner, Wage and Investment Division, should issue guidance to Volunteer Program partners requiring the development of an information security plan for each of their sites. The guidance should detail the elements to be included in this plan and the need to review the plan with volunteers and retain the plan at the site. IRS site review procedures should also be updated to include verification of the information security plan.

The Commissioner, Wage and Investment Division, should require site coordinators to use the security feature included in the tax preparation software to restrict volunteers' access to prepared returns.

The Commissioner, Wage and Investment Division, should develop processes and procedures to confirm site coordinators are aware of security requirements and hold discussions with volunteers at the sites to review these security requirements.

The Commissioner, Wage and Investment Division, should ensure that site reviews include an assessment of compliance with security controls outlined in Publication 4299. This assessment should determine if the site being reviewed uses a wireless computer connection and, if so, that a required risk assessment is completed. The assessment should also include steps to identify and verify proper storage of taxpayer information.

The Commissioner, Wage and Investment Division, should update procedures for partners to validate volunteers' identity using only Government-issued identification prior to participating in the Volunteer Program.