Connect with us

Accounting

TIGTA faults IRS on data security, cloud security in separate reports

Published

on

The Treasury Inspector General for Tax Administration, in two reports, critiqued the IRS on cybersecurity for both its data warehouse and its cloud infrastructure.

Data warehouse security

One report specifically pertained to the IRS’s Compliance Data Warehouse, effectively a massive data warehouse containing multiple years of federal tax information and personally identifiable information consolidated from multiple sources, internal and external to the IRS. The CDW offers a broad range of databases that research analysts may access through a variety of data analytic tools. This includes things like Individual Master File data, Business Master File data, tax return data, taxpayer contact information, conversations between a taxpayer and an IRS agent, and actions that took place on behalf of the IRS. As one might imagine, the IRS considers it very important for this data to remain secure. This is why it is required to record audit trails in the system’s security documentation for indications of inappropriate or unusual activity. However, TIGTA said the tools used to visualize audit trails associated with the Event ID data field, specifically CDW logins, failed to accurately display the login data field, with the result that the available login data were both incomplete and unreliable. For example, TIGTA found that from March 2023 to July 2023, the repository was not displaying any audit trails that contained CDW login information at all.

TIGTA said this can be attributed to two root causes. First is that, within the CDW Platform Audit Worksheets, the coding script used to identify system logins in the CDW logs was referencing an incorrect file name. Upon recognizing the error, IRS alerted the appropriate cybersecurity officials and continued to collaborate to identify and implement a resolution. Second, when the login information search period is greater than 90 days, the search does not return complete and accurate login information. As of April 3, 2024, the exact cause of this error was still unknown; however, cybersecurity officials are continuing to troubleshoot the issue. The IRS reports that restricting the search to 90 days or fewer helps manage performance and response time, given the sheer volume of CDW log data. The IRS plans to add a note to the audit trail repository to advise about the 90-day limitation and noted that multiple searches for 90 days or fewer may be run.

Further, TIGTA said that while actionable events require timely review to determine if additional escalation or notifications are needed, the Compliance and Audit Monitoring team is not reviewing any of them. A management official stated that CDW’s actionable events are not being reviewed because of a miscommunication between the Compliance and Audit Monitoring team and CDW personnel, and that the team began the review of all required actionable audit events in March 2024. Further, TIGTA said the monitoring that is being done is highly inefficient, as the IRS’s audit trail repository does not permit users to export or download multiple auditable or actionable events at the same time. As a result, the team is restricted to reviewing, analyzing and reporting on singular audit events. 

TIGTA did, however, concede that all 1,173 CDW users as of April 2024 completed each of the four mandatory training courses. However, mandatory training requirements for unpaid hires (academic researchers and student volunteers) were not managed via the Integrated Talent Management system. According to management officials from the IRS’s Human Capital Office, this limitation was due to an integration issue within the agency’s human resources system. While TIGTA found that the current manual process for tracking training requirements for unpaid hires is functional, it does not afford any type of verification that the training was actually completed. 

TIGTA recommended that: 1) the IRS’s chief data and analytics officer ensure the agency’s audit trail repository accurately displays and reports all CDW login information; 2) the chief information officer ensure that all required actionable audit events for the CDW are reviewed; 3) the CIO ensure that automated mechanisms are incorporated into the actionable audit event escalation process; 4) the CIO and chief data and analytics officer ensure that identified vulnerabilities are timely remediated; and 5) the chief data and analytics officer ensure that all CDW servers are included in configuration compliance scans. The IRS agreed with all five recommendations. 

Cloud infrastructure security

TIGTA, in another report, faulted the IRS for its cloud security assessment, approval and monitoring process, saying it was not maintaining appropriate separation of duties for certain roles related to cloud systems, and did not follow guidance meant to prevent conflicts of interest, increasing the risk of erroneous and inappropriate actions.

Specifically, inspectors determined that 35 (70%) of the 50 cloud systems reviewed had the same individuals assigned as either the authorizing official or the AO’s designated representative and system owner. The remaining 15 (30%) of the 50 cloud systems reviewed demonstrated appropriate separation of duty with different individuals assigned as the AO or the AO-designated representative and system owner. 

While the National Institute of Standards and Technology guidelines recommend that organizations ensure there are no conflicts of interest when assigning the same individual to multiple risk management roles, there was no IRS policy statement that specifically prevented the roles from being occupied by the same person. After this issue was brought to management’s attention, IRS officials stated they will review the NIST guidance and work to ensure that updates are made as appropriate to have different individuals occupy these roles. 

TIGTA also noted that the IRS was not preparing summary reports for 11 (22%) of 50 cloud systems every month as required. The Cloud Continuous Monitoring Strategic Operating Plan requires cloud  information system security officers to prepare a monthly summary report for each of their assigned systems and provide it to the system’s AO. Further, summary reports for 45 of the 50 cloud systems identified that the reports were missing required information. Also, 31 of the 45 cloud systems reviewed were missing the trackable Plan of Action and Milestones weakness identification number on the summary report. And security documents were missing approvals or were not properly approved within the Department of the Treasury data repository. Specifically, the repository was missing five (10%) of the 50 cloud systems’ Authorization-to-Operate memorandums. Finally, 15 of 50 cloud systems were missing required  Federal Risk and Authorization Management Program Security Threat Analysis Reports. 

TIGTA recommended that the IRS’s chief information officer ensure that: 1) separation of duty controls reflect guidance and require that all cloud systems have a unique System Owner and Authorizing Official; 2) an Authorization-to-Operate memorandum is approved for the system to remain in production; 3) summary reports are timely created; 4) procedures are updated; 5) management approvals are consistent and documented; and 6) the Cloud Security Assessment and Authorization process is completed annually. The IRS agreed with four recommendations and plans to ensure separation of duty controls reflect guidance; the system obtains authorization; that summary reports are timely created; and that management approvals are documented. The IRS disagreed with two recommendations, stating its weakness summary reporting is sufficient without unique identifiers and that cloud security assessments are completed in accordance with existing procedures.

Continue Reading

Accounting

XcelLabs launches to help accountants use AI

Published

on

Jody Padar, an author and speaker known as “The Radical CPA,” and Katie Tolin, a growth strategist for CPAs, together launched a training and technology platform called XcelLabs.

XcelLabs provides solutions to help accountants use artificial technology fluently and strategically. The Pennsylvania Institute of CPAs and CPA Crossings joined with Padar and Tolin as strategic partners and investors.

“To reinvent the profession, we must start by training the professional who can then transform their firms,” Padar said in a statement. “By equipping people with data and insights that help them see things differently, they can provide better advice to their clients and firm.”

Padar-Jody- new 2019

Jody Padar

The platform includes XcelLabs Academy, a series of educational online courses on the basics of AI, being a better advisor, leadership and practice management; Navi, a proprietary tool that uses AI to help accountants turn unstructured data like emails, phone calls and meetings into insights; and training and consulting services. These offerings are currently in beta testing.

“Accountants know they need to be more advisory, but not everyone can figure out how to do it,” Tolin said in a statement. “Couple that with the fact that AI will be doing a lot of the lower-level work accountants do today, and we need to create that next level advisor now. By showing accountants how to unlock patterns in their actions and turn client conversations into emotionally intelligent advice, we can create the accounting professional of the future.”

Tolin-Katie-CPA Growth Guides

Katie Tolin

“AI is transforming how CPAs work, and XcelLabs is focused on helping the profession evolve with it,” PICPA CEO Jennifer Cryder said in a statement. “At PICPA, we’re proud to support a mission that aligns so closely with ours: empowering firms to use AI not just for efficiency, but to drive growth, value and long-term relevance.”

Continue Reading

Accounting

Accounting is changing, and the world can’t wait until 2026

Published

on

The accountant the world urgently needs has evolved far beyond the traditional role we recognized just a few years ago. 

The transformation of the accounting profession is not merely an anticipated change; it is a pressing reality that is currently shaping business decisions, academic programs and the expected contributions of professionals. Yet, in many areas, accounting education stubbornly clings to outdated, overly technical models that fail to connect with the actual demands of the market. We must confront a critical question: If we continue to train accountants solely to file tax reports, are we truly equipping them for the challenges of today’s world? 

This shift in mindset extends beyond individual countries or educational systems; it is a global movement. The recent announcement of the CIMA/CGMA 2026 syllabus has made it unmistakably clear: merely knowing how to post journal entries is insufficient. Today’s accountants are required to interpret the landscape, anticipate risks and act with strategic awareness. Critical thinking, sustainable finance, technology and human behavior are not just supplementary topics; they are essential components in the education of any professional seeking to remain relevant. 

The CIMA/CGMA proposal for 2026 is not just a curriculum update; it is a powerful manifesto. This new program positions analytical thinking, strategic business partnering and technology application at the core of accounting education. It unequivocally highlights sustainability, aligning with IFRS S1 and S2, and expands the accountant’s responsibilities beyond mere numbers to encompass conscious leadership, environmental impact and corporate governance. 

The current changes in the accounting profession underscore an urgent shift in expectations from both educators and employers. Today, companies of all sizes and industries demand accountants who can do far more than interpret balance sheets. They expect professionals who grasp the deeper context behind the numbers, identify inconsistencies, anticipate potential issues before they escalate into losses, and act decisively as a bridge between data and decision making. 

To meet these expectations, a radical mindset shift is essential. There are firms still operating on autopilot, mindlessly repeating tasks with minimal critical analysis. Likewise, many academic programs continue to treat accounting as purely a technical discipline, disregarding the vital elements of reflection, strategy and behavioral insight. This outdated approach creates a significant mismatch. While the world forges ahead, parts of the accounting profession remain stuck in the past. 

The consequences of this shift are already becoming evident. The demand for compliance, transparency and sustainability now applies not only to large corporations but also to small and mid-sized businesses. Many of these organizations rely on professionals ill-equipped to drive the necessary changes, putting both business performance and the reputation of the profession at risk. 

The positive news is that accountants who are ready to thrive in this new era do not necessarily need additional degrees. What they truly need is a commitment to awareness, a dedication to continuous learning, and the courage to step beyond their comfort zones. The future of accounting is here, and it is firmly rooted in analytical, strategic and human-oriented perspectives. The 2026 curriculum is a clear indication of the changes underway. Those who fail to think critically and holistically will be left behind. 

In contrast, accountants who see the big picture, understand the ripple effects of their decisions, and actively contribute to the financial and ethical health of organizations will undeniably remain indispensable, anywhere in the world.

Continue Reading

Accounting

Republicans push Musk aside as Trump tax bill barrels forward

Published

on

Congressional Republicans are siding with Donald Trump in the messy divorce between the president and Elon Musk, an optimistic sign for eventual passage of a tax cut bill at the root of the two billionaires’ public feud.

Lawmakers are largely taking their cues from Trump and sticking by the $3 trillion bill at the center of the White House’s economic agenda. Musk, the biggest political donor of the 2024 cycle, has threatened to help primary anyone who votes for the legislation, but lawmakers are betting that staying in the president’s good graces is the safer path to political survival.

“The tax bill is not in jeopardy. We are going to deliver on that,” House Speaker Mike Johnson told reporters on Friday.

“I’ll tell you what — do not doubt, don’t second guess and do not challenge the President of the United States Donald Trump,” he added. “He is the leader of the party. He’s the most consequential political figure of our time.”

A fight between Trump and Musk exploded into public view this week. The sparring started with the tech titan calling the president’s tax bill a “disgusting abomination,” but quickly escalated to more personal attacks and Trump threatening to cancel all federal contracts and subsidies to Musk’s companies, such as Tesla Inc. and SpaceX which have benefitted from government ties.

Republicans on Capitol Hill, who had —  until recently — publicly embraced Musk, said they weren’t swayed by the billionaire’s criticism that the bill cost too much. Lawmakers have refuted official estimates of the package, saying that the tax cuts for households, small businesses and politically important groups — including hospitality and hourly workers — will generate enough economic growth to offset the price tag.

“I don’t tell my friend Elon, I don’t argue with him about how to build rockets, and I wish he wouldn’t argue with me about how to craft legislation and pass it,” Johnson told CNBC earlier Friday.

House Budget Committee Chair Jodey Arrington told reporters that House lawmakers are focused on working with the Senate as it revises the bill to make sure the legislation has the political support in both chambers to make it to Trump’s desk for his signature. 

“We move past the drama and we get the substance of what is needed to make the modest improvements that can be made,” he said.

House fiscal hawks said that they hadn’t changed their prior positions on the legislation based on Musk’s statements. They also said they agree with GOP leaders that there will be other chances to make further spending cuts outside the tax bill. 

Representative Tom McClintock, a fiscal conservative, said “the bill will pass because it has to pass,” adding that both Musk and Trump needed to calm down. “They both need to take a nap,” he said.

Even some of the House bill’s most vociferous critics appeared resigned to its passage. Kentucky Representative Thomas Massie, who voted against the House version, predicted that despite Musk’s objections, the Senate will make only small changes.

“The speaker is right about one thing. This barely passed the House. If they muck with it too much in the Senate, it may not pass the House again,” he said.

Trump is pressuring lawmakers to move at breakneck speed to pass the tax-cut bill, demanding they vote on the bill before the July 4 holiday. The president has been quick to blast critics of the bill — including calling Senator Rand Paul “crazy” for objecting to the inclusion of a debt ceiling increase in the package.

As the legislation worked its way through the House last month, Trump took to social media to criticize holdouts and invited undecided members to the White House to compel them to support the package. It passed by one vote.

Senate Majority Leader John Thune — who is planning to unveil his chamber’s version of the bill as soon as next week — said his timeline is unmoved by Musk. 

“We are already pretty far down the trail,” he said.

Continue Reading

Trending