Connect with us

Accounting

TIGTA faults IRS on data security, cloud security in separate reports

Published

on

The Treasury Inspector General for Tax Administration, in two reports, critiqued the IRS on cybersecurity for both its data warehouse and its cloud infrastructure.

Data warehouse security

One report specifically pertained to the IRS’s Compliance Data Warehouse, effectively a massive data warehouse containing multiple years of federal tax information and personally identifiable information consolidated from multiple sources, internal and external to the IRS. The CDW offers a broad range of databases that research analysts may access through a variety of data analytic tools. This includes things like Individual Master File data, Business Master File data, tax return data, taxpayer contact information, conversations between a taxpayer and an IRS agent, and actions that took place on behalf of the IRS. As one might imagine, the IRS considers it very important for this data to remain secure. This is why it is required to record audit trails in the system’s security documentation for indications of inappropriate or unusual activity. However, TIGTA said the tools used to visualize audit trails associated with the Event ID data field, specifically CDW logins, failed to accurately display the login data field, with the result that the available login data were both incomplete and unreliable. For example, TIGTA found that from March 2023 to July 2023, the repository was not displaying any audit trails that contained CDW login information at all.

TIGTA said this can be attributed to two root causes. First is that, within the CDW Platform Audit Worksheets, the coding script used to identify system logins in the CDW logs was referencing an incorrect file name. Upon recognizing the error, IRS alerted the appropriate cybersecurity officials and continued to collaborate to identify and implement a resolution. Second, when the login information search period is greater than 90 days, the search does not return complete and accurate login information. As of April 3, 2024, the exact cause of this error was still unknown; however, cybersecurity officials are continuing to troubleshoot the issue. The IRS reports that restricting the search to 90 days or fewer helps manage performance and response time, given the sheer volume of CDW log data. The IRS plans to add a note to the audit trail repository to advise about the 90-day limitation and noted that multiple searches for 90 days or fewer may be run.

Further, TIGTA said that while actionable events require timely review to determine if additional escalation or notifications are needed, the Compliance and Audit Monitoring team is not reviewing any of them. A management official stated that CDW’s actionable events are not being reviewed because of a miscommunication between the Compliance and Audit Monitoring team and CDW personnel, and that the team began the review of all required actionable audit events in March 2024. Further, TIGTA said the monitoring that is being done is highly inefficient, as the IRS’s audit trail repository does not permit users to export or download multiple auditable or actionable events at the same time. As a result, the team is restricted to reviewing, analyzing and reporting on singular audit events. 

TIGTA did, however, concede that all 1,173 CDW users as of April 2024 completed each of the four mandatory training courses. However, mandatory training requirements for unpaid hires (academic researchers and student volunteers) were not managed via the Integrated Talent Management system. According to management officials from the IRS’s Human Capital Office, this limitation was due to an integration issue within the agency’s human resources system. While TIGTA found that the current manual process for tracking training requirements for unpaid hires is functional, it does not afford any type of verification that the training was actually completed. 

TIGTA recommended that: 1) the IRS’s chief data and analytics officer ensure the agency’s audit trail repository accurately displays and reports all CDW login information; 2) the chief information officer ensure that all required actionable audit events for the CDW are reviewed; 3) the CIO ensure that automated mechanisms are incorporated into the actionable audit event escalation process; 4) the CIO and chief data and analytics officer ensure that identified vulnerabilities are timely remediated; and 5) the chief data and analytics officer ensure that all CDW servers are included in configuration compliance scans. The IRS agreed with all five recommendations. 

Cloud infrastructure security

TIGTA, in another report, faulted the IRS for its cloud security assessment, approval and monitoring process, saying it was not maintaining appropriate separation of duties for certain roles related to cloud systems, and did not follow guidance meant to prevent conflicts of interest, increasing the risk of erroneous and inappropriate actions.

Specifically, inspectors determined that 35 (70%) of the 50 cloud systems reviewed had the same individuals assigned as either the authorizing official or the AO’s designated representative and system owner. The remaining 15 (30%) of the 50 cloud systems reviewed demonstrated appropriate separation of duty with different individuals assigned as the AO or the AO-designated representative and system owner. 

While the National Institute of Standards and Technology guidelines recommend that organizations ensure there are no conflicts of interest when assigning the same individual to multiple risk management roles, there was no IRS policy statement that specifically prevented the roles from being occupied by the same person. After this issue was brought to management’s attention, IRS officials stated they will review the NIST guidance and work to ensure that updates are made as appropriate to have different individuals occupy these roles. 

TIGTA also noted that the IRS was not preparing summary reports for 11 (22%) of 50 cloud systems every month as required. The Cloud Continuous Monitoring Strategic Operating Plan requires cloud  information system security officers to prepare a monthly summary report for each of their assigned systems and provide it to the system’s AO. Further, summary reports for 45 of the 50 cloud systems identified that the reports were missing required information. Also, 31 of the 45 cloud systems reviewed were missing the trackable Plan of Action and Milestones weakness identification number on the summary report. And security documents were missing approvals or were not properly approved within the Department of the Treasury data repository. Specifically, the repository was missing five (10%) of the 50 cloud systems’ Authorization-to-Operate memorandums. Finally, 15 of 50 cloud systems were missing required  Federal Risk and Authorization Management Program Security Threat Analysis Reports. 

TIGTA recommended that the IRS’s chief information officer ensure that: 1) separation of duty controls reflect guidance and require that all cloud systems have a unique System Owner and Authorizing Official; 2) an Authorization-to-Operate memorandum is approved for the system to remain in production; 3) summary reports are timely created; 4) procedures are updated; 5) management approvals are consistent and documented; and 6) the Cloud Security Assessment and Authorization process is completed annually. The IRS agreed with four recommendations and plans to ensure separation of duty controls reflect guidance; the system obtains authorization; that summary reports are timely created; and that management approvals are documented. The IRS disagreed with two recommendations, stating its weakness summary reporting is sufficient without unique identifiers and that cloud security assessments are completed in accordance with existing procedures.

Continue Reading

Accounting

The basics of tax-aware long-short investment strategies

Published

on

Financial advisors and clients seeking to boost the tax savings available through loss harvesting may consider an increasingly popular leveraging strategy known as the “long-short” method.

The combination of “long” investments on a stock’s positive outlook with “short” ones based on equity declines, plus margin loans that add debt leverage to the vehicle, may turn off some advisors with risk-averse clients who don’t have a lot of capital gains that need offsetting. But tax-aware long-short investing is drawing clients seeking to maximize returns through active management on a lengthy timeline with lower payments to Uncle Sam.

At their root, tax-aware long-short vehicles present “an opportunity to go overweight certain factors and go underweight certain factors and find alpha between the two,” said Brent Sullivan, a consultant on taxable investing product distribution to sub-advisory and ETF firms who writes the Tax Alpha Insider blog. The accompanying tax savings stem from loss harvesting that “oftentimes will exceed a dollar contributed” or could even reach 200% to 400% of the principal, he noted. Continual rebalancing pushes up the losses past the level available from many direct indexing strategies in a process Sullivan compares to a “perpetual ball machine.”

“The loss harvesting paradigm here is just totally different than a direct indexing long-only,” Sullivan said. “As the market goes up, you can continue shorting. Those shorts generate harvestable losses.”

READ MORE: How the ticking clock affects tax-loss harvesting

A ‘rapidly growing but sometimes confusing area’

Much like his research documenting the continual rise in Section 351 conversions to ETFs, Sullivan is keeping close watch on tax-aware long-short vehicles, which have already surpassed his prediction of attracting $30 billion in assets under management by the end of the year. AQR Capital Management, a pioneer in tax-aware long-short strategies, is leading the way with $21.7 billion, but other managers such as Invesco, BlackRock and Quantinno have pushed the total above at least $35 billion, Sullivan noted in a newsletter last month.

“Today, advisers recognize that tax is a practice differentiator and a source of recurring client value,” Sullivan wrote. “They may be torn between low-cost, passive index ETFs and direct indexing, but that debate fades into the background once they learn of tax-aware long/short strategies.”

On the other hand, AQR itself is seeking to “help parse the jargon of this rapidly growing but sometimes confusing area” amid some “blurring of terminology, strategy design and investment objectives,” the asset management firm said in a blog post earlier this year. The company pushed back on the idea that the strategies are “only for billionaires” or simply trying to achieve benchmark returns, along with the notion that they are a form of “supercharged direct indexing.” While their tax benefits “are larger and last longer” than those of direct indexing, the two strategies come from “diametrically opposite starting points (active management for the former versus passive indexing for the latter),” the post said.

“Tax-aware long-short factor strategies realize higher tax benefits than direct indexing not because they try harder, but because they (1) trade quite a bit due to changes in pretax alpha, (2) hold large positions relative to invested capital due to leverage, and (3) can slow unnecessary gain recognition without significantly impacting pretax alpha, thanks to relatively long holding periods and highly diversified portfolios,” the company wrote. “The core strength of tax-aware long-short strategies lies in their ability to align pretax performance with the needs of tax-sensitive investors.”

READ MORE: A complex but tax-friendly approach to diversification

Estate implications

Those characteristics may eventually pose tax problems with a client’s estate plans, Sulllivan noted. Estates face an obligation to settle any debts.

“The strategy is effectively over,” he told FP. “You will realize a ton of capital gains if you suddenly, without planning, close the long and short positions.”

Advisors and their clients could take steps to wind down the leverage “years and years in advance” with as low tax exposure as possible, he said. Or they could set up an intentionally defective grantor trust or another entity instructing the trustee to manage the strategy based on a “prudent investor standard” and a long-term plan for the estate and its heirs, Sullivan said.

Since “you do not want to be auto-liquididated” upon the benefactor’s death, some of the “the brightest minds out there are thinking about trust structures” to hold the tax-aware long-short strategies, he said.

“That can be a real tax drag for any assets passing to beneficiaries,” Sullivan said. “What you do is, make sure that the trust is properly structured to continue holding margin and short positions. You’re essentially transferring the entire balance sheet of the strategy.”

Continue Reading

Accounting

House tax bill calls for $30K SALT, omits millionaire tax

Published

on

The House tax committee is seeking to increase the state and local deduction and make official several of President Donald Trump’s campaign tax pledges in a multitrillion-dollar package that will serve as Republicans’ signature legislative effort.

The House Ways and Means Committee release of the tax measures, ahead of planned debate on the panel Tuesday, is a sign the Republican-controlled chamber is moving toward a floor vote this month on the legislation. The bill aims to cut taxes by more than $4 trillion and reduce spending by at least $1.5 trillion over a decade.

The proposal doesn’t include a tax hike on the wealthiest Americans, after weeks of debate among Republicans about whether to raise levies on millionaires. The bill would permanently extend the 37% top rate for individuals that was set in Trump’s 2017 tax law. That’s despite Trump telling Speaker Mike Johnson as recently as last week that he wanted a 39.6% rate for individuals making more than $2.5 million.

The package — which Trump has dubbed his “one big, beautiful bill” is the centerpiece of his legislative agenda. It renews many of his first-term tax cuts, set to expire at the end of the year. But narrow Republican margins in the House mean that the president needs near-unanimous support from his party to pass the bill.

The bill would raise the nation’s borrowing limit by $4 trillion. This is smaller than the Senate’s preferred $5 trillion level. Lawmakers are hoping to push any additional votes on raising the debt ceiling until after the 2026 midterms.

The draft language eliminates income taxes on tips and overtime pay through 2028. House Ways and Means Committee Chairman Jason Smith had vowed to follow through on Trump’s campaign pledges to end those levies.

Trump had also campaigned on ending taxes on Social Security benefits, but that cannot be done in the special budget process that Congress is using to advance the tax package. Instead, the bill provides a $4,000 bonus for seniors on top of the regular standard deduction.

One of the thorniest issues — including a contentious standoff over increasing the state and local tax deduction — is still not resolved. The draft calls for increasing the state and local tax deduction to $30,000 for both individuals and couples, up from $10,000, with income limits for single taxpayers earning $200,000 or joint filers making twice that. But some lawmakers representing high-tax areas want an even bigger tax break — as much as $124,000 for joint filers.

On the hook for tax increases: wealthy private universities, which could see an increase in the levy on endowments from 1.4% to as high as 21% on investment income. 

Johnson told reporters Monday that the House is on track to pass the legislation by Memorial Day. It would then go to the Senate, where it could be subject to major revisions.

The new details come after the tax-writing committee released some initial provisions late Friday. Those included raising the maximum child tax credit to $2,500 from $2,000 and increasing the standard deduction, both retroactive to 2025 to put more money in voters’ pockets before the 2026 election. 

The bill also raises the estate tax exemption to $15 million and increases the 20% deduction for closely-held businesses to 23%.

Continue Reading

Accounting

Jon Voight joins studios, unions to press Trump for film aid

Published

on

President Donald Trump’s Hollywood ambassadors joined studios, labor unions and producers in asking the White House to expand and extend tax incentives as part of an upcoming budget reconciliation bill.

A letter dated Monday asked the president to include three film and TV incentives in the budget bill being drafted by Congress. The coalition includes the Motion Picture Association, which represents Hollywood studios, as well as unions of writers, actors and other trades.

Actor Jon Voight, who was named one of three special ambassadors to Hollywood in January, is leading the effort to obtain assistance from Washington to boost US film and TV jobs. The groups signing the letter represent nearly 400,000 industry professionals. Sylvester Stallone, another Trump ambassador, also signed the letter.

The U.S. film and TV industry has struggled in recent years as entertainment companies reduced their spending and moved production overseas, where cheaper labor and more generous government subsidies make their business more profitable. 

The letter doesn’t mention tariffs on foreign film production, which Trump said he would pursue in a social media post on May 4. His 100% tariff proposal, made after a visit with Voight, sent the shares of studios such as Netflix Inc. and Walt Disney Co. tumbling as investors considered the possibility of rising costs and a trade war in the entertainment business. 

The specific proposals in the new letter involve reviving Section 199 of the tax code, which provided deductions for manufacturing to film and TV production, extending Section 181, which allows for accelerated deductions, and restoring Section 461, which lets businesses use past losses to reduce future taxes.

Continue Reading

Trending