The Treasury Inspector General for Tax Administration said the IRS has failed to address literally tens of thousands of security vulnerabilities in both its mainframe platform environment and its security application environment. While there had been some improvement from the beginning of this year, inspectors still found that the majority of vulnerabilities had yet to be fully addressed.
Specifically, the Mainframe Platform Environment was found to have 80 unresolved vulnerabilities across 18 assets, of which 67 (84% of them) were “overdue,” or “not mitigated within required time frames.” Of these vulnerabilities, 15 were considered critical risk and 30 were considered high risk. Inspectors followed up in July and found that there were now 75 unresolved vulnerabilities across 17 assets, of which 59 (79% percent of them) were overdue. During this followup, four were considered critical risk and 27 were considered high risk.
TIGTA said that Enterprise Operations personnel are aware of these overdue vulnerabilities and are working to mitigate the risk through a Plan of Action and Milestones, but noted that this seemed to all be in response to inspectors’ findings, as this activity was only begin shortly after they had begun planning for this audit in October 2023. Inspectors found even more grim results when looking at the Security Application Environment. They identified a total of 56,537 unresolved vulnerabilities across 580 assets, of which 59% were overdue. Of these vulnerabilities, 6% were considered critical risks, and 41% were considered high risk. When TIGTA followed up in July, they found there were 43,290 overdue vulnerabilities affecting 570 assets. Of them, 4% were considered critical risk and 55% were considered high risk.
While one might think all these vulnerabilities are the result of lax cybersecurity, professionals with the IRS, in response to the TIGTA findings, said it’s actually the opposite. The agency had recently transitioned into a new and improved scanning tool, which led to the discovery of far more vulnerabilities than before. While Enterprise Operations and Cybersecurity personnel agree that vulnerabilities persist, they likely would not have found them at all had they not moved to a better scanning tool.
Further, TIGTA found that Internet Protocol addresses were not always assigned to the correct environments. Specifically, the IRS did not properly assign 123 Internet Protocol addresses to the Mainframe Platform Environment and 62 Internet Protocol addresses to the Security Application Environment. Further, 99 Internet Protocol addresses of the Security Application Environment assets were outside of the assigned range. Lastly, a total of 743 assets used noncompliant configurations across both environments. IRS management was less concerned about this, saying that the IP address range assigned by User and Network Services is not a significant factor in the creation and management of information technology assets.
Management further noted that the IRS inventory system has limitations to the identification of assets. As a result, when an asset cannot be reconciled due to this limitation, it will be placed into the temporary or unknown repositories, sometimes leading to duplicate assets. The IRS is in process of migrating to a new system that will have more robust capabilities and resolve the issue of items being incorrectly assigned to temporary and unknown repositories.
TIGTA said that, until the new system is functional, assets found in more than one GSS or Major Application calls into question the overall accountability for asset assignment
TIGTA recommended that the Chief Information Officer should:
1) timely remediate or mitigate all vulnerabilities in accordance with IRS policies;
2) ensure that assets are assigned to an established group;
3) ensure that systems are in place to reconcile duplicate accounting of assets;
4) reconcile assets to reflect the operating environment;
5) evaluate temporary repositories to establish ownership of assets; and
6) resolve configuration compliance settings in accordance with Federal and IRS policies.
The IRS agreed with five recommendations and plans to review vulnerability remediation processes, implement zero trust best practices to remove physical assets not properly documented, collaborate with authorizing officials to reconcile assets, and ensure that configuration settings meet Federal and IRS policies. The IRS disagreed with reconciling Internet Protocol addresses to assets to reflect the operating environment. TIGTA responded to the disagreement.
The Internal Revenue Service is reportedly planning layoffs of thousands of first-year probationary employees in the midst of tax season, perhaps as soon as this week.
The layoffs are set to occur despite assurances that the IRS would wait until May 15, a month after the end of tax season, before it would accept voluntary buyout offers under the Trump administration’s “deferred resignation” program. The administration instead moved to end that program last week soon after a federal judge allowed it to proceed. The buyout offer was accepted by approximately 75,000 federal employees.
The IRS and the National Treasury Employees Union did not immediately respond to requests for comment, but multiple news outlets, including the Associated Press, the New York Times, the Washington Post, NBC News and Fox News have reported on the plans. The cuts come after a team from the Elon Musk-led Department of Government Efficiency reportedly met with top IRS officials and sought access to sensitive taxpayer information that is normally closely guarded by IRS employees.
The American Institute of CPAs released a statement Sunday stressing the need for the IRS to have the ability to meet the needs of taxpayers and tax preparers during this filing season:
“For many years, one of the top priorities at the AICPA has been to promote efforts that ensure the IRS has the appropriate resources to meet the needs of taxpayers and preparers,” said the AICPA. “Our goal is to support taxpayers and our members during times of uncertainty and to provide guidance to help navigate any changes that may affect critical, time-sensitive interactions with the IRS. Many are concerned with potential challenges that could arise from recent changes throughout government. While there is a lot of speculation and many unknowns, the AICPA is actively monitoring the situation and engaging with IRS leadership and other key stakeholders to understand and mitigate the impact of these changes on IRS services. IRS service levels and modernization efforts have seen progress since the COVID-19 pandemic and we are committed to seeing those efforts continue. Americans deserve a fully functioning agency that can be respected by taxpayers and their preparers, thereby allowing them to comply with their tax obligations.”
The move to fire the probationary employees at the IRS comes as the Trump administration and DOGE have begun widespread layoffs at other departments of the federal government, not only of first-year employees, but of longer-serving employees who had earned civil service protections, along with effective shutdowns of agencies such as the U.S. Agency for International Development and the Consumer Financial Protection Bureau. That has prompted lawsuits and protests in Washington, D.C., and other cities across the country, but the layoffs have been paused at the CFPB for now by a federal judge. The same could happen with the IRS.
Expect plenty of changes in the world of tax under the new administration.
On Inauguration Day, President Donald Trump signed an executive order calling for a longer hiring freeze at the Internal Revenue Service than he was imposing on other federal agencies, as well as another executive order rejecting U.S. participation in the Organization for Economic Cooperation and Development’s two-pillar global tax framework. He also called for sending armed IRS agents to patrol the Mexican border, which the Department of Homeland Security later requested of the Treasury Department.
Republicans in Congress are currently negotiating the contours of an extension of Trump’s signature tax legislation, the Tax Cuts and Jobs Act of 2017, along with his campaign promises of exempting certain kinds of income, such as tips, Social Security income and overtime, from taxes.
Mark Everson, a former IRS commissioner who is currently vice chairman of Alliant, a tax consulting firm in Washington, D.C., believes the administration under Treasury Secretary Scott Bessent will focus on the international front with tariffs and sanctions.
“It will be relatively more aggressive in the international arena,” said Everson. However, he believes the OECD tax deal would only be implemented through an act of Congress in the aftermath of Trump’s executive order.
(For insights on the new administration’s impact on other areas of regulation, like the PCAOB, see our feature article.)
He also expects to see changes at the IRS, with less emphasis on enforcement and diversity, equity and inclusion programs. “Consistent with the move against DEI, my guess would be a return to enforcement without scrutiny of results by racial grouping,” said Everson. “There’s a lot of discussion of the impact disproportionately on minorities through the Earned Income Tax Credit in terms of audit rates. I don’t think that will be considered in this approach going forward, given what they’ve already done with the abolition of the DEI offices, including, as I understand it, at the service.”
However, he expects to see continuing improvements in taxpayer service. “I do think that there will be common ground in terms of emphasis on service improvements,” said Everson. “I’m not suggesting that everything at the IRS is going to stop. Hardly. The Republicans feel very strongly about the need for good service, and I think that will be a focus of the administration once, presumably, Commissioner [Billy] Long is in office. I think there will be continuation and a great deal of focus on privacy versus efficiency. They’ll want to make the improvements on the system side, which are already underway, but I do think there will be a great deal of focus on privacy.”
Hiring freeze
The hiring freeze at the IRS could be a concern, however.
“Will they be able to maintain adequate personnel? Time will tell on that, but I think we’ll know fairly quickly,” said Everson. “The filing season has already started, and I think that the impact of departures on the workforce will be felt over time. I’m not overly concerned about the filing season, per se. Over a period of time, if people are leaving government — and the IRS does have a very high component of people who have been working from home — because that is no longer allowed, what will the impact be there? That’s very much in the mix, but it will take time to feel the effects of that.”
He expects to see more of a focus at the IRS on process in terms of enforcement activities. Trump’s proposal to create an “External Revenue Service” to collect tariffs and duties could also introduce complications, since many of those functions are already performed at the Department of Homeland Security rather than the Treasury Department.
Former Representative Billy Long, a Republican from Missouri, speaking at a Donald Trump campaign event
Al Drago/Bloomberg
After the election, Trump named former Rep. Billy Long, R-Missouri, to be the next IRS commissioner, even though IRS Commissioner Danny Werfel’s term was scheduled to run until November 2027. That prompted Werfel to announce his last day would be on Jan. 20, coinciding with Inauguration Day. When he was in Congress, Long had sponsored a bill to abolish the IRS and replace it with a consumption-based tax known as the Fair Tax. In January, a group of 12 Republican lawmakers revived the bill as the Fair Tax Act of 2025.
The Trump administration and Republicans in Congress have been moving to claw back at least half of the $80 billion in extra funding under the Inflation Reduction Act from the IRS’s enforcement efforts, which had been targeting large partnerships and corporations, as well as high-wealth individuals, for increased audits. That could affect the reliance of the agency on doing centralized partnership audits, which were allowed under the Bipartisan Budget Act of 2015, but have only recently begun being used.
“Without the IRA funding — and as it stands today, there’s no funding coming from any additional sources — it is certainly less likely that the IRS will be able to conduct effective audits of partnerships,” said Colin Walsh, principal and practice leader of tax advocacy and controversy services at Top 10 Firm Baker Tilly. “Something could change tomorrow, and Billy Long could become commissioner and figure out a different way to finance it. Billy Long will have his own ideas, and we’re all curious to see how he’d like to build the IRS. There’s a big push to get federal workers back into the office. What impacts might that have? Maybe the theory could be that people working in an office are going to be more effective and more efficient than people working remotely. I don’t think at this stage we can even predict, if Billy Long becomes the commissioner, what that will look like, but we can say that it is going to be different. I think comfortably, we could say it’s going to be different than what it would have been like if the IRS had $80 billion and Danny Werfel, versus $40 billion and Billy Long. It is different objectively.”
“It doesn’t mean that it will necessarily be less stringent,” he noted. “We just don’t know, whereas six months ago, we all had a pretty good idea of where this was headed, because the IRS was explicit in saying what they were going to do, creating a partnership audit task force, auditing 80 of the largest partnerships, and in practice, we were seeing that last year.”
The IRS and the Treasury may also cut back on labeling tax transactions such as micro-captive insurance as “transactions of interest.”
“The IRS lost all those cases on making things transactions of interest or reportable transactions by notice,” said Bill Smith, managing director of the national tax office at Top 25 Firm CBIZ Advisors. “They now have to go through the regulatory process, with proposed regulations, a notice and comment period, all of that. Having nothing to do with the change of administration, they suffered a pretty serious setback there. They suffered a setback with the elimination of Chevron deference. It’s all taxpayer favorable, but is it good, sound policy? The IRS collects something like 97% of the revenue for the United States. I don’t know if Elon Musk is going to be able to cut that much out. If you’re going to eliminate a lot of the income, you’d better start eliminating the expenses too.”
Virginia, Pennsylvania and Minnesota made headway this week in adding alternative paths to CPA licensure.
The Virginia House and Senate passed legislation Monday, backed by the Virginia Society of CPAs, that creates an additional pathway to licensure and ensures practice mobility for out-of-state CPAs, effective Jan. 1, 2026. This makes it the second state, behind Ohio, to create a new CPA pathway.
HB 2042 and SB 1042 allow CPA candidates to achieve licensure with a baccalaureate degree with the required accounting coursework, two years of experience and passing the CPA exam. Candidates can still follow the older pathway, which entails 150 hours of education, one year of experience and passing the exam, but “the new path allows accountants to opt for more real-world experience rather than take an additional 30 hours of education,” according to a news release.
“Increasing the options accountants have to become licensed has been a major focus of the VSCPA and the profession nationwide,” VSCPA president and CEO Stephanie Peters said in a statement. “With declining college enrollments and new majors like data analytics, the competition to attract students to the accounting profession is strong. Corporations can’t run without finance teams, and businesses rely on their CPAs for valuable tax planning and strategic advice. It’s crucial we develop new ways to get accountants licensed as CPAs to become the trusted business advisors that help keep our economy running.”
The VSCPA worked with Del. Holly Seibold, D-Fairfax, and Sen. Adam Ebbin, D-Fairfax, with support from VSCPA member and Del. Joe McNamara, CPA, R-Roanoke. Both bills passed the full General Assembly unanimously. The VSCPA does not currently see any barriers to Gov. Glenn Youngkin singing the legislation.
Virginia State Capitol
Martin Kraft
Pennsylvania and Minnesota
Pennsylvania introduced a Senate bill to add an extra pathway to CPA licensure, allowing CPA candidates to achieve licensure with 120 college credits, two years of relevant work experience verified by a Pennsylvania CPA and passing the CPA exam. The existing pathway requiring 150 credits is still available for candidates.
“At a time when the accounting profession faces a variety of pipeline challenges, it is crucial to create innovative pathways that meet the needs of today’s workforce while safeguarding the public trust and high standards that define the CPA designation,” PICPA CEO Jennifer Cryder said in a statement.
“We believe these updates are critical to the future of the accounting profession,” she added. “By working together with our stakeholders, we can modernize licensure laws without compromising the core principles that define the CPA profession.”
The initial memo introducing the bill was led by Sen. Scott Hutchinson, R-Venango, and Sen. Nick Pisciottano, CPA-inactive, D-Allegheny. A companion bill is set to be introduced in the state House by Rep. Ben Sanchez, D-Montgomery, and Rep. Keith Greiner, CPA, R-Lancaster.
Meanwhile, Minnesota introduced a Senate bill to add two more pathways to licensure, which would allow CPA candidates to achieve licensure with a bachelor’s degree along with two years of general work experience and passing the CPA exam, or a master’s degree with one year of experience and passing the exam.
The legislation also ensures automatic practice mobility and changes regulations to make the Minnesota State Board of Accountancy the entity determining substantial equivalency, not NASBA’s National Quality Appraisal Service.
A companion bill in the Minnesota House is expected to be introduced later this week.