TIGTA recommends improvements to CAF and Tax Pro Account

In a recent audit report, the Treasury Inspector General for Tax Administration (TIGTA) identified opportunities for the IRS to improve the accuracy and reliability of its Centralized Authorization File (CAF) system and to expand use of its Tax Pro Account system (TIGTA Rep’t No. 2023-40-033, Opportunities Exist to Improve the Accuracy of Information in the Centralized Authorization File and Increase the Use of the Tax Pro Account System (May 24, 2023)).

Background: Under Sec. 6103(e)(6), taxpayers can execute a power of attorney to someone to represent them before the IRS, and Sec. 6103(c) allows taxpayers to permit another person to view their confidential tax documents and information. Taxpayers use Form 2848, Power of Attorney and Declaration of Representative, to authorize a third party (an “authorized individual”) to represent them before the IRS, which includes requesting, receiving, and submitting tax forms. Form 8821, Tax Information Authorization, permits an authorized individual to receive confidential returns and return information on a taxpayer’s behalf either verbally or in writing. For either Form 2848 or Form 8821, the taxpayer can revoke the authority at any time.

Because these forms grant individuals other than the taxpayer access to significant private information, it is crucial for the IRS to implement controls to ensure the accuracy and validity of the authorization forms, as well as of the identity of the individuals submitting them, to prevent identity theft (i.e., nonauthorized individuals gaining access to taxpayer data). As a first step in these controls, the IRS maintains the CAF, a database of information regarding authorized individuals appointed by Forms 2848 and 8821. In the 2022 fiscal year alone, the IRS received over 3.7 million forms to process in this system (id., Fig. 2, p. 2) and processed 4.3 million forms. If the Form 2848 or 8821 contains all required elements, an IRS representative manually transcribes the form information into the CAF database.

Each authorized individual receives a unique CAF number that enables the IRS to identify the individual and all the taxpayers for whom the individual has established power of attorney or access to confidential tax information. Importantly, related entities and individuals with multiple addresses may be assigned multiple CAF numbers, and an individual may obtain a CAF number even if they do not currently represent a taxpayer.

Two significant changes have affected the CAF process in the past several years. In 2019, Section 2302 of the Taxpayer First Act, P.L. 116-25, required the IRS to establish uniform standards for accepting e-signatures on forms establishing power of attorney or granting access to confidential information (i.e., Forms 2848 and 8821). In response, in 2021, the IRS deployed the Tax Professional Online Account (Tax Pro Account) to strengthen security over the process for representatives to access taxpayers’ account information. This system entailed the following changes that significantly modernized the authorization process and bolstered its security (p. 4):

1. Authorized individuals can securely request authorization as a designee or power of attorney and complete Form 2848 or 8821 on behalf of the taxpayer online. This process also enables the individual to e-sign the form and send it to the taxpayer for their signature.

2. Authorization is immediately uploaded to the CAF database without the approval of an IRS tax examiner.

Results of review: These process changes significantly increased the potential efficiency of the CAF system. While the Tax Pro Account system provides a more modern and efficient way to obtain authorization, the IRS received only 17,074 CAF requests via Tax Pro in fiscal year 2022. To put that in perspective, the IRS received during that period over 500,000 CAF inventory receipts via paper, over 750,000 through Taxpayer Digital Communications, and 2.3 million through Enterprise File Storage (see graphic, “Sources of CAF Authorizations”). Despite the cumulative investment in the Tax Pro Account system of over $60 million, it remains comparatively rarely used (p. 9).

TIGTA noted that the IRS deployed the Tax Pro Account system in accordance with TIGTA’s recommendation in an earlier report to establish such a system, one of 12 recommendations to improve CAF’s accuracy (TIGTA Rep’t No. 2020-40-067, Improvements Are Needed to Address Continued Deficiencies in Ensuring the Accuracy of the Centralized Authorization File (Oct. 20, 2020)).

Despite the IRS’s agreement with nine of these earlier recommendations, in its follow-up audit, TIGTA again identified substantial issues regarding the accuracy of the information in the CAF database. These included 8,764 deceased authorized individuals with CAF numbers, of which 5,660 were considered in “good standing” as of November 2021 (Rep’t No. 2023-40-033, p. 6). In addition, TIGTA found 15,713 authorized individuals with multiple CAF numbers as of October 2022. While a December 2022 IRS report indicates that the number declined to only 277 authorized individuals, the IRS also acknowledged that not all records could be merged. Accordingly, TIGTA concluded that the CAF system still sometimes generates multiple accounts for the same authorized individual.

Significantly, the IRS confirmed instances in which the inability to authenticate the identity of an authorized individual led to the inadvertent release of confidential taxpayer information, which could be prevented by linking the CAF number to the authorized individual’s taxpayer identification number (TIN). Although the IRS management pushed back on the idea of linking these numbers, on the grounds that it would delay processing of Forms 2848 and 8821, TIGTA stressed that the link could be processed separately from the forms.

Other findings identified 200 reports of suspicious CAF authorizations between April 2021 and May 2022 (id., p. 7). Of these cases, the IRS confirmed 47 as fraudulent, 10 of which still had active authorization in the CAF database. The system still considered three of the 10 active fraudulent CAF accounts to be in “good standing,” generating major issues for identity theft.

Issues with preparer tax identification numbers (PTINs) also abounded in the CAF database. Over 5,000 PTINs did not match the IRS’s PTIN database, with 678 appearing invalid (id.). TIGTA also found questionable PTINs such as “P12345678” and others with owners such as “John Doe” (id., p. 8)

Recommendations to the IRS: TIGTA provided the following recommendations, all of which the IRS agreed with and said it would implement.

1. Create a method for collecting authorized individuals’ identifying information as part of the application for a CAF number and subsequent authorization requests.

IRS management response: The IRS is creating procedures to link PTINs with CAF numbers and TINs. These changes will be available through the Tax Pro Account system.

2. Ensure that existing authorizations linked to the seven CAF numbers the IRS identified as fraudulent are merged to newly assigned CAF numbers.

IRS management response: The IRS has already merged the fraudulent CAF numbers.

3. Review the 5,088 potentially invalid PTINs and update the CAF database with accurate PTIN information.

IRS management response: The IRS will complete this process.

4. The Commissioner, Wage and Investment Division, should coordinate with the Office of Online Services to conduct directed outreach encouraging the use of Tax Pro Account to submit authorizations, identify why people are not using the system, and provide information to help taxpayers create an online account.

IRS management response: The IRS will pursue efforts to publicize the Tax Pro Account system better.

Summary: TIGTA’s report provides meaningful insight into the CAF database to highlight deficiencies in the screening and merging process and to improve the systemfs accuracy, reliability, and security. The report also highlights the low usage of the Tax Pro Account system, which, if increased and improved, should theoretically decrease the deficiencies in the CAF database.

■ TIGTA Rep’t No. 2023-40-033, Opportunities Exist to Improve the Accuracy of Information in the Centralized Authorization File and Increase the Use of the Tax Pro Account System (May 24, 2023)

— Isaac Chasen is a recent graduate of the SC Johnson College of Business at Cornell University. John McKinley, CPA, CGMA, J.D., LL.M., and Thomas Godwin, CPA, CGMA, Ph.D., are both professors of the practice in accounting and taxation in the SC Johnson College of Business at Cornell University. To comment on this column, contact Paul Bonner, the JofA’s tax editor.