Internal Inspections Report

Field office

Prepared By:

[Insert Agency]

[Insert Agency Address]

[Insert Field Office Location]

[Insert Field Office Address]

[Insert Date]
INSTRUCTIONS

The following questions serve as an internal audit checklist regarding the agencies security procedures

relating to Internal Revenue Service documents and federal security implementation controls. The purpose of this questionnaire is to measure the agencies level of compliance with federal disclosure regulations.

When answering the questions in this document, the answers should be entered on the line directly below the question. Formatting and color for the answer has already been set, so modifying this it not advisable. The responses will be colored blue, so it’s easily identifiable. For Example:

1. How is FTI received from the IRS?

FTI is received from the IRS via the secure Tumbleweed client to a Windows XP workstation.

After completion, the form should be printed out and signed by the Disclosure Officer and the Director from the Agency.

The Agency should complete the contact information below for all parties that involved in supplying information.

Name	Title	E-mail

It is advisable for the agency to collect and maintain documented evidence to back to answers to this report in the instance of an audit. Having this evidence on hand will also aid the IRS Safeguards on-site review.
Record Keeping Requirements (Publication 1075 section 3.0) IRC Section 6103(p)(4)(A)

How is FTI accessed? (mail, agency application, other-list)

Are products/documents created from the FTI data (letters, reports, etc.)? Describe what products/documents are created.

How are these products/documents tracked and stored until destruction?

What type of FTI does the Field Office use?

How do you make use of this data?

Secure Storage (Publication 1075 section 4.0) IRC Section 6103(p)(4)(B)

Please describe the physical security of the Field Office? (e.g. keypad locked doors, guard desks, locations, hours, etc.)

If keypads are used, is each attempt logged?

Who reviews the access attempt logs? (Name and title)

What alarm systems are currently running at Field Office? (e.g. Intrusion Alarms, Motion Detectors, Exit Alarms)

Who monitors these alarms? (Name and title)

Are security cameras used at the Field Office?

Who monitors the security feed? (Name and title)

Are records maintained on the issuance of keys/key cards?

How are records maintained? (automated file, written log, etc.)

Who is responsible for the issuance of keys/key cards (Name and title)

Are periodic reviews conducted to reconcile records and determine if users still need access?

Date of last review.

Is FTI locked in a storage cabinet?

Where is the key kept?

Who has access to the key?

How many keys are in existence?

Who maintains the backup keys?

Are combination locks used?

How often is the combination changed?

Who controls the combinations?

Are ID cards required to be worn by employees at all times?

How are ID cards inventoried or managed?

Do visitors/vendors sign a visitor access log?

What data elements are captured in the log?

Who reviews the visitor access log periodically?

Two barriers are required to protect FTI. Please Describe the one that applies to your agency:

i. Secured perimeter / locked container

ii. Locked perimeter / secured interior

iii. Locked perimeter / secured container

iv. Other (describe)

Who has access to the office after core business hours?

How is security enforced after core business hours?

Restricting Access (Publication 1075 section 5.0) IRC Section 6103(p)(4(C)

Does the agency have web based applications?

Is FTI accessible through a web site?

Is FTI transmitted via email?

How is the FTI protected? (encryption - describe)

Is FTI transmitted via fax machine?

Where is the receiving fax machine located? (location in office)

Are all individuals in the receiving location cleared for FTI access?

Disposing Federal Taxpayer Information (Publication 1075 section 8.0) IRC Section 6103(p)(4)(F)

Is FTI paper waste material generated?

Where is paper waste material placed? (recycle bins, locked containers, waste baskets, other container)

How is the paper waste material destroyed?

Who performs the destruction of paper waste material? (Agency Staff, Contractor – list)

Is a contractor used to pick up the waste material?

Name of contractor:

Where does the contractor take the waste material for destruction?

Does agency staff accompany material and view destruction?

I hereby submit this Internal Inspections Report to the headquarters function of this agency as part of the IRS Safeguards Internal Inspections requirement.

/s/

______________________________________________	_____________

Field Office Official Conducting Internal Inspection	Date

I acknowledge that I reviewed this Internal Inspections Report as part of the IRS Safeguards Internal Inspections requirement and initiated appropriate corrective actions for any deficiencies identified.

/s/

______________________________________________	_____________

Agency Disclosure Officer	Date

/s/

______________________________________________	_____________

Agency Official	Date