TIGTA: IRS software license management inadequate

Tools

The Internal Revenue Service is not adequately performing desktop and laptop software license management and is not adhering to federal requirements and recommended industry best practices, according to a report from the Treasury Inspector General for Tax Administration. The TIGTA report, dated June 25, was not publicly released until Aug. 20.

"Efficient and cost-effective management of the IRS's software assets is crucial to ensuring that information technology services continue to support the IRS's business operations and help it to provide services to taxpayers efficiently," states the report.

However, auditors found that the IRS does not have enterprisewide or local policies, procedures and requirements for software license management. In addition, during the audit, the IRS's User and Network Services organization was unable to provide TIGTA with essential licensing records for properly managing licenses on 24 of 27 software products reviewed.

TIGTA also discovered that the IRS does not have specialized software license tools designed to discover, track, manage, and detect inactive usage of software licenses. Moreover, the report disclosed that the IRS does not have an accurate inventory of software and related licenses that contains licensing models applicable to each software product which links data on the licenses purchased and deployed with the purchase costs, procurement information, and monitoring and usage data.

To address these shortcomings, TIGTA recommended that the IRS chief technology officer develop policies and guidance, and roles and responsibilities for managing software assets and licenses; implement a specialized software license management tool and develop detailed standard operating procedures for using the tool; develop an inventory of software licensing data and maintain the inventory with a specialized software license tool; and maintain data in the inventory that the IRS can use to more effectively manage software spending.

In its response to the TIGTA report, the IRS agreed with all six recommendations with slight modifications on four of them.  The agency plans to use best practices to develop enterprisewide software license management policies, procedures, roles, and responsibilities; identify and implement a standard enterprise toolkit with standard operating procedures for the management of software licenses; and collect software inventory data from the toolkit in a central data repository.

Also included in its response to the report was a statement from the IRS indicating that TIGTA's audit examined the IRS's desktop and laptop environment, which the IRS considers a part of its overarching approach for enterprise software governance. As a result, the agency said its corrective actions addressing recommendations include desktop and laptop software licensing as a subset of the enterprise. However, TIGTA took issue with this IRS statement.  

"During the audit period, the IRS did not have an overarching approach for enterprise software governance or the assimilation of Information Technology Infrastructure Library (ITIL) Maturity Level 3 processes regarding centralizing the responsibility for software license management," wrote Michael E. McKenney, TIGTA's Acting Deputy Inspector General for Audit, in a memo accompanying the report.

For more:
read the TIGTA report, 2013-20-025

Related Articles: 
IRS lacks a plan for data center consolidation, finds TIGTA 
TIGTA: Delays hinder IRS ability to monitor employee computers for security 
IRS modernization effort leaves IRS IT vulnerable, says TIGTA