The US Government’s Internal Revenue Service (IRS) has been told to speed up its move to the cloud.

A report from the Government Accountability Office (GAO) found that the IRS’s reliance on outdated IT infrastructure was increasing the risk of cybersecurity breaches and staffing issues, as well as costs.

The report found that around 33 percent of applications, 23 percent of software instances in use, and eight percent of hardware assets were considered ‘legacy’. For context, the applications were between 25 and 64 years old, and the software was up to 15 versions outdated.

The issue of legacy IT is not new for the IRS. In 2019 the organization released its Integrated Modernization Business Plan. This initially laid the pathway for modernization incentives including moving to the cloud through the fiscal year 2024. This has since been updated and a plan should be finalized sometime early this year.

The GOA found that of 21 modernization initiatives that the IRS had underway, nine involved legacy systems. Of those nine, six failed to address the key problem of the disposition of legacy systems. Officials had instead vaguely stated that the issue would be addressed at an ‘appropriate’ time.

Last year the IRS announced that it would be updating the Individual Master File (IMF), which houses the data for individual tax accounts, by 2030. However, the organization recently paused six of its initiatives including two which were necessary for the scheduled update. As a result, the new deadline is unknown. The IMF has been used since 1970, making it around 53 years old.

According to the IRS, this suspension was due to a need to prioritize and staff were thus moved to other projects. The IRS has since agreed to restart work on the IMF and will do so with the remainder of funding provided by the Inflation Reduction Act which saw ~$4.8bn go to the IRS for Business Systems Modernization and $25.3 billion for Operations Support which includes the funding of operations and maintenance of the IT systems.

The GAO’s report also notes that IRS’s cloud computing efforts fully addressed 11, partially addressed one, and did not address two requirements identified in the Office of Management and Budget’s June 2019 cloud computing strategy. The main element of this was the IRS's failure to conduct regular evaluations of customer experiences and needs.

In total, the GAO has made nine recommendations to the IRS, including that the IRS should: establish time frames for addressing the disposition of legacy systems and document this (Enterprise Case Management, Enterprise Data Platform, Information Returns Modernization, Information Technology Service, Enterprise Anomaly Detection, and Workforce Infrastructure); ensure that cloud computing efforts fully address the key Office of Management and Budget’s requirements as related to standardizing cloud contract agreements, those associated with the developing and implementing of policy for high-value assets in the cloud, and finally to conduct regular evaluations of customer experience.

The IRS has agreed to all recommendations.