Management and Oversight of Cloud Managed Services Contracts and the Enterprise Cloud Program Need Improvements

Submitting OIG:

Treasury Inspector General for Tax Administration

Date Issued:

Tuesday, January 23, 2024

Agency Reviewed / Investigated:

Internal Revenue Service

Submitting OIG-Specific Report Number:

2024-200-009

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

View Document:

Attachment	Size
2024200009fr.pdf	1.49 MB

Related Open Recommendations

Recommendation Number	Recommendation Status	Significant Recommendation
1	Open	No
In collaboration with IRS leadership, e.g., Chief Information Officer, develop a process to track cloud services contracts to ensure that contracts for cloud applications can be identified readily.
2	Open	No
Ensure that contracting officers store cloud services contracts in the Procurement System’s Folders Management module as required.
3	Open	No
Develop and provide contract coding and categorization guidance and training to contracting officers.
4	Open	No
The Chief Procurement Officer should develop a process to track cloud services contract values by cloud application to ensure that specific contract values and obligations can be readily identified and determined.
5	Open	No
The Chief Procurement Officer should ensure that Contracting officers consistently and effectively incorporate the SLAs, including penalties for not meeting service levels, into cloud services contracts.
6	Open	No
The Chief Procurement Officer should ensure that the penalty of $1,017 is collected from the managed service provider for not meeting the service level.
7	Open	No
The Chief Procurement Officer should ensure that contracting officers include all applicable contract clauses in cloud services contracts.
8	Open	No
The Chief Information Officer should ensure that a modification is executed to the cloud services contract identified as an exception to include contract clauses related to contractor security requirements and training.
9	Open	No
The Chief Information Officer should clarify in a formal policy that applications migrating to the cloud are required to engage and be processed centrally by the Enterprise Cloud Architecture and Design office.
10	Open	No
The Chief Information Officer should ensure that all applications operating in the cloud have obtained governance board approval.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

Open

In collaboration with IRS leadership, e.g., Chief Information Officer, develop a process to track cloud services contracts to ensure that contracts for cloud applications can be identified readily.

Open

Ensure that contracting officers store cloud services contracts in the Procurement System’s Folders Management module as required.

Open

Develop and provide contract coding and categorization guidance and training to contracting officers.

Open

The Chief Procurement Officer should develop a process to track cloud services contract values by cloud application to ensure that specific contract values and obligations can be readily identified and determined.