Blogs

What is a “record” in a collection of data? How about a few rows of data with associated metadata from a database table? Queries for specific data formatted into printable reports have often been considered records. These “database views” may have been used as time-bound database records “snapshots.” Some organizations, apparently including the United States Internal Revenue Service, may see the entire database as a “record.”

This critical Electronic Records Management issue is about to become a part of kitchen table dialog as everyone that files a tax return realizes the IRS may request Quicken or QuickBooks data files. The IRS, starting in 2010, purchased a couple of thousand copies of QuickBooks software and began training a thousand or so agents in using it. Warnings about the possibility of IRS agents requesting entire data files has been growing among software user groups (http://community.intuit.com/posts/alert-irs-is-using-quickbooks-to-audit), consultants, and tax advisors. It has been well-known for many years that in civil disputes, like divorce cases, the family Quicken financial file was an electronic discovery gold mine. Very revealing information could found in those data files resulting in often surprising “discoveries” for either party!

The IRS is apparently doing this in part because tax payer’s paper records are often incomplete. There are some possible limitations on requesting this data (or should I say records?). The need to request a copy a data file is apparently up to individual examiners, and they should only request data for the year(s) being audited. (I feel so much better now!) Requesting this information is apparently legal and they can demand it through a summons if they want to. However, the problem is that providing complex e-records has many dangers. Producing relevant e-records without accompanying privacy invading data or compromises in data security can be very difficult. It is for this reason that the use of this database bound information for tax auditing may be precedent setting regarding many ERM issues.

One of the most important considerations in producing records for audits or e-discovery is to focus the effort on relevant records. This reduces time consuming records reviews and the possibility of incurring any unwarranted risks resulting from a “fishing expedition.” To address this challenge, some actions can be taken to reduce the risk of exposing electronic information that is not appropriate for many reasons. Some examples of such possible actions are:

1. Limit the data collected from the database to the specific parameters requested, such as date ranges, accounts, transaction types, etc.
2. Do not give out primary file administrator passwords or privileges; create separate accounts that enable focusing on the relevant records,
3. Turn off all data links to external accounts like bank accounts or Internet Web sites, as unmanaged connections could allow violating their access and security policies, and
4. Password protect the e-records file produced to assure limited access.

(Remember that these are suggestions for consideration based on ERM issues insights, not tax or legal advice, as one should confer with those audience about specific details and actions.)

There are limitations to the information an auditor such as the IRS can request. And one can expect this issue to become more vigorously debated as The American Institute of Certified Public Accountants (AICPA) and a number of tax specialty law firms have begun resisting IRS efforts to achieve unfettered privacy invading access to complex financial files. However, for the time being, one can also expect this issue to have a major impact on small and medium sized businesses (SMBs). For one, IRS studies have found they do not think they are collecting a high enough percentage of taxes owed from SMBs. Secondarily, SMBs are more likely to store e-records in QuickBooks or other small data files that can be the target of an information request. The IRS apparently wants to data mine the information rather than spend an agent’s time requesting specific documents or waiting on taxpayer documents to be received. Would this not normally be considered an exceedingly unspecific global request for e-records?

Once again, the importance of addressing e-records issues impacts our daily lives. With each sunrise, we can see more ERM “challenges” surfacing raising the importance of ERM issues with the public. This has got to be a hot discussion item at tax time! ERM practitioners need to be ready with answers.