The Internal Revenue Service (IRS) had not located 594 IT assets assigned to former employees as of April 2026, creating risks of data loss and financial loss to the agency, according to an Aug. 24 report from the Treasury Inspector General for Tax Administration (TIGTA).
TIGTA examined the IRS’s management of more than 32,000 IT assets assigned to approximately 22,000 employees who departed the agency from April 2025 through July 2025.
While most assets were returned, TIGTA identified 1,308 assets – 4% of the total – that were listed as unreturned as of November 2025. The IRS subsequently located 714 of those assets, leaving 594 assets valued at $274,822 unaccounted for as of April 2026.
“These assets place the IRS at risk of data loss,” TIGTA said, noting that the laptop hard drives and smartphone memories had not been cleared and could contain sensitive taxpayer information.
IRS officials provided evidence that the former employees had not accessed the agency network after leaving.
Gaps in asset inventory process
TIGTA attributed problems with the IRS’s asset inventory in part to gaps in policy and reconciliation processes. Although IRS policy requires departing employees to return agency assets, it does not establish a specific time frame for doing so.
The watchdog also found cases in which managers who collected equipment from onsite employees did not return it to local IT offices. Local IT offices sometimes failed to ship equipment to IT depots or update the asset-management system, and IT depot employees did not always update the status of returned equipment upon receipt.
The IRS also does not have a policy for recovering the costs of unreturned assets from departing employees, TIGTA said.
“Therefore, there are no consequences if a departing employee does not return their assets,” TIGTA said.
The agency spent months trying to locate the missing equipment by contacting employees’ managers and checking local IT offices and IT depots. In May 2026, the IRS updated its asset-management system to list the 594 assets as lost and contacted TIGTA’s Office of Investigations to report them as stolen.
TIGTA’s Office of Investigations requested additional documentation showing that IRS management had tried to contact the former employees to retrieve the equipment before it would initiate an investigation.
“As these employees have separated from the IRS, we believe these assets should be considered stolen as opposed to missing,” TIGTA said in the report.
Issues in BYOD program
Separately, TIGTA found problems with the IRS’s process for revoking departing employees’ access to its Bring Your Own Device (BYOD) program.
Of 52 BYOD participants who separated from the IRS from February 2025 through July 2025, the agency failed to remove program access for 23 employees, or 44%. Those employees were participants in the Deferred Resignation Program.
TIGTA alerted the IRS to the issue on Oct. 1, 2025, and the agency removed the 23 employees’ BYOD access on Oct. 2. IRS officials provided evidence that none of the 23 employees accessed the agency’s network after their departure.
The watchdog also found that required audit-trail data from the IRS’s cloud-based asset-management system was not captured in the agency’s centralized audit-trail repository.
The asset-management system moved to a cloud-based platform in November 2024, but staff responsible for the audit-trail repository told TIGTA they were unaware that the system existed or that its audit trails needed to be added to the repository.
TIGTA said the missing audit-trail data limited the IRS cybersecurity organization’s ability to monitor systems for inappropriate use. The watchdog also found that IRS policy did not clearly explain how system administrators should transmit audit-trail data to the repository.
TIGTA made four recommendations to the IRS chief information officer, including establishing specific time frames for returning assets and updating inventory records; taking steps to locate potentially stolen assets and prepare documentation for TIGTA investigators; adding the cloud asset-management system’s audit trails to the centralized repository; and clarifying administrators’ responsibilities for sending audit trails to the repository.
The IRS agreed with all four recommendations.