The Internal Revenue Service issued more than $20 million in refunds in error because it realized too late that individuals who overpaid taxes owed did so using bad checks, according to a report released by the Treasury inspector general for tax administration on Tuesday.

The inspector general issued a second report on Tuesday that found IRS managers needed to be more consistent in reviewing security reports to detect potential unauthorized accesses to taxpayer accounts by agency employees.

In its first report, the inspector general found that during the 2008 tax season, the IRS had 245,007 checks totaling $1.55 billion returned because of insufficient funds or other issues. Of those checks, 15,823 were written for a larger amount than the taxpayer owed, which resulted in the IRS automatically generating $53 million in refunds before officials realized that the payment checks were no good. The IRS was able to stop payment on about 8 percent of the $53 million in refunds, but more than $20 million was cashed.

Less than 1 percent of all payments the agency processes are in error, and "weaknesses in the IRS' dishonored check processing put millions of dollars at risk," the inspector general said.

To prevent erroneous refunds, IRS guidelines require tax examiners to adjust account information and to stop payment on refunds, as needed, within 21 days of a bank notification that a check is no good. But in a review of sample taxpayers' accounts, the IG found that 55 percent of bounced checks were not properly addressed within that time frame. About 60 percent of the time, tax examiners did not begin to address the bad checks until after the refund was erroneously generated, and they took as many as 47 days to reverse the payment after learning a check bounced.

"The IRS should implement computer controls to prevent refunds of overpayments from posting to a taxpayer's account until it is reasonably assured the related payment has cleared the bank," noted the inspector general, who determined that a freeze on refunds for 21 days would provide enough time for the IRS to determine if the payment did not go through. This system could protect more than $20 million a year and almost $102 million during the next five years from being issued to taxpayers in error, according to the report. Systemically stopping refunds on bad checks also could allow the IRS to redirect $119,308 per year, which is used to recover erroneous refunds, to other purposes.

The IRS' commissioner of its wage and investment division agreed to develop a system to identify erroneous refunds paid on bounced checks, contingent on funding. The IRS also said it would recover refunds that were erroneously issued during the 2008 and 2009 calendar years.

In the long term, the inspector general also recommended that the IRS modify its payment processing system to convert the paper checks taxpayers receive into electronic fund withdrawals, which would allow automatic authorization from the bank and notification if the payment could not be honored.

Currently, however, the Treasury Department's Electronic Federal Tax Payment System does not have the functionality to allow the IRS to convert paper checks to an electronic format for transmitting to banks.

In its second audit, the inspector general found that the IRS needed to do more to ensure that taxpayers' accounts are protected from unauthorized access by agency employees.

In fiscal 2008, 11 percent of the security reports generated by the Integrated Data Retrieval System, which maintains taxpayers' names, Social Security numbers, birth dates, addresses, filing statuses, exemptions and income, were not reviewed and certified by IRS managers. The security reports summarize audit trail information that can be used to detect potential unauthorized accesses to accounts.

The IDRS Online Reports Services system, which is a Web-based application for authorized reviewers, notifies managers by e-mail when security reports are available and when responses to reports are due. Of the 325,475 security reports in fiscal 2008 requiring certification by IDRS managers, 89 percent were certified. That was an improvement from fiscal 2005, when the IG reported that only 54 percent of IDRS security reports were certified. Nonetheless, the IG identified 36,493 reports that were not reviewed and certified, "potentially allowing improper accesses to go undetected."

IRS management agreed to develop and implement compliance review procedures for IDRS security officers, and hold managers accountable when they fail to meet their requirements for reviewing security reports. A memorandum also will be released reiterating IDRS security program policy requirements.