admin
The Treasury Inspector General for Tax Administration (TIGTA) just handed the IRS a stinging report. In short: the agency rushed a new “Procurement Hub” into service to support the White House’s “Defend the Spend” push, skipped key procurement and security safeguards, and left about $4.46 million in questioned costs. That’s not a typo. It’s a watchdog flag — and taxpayers should be asking hard questions.
TIGTA Finds $4.46 Million in Questioned Costs
TIGTA’s final audit found the Procurement Hub grew from a small pilot to a nearly $5 million commitment without the checks that normally stop waste. After two pilot orders at $250,000 each, the IRS signed a third order of roughly $4.5 million to extend the Hub and add AI features. The agency paid the full amount up front. TIGTA singled out about $4,458,165 as “questioned costs — potential” because the contract lacked clear engineering milestones and the IRS did not do enough market research before cutting the big check. Taxpayers don’t get receipts that vague; they get bills.
How the Procurement Hub Went Off the Rails
The audit links the mess to a one-word problem: rush. The Hub was fast-tracked so it could feed the Defend the Spend effort. That urgency is understandable in theory. In practice, it became an excuse to bypass normal procurement steps. No solid market research, no clear deliverables for engineering work, and a payment structure that removed the government’s leverage if services weren’t delivered — all red flags that TIGTA dutifully put on paper. The IRS disagreed with parts of the critique but told TIGTA it agreed or partially agreed with the audit’s recommendations. Translation: they’ll try to fix it now that someone else found the holes.
Security Lapses and Access Failures
The report did not spare the tech side. The Procurement Hub was jammed onto an existing analytics platform without properly updating risk authorizations as required by NIST. Of 1,017 people with Hub access, 959 — 94% — had not been registered through the IRS’s access control system. Worse, 903 of those accounts never used the Hub in the six months TIGTA reviewed, yet many accounts stayed active well past the IRS’s 120-day inactivity rule. That’s sloppy at best, dangerous at worst. Sensitive contract data and proprietary information were sitting in a system with weak gates and too many open doors.
Sunset, Accountability, and What Comes Next
After TIGTA shared its draft findings, the IRS said it would “sunset” the Procurement Hub and move the functions to an existing platform by the end of the year. Chief Information Officer Kaschit Pandya and procurement officials argued parts of the procurement were defensible, and Acting Senior Procurement Executive Alan J. Monico Jr.’s shop will be watching the transition. Fine. But sunsetting a tool after you’ve plunked down millions and left security holes is not accountability — it’s damage control. Congress and oversight bodies should demand records, recover improperly paid funds where possible, and insist the IRS show proof that fixes are in place. Citizens deserve a government that defends their money instead of creating new lines on the waste ledger.
The TIGTA audit is a clear warning: good intentions do not excuse bad process. If the administration wants to “defend the spend,” it should start by defending rigorous contracting rules and basic cybersecurity. Otherwise, the next time Washington rushes something to look good on a spreadsheet, taxpayers will be left holding the bill — and someone will have to explain why $4.46 million in questions was the result.
