COVID-19 RELIEF: IRS Can Use Lessons Learned to Address and Prevent Improper Payments in Future Tax Programs (GAO-26-107456)
SCALE
- About USD 283 billion in ERC refunds to employers as of June 2025, from nearly 5 million claims processed.
- About 83 percent of the refund dollars - some USD 235 billion - went out from 2022 through June 2025, after unemployment had returned to its pre-pandemic level.
- Average processing time ranged from 71 days for returns processed in 2022 to 546 days in the first part of 2025.
COMPLIANCE
- The CARES Act set the two statutory eligibility criteria: a requisite decline in gross receipts, or a government suspension of operations order.
- The Payment Integrity Information Act (PIIA) requires an improper payment estimate, a root cause analysis and related reporting for a programme designated susceptible to significant improper payments.
- Office of Management and Budget (OMB) guidance required that designation to be escalated to the agency designated risk official for the agency risk inventory.
- A July 2025 law retroactively disallowed certain unpaid ERC claims filed after 31 January 2024 and imposed penalties on ERC promoters failing to meet IRS due diligence requirements.
ECONOMY
- the improper payment estimate required by law, and whether one was produced
- root cause analysis and the statutory reporting resting on it
- cost of examinations and recapture against the cost of screening at filing
- alignment of refund dollars with the economic conditions the credit answered
EFFICIENCY
- timeliness of the enterprise and fraud risk profiles in picking up ERC
- escalation of a programme designated susceptible to improper payments
- processing of amended returns and the manual work it required
- the 2023 processing moratorium and the compliance model built during it
- follow-through on earlier audit recommendations
EFFECTIVENESS
- eligibility information asked for on the employment tax returns actually filed
- options weighed for collecting it - attestation form, narrative box, online checklist
- ability to identify ineligible employers before refunds were paid
- lessons carried forward to future emergency tax programmes
1. Risk-management processes did not catch ERC compliance risks in time
Risk guidance
The report states that 'IRS's enterprise risk management and fraud risk management processes did not identify the specific compliance risks of ERC claims on amended returns in a timely manner' (p.31), although 'The warning signs for potential ERC compliance issues on amended returns started in 2021 as the number of questionable claims grew' (p.31). The escalation that should have followed did not happen: 'IRS's February 2022 designation of ERC as susceptible to significant improper payments risk should have triggered escalation of ERC to the agency designated risk official for inclusion in the agency's risk inventory, per OMB guidance. By March 2022, questionable ERC claims flagged for examination had increased by over 10,000 percent' (p.32). ERC reached the Enterprise Risk Profile only in October 2023 - the month after IRS imposed a processing moratorium to build a compliance model - and the Fraud Risk Profile in December 2023, with an IRS official agreeing that 'IRS could have acknowledged the risks associated with processing paper returns, the newness of the ERC, and its retroactive provisions sooner' (p.33). A 2022 GAO recommendation that IRS document its process for addressing amended-return compliance risks remained only partially addressed as of September 2025 (p.32).
- Domains: Taxes
- Function: Planning
- Quality: Sound risk management
2. The tax forms employers actually filed never asked for the two statutory eligibility criteria
Compliance and regulatory guidance
Form 941, the employment tax return employers used to claim ERC, 'asked for total qualified wages for ERC, but not for information related to specific components of those wages. Additionally, Form 941 did not ask employers for information about the two key statutory criteria, from the CARES Act, for ERC eligibility: (1) whether they experienced either a requisite decline in gross receipts, or (2) were under a government suspension of operations order' (p.34). GAO puts that on the administration rather than on the statute: 'We recognize, as discussed previously, that statutory ERC eligibility relied on new or unclear definitions. However, designing forms and requesting eligibility information are decisions for IRS' (pp.34-35). Of the two criteria the receipts test 'may have been easier to verify', since 'most employers generally track gross receipts already for inclusion on their income tax returns' (p.35). Three alternatives were weighed and none reached the return itself. An attestation form considered in 2023 was dropped because of the correspondence it would create and because 'the timing for introducing the form meant that a large group of ERCs were already allowed without it, creating a disparity with employers who would need to file it going forward' (p.35). The Form 941-X narrative box, which employers could use for eligibility information, was transcribed and then discontinued because of its 'minimal impact' on data analytics (p.35). An online eligibility checklist released in November 2023 asked about gross receipts and government orders, but 'was an optional tool that was not available when ERC filing began and results were not submitted to IRS' (p.36). The consequence is stated directly: 'By not requiring information on the core eligibility requirements for ERC, IRS had limited ability to identify ineligible employers to prevent or recapture erroneous refunds. Instead, IRS had to use resource intensive steps, such as examinations, to gather and assess eligibility information after the initial filing' (p.37).
- Domains: Taxes
- Function: Governance
- Quality: Reliable, integrated information base
3. Most of the money went out years after the pandemic-era eligibility window had closed
Performance analysis
The money arrived after the emergency it was written for: 'for 2022 through June 25, 2025, about $235 billion in ERC refunds were processed, representing about 83 percent of the total refund dollars' (p.50), out of more than $283 billion in claims processed altogether (p.49). GAO sets that against the labour market the credit was meant to answer: 'Unemployment peaked in 2020, at 13 percent in the second quarter. Unemployment averaged approximately 9.5 percent from the second through the fourth quarters when fewer than 80,000 ERC claims were processed. Conversely, in 2022 when the unemployment rate had returned to its pre-pandemic level (under 4 percent), there were more than 1.6 million ERC claims processed' (p.49). Processing time is the mechanism - 'average processing times ranged from a low of 71 days for returns processed in 2022 to a high of 546 days for returns processed in the first part of 2025' (p.49) - so that the audit found that 'receipt of most ERC refund dollars did not align with some of the worst economic conditions' (p.49).
- Domains: Taxes
- Function: Finance
- Quality: Cost control and value for money
Control focus
| ICS phase | Control function | Cases |
|---|---|---|
| Guidance | Risk guidance | 1. Risk-management processes did not catch ERC compliance risks in time |
| Compliance and regulatory guidance | 2. The tax forms employers actually filed never asked for the two statutory eligibility criteria | |
| Monitoring | Performance analysis | 3. Most of the money went out years after the pandemic-era eligibility window had closed |