fixes hadn t been fully implemented despite the irs reporting that they were complete. as a result, the report says the agency failed to do things like properly lock user accounts, update software or scan servers for major vulnerabilities which makes it easier for people to exploit user accounts and steal taxpayer identities. with all eight of those corrective actions, the inspector general s investigation also found the irs didn t audit any of them to insure their implementation, four lacked the right executive approval to close them and three had no documentation at all to support their closure. investigators then broadened their sample size to 69 planned corrective actions and found that only 24 had documentation to fully support being closed. when the right degree of security diligence is not applied to systems, disgruntled insiders or malicious outsiders can exploit security clearances and may gain unauthorized