A lack of proper information security controls at the Internal Revenue Service puts taxpayer and other sensitive data at risk, according to a report issued by the General Accountability Office (GAO).