Natwar Gandhi was appointed in July to a third term as the District's chief financial officer. (Linda Davidson/The Washington Post)

The mail was strewn in 15 postal tubs in a storage room at the District’s tax office. Some of the postmarks were months old, but the envelopes had never been opened.

Investigators found the stash in December 2010, and two cashiers were immediately dispatched to open, sort and count the payments, found in the Recorder of Deeds unit at the tax office. The probe revealed unprocessed payments from D.C. taxpayers worth $2 million, along with real estate documents required to complete property transactions.

That account comes from one of about a dozen internal audits and reports citing significant security lapses in the District’s Office of Tax and Revenue in the five years since a mid-level manager was caught embezzling tens of millions of dollars and the city vowed sweeping reforms, The Washington Post found.

(Related: D.C. tax office was warned more than once about database security )

Chief Financial Officer Natwar M. Gandhi, who oversees the tax office, has drawn praise for turning a city once on the verge of bankruptcy into a Wall Street winner, with high bond ratings and balanced budgets. In July, Gandhi was appointed to his third term as the $199,700-a-year independent financial overseer for the District.

But problems linger just below the surface, according to reports obtained by The Post that have not come to public attention. Time and again, auditors have warned Gandhi about weak controls and oversight in the tax office — which handles $6 billion in annual revenue — including insufficient tracking of payments, “dummy accounts” with fictitious Social Security numbers and lax supervision of adjustments to taxpayer accounts. The reports describe a tax operation that has “inadequate controls” and a lack of “management oversight,” and that is “vulnerable to undetected errors, manipulation and fraud.”

Gandhi’s agency did not respond to repeated requests for comment about most of the reports and audits reviewed by The Post. But in a previous interview, Gandhi and his senior managers said they have made major improvements to accountability since manager Harriette Walters was caught in 2007 stealing $48 million through phony property tax refunds — the largest embezzlement in city history.

“We reinforced, strengthened to the utmost degree, all the controls and processes to make sure that something like that is most unlikely to happen again,” Gandhi said.

The audits and reports were written by Gandhi’s internal affairs unit, run for the past two years by William J. DiVello, a former assistant inspector general in the city. Last week, DiVello abruptly resigned, telling The Post that Gandhi and his senior managers were pushing to leave audits in draft format. Gandhi’s office has taken the position that draft reports are exempt from disclosure under public records laws.

The Post obtained one draft report, produced by internal auditors in March but not made public until The Post published a story in August, that described a “significantly flawed” system for tracking property assessments that allowed tax office supervisors to access property records and alter them without being detected.

DiVello said he quit on the spot last week when senior managers said in a meeting that they would not release to the D.C. Council a revised version of the audit — which includes additional findings and recommendations — in advance of an oversight hearing on the tax office on Wednesday.

“I prayed that they would see the light,” DiVello told The Post on Friday. “Just sign the report, clear the air.”

He said five or six additional reports about various aspects of Gandhi’s agency, including the tax office, are still lingering in draft.

Gandhi’s spokesman, David Umansky, said Friday that the revised report was not yet complete. Late Friday, after The Post raised questions, the agency delivered the revised report to members of the council. Umansky said the agency does not keep reports in draft form to prevent public disclosure.

The Post was able to independently obtain the draft report about the tax office. About a dozen finalized reports were provided by Gandhi’s agency after a public records request. Finalized reports are not publicly circulated because the agency fears that the findings would provide a road map for employees with nefarious intentions, Umansky said.

Former D.C. auditor Deborah Nichols said Gandhi’s agency has long held reports in draft, and she recalled once requesting and receiving more than a dozen drafts at the same time.

“I think it’s a good thing when you issue them,” Nichols recently told The Post. “You show you have operational issues and you are taking care of them. As a steward, as fiduciary of the people’s money, you’re showing them you have a system of accountability and transparency.”

At the hearing Wednesday, where DiVello is expected to testify, the council’s Committee on Finance and Revenue will examine the workings of the tax office. Among the issues: a controversial spate of tax office settlements that reduced the 2012 proposed assessments of hundreds of commercial properties by a total of $2.6 billion. Gandhi has said the settlements were necessary to avoid the expense of litigation.

In an interview in August, Gandhi outlined a series of reforms at the tax office. He said he fired many employees and managers in the wake of the Walters scheme, which spanned 20 years.

“We wanted to make sure that all the people in the chain there, basically, particularly the managerial people, were removed,” said Gandhi, who himself ran the tax office before becoming the city’s chief financial officer in 2000.

Gandhi said he has enhanced ethics training and improved internal vigilance in recent years. He said he has also brought in a new deputy chief financial officer, Stephen Cordi, to oversee the tax office. Cordi, a veteran tax administrator from Maryland, added: “Checks don’t get out the door without an awful lot of scrutiny.”

This year, the tax office updated auditors on several of the audits, saying it had made changes based on auditors’ recommendations.

But Richie McKeithen, who was hired to run the property tax division after the Walters scandal, said historically it was difficult to make improvements. He said technology needs were shortchanged and positions left unfilled, such as a supervisor to oversee commercial property transactions.

“We tried to fix it, but you don’t get the resources,” said McKeithen, who left the agency in 2010 to become chief assessment officer in Philadelphia. “When you don’t change the things that are causing the audit to say what it is saying . . . then all you can do is keep getting hit in the head with what the auditors said. When you couldn’t get the commercial supervisor position . . . that’s a pretty good indication of what’s a priority and what’s not.”

A series of problems

The tax office faced scrutiny long before Walters was exposed.

In 2001, one year after Gandhi became chief financial officer, city officials discovered that $68 million in tax payments had not been processed. The finding prompted the agency to conduct an internal review of the system that logs and tracks tax collections.

In 2004, two tax auditors were convicted of accepting bribes. One of the collectors accepted $19,000 in bribe money to lower the taxes of two local businesses: A liquor store’s bill went from $70,000 to $12,000, and a restaurant’s taxes went from $40,000 to nothing. The other collector accepted $30,000 in bribe money to reduce the taxes of a local business from $400,000 to $72,000, The Post reported at the time.

Then, on Nov. 7, 2007, Walters was arrested for cutting refund checks and depositing them into bank accounts controlled by her friends and family, a scam she ran for more than two decades. She learned how to process fake refunds from a co-worker in the mid-1980s, according to an investigative report produced for the D.C. Council. Over the years, the fraudulent refunds ranged from less than $5,000 to more than $500,000. Between 2005 and 2007, Walters’s refunds accounted for nearly 35 percent of all property tax refunds in the city.

At her sentencing in 2009, Walters told a federal judge, “If you put me back in there today, I could get each of you a check.”

Gandhi promised top-to-bottom changes, but problems continued after Walters was gone, records and interviews show.

In early 2008, internal auditors reported that the billing and refund tax-collection system, known as the Integrated Tax System, allowed employees to adjust taxpayer accounts, eliminating penalties or applying credits with little oversight from supervisors.

“There is minimal and inconsistent management supervision of the adjustments made to taxpayer accounts,” the auditors wrote in the report. “This is a serious internal control issue.”

In a written response, tax office chief Cordi agreed with the findings and said that staff members had “begun a comprehensive review of security related to online . . . taxpayer adjustments.”

Six months later, in June 2008, the auditors raised concerns that an unauthorized accounting practice was being used in the tax office as a work-around. Staff members had created “dummy accounts” for payments that could not be processed because of a switch in computer systems or a lack of identifying information about the taxpayers who had sent the money. The auditors found numerous accounts with fictitious Social Security numbers, including 58 with the number 999-99-9999.

The auditors did not indicate that any money was missing. Instead, they warned that the practice “creates numerous risks to the [tax office], including the issuance of erroneous bills, mishandling of taxpayers payments by failing to give due credit for taxes paid and creating the opportunity for potential release of fraudulent refunds.”

The auditors recommended that the tax office immediately review all of the dummy accounts and properly post the payments.

‘I was out there alone’

Yet, in December 2008, auditors discovered that a senior program analyst in the tax office was still using a dummy account. “It appears that the identified employee was given carte blanche access to the system, without any managerial oversight,” auditors later wrote.

Former tax office employee George Conly, now retired, told The Post that he was the analyst mentioned in the audit. He said that the office, as he understood it, used dummy accounts so payments that couldn’t be linked to particular taxpayers did not languish as “unresolved” on the agency’s financial reports. He said some of the payments were several years old and “clearly unidentifiable.”

“These accounts were really only a very minor part of daily work” at the tax office, Conly said.

He acknowledged twice moving money out of the dummy accounts to help settle debts owed by taxpayers whom he said had correctly complained about prior payments not credited by the agency.

“Looking back, this was probably the wrong way to handle these cases,” Conly said. “But I felt I was doing the right thing, the fair thing for the taxpayers.”

The auditors also found that $1.6 million in interest and penalties had been abated for taxpayers.

The auditors did not indicate any criminal wrongdoing. Instead, they wrote, “in our judgment, the unauthorized actions of this employee to abate a taxpayer’s account, resulting in the reduction of a liability, is an extremely serious matter requiring management’s immediate attention.”

Conly said he eliminated penalties and interest when taxpayers appeared to have a good reason to deserve the break, such as when a previous payment was incorrectly posted by the tax office, something he said happened frequently.

“Managers did not monitor the system,” he said. “At the time, I just knew that I was out there alone. I don’t know how many other people were doing abatements, but I couldn’t have been the only person because they needed to be made. I believe to this day I did many good things to help people who otherwise would have been treated unfairly.”

Conly said that, as a matter of principle, he never accepted money or favors from taxpayers. He retired in 2009.

In a written response to the audit, Cordi promised that “corrective action will begin within 10 business days.”

More revelations

Gandhi and Cordi received more audits and reports, uncovering new problems. In March 2009, auditors found that tax refunds of less than $10,000 — the majority of refunds issued by the tax office — were not subjected to the same level of scrutiny as larger refunds, leaving the office “vulnerable to misappropriation and fraud.”

Cordi responded in September 2009, saying the office was reviewing a sample of smaller refunds.

That same year, internal auditors expressed concern about the lack of controls on payments by taxpayers to a post office box used as the largest single receipt collection point in the city. A sole clerical assistant was responsible for picking up the payments, which were then handled by several other people before being tracked in the system.

“This significantly increases the chances for the payment to be lost, manipulated or diverted by a number of different individuals,” the auditors wrote.

Cordi again promised to make fixes, writing to the auditors, “We have revised the entire process as it relates to the PO Box for the Collection Division.”

From outside the agency, there were new concerns. The District’s inspector general, Charles Willoughby, reported in a 2009 audit that the tax office had not “tracked, verified and approved” internal changes made in response to recommendations by independent investigators in the wake of the Walters scandal. Gandhi’s agency had not appointed a project manager to ensure that the recommendations were adequately addressed or developed a plan for corrective action.

The inspector general identified 94 prior recommendations. After reviewing 62 of them, auditors found that most of the changes were in progress or complete.

Reports of ‘weaknesses’

In late 2010, Gandhi’s internal auditors found that the tax office was not effectively examining or auditing “high risk” tax returns. In response, the office said it would make changes.

In early 2011, auditors found that the tax office was sending thousands of property tax notices to bad addresses, with an average of 37,000 pieces of returned mail per year over a five-year period. The tax office, auditors said, “potentially suffers lost revenues caused by delinquent collection of property tax revenues.”

Cordi defended the office, saying that property taxes were paid for the vast majority of accounts with returned mail and that 40 percent of property tax accounts were paid electronically. He agreed, however, to update the agency’s mailing-address database.

Around that time, internal auditors began to suspect that a tax office employee was once again creating fraudulent refunds, reports show.

Based on a tip from the tax office, auditors in January 2011 launched an investigation that revealed that tax examiner Mary Ayers-Zander, hired in 2001, had used different taxpayer accounts to generate fraudulent refunds worth $400,000 from 2007 to 2011. The scheme was unrelated to Walters.

The agency reported it to local authorities. Ayers-Zander pleaded guilty and was sentenced this year to 30 months in prison.

“Mary Ayers-Zander treated the D.C. treasury like her personal piggy bank,” U.S. Attorney Ronald C. Machen Jr. said at the time.

Umansky, Gandhi’s spokesman, told The Post at the time that the theft was spotted because of reforms implemented after the Walters scandal.

Internal auditors, however, found in a November 2011 report that tax office employees could still adjust and approve refunds without supervisory oversight, and they blamed the latest scheme on “internal control weaknesses in the adjustment and refund process.”

In response to the report, Cordi again promised reforms: “We are in the process of making the necessary changes in access and procedures.”

Zander is slated to pay $413,610 in restitution to the city as part of her plea agreement.

Nikita Stewart and Jennifer Jenkins contributed to this report.