A government watchdog has faulted the IRS for failing to adequately protect sensitive taxpayer information.