SSA DISABILITY 

BENEFITS

Comprehensive 

Strategic Approach 

Needed to Enhance 

Antifraud Activities

Report to the Chairman, Subcommittee 

on Social Security, Committee on Ways 

and Means, House of Representatives

April 2017

GAO-17-228

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-17-228, a report to the 

Chairman, Subcommittee on Social Security, 

Committee on Ways and Means, House of 

Representatives

April 2017

SSA DISABILITY BENEFITS

Comprehensive Strategic Approach Needed to 

Enhance Antifraud Activities

What GAO Found

The Social Security Administration (SSA) has taken steps to establish an 

organizational culture and structure conducive to fraud risk management in its 

disability programs, but its new antifraud office is still evolving. In recent years, 

SSA instituted mandatory antifraud training, established a centralized antifraud 

office to coordinate and oversee the agency’s fraud risk management activities, 

and communicated the importance of antifraud efforts. These actions are 

generally consistent with GAO’s Fraud Risk Framework, a set of leading 

practices that can serve as a guide for program managers to use when 

developing antifraud efforts in a strategic way. However, SSA’s new antifraud 

office, the Office of Anti-Fraud Programs (OAFP), faced challenges establishing

itself as the coordinating body for the agency’s antifraud initiatives. For example, 

the OAFP has had multiple acting leaders, but SSA recently appointed a 

permanent leader of OAFP to provide accountability for the agency’s antifraud 

activities.

SSA has taken steps to identify and address fraud risks in its disability programs, 

but it has not yet comprehensively assessed these fraud risks or developed a 

strategic approach to help ensure its antifraud activities effectively mitigate those 

risks. Over the last year, SSA gathered information about fraud risks, but these 

efforts generally have not been systematic and did not assess the likelihood, 

impact, or significance of all risks that were identified. SSA also has several 

prevention and detection activities in place to address known fraud risks in its 

disability programs such as fraud examination units, which review disability 

claims to help detect fraud perpetrated by third parties. However, SSA has not 

developed and documented an overall antifraud strategy that aligns its antifraud 

activities to its fraud risks. Leading practices call for federal program managers 

to conduct a fraud risk assessment and develop a strategy to address identified 

fraud risks. Without conducting a fraud risk assessment that aligns with leading 

practices and developing an antifraud strategy, SSA’s disability programs may 

remain vulnerable to new fraud schemes, and SSA will not be able to effectively 

prioritize its antifraud activities.

SSA monitors its antifraud activities through the OAFP and its National AntiFraud Committee (NAFC), which serves as an advisory board to the OAFP, but 

the agency does not have effective performance metrics to evaluate the effect of 

such activities. The OAFP has responsibility for monitoring SSA’s antifraud 

activities and establishing performance and outcome-oriented goals for them. It

collects metrics to inform reports about its antifraud initiatives, and the NAFC 

receives regular updates about antifraud initiatives. However, the quality of the 

metrics varies across initiatives and some initiatives do not have metrics. Of the 

17 initiatives listed in SSA’s 2015 report on antifraud initiatives, 10 had metrics 

that did not focus on outcomes, and 4 did not have any metrics. For example, 

SSA lacks a metric to help monitor the effectiveness of its fraud examination 

units. Leading practices in fraud risk management call for managers to monitor 

and evaluate antifraud initiatives with a focus on measuring outcomes. Without 

outcome-oriented performance metrics, SSA may not be able to evaluate its 

antifraud activities, review progress, and determine whether changes are 

necessary.

View GAO-17-228. For more information, 

contact Seto Bagdoyan at (202) 512-6722 or 

bagdoyans@gao.gov, or Cindy Brown Barnes

at (202) 512-7215 or brownbarnesc@gao.gov.

Why GAO Did This Study

SSA’s Disability Insurance (DI) and

Supplemental Security Income (SSI) 

programs provide cash benefits to 

millions of Americans with disabilities 

who are unable to work. Collectively, 

payments from DI and SSI were about

$200 billion in fiscal year 2015. 

Although the extent of fraud in these 

programs is unknown, recent highprofile cases have highlighted 

instances in which individuals 

fraudulently obtained millions of dollars

in benefits. GAO was asked to review 

SSA’s fraud risk management. 

This report examines SSA’s actions to 

manage fraud risks and the extent to 

which these actions align with leading 

practices for (1) establishing an 

organizational culture and structure 

conducive to fraud risk management, 

(2) identifying, assessing, and 

addressing fraud risks, and (3) 

monitoring and evaluating its antifraud

activities. GAO reviewed SSA 

documents, such as training materials 

and operational guidance; and 

interviewed SSA officials at the 

agency’s headquarters, its three fraud 

examination units, and selected state 

disability determination offices chosen 

for their proximity to antifraud 

initiatives. GAO assessed those

actions against leading practices 

identified in its Fraud Risk Framework.

What GAO Recommends

GAO recommends SSA (1) conduct a 

comprehensive fraud risk assessment 

for its disability programs, (2) develop 

a corresponding antifraud strategy, (3) 

develop outcome-oriented metrics for 

antifraud activities, and (4) review 

progress and change activities as 

necessary. SSA agreed with GAO’s 

recommendations.
Page i GAO-17-228 SSA Disability Benefits

Letter 1

Background 3

SSA Has Demonstrated an Organizational Commitment to 

Combating Fraud, but Its New Antifraud Office Is Still Evolving 12

SSA Has Taken Steps to Identify and Address Disability Fraud 

Risks but Has Not Conducted a Comprehensive Fraud Risk 

Assessment or Developed an Antifraud Strategy 15

SSA Does Not Have Effective Metrics to Monitor and Evaluate Its 

Antifraud Activities 24

Conclusions 26

Recommendations for Executive Action 27

Agency Comments and Our Evaluation 28

Appendix I Comments from the Social Security Administration 30

Appendix II GAO Contacts and Staff Acknowledgments 33

Table

Table 1: Overview of Disability Insurance and Supplemental 

Security Income Programs 3

Figures

Figure 1: Social Security Administration’s (SSA) Eligibility 

Determination Process for Disability Programs 5

Figure 2: Social Security Administration’s Disability Fraud 

Detection and Referral Process 7

Figure 3: Social Security Administration’s (SSA) Antifraud 

Management Structure 9

Figure 4: The Fraud Risk Management Framework 11

Contents
Page ii GAO-17-228 SSA Disability Benefits

Abbreviations

CDI Cooperative Disability Investigation 

DDS Disability Determination Services 

DI Disability Insurance

Fraud Risk Framework A Framework for Managing Fraud Risks in 

Federal Programs

GPRA Government Performance and Results Act 

of 1993

NAFC National Anti-Fraud Committee 

OAFP Office of Anti-Fraud Programs 

OIG Office of the Inspector General 

SES Senior Executive Service 

SSA Social Security Administration 

SSI Supplemental Security Income

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-17-228 SSA Disability Benefits

441 G St. N.W.

Washington, DC 20548

April 17, 2017

The Honorable Sam Johnson

Chairman

Subcommittee on Social Security

Committee on Ways and Means

House of Representatives

Dear Mr. Chairman:

The Social Security Administration (SSA) provides cash benefits through 

two main programs to millions of Americans with disabilities who are 

unable to work: Disability Insurance (DI) and Supplemental Security 

Income (SSI). Collectively, payments from these programs were about

$200 billion in fiscal year 2015. Although the extent of fraud in these 

programs is unknown, high-profile cases have highlighted instances in 

which individuals fraudulently obtained benefits. For example, according 

to a report from SSA’s Office of the Inspector General (OIG), over 70 

individuals in New York pled guilty in 2014 to participating in a conspiracy 

to obtain at least $14 million in fraudulent SSA disability benefits. DI and 

SSI are on the Office of Management and Budget’s list of programs 

designated as high risk for improper payments, which include but are not 

limited to payments made as a result of fraud. In addition, we include 

federal disability programs on our high-risk list of agencies and programs 

that are vulnerable to fraud, waste, abuse, and mismanagement or are 

most in need of transformation.1

You asked us to review SSA’s approach to managing fraud risks in light 

of our July 2015 A Framework for Managing Fraud Risks in Federal 

Programs (Fraud Risk Framework), which describes leading practices 

that agencies can follow to proactively and strategically manage fraud 

risks.2 This report examines SSA’s actions to manage fraud risks in its 

disability programs and the extent to which these actions align with 

leading practices for (1) establishing an organizational culture and 

structure conducive to fraud risk management, (2) identifying, assessing, 

 1

GAO, High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts 

Needed on Others, GAO-17-317 (Washington, D.C.: Feb. 15, 2017). 

2

GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP 

(Washington, D.C.: July 2015). 

Letter
Page 2 GAO-17-228 SSA Disability Benefits

and addressing fraud risks in its disability programs, and (3) monitoring 

and evaluating its fraud risk management activities.

To identify and examine SSA’s actions, we reviewed SSA documents 

including its 2014 and 2015 annual antifraud reports as well as 

operational guidance, training materials, and prior SSA OIG and GAO 

reports. We also interviewed SSA officials from across the agency’s 

headquarters including those in the Office of Anti-Fraud Programs 

(OAFP), as well as in the Operations, Disability Adjudication and Review, 

Learning, and Communications components. In addition, we interviewed 

staff in all three of SSA’s fraud examination units, visiting those in New 

York, New York, and San Francisco, California.3 To gain additional 

insights about SSA’s actions to manage fraud risk in its disability 

programs, we conducted site visits in Baltimore County, Maryland, and 

New York, New York.4 We selected Baltimore County, Maryland, because 

SSA’s headquarters including the OAFP is located there, and New York,

New York, because it is the location of SSA’s first fraud examination unit,

which was established in response to two high-profile fraud schemes. To 

assess SSA’s actions, we compared them with leading practices 

identified in the Fraud Risk Framework. In addition, we assessed SSA’s 

actions against federal internal control standards such as those related to 

managing fraud risks.5 We did not evaluate the effectiveness of SSA’s 

actions to combat particular fraud schemes.

We conducted this performance audit from November 2015 to April 2017 

in accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

 3

SSA refers to these units as fraud prevention units. We interviewed officials from the 

Kansas City, Missouri, unit by telephone. 

4

In each location, we interviewed staff in the state Disability Determination Services (DDS) 

office and a Cooperative Disability Investigation (CDI) unit. In addition, we interviewed 

staff from a field office in Baltimore, as well as the regional office and a hearing office in 

New York. 

5

GAO, Standards for Internal Control in the Federal Government, GAO-14-704G 

(Washington, D.C.: September 2014). 
Page 3 GAO-17-228 SSA Disability Benefits

SSA provides benefits to individuals with disabilities through two main 

programs: DI and SSI. Individuals are generally considered disabled if 

they are unable to do their previous work and, considering age, 

education, and work experience, are unable to engage in any other kind 

of substantial gainful work and their disability has lasted or is expected to 

last at least 1 year or is expected to result in death. See table 1 for 

additional key features and requirements of the DI and SSI programs.

Table 1: Overview of Disability Insurance and Supplemental Security Income 

Programs

Disability Insurance (DI)

Supplemental Security 

Income (SSI)

Purpose Provides benefits to persons 

who become unable to work 

because of disability. 

Provides benefits for disabled, 

blind, or aged people who have 

low income and limited 

resources. 

Work requirement Requirement depends on 

age of claimant, but is 

generally 40 quarters of 

coveragea

No prior work requirement.

Number of recipients

(fiscal year 2015)

10.9 million 8.3 million

Benefits paid

(fiscal year 2015)

$142.8 billionb $58.9 billionc

Source: GAO analysis of relevant federal laws and Social Security Administration (SSA) documents. | GAO-17-228

a

Generally, individuals need 40 work quarters (credits) to qualify, 20 of which must have been earned 

in the 10 years prior to becoming disabled. Individuals may earn up to 4 work credits per year, and 

the amount of earnings needed for credit is calculated using the national average wage index. In 

2017, $1,300 is needed for each credit.

b

This figure includes both persons with a disability and their family members who receive benefits.

c

This figure includes federal benefits and state supplementary payments.

SSA’s process for determining eligibility for disability benefits—which is 

generally the same for DI and SSI claimants—starts when an individual

submits a claim to SSA. First, an SSA field office employee reviews the 

claim to determine whether the claimant meets SSA’s nonmedical 

eligibility requirements and, if so, forwards the claim to a state Disability 

Determination Services (DDS) office.6 A DDS examiner then reviews the 

claim to make a determination of medical eligibility. If the claim is denied, 

the claimant has several opportunities for appeal within SSA, starting with 

 6

For example, an SSA field office employee will ensure that an SSI applicant meets 

income requirements and determine whether a DI applicant has a sufficient work history.

Background
Page 4 GAO-17-228 SSA Disability Benefits

a reconsideration at the DDS level and then a hearing before an 

administrative law judge. Claims at all levels for which the claimant is 

determined to be eligible for DI or SSI benefits, also called favorable 

claims, are forwarded to other SSA offices for payment. See figure 1 for 

an overview of SSA’s eligibility determination process for disability 

programs.
Page 5 GAO-17-228 SSA Disability Benefits

Figure 1: Social Security Administration’s (SSA) Eligibility Determination Process 

for Disability Programs

a

In 1999, SSA eliminated the reconsideration step in 10 states (Alabama, Alaska, Colorado, 

Louisiana, Michigan, Missouri, New Hampshire, New York, Pennsylvania, and in the Los Angeles 
Page 6 GAO-17-228 SSA Disability Benefits

area of California) as part of the Prototype Initiative. In these states, claimants who wish to appeal 

their initial DDS determination must appeal for review before an administrative law judge.

b

If parties are not satisfied with the Appeals Council decision, they may pursue the matter further in 

federal district court.

SSA has policies and guidance on how SSA and DDS employees should 

document and report suspected fraud. According to SSA’s policy, fraud 

generally occurs when an individual makes or causes to be made false 

statements of material facts or conceals such facts for use in determining 

rights to benefits, with intent to defraud. SSA guidance includes a list of 

factors that may indicate potential fraud for field office staff and DDS 

examiners to consider when processing disability claims. According to 

SSA’s policy, employees should gather enough information to either 

remove suspicion or determine that there is potential fraud. If they 

determine that potential fraud exists, they should refer the case to the

SSA OIG. They are also expected to develop the referral with as much 

information as possible, including who allegedly committed fraud, how, 

and when. See figure 2 for an overview of SSA’s fraud referral process.

SSA Disability Fraud 

Identification, 

Investigation, and 

Oversight
Page 7 GAO-17-228 SSA Disability Benefits

Figure 2: Social Security Administration’s Disability Fraud Detection and Referral 

Process

a

SSA employees who may review a claim include field office staff, hearing office staff, and 

administrative law judges.

b

Fraud referrals may also come to the OIG from nonemployees such as private citizens.
Page 8 GAO-17-228 SSA Disability Benefits

To help investigate some potential disability fraud cases, the OIG and 

SSA collaborate through Cooperative Disability Investigation (CDI) and 

fraud examination units:

• CDI units are staffed with a mix of SSA, DDS, and OIG staff, as well 

as state or local law-enforcement officers, to obtain evidence when 

potential fraud is suspected. CDI investigators often work undercover. 

As of January 2017, there were 39 CDI units covering 33 states, the 

District of Columbia, and Puerto Rico.

• Fraud examination units are staffed by SSA employees with disability 

determination expertise. Prompted by OIG requests and at the 

direction of SSA’s Operations component, they review claims to help 

detect patterns of disability fraud perpetrated by third parties such as 

physicians, attorneys, or claimant representatives. As of January 

2017, fraud examination units were located in New York City, San 

Francisco, and Kansas City, but each of the three units works on 

cases from anywhere in the nation.

SSA’s OAFP provides centralized oversight and accountability of the 

agency’s antifraud initiatives. The OAFP’s efforts include managing fraud 

risks in all of SSA’s programs including its disability programs. SSA’s 

National Anti-Fraud Committee (NAFC) provides a forum for agency 

executives to collaborate on antifraud strategies and serves as an 

advisory board for the OAFP in determining what initiatives to monitor, 

among other things. The NAFC is cochaired by SSA’s Deputy 

Commissioner for Budget, Finance, Quality, and Management and the 

agency’s Inspector General. All SSA deputy commissioners are voting 

members of the NAFC. The Associate Commissioner for the OAFP, who 

reports to the Deputy Commissioner for Budget, Finance, Quality, and 

Management, serves as the agency’s chief fraud prevention officer and is 

a nonvoting member of the NAFC. The NAFC is at a higher level than the 

OAFP and has cross-agency authority. See figure 3 for an overview of 

SSA’s antifraud management structure.
Page 9 GAO-17-228 SSA Disability Benefits

Figure 3: Social Security Administration’s (SSA) Antifraud Management Structure

Note: The Associate Commissioner of the OAFP serves as SSA’s chief fraud prevention officer and 

reports to the agency’s Deputy Commissioner for Budget, Finance, Quality, and Management.

According to federal standards and guidance, executive-branch agency 

managers are responsible for managing fraud risks and implementing 

practices for combating those risks. Federal internal control standards call 

for agency managers to assess fraud risks as part of their internal control 

activities.7 The Fraud Risk Framework provides a comprehensive set of 

 7

GAO-14-704G. 

Fraud Risk Management 

Standards and Guidance
Page 10 GAO-17-228 SSA Disability Benefits

leading practices that serves as a guide for agency managers to use 

when developing efforts to combat fraud in a strategic, risk-based way.8

The Fraud Risk Framework describes leading practices in four 

components:

1. Commit—Commit to combating fraud by creating an organizational 

culture and structure conducive to fraud risk management;

2. Assess—Plan regular fraud risk assessments and assess risks to 

determine a fraud risk profile;

3. Design and Implement—Design and implement a strategy with 

specific control activities to mitigate assessed fraud risks and 

collaborate to help ensure effective implementation; and

4. Evaluate and Adapt—Evaluate outcomes using a risk-based approach 

and adapt activities to improve fraud risk management.

In addition, the Fraud Risk Framework reflects activities related to 

monitoring and feedback mechanisms, which include ongoing practices 

that apply to all four components, as depicted in figure 4.

 8

GAO-15-593SP.
Page 11 GAO-17-228 SSA Disability Benefits

Figure 4: The Fraud Risk Management Framework
Page 12 GAO-17-228 SSA Disability Benefits

In July 2016, the Office of Management and Budget published guidance 

about enterprise risk management and internal controls in federal 

executive departments and agencies.9 Among other things, this guidance 

affirms that managers should adhere to the leading practices identified in 

the Fraud Risk Framework. In addition, the Fraud Reduction and Data 

Analytics Act of 2015, enacted in June 2016, requires the Office of 

Management and Budget to establish guidelines for federal agencies to 

establish controls to identify and assess fraud risks and design and 

implement antifraud control activities. The act requires the Office of 

Management and Budget to incorporate the leading practices from the 

Fraud Risk Framework in the guidelines. Further, the act requires federal 

agencies to submit to Congress a progress report each year for 3

consecutive years on the implementation of the controls established 

under the Office of Management and Budget guidelines, among other 

things.10

SSA has taken steps to establish an organizational culture and structure 

that are conducive to managing fraud risks in its disability programs. The 

agency has demonstrated a senior-level commitment to combating fraud 

in its disability programs and has worked to involve all levels of the 

agency in setting an antifraud tone. For example, in April 2014, SSA 

reestablished the NAFC to provide support for national and regional 

antifraud activities.11 The NAFC is composed of deputy commissioners 

from across the agency and other SSA executives who meet at least 

quarterly, which helps to demonstrate a senior-level commitment to 

combating fraud—one of the Fraud Risk Framework’s leading practices.12

The NAFC invites regional staff to its regular meetings and to an annual 

conference to report on the progress of SSA’s antifraud initiatives, which 

helps involve multiple levels of the agency in setting an antifraud tone—

another leading practice in the Fraud Risk Framework. SSA also 

demonstrated a commitment to combating fraud at all levels of the 

agency when it implemented the first annual mandatory antifraud training 

 9

Office of Management and Budget, Management’s Responsibility for Enterprise Risk 

Management and Internal Control, Circular No. A-123 (Washington, D.C.: July 15, 2016).

10Pub. L. No. 114-186, § 3, 130 Stat. 546, 546 (2016).

11The NAFC was formed in 1996 but met on an ad hoc basis from September 2003 to 

March 2014. 

12In fiscal year 2016, for example, the NAFC met seven times.

SSA Has 

Demonstrated an 

Organizational 

Commitment to 

Combating Fraud, but 

Its New Antifraud 

Office Is Still Evolving
Page 13 GAO-17-228 SSA Disability Benefits

in 2014 for all SSA and DDS staff. As discussed further below, the 

training describes indicators of potential fraud and instructs staff on how 

to report it. According to SSA officials, 97 percent of SSA employees and 

all DDS employees except for those on extended leave completed the 

most recent annual antifraud training.

SSA further demonstrated a commitment to antifraud efforts by 

conducting a study to evaluate its fraud risk management approach and 

shortly thereafter establishing a dedicated antifraud office within the 

agency. SSA contracted with a consulting firm in April 2014 to identify 

leading practices for managing fraud risks and, according to SSA officials, 

sought input from other federal agencies about their efforts.13 The 

consulting firm’s study identified the importance of establishing a 

dedicated antifraud office. SSA subsequently established the OAFP in 

November 2014.

The OAFP is responsible for coordinating antifraud efforts, developing 

antifraud policies, and creating and implementing fraud mitigation plans 

across SSA, among other things. These responsibilities are consistent 

with leading practices. According to the Fraud Risk Framework, agency 

managers can show commitment to combating fraud by creating a 

structure with a dedicated entity to lead fraud risk management activities 

and coordinate antifraud initiatives across the agency. In addition, leading 

practices call for the designated antifraud entity to, among other things, 

serve as the repository of knowledge on fraud risks and controls and lead 

or assist with trainings and other fraud-awareness activities. Since the 

OAFP was established, the office has performed several of these 

activities. For example, the OAFP has taken steps to coordinate antifraud 

initiatives across SSA by gathering information about progress on the 

initiatives, and has helped create antifraud training materials for the 

agency. In addition, the OAFP formed a committee in 2015, made up of 

associate commissioners from across the agency, to work on antifraud 

initiatives.

SSA’s Acting Commissioner has reinforced SSA’s commitment to 

combating fraud by communicating the importance of antifraud efforts in 

 13SSA continues to participate in efforts to share information on antifraud efforts with other 

entities. For example, in 2009 SSA formalized a working group with employees of 

benefits-paying agencies of six countries. According to SSA officials, this working group 

generally holds quarterly conference calls to share information on the goals and 

challenges faced by the group members’ antifraud programs. 
Page 14 GAO-17-228 SSA Disability Benefits

multiple ways. For example, the Acting Commissioner highlighted SSA’s 

antifraud efforts in a March 2015 virtual town hall meeting, which more 

than 27,000 SSA staff participated in by video or in person, and issued a 

“Commissioner’s broadcast” to all employees, encouraging staff to 

provide suggestions for combating fraud via an e-mail box launched in 

March 2014. From March 2014 through the end of December 2016, SSA 

received 399 suggestions and implemented 8 of them by, for example, 

adding examples and a cross-reference in SSA’s operations manual to 

help employees identify potential beneficiary fraud. In addition, the Acting 

Commissioner included preventing waste, fraud, and abuse as a guiding 

principle in SSA’s strategic plan and supported the launch in early 2015 of 

SSA’s antifraud website, which includes a link for the public to report 

suspected fraud to the OIG.

Although these steps are generally consistent with leading practices in 

fraud risk management, the OAFP faced challenges during its first 2 

years to fully establish itself within the agency. Specifically, the OAFP 

faced challenges related to a lack of consistent leadership and 

established institutional relationships. However, recent actions may help 

to address these challenges:

• Lack of consistent leadership: Until recently, the OAFP had not had a 

permanent leader who provided accountability for the agency’s 

antifraud initiatives. When the OAFP was established, SSA 

designated the OAFP associate commissioner as the agency’s chief 

fraud prevention officer. According to SSA officials, from the summer 

of 2015 until September 2016, two Senior Executive Service (SES) 

candidates served successive 6-month periods as the OAFP’s acting 

associate commissioner.14 In September 2016, a third SES candidate 

was appointed as the acting associate commissioner of the OAFP. 

Upon confirmation as a member of the SES, he became the OAFP’s 

permanent associate commissioner and assumed the role of SSA’s 

chief fraud prevention officer in October 2016, according to SSA 

officials.

• Lack of established institutional relationships: The OAFP is a relatively 

new, small office that is still building relationships and establishing its 

 14The SES candidates were part of the federal government’s SES Candidate 

Development Program, which is designed to provide mentorship and training for future 

senior leaders. SSA SES candidates are assigned to at least three developmental 

assignments, two of which must be for at least 6 months, and two of which must be 

outside of the candidate’s home component. 
Page 15 GAO-17-228 SSA Disability Benefits

role across the agency for which it is charged with overseeing fraud 

risk management efforts. According to SSA officials, the process of 

building relationships across the agency will likely require additional 

time to become more fully implemented. The OAFP is relatively small 

compared with the size and complexity of SSA’s 11 components. In 

fiscal year 2016, the OAFP had approximately 60 full-time equivalent 

staff, who were in charge of coordinating antifraud initiatives, among 

other tasks, across SSA, which employs over 60,000 full-time 

equivalent staff, excluding DDS staff. The OAFP is also in the process 

of overcoming perceptions of mission overlap. For example, according 

to SSA officials, there were initial concerns about the OAFP’s role in 

identifying potential fraud overlapping with the OIG’s role in 

investigating potential fraud. In August 2015, the Acting 

Commissioner of SSA approved a memo to components across the 

agency including the OIG that clarified the function and 

responsibilities of the OAFP.

SSA has undertaken efforts over the last year to identify fraud risks in its 

disability programs but has not comprehensively assessed the fraud risks 

identified through those efforts. Leading practices in fraud risk 

management call for the agency’s designated antifraud entity to lead 

fraud risk assessments and plan to conduct updated assessments on a 

regular basis. In planning the fraud risk assessment, leading practices call 

for managers to tailor the fraud risk assessment to the program by, 

among other things, identifying appropriate tools, methods, and sources 

for gathering information about fraud risks and involving relevant 

stakeholders in the assessment process. Fraud risk assessments that 

SSA Has Taken Steps 

to Identify and 

Address Disability 

Fraud Risks but Has 

Not Conducted a 

Comprehensive 

Fraud Risk 

Assessment or 

Developed an 

Antifraud Strategy

Steps Taken to Identify 

Fraud Risks in Disability 

Programs but Not to 

Conduct a Comprehensive 

Fraud Risk Assessment
Page 16 GAO-17-228 SSA Disability Benefits

align with leading practices involve (1) identifying inherent fraud risks 

affecting the program, (2) assessing the likelihood and impact of those 

fraud risks, (3) determining fraud risk tolerance, (4) examining the 

suitability of existing fraud controls and prioritizing residual fraud risks, 

and (5) documenting the results.15 There is no universally accepted 

approach for conducting fraud risk assessments because circumstances 

among programs vary.16

In spring 2016, SSA took steps to identify fraud risks in its disability 

programs by contracting with a third party, but this effort was not intended 

to be a comprehensive fraud risk assessment. According to the 

contractor’s report, the initial goals of the project were to develop a fraud 

risk assessment methodology that could be refined and updated over 

time and to conduct a pilot study of fraud risks in SSA’s disability 

programs by applying the risk assessment method. The contractor 

developed risk profiles for four fraud risks in SSA’s disability programs, 

including a qualitative assessment of the likelihood, impact, and 

significance of each risk, as well as potential responses to each risk. The 

contractor also included several other examples of fraud risks in SSA’s 

disability programs in its final report but did not assess these other risks. 

Both the contractor and SSA cited the limited time frame for the effort as 

a reason for not completing the initial project goal of applying the fraud 

risk assessment method more comprehensively. For example, because of 

the limited time frame, the contractor was not able to include disabilityprogram experts on the risk assessment team or review risk information 

beyond information included in documents provided by SSA stakeholders. 

Although it was not able to conduct a comprehensive assessment of fraud 

risks in SSA’s disability programs, the contractor stated in its final report 

that its assessment of four fraud risks provided a successful proof-ofconcept of its risk assessment method and that SSA could apply and 

update that method over time.

 15GAO-15-593SP. 

16Quantitative methodologies for assessing the likelihood and impact of fraud risks that 

involve statistical analysis (e.g., estimating the frequency and value of fraud based on 

historical data) may be more precise than qualitative methodologies. However, leading 

practices note that other quantitative or qualitative methodologies can still be informative 

when resource constraints, available expertise, or other circumstances prevent the use of 

statistical analysis. For example, managers may score risks on a scale of “rare” to “almost 

certain” for likelihood and “immaterial” to “extreme” for impact. GAO-15-593SP.
Page 17 GAO-17-228 SSA Disability Benefits

SSA also identifies fraud risks in other ways. Specifically, according to 

SSA officials, the OAFP hired a contractor to conduct interviews of SSA 

and DDS staff in the spring and summer of 2016 to gather information on 

patterns and characteristics of fraud in its disability programs to help 

develop an antifraud data-analytics model. However, they noted that the 

final report will not be available until mid-2017. In addition, according to 

SSA officials, SSA may become aware of fraud risks through information 

provided by the OIG’s Office of Investigations and from SSA field offices 

and hearing offices. These ongoing activities may provide SSA 

information on fraud risks in its disability programs but do not provide an 

overall assessment of fraud risks.

SSA plans to assess fraud risks, but it is unclear when or how an 

assessment of its disability programs will occur and whether it will follow 

leading practices.17 SSA’s antifraud plans for 2016 to 2018 include an 

objective to conduct regular fraud risk assessments but do not specify 

which programs will be included. In addition, it is uncertain when or how 

SSA will conduct these assessments because the plans do not describe 

interim steps or specific time frames. SSA’s plans include reassessing 

fraud risks in its programs on a regular basis, but the plans do not provide 

timelines for updating its risk assessments. Further, it is not clear which 

agency stakeholders will be involved in the process or what specific tools, 

methods, and sources SSA will use to gather information about fraud 

risks. SSA’s plans state that it will use information produced by its dataanalytics system to assist with its risk assessments but, as discussed 

below, this data-analytics system is in the early stages of development 

and it may be years before the system produces information on disability 

fraud schemes and trends that could be incorporated into a fraud risk 

assessment.18 According to a senior OAFP official, the risk-assessment 

effort is on hold because the OAFP is focusing its staff resources on 

developing its data-analytics system. However, information on the relative 

likelihood and impact of fraud risks identified through a fraud risk 

 17In April 2015, SSA’s OIG recommended that SSA conduct a fraud risk assessment. 

Specifically, the OIG recommended that SSA take a risk-based approach to combating 

fraud, weighing the qualitative and quantitative impacts of various fraud risks on the 

organization’s reputation, finances, and operations. SSA agreed but, as of January 2017, 

had not yet addressed the recommendation. 

18As noted in our Fraud Risk Framework, managers can use data on fraud schemes and 

trends from monitoring and detection activities—such as data-analytics systems—to help 

identify fraud risks. Managers may also conduct interviews, hold brainstorming sessions, 

or use surveys to gather information on fraud risks. GAO-15-593SP.
Page 18 GAO-17-228 SSA Disability Benefits

assessment can help ensure that the data-analytics system is 

appropriately targeted and that the OAFP’s resources are focused on 

SSA’s most significant fraud risks.

Conducting fraud risk assessments that involve relevant stakeholders and 

align with other leading practices, and updating such assessments on a 

regular basis, can help identify fraud vulnerabilities before any actual 

fraud occurs and better position management to take steps to strengthen 

antifraud controls. Without planning and conducting regular, 

comprehensive assessments of fraud risks in its disability programs and 

documenting the results, SSA does not have reasonable assurance that it 

has implemented antifraud controls to mitigate risks in its disability 

programs and may be vulnerable to new or emerging fraud risks.

SSA has several control activities that seek to prevent, detect, and 

respond to fraud in its disability programs. However, SSA has not 

developed and documented an overall antifraud strategy to guide its 

design and implementation of antifraud activities and help ensure it has 

sufficient and appropriate controls in place to mitigate its most significant 

fraud risks. Leading practices in fraud risk management call for managers 

to document an antifraud strategy that links antifraud activities to the 

program’s most significant fraud risks.19 Although SSA has not developed 

and documented an overall antifraud strategy, SSA has implemented 

several initiatives, some of which it created after identifying specific fraud 

risks. For example, after large-scale fraud schemes in SSA’s New York 

region highlighted the possibility that third parties could facilitate fraud 

against SSA, the agency established fraud examination units in 2014 to 

help detect these types of fraud schemes in the future. In addition, after 

identifying an issue in 2011 with the case management system used by 

administrative law judges that could potentially allow judges to improperly 

reassign cases, SSA officials said that they took steps such as changing 

system access rules to reduce the likelihood that this issue could occur. 

 19GAO-15-593SP. 

SSA Has Several Control 

Activities to Address Fraud 

but Lacks a Risk-Based 

Strategy to Guide Its 

Efforts
Page 19 GAO-17-228 SSA Disability Benefits

SSA performs several control activities that are designed to prevent, 

detect, and respond to disability program fraud. SSA considers risk when 

implementing some of these activities, for example by considering the 

likelihood an individual transaction may be fraudulent or the overall 

amount of funds involved. SSA’s antifraud activities include the following, 

among others:20

• Cooperative Disability Investigation (CDI) units: SSA and the OIG 

established CDI units in fiscal year 1997 to help prevent and detect 

potential disability fraud and have increased the number and 

coverage of the units in recent years. A typical CDI unit is staffed with 

an OIG agent who serves as the unit leader, SSA program specialists 

and DDS examiners who serve as experts on SSA disability policies 

and procedures, and state or local law-enforcement officers who 

gather evidence through covert surveillance operations or interviews.

As of January 2017, there were 39 CDI units covering 33 states, the 

District of Columbia, and Puerto Rico, which is up from 26 units 

covering 22 states and Puerto Rico in fiscal year 2014.21

Most referrals come to CDI units from DDS examiners who identify 

suspicious information during an initial eligibility determination or 

reconsideration, but referrals can also come from administrative law 

judges during their review of appealed decisions, as well as from 

other sources such as SSA field offices and the general public. Unit 

leaders screen referrals and, if the case is accepted, law-enforcement 

officers conduct an investigation. Staff from one CDI unit we 

interviewed said they spend more investigative resources on cases 

that could have more of a financial effect, such as younger individuals 

who could potentially receive more benefits over their lifetimes. After 

an investigation, CDI units prepare a summary report of their findings 

that DDS or SSA staff are required to consider in making a disability 

determination, which could help prevent or stop fraudulent benefits 

from being paid.

 20This is not an exhaustive list of all activities SSA has in place that may prevent, detect, 

or respond to disability fraud.

21The Social Security Benefit Protection and Opportunity Enhancement Act of 2015 

requires SSA to expand the CDI program to cover all states, five territories, and the 

District of Columbia by October 1, 2022. Pub. L. No. 114-74, tit. VIII, § 811, 129 Stat. 584, 

601.
Page 20 GAO-17-228 SSA Disability Benefits

• Fraud examination units: SSA established fraud examination units in 

2014. These units help detect potential third-party disability fraud and 

help respond to known fraud cases perpetrated by doctors, 

representatives, and other third parties. The units are staffed with 

SSA disability examiners from regional offices who assist the OIG with 

disability fraud investigations involving third parties and help 

reevaluate disability claims that could have been affected by known 

fraudsters. For example, unit staff can analyze groups of potentially 

fraudulent cases to identify trends or suspicious information, such as 

inconsistencies, altered medical records, or similar or identical 

medical evidence used in multiple claims. After their analysis, 

examiners share their findings with the OIG to consider in its 

investigation. In addition, fraud examination unit staff reevaluate 

disability claims that have evidence from third parties involved in fraud 

schemes, such as a case that was uncovered in Puerto Rico where 

third-party facilitators conspired with claimants to submit evidence for 

fabricated or exaggerated disabilities, resulting in 27 defendants 

sentenced as of September 2014, according to a report from SSA’s 

OIG. During a reevaluation, unit examiners help evaluate whether 

there is sufficient evidence of a claimant’s disability after evidence 

from a physician or other third party involved in a fraud scheme is 

excluded, or whether other evidence and further evaluation is needed 

to support the claim.

• Antifraud training and awareness-raising for SSA employees: As 

mentioned earlier in this report, SSA has annual mandatory antifraud 

training for all staff and multiple activities designed to raise awareness 

among employees about fraud, which can help deter and detect 

potential disability fraud by educating staff on how to identify and 

report suspicious activity. Since 2014, SSA has developed three 30-

minute antifraud training videos that explain fraud and fraud-related 

terms, highlight OIG success stories and agency antifraud activities, 

and instruct employees on how to report potential fraud. Employees 

view the training through SSA’s online learning management 

system—which tracks completion of the course—or in other ways, 

such as in group settings. SSA requires managers to certify that 

employees completed the training. In addition, SSA has multiple 

sources of fraud-awareness information, such as newsletters, an 

internal website page, memos, and OIG presentations that highlight 

agency antifraud activities and instruct staff on how to identify and 

report potential fraud.

• Antifraud communications to the public: SSA promotes fraud 

awareness externally, which can help prevent fraud by deterring 

potential fraudsters and detect potential fraud by encouraging the 

Categories of Fraud Control Activities

Control activities for managing fraud risks fall 

into three general categories—prevention, 

detection, and response. These categories 

are interdependent, and activities can often 

serve more than one purpose.

Fraud prevention activities include efforts to 

mitigate the risk of fraud occurring or to 

identify potential fraud before making 

payments.

Fraud detection activities help discover fraud 

that has already occurred.

Response activities include actions to 

address instances of potential fraud, such as 

referring potential fraud cases for investigation 

and prosecution, as well as actions to remedy 

the harm caused by proven fraud.

Preventive activities generally offer the most 

cost efficient use of resources, since they 

enable managers to avoid a costly and 

inefficient “pay-and-chase” model in which 

fraudulent transactions are detected and then 

attempts are made to recover funds after 

payments have occurred.

Source: GAO. | GAO-17-228
Page 21 GAO-17-228 SSA Disability Benefits

public to report suspicious activity. For instance, SSA provides fact 

sheets, posters, articles, web graphics, and social media posts on its 

website for groups, organizations, and individuals to use to help 

promote SSA’s antifraud messages. SSA’s website also contains 

information on how to report suspected fraud, a message from the 

Acting Commissioner warning the public that SSA will find and 

prosecute fraudsters, and examples of what SSA is doing to combat 

fraud. In addition, SSA includes antifraud language on notices to 

beneficiaries, which includes the OIG’s hotline number and website.

• Antifraud data analytics: SSA is in the beginning stages of developing 

a data-analytics system to help prevent and detect potential fraud. 

According to agency officials, this system will include multiple models,

and SSA plans to contract for a disability-related model after midfiscal year 2017 that will likely use data from several SSA databases 

to help identify pending disability claims that may be fraudulent on the 

basis of conditions that are indicative of disability fraud. As previously 

discussed, the OAFP worked with a contractor in fiscal year 2016 to 

conduct interviews with SSA staff who are familiar with the disability 

programs to help understand how fraud might occur in those 

programs. The OAFP plans to use that information to help guide its 

development of the model and what data may be required.22

According to OAFP officials, the agency plans to develop models that 

will rank claims by the likelihood of potential fraud so that analysts can 

focus on reviewing highly ranked claims more closely. SSA plans for 

the system to run in real time, which would allow SSA to examine 

questionable claims before they are fully processed and prevent 

potentially fraudulent benefits from being paid.

• Prosecution and sanctions: SSA has additional activities to respond to 

fraud and potential fraud and has taken steps to improve its 

processes. For example, SSA has provided attorneys to serve as 

 22We previously recommended that SSA take steps to improve its data-analytics efforts 

for program integrity purposes. Specifically, in November 2014, we recommended that 

SSA develop an implementation plan for new initiatives that use analytics to identify 

potential fraud schemes, including identifying data requirements such as the collection of 

unique medical provider information. GAO, Social Security Disability Benefits: Enhanced 

Policies and Management Focus Needed to Address Potential Physician-Assisted Fraud, 

GAO-15-19 (Washington, D.C.: Nov. 10, 2014). Additionally, in December 2014, we 

recommended that SSA provide more timely access to data on third-party representatives 

and enhance mechanisms for identifying and monitoring trends that may present risks to 

program integrity. GAO, Social Security Disability Benefits: Agency Could Improve 

Oversight of Representatives Providing Disability Advocacy Services, GAO-15-62 

(Washington, D.C.: Dec. 3, 2014). As of January 2017, SSA had not addressed these 

recommendations.
Page 22 GAO-17-228 SSA Disability Benefits

fraud prosecutors to supplement the prosecutorial resources of the 

Department of Justice, which has responsibility for criminally 

prosecuting SSA fraud cases. Specifically, SSA doubled the number 

of fraud attorneys to 24 in fiscal year 2015 compared with early fiscal 

year 2014. In fiscal year 2015, the SSA attorneys secured 171 

convictions resulting in over $16 million in restitution, according to an 

SSA report. Additionally, SSA can impose administrative sanctions—a 

temporary suspension of benefit payments for 6 to 24 months—on 

individuals who knowingly provide false or misleading information to 

SSA or fail to disclose information that is material to determining a 

right to benefits. In 2013, SSA implemented a new process to 

increase the consistency of imposing administrative sanctions and 

implemented a tool for improved tracking and monitoring of 

administrative sanctions in 2016.23

SSA has other program integrity activities that can help detect potential 

fraud in its disability programs, although these activities were not 

designed for this specific purpose. For example, SSA performs analytics 

to prevent and detect suspicious online transactions, such as unusual 

direct deposit requests.24 According to SSA officials, in fiscal year 2016, 

SSA reviewed over 29,000 suspicious online transactions and referred 

1,460 of those transactions to the OIG. Some of these transactions may 

involve disability benefits. According to SSA officials, the agency’s system 

to prevent and detect suspicious online transactions ranks such 

transactions by the likelihood of potential fraud, which helps focus reviews 

on the cases that are most likely to be fraudulent. SSA also uses datamatching techniques and participates in external data-sharing 

agreements to help determine benefit eligibility and detect improper 

payments, of which some may be fraudulent disability benefit payments. 

For example, SSA uses the Department of Health and Human Services’

National Directory of New Hires—a database containing quarterly wage 

data—to help determine an individual’s initial and continued eligibility for 

DI and SSI benefits. Another data match enables the agency to verify SSI 

applicants’ and recipients’ bank account balances to determine whether

they failed to report monetary resources that could affect their benefit 

amount or render them ineligible. Additionally, DDS examiners conduct 

 23SSA implemented the tool after we recommended that the agency improve its collection 

of data about administrative sanctions and their disposition. GAO, Disability Insurance:

SSA Needs to Better Track Efforts and Evaluate Options to Recover Debt and Deter 

Potential Fraud, GAO-16-331 (Washington, D.C.: Apr. 13, 2016).

24Individuals receiving certain SSA benefits—including retirement and DI—can use SSA’s 

online services to start or change direct deposit of their benefits, among other things. 
Page 23 GAO-17-228 SSA Disability Benefits

periodic continuing disability reviews of disability beneficiaries to 

determine whether they remain eligible for benefits. If examiners identify 

suspicious evidence, such as conflicting medical information, during these 

reviews and perceive potential fraud, they are instructed to refer the case 

to the OIG for investigation.

SSA has reported on the status of its antifraud initiatives and has a plan 

that includes high-level goals and objectives for managing fraud risks. 

However, it is unclear whether SSA’s antifraud initiatives are targeting the 

most significant fraud risks in SSA’s disability programs because SSA has 

not developed or documented an antifraud strategy that aligns antifraud 

activities to the most significant fraud risks identified through a 

comprehensive fraud risk assessment. SSA reported to the 

Subcommittee on Social Security, Committee on Ways and Means, in the 

House of Representatives in December 2014 and November 2015 on its 

antifraud initiatives, but these reports essentially provide summaries of 

antifraud efforts rather than a proactive strategy to guide SSA’s efforts 

moving forward. In particular, the reports generally do not clearly link 

antifraud activities to specific fraud risks by, for example, describing how 

the activities can address identified fraud risks. In September 2016, SSA 

completed a high-level antifraud plan that lists the agency’s antifraudrelated goals for 2016 to 2018. The plan outlines specific initiatives 

related to each goal but generally does not describe how these initiatives 

can help SSA address identified fraud risks. For example, the plan 

includes an initiative to increase the number of attorneys that serve as 

fraud prosecutors for SSA. The plan states that officials responsible for 

the initiative will determine strategic locations for the prosecutors but does 

not indicate how SSA will consider fraud risk in different areas when 

identifying locations for the prosecutors.

Without developing and documenting an antifraud strategy that considers 

the likelihood and impact of fraud risks along with its tolerance for these 

risks and its existing activities to mitigate them, as called for in leading 

practices, SSA cannot ensure that it has a coordinated approach to 

address the range of fraud risks in its disability programs and 

appropriately target the most significant risks. Developing an antifraud 

strategy can help SSA ensure that it has an appropriate balance of fraud 

prevention and detection activities to address its risks and can help SSA 

target its program integrity resources to the antifraud activities that would 

most cost effectively mitigate its fraud risks.
Page 24 GAO-17-228 SSA Disability Benefits

SSA monitors its antifraud activities—including those to protect its 

disability programs—through the OAFP and NAFC, but the metrics SSA 

uses do not enable effective monitoring and evaluation. According to SSA 

documents, the OAFP is responsible for monitoring SSA’s antifraud 

activities and establishing performance and outcome-oriented goals for 

them. The OAFP receives updates from the components that are 

responsible for each antifraud initiative and has shared these updates 

with the NAFC through periodic meetings and with Congress through 

reports about SSA’s antifraud initiatives. The OAFP provides flexibility to 

the SSA components in developing and identifying the metrics that are 

used to assess and report on antifraud initiatives, and, according to an 

OAFP official, the office does not revise the metrics submitted by 

components. Leading practices identified in the Fraud Risk Framework 

call for managers to develop outcome-oriented measures to monitor and 

evaluate fraud risk management activities and to adapt activities based 

on the results. In addition, according to federal internal control standards, 

managers should establish and operate activities to monitor the internal 

control system and evaluate the results, which may be compared against 

an established baseline.25 Furthermore, agency-wide strategic planning 

requirements established under the Government Performance and 

Results Act of 1993 (GPRA) and enhanced by the GPRA Modernization 

Act of 2010 required agencies to establish outcome-oriented goals and a 

balanced set of performance indicators, including output and outcome 

indicators as appropriate, in measuring or assessing progress toward 

goals.26 Although these requirements apply at the agency level, in our 

prior work we have reported that these requirements can serve as leading 

practices for strategic planning at lower levels within federal agencies, 

such as planning for individual divisions, programs, or initiatives.27

However, we found that SSA does not track most of its antifraud 

initiatives via outcome-oriented metrics to help the agency regularly 

measure progress in achieving targets. Of the 17 ongoing initiatives listed 

in SSA’s 2015 antifraud initiatives report, we found that 10 had metrics 

that were not outcome-oriented, and 4 did not have any metrics. For 

example, the percentage of staff trained in fraud detection and prevention 

methods (an output) is listed as a metric of the antifraud training initiative, 

 25GAO-14-704G. 

26See Pub. L. No. 103-62, 107 Stat. 285 and Pub. L. No. 111-352, 124 Stat. 3866 (2011).

27GAO, Environmental Justice: EPA Needs to Take Additional Actions to Help Ensure 

Effective Implementation, GAO-12-77 (Washington, D.C.: Oct. 6, 2011).

SSA Does Not Have 

Effective Metrics to 

Monitor and Evaluate 

Its Antifraud Activities
Page 25 GAO-17-228 SSA Disability Benefits

but SSA does not evaluate the outcomes associated with those trainings 

such as the change in particular behaviors following the trainings (e.g., 

the number of referrals to OIG about schemes covered during the 

trainings). In addition, the 2015 report lists the fraud examination units 

and fraud case reviews as initiatives but does not include metrics for 

either. Further, the majority of antifraud initiatives do not provide targets 

against which to measure performance and track progress relative to a 

baseline. For example, the initiative to add antifraud language to SSA 

notices states the “number of notices issued annually with antifraud 

language is over 186 million notices” as a metric but does not include a 

target.

As previously mentioned, the NAFC receives updates on SSA’s antifraud 

initiatives from the OAFP, but it plays a limited role in monitoring and 

making decisions about the initiatives. SSA antifraud initiatives reports 

state that the NAFC monitors certain antifraud initiatives. For example, 

the 2015 report notes that the NAFC identified 10 major antifraud 

initiatives to monitor that year. Although not all NAFC members attend its 

meetings, the NAFC meets at least quarterly to sustain attention on 

antifraud initiatives. The NAFC meetings provide an opportunity to 

present updates and ensure committee members are aware of ongoing 

initiatives. However, our review of summaries from the seven NAFC 

meetings held during fiscal year 2016 found that the NAFC generally did 

not take an active role in monitoring the initiatives. For example, six of the 

seven NAFC meeting minutes did not indicate instances in which the 

NAFC requested further information to determine whether antifraud 

initiatives were meeting their intended goals or recommend changes to 

improve antifraud initiatives. According to SSA officials with responsibility 

for implementing antifraud initiatives, the NAFC serves as a forum for 

updates about antifraud initiatives, including efforts being implemented in 

SSA’s regions, but makes few decisions about the initiatives and 

performs limited monitoring of them.

SSA recognizes the importance of monitoring, but it is unclear how it 

plans to evaluate its antifraud activities and adapt them if necessary. We 

have previously reported that agencies may face challenges measuring 

outcomes of fraud risk management activities in a reliable way. These 

challenges include the difficulty of measuring the extent of deterred fraud, 

isolating potential fraud from legitimate activity or other forms of improper 

payments, and determining the amount of undetected fraud.28 However, 

 28GAO-15-593SP.
Page 26 GAO-17-228 SSA Disability Benefits

as described in the Fraud Risk Framework, it is possible for agencies to 

gather additional information on the short-term or intermediate outcomes 

of some antifraud initiatives, which may be more readily measured than 

ultimate benefits. For example, although SSA does not have a metric to 

monitor the fraud examination units or to evaluate their effect on fraud, it 

is possible for SSA to identify more immediate outcomes such as the 

number of potential fraud patterns that the units uncover doing 

nonreevaluation work.29 SSA’s antifraud strategic plan for 2016 to 2018 

includes an objective to “adapt fraud risk management activities and 

communicate the results of monitoring and evaluations to management.”

Although the plan highlights the importance of monitoring to help 

strengthen fraud risk management activities, it does not include specific 

steps for monitoring its antifraud initiatives. Identifying performance 

metrics, including baselines and targets as appropriate, and requiring 

additional information from the responsible components on progress 

made would help the OAFP and NAFC better monitor whether SSA is 

achieving its antifraud goals. Without this information, the OAFP and 

NAFC may not be able to determine whether SSA’s antifraud activities 

are operating effectively or determine whether changes are necessary.

Proactively managing fraud risks can help facilitate SSA’s mission by 

ensuring that government services function as intended, and SSA has 

taken some steps to manage these risks. Many of SSA’s actions such as 

establishing an entity dedicated to coordinating fraud risk management 

activities and instituting annual antifraud training throughout the agency 

are consistent with leading practices and demonstrate a commitment to 

managing fraud risks. However, gaps exist in the agency’s fraud risk 

assessment, corresponding strategy design, and monitoring of antifraud 

activities. Despite some foundational efforts such as piloting a method for 

conducting future assessments by profiling four particular risks, until it 

conducts a thorough, systematic assessment of its fraud risks, SSA will 

lack robust information on the risks that may most affect the integrity of its 

disability programs. As a result, SSA may be using its resources to 

combat fraud schemes that are unlikely to materialize or that have a 

relatively minimal effect on SSA’s finances or reputation. Although SSA 

plans to assess fraud risks, it is unclear when an assessment of its 

disability programs will occur and whether it will reflect leading practices. 

 29The fraud examination units review disability claims. In some cases, the units reevaluate 

disability claim decisions that could have been tainted by known fraud schemes. In other 

cases, the units review disability claims to help uncover potential fraud schemes.

Conclusions
Page 27 GAO-17-228 SSA Disability Benefits

Absent a comprehensive fraud risk assessment that aligns with leading 

practices and is regularly updated, SSA will not be equipped to address 

the fraud schemes to its disability programs that are considered to be the 

most significant before they occur. Similarly, without developing, 

documenting, and implementing a comprehensive antifraud strategy that 

builds on a comprehensive risk assessment, as called for by leading 

practices, SSA cannot ensure that its antifraud control activities are 

targeted to its fraud risks, and therefore may be using its resources for 

program integrity efforts inefficiently.

Further, by creating the OAFP and reestablishing the NAFC, SSA has laid 

some important groundwork for monitoring and evaluating SSA’s 

antifraud activities. However, without establishing outcome-oriented 

metrics and then regularly reviewing progress toward meeting these 

goals, the OAFP will not be able to determine whether the agency’s 

antifraud control activities are working as intended. The OAFP is charged 

with coordinating among SSA’s components that lead particular antifraud 

efforts and establishing outcome-oriented goals; the NAFC—with its 

higher, cross-agency authority—is well-positioned to consider, act on, and 

help enforce the OAFP’s recommendations. If the OAFP does not review 

progress toward meeting antifraud goals and then recommend changes 

to any antifraud control activities that are not meeting goals, SSA will be 

hard-pressed to address known fraud risks and to respond to emerging 

risks that could undermine the agency’s antifraud efforts.

We recommend that the Commissioner (or Acting Commissioner) of SSA 

direct the OAFP to take the following four actions for its disability 

programs:

• lead a comprehensive fraud risk assessment that is consistent with 

leading practices, and develop a plan for regularly updating the 

assessment;

• develop, document, and implement an antifraud strategy that is 

aligned to its assessed fraud risks;

• work with components responsible for implementing antifraud 

initiatives to develop outcome-oriented metrics, including baselines 

and goals, where appropriate for antifraud activities; and

• review progress toward meeting goals on a regular basis, and 

recommend that the NAFC make changes to control activities or take 

other corrective actions on any initiatives that are not meeting goals.

Recommendations for 

Executive Action
Page 28 GAO-17-228 SSA Disability Benefits

We provided a draft of this report to SSA for review and comment, and its 

written comments are reproduced as appendix I in this report. SSA 

agreed with our recommendations and emphasized its commitment to 

preventing and detecting fraud. The agency also provided technical

comments, which we incorporated into the report as appropriate. SSA 

described how it plans to address our recommendations as follows:

• Regarding our recommendation to lead a comprehensive fraud risk 

assessment of SSA’s disability programs, SSA agreed and stated that 

it will conduct a fraud risk assessment on its major lines of business 

on a recurring schedule, beginning with disability in fiscal year 2017. 

The agency stated that it will conduct this assessment after 

developing a fraud risk management strategy that is consistent with 

leading practices identified in the Fraud Risk Framework. Although it 

is important to take a strategic approach to assessing fraud risks, we 

maintain that an effective fraud risk management strategy is based on 

a comprehensive fraud risk assessment.

• Regarding our recommendation to develop, document, and implement 

an antifraud strategy that is aligned to assessed fraud risks, SSA 

agreed and stated that it will prioritize and align the agency’s antifraud 

strategy to the outcomes of the fraud risk assessment.

• Regarding our recommendation to work with components responsible 

for implementing antifraud initiatives to develop outcome-oriented 

metrics, including baselines and goals, where appropriate for antifraud 

activities, SSA agreed and noted that it will collaborate with 

stakeholders, including its OIG, to implement this recommendation.

• Regarding our recommendation to review progress toward meeting 

goals on a regular basis and to recommend that the NAFC make 

changes to any control activities or initiatives that are not meeting 

goals, SSA agreed. The agency stated that, as it develops its 

antifraud strategy, the NAFC will measure and recommend necessary 

corrective action to ensure that its initiatives achieve SSA’s stated 

objectives and goals. In addition, SSA stated that it will seek 

opportunities to prioritize initiatives and activities through a risk-based 

approach to mitigating the risk of program fraud.

As agreed with your office, unless you publicly announce the contents of 

this report earlier, we plan no further distribution until 30 days from the 

report date. At that time, we will send a copy to the Acting Commissioner 

of Social Security. In addition, the report will be available at no charge on 

the GAO website at http://www.gao.gov.

Agency Comments 

and Our Evaluation
Page 29 GAO-17-228 SSA Disability Benefits

If you or your staff have any questions about this report, please contact 

Seto J. Bagdoyan at (202) 512-6722 or bagdoyans@gao.gov or Cindy 

Brown Barnes at (202) 512-7215 or brownbarnesc@gao.gov. Contact 

points for our Offices of Congressional Relations and Public Affairs may 

be found on the last page of this report. GAO staff who made key 

contributions to this report are listed in appendix II.

Sincerely yours,

Seto J. Bagdoyan

Director

Forensic Audits and Investigative Service

Cindy Brown Barnes

Director

Education, Workforce, and Income Security Issues
Page 30 GAO-17-228 SSA Disability Benefits

Appendix I: Comments from the Social 

Security Administration
Page 31 GAO-17-228 SSA Disability Benefits
Page 32 GAO-17-228 SSA Disability Benefits
Page 33 GAO-17-228 SSA Disability Benefits

Seto J. Bagdoyan, (202) 512-6722 or bagdoyans@gao.gov

Cindy Brown Barnes, (202) 512-7215 or brownbarnesc@gao.gov

In addition to the contacts named above, Tonita Gillich (Assistant 

Director), Joel Green (Analyst-in-Charge), Daniel Bertoni, Erin 

McLaughlin, and Bridgette Savino made key contributions to this report. 

Also contributing to the report were Holly Dye, Alexander Galuten, Erin 

Godtland, Maria McMullen, Kevin Metcalfe, James Murphy, Shana 

Wallace, David Watsula, and Greg Whitney.

Appendix II: GAO Contacts and Staff 

Acknowledgments

GAO Contacts

Staff 

Acknowledgments

(100438)
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, LinkedIn, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov and read The Watchblog.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.