a

GAO

United States General Accounting Office

Report to the Chairman, Subcommittee 

on Social Security, Committee on Ways 

and Means, House of Representatives

August 2001 INFORMATION 

TECHNOLOGY 

MANAGEMENT

Social Security 

Administration 

Practices Can Be 

Improved

GAO-01-961

Page 1 GAO-01-961 SSA IT Management

United States General Accounting Office

Washington, D.C. 20548

A

August 21, 2001 Leter

The Honorable Clay Shaw

Chairman, Subcommittee on Social Security

Committee on Ways and Means

House of Representatives

Dear Mr. Chairman:

As the Social Security Administration (SSA) strives to meet its future 

challenge of delivering high-quality customer service in the face of 

increases in both workloads and in the number of retirements of its 

experienced workforce, it needs to identify strengths and weaknesses with 

its agencywide operational and managerial capabilities. Evaluating SSA’s 

management of information technology (IT) is a critical part of efforts to 

assess whether the agency is adequately addressing these capabilities. As 

you requested, our objective was to evaluate SSA’s IT policies, procedures, 

and practices in the areas of investment management, enterprise 

architecture, software acquisition and development, information security, 

and human capital. These five areas encompass major IT management 

functions and are recognized by the industry as having substantial 

influence over the effectiveness of an organization’s operations. 

To address this objective, we reviewed SSA’s policies and procedures in 

each of the five key areas and compared them against applicable laws, 

federal guidelines, and industry standards. We also reviewed selected IT 

projects and activities to help determine if SSA’s practices were consistent 

with its own policies and procedures, as well as with federal and industry 

standards. For each IT area we reviewed, we depicted our evaluation 

results and judgments on the current state of SSA’s policies, procedures, 

and practices by using three broad indicators. We performed our work 

from January through June 2001, in accordance with generally accepted 

government auditing standards. 

On July 9, 2001, we provided a detailed briefing to your office on the results 

of this work. The briefing slides are included as appendix I. The purpose 

of this letter is to provide the published briefing slides to you and to 

officially transmit our recommendations to the Acting Commissioner of 

Social Security. 

In brief, we reported that SSA had many important IT management policies 

and procedures in place in each of the five areas, but did not always 
Page 2 GAO-01-961 SSA IT Management

implement them consistently. In some areas, SSA had not established 

certain key policies, procedures, or practices, essential to ensuring that its 

IT is effectively managed. We noted weaknesses in all of the five key areas 

of IT management—particularly in investment management and human 

capital management—and are making numerous recommendations to the 

Acting Commissioner of Social Security to address these weaknesses. The 

Acting Commissioner has agreed with our recommendations.

Recommendations for 

Executive Action

To improve SSA’s IT management practices, we recommend that the Acting 

Commissioner of Social Security direct the Chief Information Officer and 

the Deputy Commissioner for Systems to complete the following actions: 

In the investment management area,

• develop and implement a process guide that establishes the policies, 

procedures, and key criteria for conducting the IT investment 

management process and guiding executive staff operations; 

• develop and maintain selection criteria that include explicit cost, 

benefit, schedule, and risk criteria to facilitate the objective analysis, 

comparison, prioritization, and selection of IT investments;

• analyze and prioritize all IT investments based on the predefined 

selection criteria and make selection decisions according to the 

established process;

• establish and annually review cost, benefit, schedule, and risk life-cycle 

expectations for each selected investment; 

• revise the IT oversight process so that the executive staff oversees the 

comparison of actual cost, benefit, schedule, and risk data with original 

estimates for all investments to determine whether they are proceeding 

as expected and, if not, to take corrective actions as appropriate;

• regularly perform post-implementation reviews of IT investments and 

develop lessons learned from the process;

• develop, manage, and regularly evaluate the performance of a 

comprehensive IT investment portfolio containing detailed and 

summary information (including data on costs, benefits, schedules, and 

risks) for all IT investments; and

• implement investment process benchmarking so that measurable 

improvements may be made to agency IT investment management 

processes based on those used by best-in-class organizations. 
Page 3 GAO-01-961 SSA IT Management

In the enterprise architecture area,

• establish milestones for and complete key elements of SSA’s 

enterprisewide architecture, including (1) finalizing its framework, (2) 

updating and organizing its architectures and architecture definitions 

under the framework, and (3) reflecting its future service delivery vision 

and e-business goals; and

• effectively implement change management and legacy system 

integration policies, procedures, and processes across the agency, and 

set target dates for full implementation of these maintenance processes. 

In the area of software development, 

• consistently apply the requirements management, project planning, 

project tracking and oversight, quality assurance, and configuration 

management policies and procedures developed by the software 

process improvement program across all software development efforts; 

and

• develop and implement a procedure to grant waivers to software 

development projects when deviations from policies and procedures 

occur.

In the information security area,

• strengthen the entitywide security framework by completing policy/risk 

models and technical system standards (security settings) for SSA’s 

major systems platforms; 

• develop monitoring techniques and corrective actions for 

noncompliance for the major systems platforms; and 

• use the platform security settings to strengthen security for each 

application utilizing these platforms. 

In the human capital area,

• complete an assessment of the Office of Systems’ current and future IT 

knowledge and skill needs;

• develop and maintain an inventory of the Office of Systems’ current IT 

staff’s knowledge and skills;

• determine whether a gap exists between current and future IT staff 

requirements and current staffing;

• implement workforce strategies that support the results of this gap 

analysis; and 
Page 4 GAO-01-961 SSA IT Management

• analyze and document the effectiveness of its strategies for recruiting, 

training, and retaining IT personnel, and use these results to 

continuously improve its IT human capital strategies. 

Agency Comments and 

Our Evaluation 

In providing written comments on a draft of our briefing, the Acting 

Commissioner agreed with all of our recommendations and identified 

various actions that SSA has planned or undertaken to address them. SSA 

also offered updated information and suggestions for revising several 

specific areas of our briefing, which we have incorporated where 

appropriate. 

Concerning our evaluation of its information security performance, SSA 

stated that it has now completed the development of policy/risk models 

and technical system standards for its major system platforms and 

suggested that we change our assessment of its performance in five 

information security areas. We are encouraged that SSA has reported 

completing its policy/risk models and technical system standards; 

adherence to sound models and standards should strengthen the security 

of its major platforms and information systems environment. However, 

because these models and standards were finalized after the completion of 

our review, we have not had an opportunity to verify their implementation 

and cannot, therefore, change our assessment at this time. Appendix II 

contains the full text of SSA’s comments and suggested revisions.

As agreed with your office, unless you publicly announce the contents of 

this report earlier, we plan no further distribution until 30 days from the 

date of this letter. At that time, we will provide copies to the Acting 

Commissioner of Social Security and to the Director, Office of Management 

and Budget, as well as to other interested parties. Copies will also be 

available at our Web site at www.gao.gov. 

Should you or your office have any questions concerning this report, please 

contact me at (202) 512-6257, or Valerie Melvin, Assistant Director, at (202) 

512-6304. We can also be reached by e-mail at mcclured@gao.gov and

melvinv@gao.gov, respectively. Individuals making key contributions to the 
Page 5 GAO-01-961 SSA IT Management

briefing and this report were Michael Alexander, Yvette R. Banks, Nabajyoti 

Barkakati, John Christian, Lester Diamond, Thomas F. Noone, Madhav 

Panwar, Elizabeth Roach, and Marcia Washington. 

Sincerely yours,

David L. McClure

Director, Information Technology Management Issues
Page 6 GAO-01-961 SSA IT Management

Appendix I

GAO’s July 9, 2001, Briefing ApendixI

	







		


	 
!

"	#$%%&
Appendix I

GAO’s July 9, 2001, Briefing

Page 7 GAO-01-961 SSA IT Management



'	
 (	


 	
 )

	



		



	

	

		
	
	
	



	) )

 
!!	"

 #

$
  %

$
!$!	$
 &

' 	
	
"		
 &(

' )	


 #(

' 
*
		+
	
 %(

' 	
	
 ,,

' -	.

 ((
Appendix I

GAO’s July 9, 2001, Briefing

Page 8 GAO-01-961 SSA IT Management

#

 


' 

	
	
	

!!	
	


	
	
		
!	


!
*
		
	
!

	
	
!		

/

	"



' 0
		
	
		
!

!


*
		
	
!	
	
!		

!	






	

	!

	!		

	/

' 0

 
	



	





			

	!	
1
	
	



!

/

 
	
2 



	
	/0





	
	
	
/

' 	
		


	3	
			







	
	/

' 0	


*
	4

!"+/0	
1

5	
5	66&!		
	


		

	


	/

' 0
		
	

	/

(*!
Appendix I

GAO’s July 9, 2001, Briefing

Page 9 GAO-01-961 SSA IT Management

%

'



'



	


	
	
	



	
	
	

					



/	

 
7

' 
				+

		+8



	
1		

!
	


	


1	
		
	/

' 
%,

	


	


' 4	
	




9##

		


' 
	


	8	8



	

1






		!	(,
!
	!


/

' 
(/(

	
	


' 4	
	




9/:

		

Appendix I

GAO’s July 9, 2001, Briefing

Page 10 GAO-01-961 SSA IT Management

,

'


+!


;;<66&!






	
 9:%&

	 	
	 


' ,%=
	

	 
!


	
 9,&:

	:6 	




,

' (, 
*
	
	
 
!


	
 9%

	#6

	




' 	
&6 	

	
.


$
		5

	


;<66&
88	
	
&(/	

;<66&


	
	1/
Appendix I

GAO’s July 9, 2001, Briefing

Page 11 GAO-01-961 SSA IT Management

(

'


+!
-	,

&>8

	

	
	
	
	1
		


	



66(

	
	

"		
	4
)2
#664/)


66#			






66#
/

	
		
!




 
	
	
/

)


 	

;<66&

	

	


"(.
/+

+ 01

$%%&	

+2

&

;		
	
	
;. 9&?/6 9&6:/6

"	
.
	
	
". 9/6 9=/6

@
	
=66@.

.	


	 9&6/6 9:%/6


1		>
		
.
 9&/6 9:/6




A	 9,/6 96&/6

)

	+
)+	
	
.
 9%6/6 9&,:/6

$
$.	
 9=/6 9(%/6

)

	0A
	
 9?/6 9(/6

	

-	A
 9#/6 9,/6


	

	
	
 9#/6 9%6/6

(
2 3&$%4% 35674%
Appendix I

GAO’s July 9, 2001, Briefing

Page 12 GAO-01-961 SSA IT Management

:




	

7

'0
	-0
,

' $
		
			
	
	


	



!	

!	
		
	
	

	

' $

	


	B		
		

	




' 

	
	

	
		
	
	
	

' )2


	
	
66

'
		
-,

' $
		
	

!




	1
!

	
	

	
		
	

' $ 
	


	


	


	




	

	




' 	



	-A

	

	
	
 


'


+!
-	,
Appendix I

GAO’s July 9, 2001, Briefing

Page 13 GAO-01-961 SSA IT Management

=




	

	
	7

'+
8-8,

' $
		





	!		







	




' $

!		

	

	






' .	



 


' +
	

	


' >

	
	


' 



	
1

' 


		


' )2




	66,

'


+!
-	,
Appendix I

GAO’s July 9, 2001, Briefing

Page 14 GAO-01-961 SSA IT Management

?

'


 

.	
	.	
		

*	

			
	
	
.
	8.	
	1	




						 
/

+
.	
+.

	







	


!	
	
			!	
			
!


		
!
	

	!
	*
		
	
!	


	*
	
!!	

/

' ;
.			+


+.7

' 
.	!
	
		

	!

' 
.	!
+		+
	
!

' 
.	!
A*	
!

' 
.	!	
	"		
!	

' +
!
$
					

	/

' 	;&(!66&!



)

	!	


+.!



	
		8




	






	
	

/
Appendix I

GAO’s July 9, 2001, Briefing

Page 15 GAO-01-961 SSA IT Management

&6

+
.	;		!	
!	"		
+.;"


' 		
	
	
!*
			
!

		
!



		

!			
		



' 


	

	
	!


					
	


	

!	


		2
	

' 
	
	
	

' *

	!		
	

!	



2
.		
	2


+.;"

' 
.	!*
		C	


' 
.	!4


' 
.	!;

"		


' 
.	!;		
$
	
	

' 
.	!$

		>
"		


' 
.	!D

		$		


' )2
!"		
	
	
$

+


' +
!	
		

A


' 	;		
)2


'


 -	,
Appendix I

GAO’s July 9, 2001, Briefing

Page 16 GAO-01-961 SSA IT Management

&&

'




	
66&!


' !=&#
		+.17

' !6: .




' .
	



' :=%
			8
//!.
.
1
	
	


			



' !#6( 
		+.;" 17

' =(.




' !6		8
//!
		

	

"		
	


Appendix I

GAO’s July 9, 2001, Briefing

Page 17 GAO-01-961 SSA IT Management

&



		
!	1

	 

	
			B
	
	
	

	
	



	
	7

' !
	

88 


	!	

!	



	88


	B
	
/0	



	1	
		
	
		

/#

1
1
	B
	

	

	!	

!	



	
!	2
	
	

	

1/

1


	


	

	


	
	
/4
		
	



		B
	!

	



	




	


	

		
	/

' +
 

	


	
*	
	8		
	








			
!

	


	
	
	
!	



		

	
		
	
	

	*
/

	
	


	
!
!	
	
		



	



	!	
	
	

	!
!
	


	

!	
	/
	
		
	


!		


			
	

	

	/

''
	
'




+!	



	


	
	

	




	
	!)2+
CE"+8

&6/&/#!"666/
	
	
	
		
		!



	

 

!	





"
	
	#


$
CE"+8&6/&/&#!;&??:/
Appendix I

GAO’s July 9, 2001, Briefing

Page 18 GAO-01-961 SSA IT Management

&#

' 9
:	!


	
	

	



!
!	



	
	
		
!



	

		
	
	
	

/F


*
	*
	
			!


	!	


1		


!

	!
	
	

!	*
	1		
/F



	
	
*	
		
! 

			! 



1		
!*

	!		
			
/

' 	




	

!		


!	





	
	


		
1
	!	
B

	
		
!	
	
	/	
	




	
	
	1	
!
		!
	
		

!

	

	!			

B	
		







/

' 	 




1	


	1




2


	
	/F	



		
	
	1	
	1

*	
!		
	2
	


1	
	1

		
	
*	
!
	



	
	




	*	
	2
	
	!	

		


			

	
	1	
	1

/

''
	
'




+!	-	,
Appendix I

GAO’s July 9, 2001, Briefing

Page 19 GAO-01-961 SSA IT Management

&%

''
	
'


+!	

	

	
1
!


!!	


/0
	




7

;
	



		
2



	




	

3	
	


		

/

<

	






1	
	3	



1
	
	
/


	



		
	

	1	
	3	


!!

		



	/

;
1!

	
	 	
	


	



!!	
/	
 

		

	

	

	




		
!		
	
		

	


/
Appendix I

GAO’s July 9, 2001, Briefing

Page 20 GAO-01-961 SSA IT Management

&, $
1	
	3



1


	






	38




''
	
'


+!		


.	!	

	3




!!	

	



	

	
	
"		


)	





 -	.




+
	


	
	

	

 





1	

4			

	

 





	

$



	
	
	

	
	
	


$


	


$

	


$
8
	

		

1

$

	

	

		



	
	
	

		


	
	
	1	

8	

		


	
		



		


	
		


.			


>
	

	

A*	
		



 

			


 

1		



*

	


	
			


A1	


	

	
	
	



$

	



@
1	



)

	

.	

		


A*	


		


01

	
	

$

	
Appendix I

GAO’s July 9, 2001, Briefing

Page 21 GAO-01-961 SSA IT Management

&(

	
	
		
1
	
	











	!	

!	

	

	
	
/




!


!	


	

	


	
	
		
/

''
	
'


!==(!
!9

●	




●




● 	

●	
 	
 
!


●""#

●$
"$ 



●	
 

 

● $"

●	
 

●	
 	
 
%


●

%


●

●$


	
&%


●
'  
	
&

●	


	
	
			



6

	


	
	


$

>

+
	

.



	
	
$



$

4
	


	
	


;	
	

&

.
	

	
	


	

7

>	








	



 	


7	
		


	
	
"		
!

CE"+8&6/&/#/
Appendix I

GAO’s July 9, 2001, Briefing

Page 22 GAO-01-961 SSA IT Management

&:

+
	.

$7


<+&

'  9	8 !'
88
	










<+$

' !
( 
88
				
	

	


	B
	!	

	


	
	/

' '
*(!
88
	B
		


 




	
2

	!

	
1

		

		
/

' 

;88
		
				
	


	!	



		
	1	/

' 	.'
*88	

 


	B
	

			
	/
	
	
				 


		

	 
		



 


/

' '
88	

	!




	
/

''
	
'


!==(!
!9-	,
Appendix I

GAO’s July 9, 2001, Briefing

Page 23 GAO-01-961 SSA IT Management

&=

+
	.

$	
	


<+>

' 
	
!
88	

	

	




	
	
			B
	


/

' '

888
		


	1




			
	


	B
	/

' !
882	
		


!	
!
!	1



	
	

			

	
	
	


/
	




	


	
	
	
!
			
B	
	
	



	




/

' '8!88

	
	
	
		

	
	


	
	

/
	
2		

	
	
	1	

				


	

	2

		
	
/

' ''
(!
88	
	
	
		
	
	




/
	

 

	

	


	
	
	
	1		


	



/

''
	
'


!==(!
!9-	,
Appendix I

GAO’s July 9, 2001, Briefing

Page 24 GAO-01-961 SSA IT Management

&?

+
	.

$	
	


<+6

' '= !90;88
	
	
	
		



	






/

' ''
+!	 
!88



		


	
	

	
	
	
	
	
	




	/

' 	88	
B		
	

	
	
	
	


8
/


<+7

' !'

;88	
	
	

	
	

	
	
		




2

8	8


	B
	/

' =8
!
	88	
	
	





	
	


	1	
	B
	
2
		


2



	/

''
	
'


!==(!
!9-	,
Appendix I

GAO’s July 9, 2001, Briefing

Page 25 GAO-01-961 SSA IT Management

6

''
	
'


!==!9

0

	
	
		
	
.
	8.	
!"4.



$	C!	C!	


	
	

	






	
	/

0	
	
		


	
	
	


/0





	
	
	
	

-	A
 


	
;		
	
	
A
	
 
!
.



01!
	


 
	
	
/

0

	
	





,/%0	







&

B
1/

%4	
		
	
!

#

	
	


		
	
	
	




!	
!	
/
Appendix I

GAO’s July 9, 2001, Briefing

Page 26 GAO-01-961 SSA IT Management

&

)2

.0 

*




	 


/	
	!
.

	
&	
	


81

 
8
8

	
		
	


	8	 
/

		8.0

 


!

 
		





.	

!
	




)2

/

)2

+
.		


	
	
4/"	

	

	1	
/




		




	


.	

			*





	.

01.0 
!


8
 
/-!
	

	



		1

)2


	

	
	
	
	
		
		81	
/


 

''
	
'


!==+!	

 
*

!


!






!

-
 
,

	






	38




$
1	
	3



1


.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 27 GAO-01-961 SSA IT Management



4			

	
 
/

$ 

	1	

	





 
/	


	 
		


	 


/

		B
	
	
		
	



	
		
	!
!

		
!	2		
	



	/


	
		


!
		
		

	
	
		

	
	








			1			
	


		
	/.	
	
	


		

	
		
		




	!	
!	1	
	
	
/


 

	



 
*

''
	
'


!==+!	-	,


;


!

-
 
,

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 28 GAO-01-961 SSA IT Management

#

)2


8








		
	
/.
	

	



$
	!
$	$
	! 
	
!

1	

!	
,8<
$
	/.




!
!	

/-!
8





	
	
	
2


!
!	
!

1
88	
	




	1	


		
	

	

/

'










	
/

A

B	






	
		


	
!


	
		

A


A!		


.
			
	/

.1				A

	
			

)2

/








B
		

	


		
!	2

!


!
!

	
!1
2

	/	


	!
	
 
2		
	8


		
A/


 

''
	
'


!==+!	-	,

'



!

-
 
,

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 29 GAO-01-961 SSA IT Management

%

.!
	

)2

!2		1

					
	
/	
	



B	


	
		

		


	
,8<
$
	 1/





,8<
$
	




	




	/.


	
2

	
		

8


	
	
/-!	
	

	
	




	


	
	
	
	


	

	
	
 
	




		/	
	!		
	
	1

2

		


.)2

/

	
	
	


8

B	






/A	
		



	
	
	1			
	

./

-!

12

!


!
!	
!

	

1
	
	




	
	

	 

	
B	
B
	
	
/

	
	!
	

 


2		
	8


		
A/



'

!

!






''
	
'


!==+!	-	,


!

-
 
,

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 30 GAO-01-961 SSA IT Management

,

	

!
.	
		

 



8
	

	$A	



	/
!

	$A		


	/#6.0 
	
	
!	
	

		

$A/	
	!
	


	
	 
$A

	

	
	$A/

'=

 


!9

;

)2

.0 

*




	 


/	
	!
.

	
&	
	


81

 
8
8

	
		
	


	8	 
/-!		


	
2

		

	
1

	


2
	
	
B



/

 


.0



		



.	

!


	


)2

/


 

''
	
'


!==+!	-	,

'

 


!



!

-
 
,

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 31 GAO-01-961 SSA IT Management

(




			



		
/	



	
		
	


	!

B
	!


!	
	
!



	

,8<
$
	/-!	



	
			


	



	


			
	
/





	




	

	





		
	
/	







	8	8	
	
!	

!
B

	
	
!



!	

	

 
/-!



		




/	
	
	




	2
!
	





	
!


	!	

	!			
		






	






	
	


	B
	/


 

'

 


!	

 
!


!

-
 
,

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	

''
	
'


!==+!	-	,
Appendix I

GAO’s July 9, 2001, Briefing

Page 32 GAO-01-961 SSA IT Management

:

	+666!	
)

		
.	



!

!

!	
	
	
	










		
	


	
	/



	


	
	2



	



	/


)

		
.	




			8			
	
!


	

	
	


	
	


	1	
/

=
!


	








			B
	

	
	
			



	
	


	
	


	/-!

		1	
		
	


	1	




	
	

	
	

	!	1	

8	8


	B
	!	1		
	


	
/


 

!

 



;


!

-
 
,

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	

''
	
'


!==+!	-	,
Appendix I

GAO’s July 9, 2001, Briefing

Page 33 GAO-01-961 SSA IT Management

=

' !
( 
)

0



		
	
		
!
1	




)2

		
	
		

		1		



		
	
		/

' '
*(!
)

0

)2


		8.0 


	
	


2

	!		

1	


 
		



		
	
!
	
!		
*	
/

' 

;)

0

8
8
	
					

!
1

	

	1
	
	
	


	

	
	
/	
		
88	
	 
	
!
!


!
	!

	!	!		
!
!	

88

		

	
	

2




	1	

	
	
	/	
		
2



	



	

	
	/

''
	
'


 !;
Appendix I

GAO’s July 9, 2001, Briefing

Page 34 GAO-01-961 SSA IT Management

?

' '
)

0

	!2



	
!
1	




 

	
B!	

!	



 


/

' '

8)

0





	


2



!	
!
!	1!


1	

	1
	



		

	
	









			


/




	
	


		

!



	

	
!






		

		

	
	





8
	8



		/

' !
)

0

	
B		

	

!	
!
!	1




	

	
	
	
	
!		

	




		

		
	
	







	
8


	

	


	8	8

	

!
!	!

*

!


	!
//

''
	
'


 !;-	,
Appendix I

GAO’s July 9, 2001, Briefing

Page 35 GAO-01-961 SSA IT Management

#6

' '8!)

0

		
	




	
	

	

	
		

	
	
88	
	
!	
!
!	1
88
1

	

	

	
	



	
1	
		



/

' ''
(!
)

4
)2

	

	

	
	
!
1

	




	
!	
!
!	12

	/

' '= !90;

0



		
	


	
	
	



	


		
!
1	
		


	
	

	
	 
88//!
!	
!


	!	


!	
	


88	
	
		
	
	


		
/

''
	
'


 !;-	,
Appendix I

GAO’s July 9, 2001, Briefing

Page 36 GAO-01-961 SSA IT Management

#&

' ''
+!	 
!)

0




			
B	


	
!
1










		1	
	





	
	
	
		
/

' 	)

0


		


		
	
	
	!

	
*


						

	8
!
8


	
	


/

' !'

;)

0

	1	
	
	
		

8	8
	B
	!


1



	
	
	

	


	



2

8	8
	B
	/

' =8
!
	)

G	

	

	
	8			
	
	
	

	
			!
	




	







		
/

''
	
'


 !;-	,
Appendix I

GAO’s July 9, 2001, Briefing

Page 37 GAO-01-961 SSA IT Management

#


7

' +
	
	






!!	

1
	
	
	
	
		
		

)2


	/

' +
		
	

	


	
2


!	
!
!	

1





 
	
!	!
B
	!	

	

	
	
/

' 	
B	
B

	
	
	
	

	
	

1

			



/

' )

			


!	
!
!	1

2

	



	
	
/

!

	

 
!
Appendix I

GAO’s July 9, 2001, Briefing

Page 38 GAO-01-961 SSA IT Management

##

' A




)2


	




!	
!
!	1

	




	
	




	

	2
	

1

	


/

' A


8
	

		
	
	

	


	
/

' +
!	!	




		

	
	


	
		

		
		
	
	


!	
!
!	1

	
	
/

' 
	
	
	
	1	


	



		
	
		
	

8	8


	B
	/

!

	

 
!-	,
Appendix I

GAO’s July 9, 2001, Briefing

Page 39 GAO-01-961 SSA IT Management

#%

!

'

!;

;

		
!




!	
	
!


	



' 2
1
	 

	





	1	
			


!

' 
		
		



	


			

		
	
	

!

' 	

8
	

	
		




	
 

8
	

	!

' 	
	
	8	8	
	

			

		 





	
		
	
	!

' 	



					
	
	

	


2		

	!
Appendix I

GAO’s July 9, 2001, Briefing

Page 40 GAO-01-961 SSA IT Management

#,

!

'

!;-	,

' 



					
	
	


	

		

		

	!	

' 		

				8.0 
/
Appendix I

GAO’s July 9, 2001, Briefing

Page 41 GAO-01-961 SSA IT Management

#(

		



	

		
	



	
	

	


	

	
	
/



		
		


7

' ( 
 88

	

	
	

	
	!	
1	

!		
	
*



	
	

'  88	









	1		



	
	!	


	
	
	

		
		


	






'  88

	


	

	


					
			


	
1

!	









	

	
		


''
	
'


+
 


	
==(!
!9
Appendix I

GAO’s July 9, 2001, Briefing

Page 42 GAO-01-961 SSA IT Management

#:

"4
	*	
	

	1
	
	
	




/
	
		

	


		





7

( 
 

' 4	
	


' 	
	
	

		


 

' 





!	

!		
	
	




	

' +

		

		
	
	!!	



 

' 	

	!!		



''
	
'


+
 


	
==(!
!9-	,
Appendix I

GAO’s July 9, 2001, Briefing

Page 43 GAO-01-961 SSA IT Management

#=

"4
	
*	



1
	
		


	



7



' "			
	





		

	
	


2


' +
	
	


	

	2
			









	






0



	
.
	8.	
		

"4!
!	
..	
/,0

	



		


/

''
	
'


+
 


	
==(!
!9-	,

,	
 

	

!	



	
	
!.	
	.	
!	&/6!;66&/
Appendix I

GAO’s July 9, 2001, Briefing

Page 44 GAO-01-961 SSA IT Management

#?



	

	
		

	
	!	
		
	!		!
!


	


	
!			

/	
	!




	

	
	1





		
	!	
	
	

	

		

/



	
	
/


 

''
	
'


+
 


	
==+!	

( 


?	

 


!

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 45 GAO-01-961 SSA IT Management

%6



	

		

	
			



	



!
B
!	

!

		
	
	!	*

	/

	

		
	





!	
	
	
!		



	




/




	


	
	


!1	

	!	




	/-!2
	

	



	
		
	



!

	B!	


			


1/	
	!	




	












	



6&6H		8	
/





 


!

''
	
'


+
 


	
==+!	-	,

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	



Appendix I

GAO’s July 9, 2001, Briefing

Page 46 GAO-01-961 SSA IT Management

%&

	

	

	



	
		

		
	
	


			
	
			

/


)	




	

	!



!	


	

!	
1!	

		

/


		


	
!
	
	
	0
	
/




	

A4

 

	



	

2
	




	

			




	/-!2
	

	



	
		
	



!	B!	




			
1/	
	!

	




	












	

6&6

H		8	
/





 




''
	
'


+
 


	
==+!	-	,


!

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 47 GAO-01-961 SSA IT Management

%


)	



	
!

	!	


	

	

	/



			




	

	/	
	!

A4

 




			

	


				/-!	








		


	
		!	
	


	




	

	/	


	!	




	












	



H	6&6	8	
/


)	



	


		
	
	


	
	



	


	/

A

4 


			
	/


	
			
				


		

 


/-!

	






		




	
		!	
			




			
/

2









! 
 

''
	
'


+
 


	
==+!	-	,

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 48 GAO-01-961 SSA IT Management

%#

' G	




	


!	
	&
		

	B	


			
1!			












		8	
!


1	




*



		
	


	
			/

' 0

	
	


			
!


1	


	

			
	





		
	
		
	
*/

' 0

	
	


	

	!
1

	

	
	
	


	


2
	


	
8
		/

''
	
'


 +
 


	
;
Appendix I

GAO’s July 9, 2001, Briefing

Page 49 GAO-01-961 SSA IT Management

%%


7

' .

1
	

	


	
	&	
B	


	


1!
			B	




	

	
		
1!	#

	




		8	
/	
	!






	



	


		
/

' )	

			
	

	

	
!!

	


	

	/










	

	
	
		/

+
 


	


	

 
!
Appendix I

GAO’s July 9, 2001, Briefing

Page 50 GAO-01-961 SSA IT Management

%,

' 	B
	

	
	
	



	

	


		B
!	




1	


	


	/

' 	
66&!


	
		




/	

			





	B
		



	

	
	
	
		!
!	/

' 


1

	8

			
2
		
		

/







		B


	


	


1/




2




2
		






	


	
66&/

' 
		






$
			

"
/
	

		8

	
/

' 






	
	
	
			
	



	

	/

+
 


	


'

+
 


	
;
Appendix I

GAO’s July 9, 2001, Briefing

Page 51 GAO-01-961 SSA IT Management

%(

"		B
	
	
8	
	


	/*






	


*


	
	*	


	

!			
		
/.	"

	G	

)			

	


)!	B
2
	
!

	



				B
	


/

).

"

"
".""I(

1





	


	
		B
		

	
	1	!	






			

	
/



7

&/7


B		/

/ 7 
		


3
	
	

	



/

#/87
	
	
	B3

 
	!



	
	B
	
	
*	
	



	/

%/?@	!7



!
!	




3

	
*	



	
		


/

,/( A7	
		
	
*	


1


	

			
	
	
/

''
	
'


9

:	8!==(!
!9

(

.

"

"
"
1.	"

	G	
!	.""I
	
G//$
	
	

1/
Appendix I

GAO’s July 9, 2001, Briefing

Page 52 GAO-01-961 SSA IT Management

%:

.""




,*

2
		
	


!1		1F$/

)




!

	F$!



*
		

	
/

	&??:!




$	
$	






	B
	

 







!

	

!	
*



/$	

	
	

	
		

	

				
	


8
 
		
	
				2
	 
8





/$


	
	 
		



		

	

	%: 
	

/





(6 

	

	

	

	

	 
	
$	


	


		


	

	
/

''
	
'


9

:	8!==(!
!9-	,
Appendix I

GAO’s July 9, 2001, Briefing

Page 53 GAO-01-961 SSA IT Management

%=

0


		

	
	
)


+
	
.""/0




	
	




		
	





F$!

		


	









	/

	

!	



!)8
	


/

0


	
 
88
)

	+


+4	


)		"		
	
	
	
+

)"+88


*
/0
 

	

	

/



 
	
			




1		

!





	
	 
		

!	





	




1	

/

0	



*
	

	











		8/

''
	
'


9

:	8!==(!
!9-	,
Appendix I

GAO’s July 9, 2001, Briefing

Page 54 GAO-01-961 SSA IT Management

%?

' :	
88

		
		
		



J*	

	

	

 

/

' 9
 
* 88	
		B
1
	
	



						
 
/

' 9
 
*
;!
88		


	!
!

	
 

 




/


	






		
	


	

 
J	


		


	/

' 9
:		
88
	
	
 
	




	



	B
	
	/

' 9
	
88

		
	
	








 
J


!




	
				*	
	
	/





	
F$7

''
	
'


9

:	8!==(!
!9-	,
Appendix I

GAO’s July 9, 2001, Briefing

Page 55 GAO-01-961 SSA IT Management

,6


	
 

			



	

	
 

	


/-!

 


	
	
	
/;	
	!	
	
 
	

	


	

	
	




/
 



	

 

			

!


	
	




	

	
	





/


*	
		
/


	
*	


 
/

-!	
 
	
	

	

		
	*	
		


/

9
 
*

 

:	





 

''
	
'


9
8!==+!	


!

-B 

,

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 56 GAO-01-961 SSA IT Management

,&


		
			
/

0
	 
	
	
			



		

	
			

!

		

	
			



	

 
/


	
*

	/	

 
	
*

	
		



*

	/-!
1*

	




 
/

9


	




9
:	

	



	 

1		
/

0

1		


!

	

	


	

		
2




1


	
 
/

9
 
*


;

!



 

''
	
'


9
8!==+!	-	,


!

-B 

,

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 57 GAO-01-961 SSA IT Management

,

' 0
$	


	
		



	

	
	
!

	
	


	


!
1	





	
*




	
	
	

/

' C	







	!

1	

		
	
	



	
1




	






	
	

	




	/

''
	
'


 9
8!;
Appendix I

GAO’s July 9, 2001, Briefing

Page 58 GAO-01-961 SSA IT Management

,#

9
8!

	

 
!


7

' )	


*	
		
! 

			! 

1		
!*



	!		
			

	

$

	
	






	

/

' +
	
	

	



	
 
	


	
	/
	
	
	


	

	!
	



+
.	


	


.	



 
/
Appendix I

GAO’s July 9, 2001, Briefing

Page 59 GAO-01-961 SSA IT Management

,%

9
8!

'

9
8!;







1	


	
	7

' 
	2

81

	




.	
		

	
 
	




	

	/

' 
	B
		
	
 

	

	
	


	


	

	/;
!
$


	

	

 
		





	
		
	
	

	

	/

	





 
				8

*	


	

		
	
/

' 


*


	


 
	
	
		/
Appendix I

GAO’s July 9, 2001, Briefing

Page 60 GAO-01-961 SSA IT Management

,,

	
	


		B
	
8
	
/



		
	

!
		


!	


	

	B
	
	
/
	


	
	




			
B		/	

	
		






	
B	
!	

!/


!	






			
B

	

/

F

			
	
1	
7

' ;==	
	


	
	


	
	


	
	


!	1	12!		
	
8


	



' 
9
==
					
1	
	




	

' 
==
	
		

	


	
1
	
	


!


!		
1	





''
	
'


	
==(!
!9
Appendix I

GAO’s July 9, 2001, Briefing

Page 61 GAO-01-961 SSA IT Management

,(

0


			
	
	
.
	8

.	
!
.


!	
	"4!
!	


@
	
	



			
/0	

	!

	


	!


	
!	
1	


	

	/0

%
%

	

	&

	


	
'
()))/0$
.		





	
666		


	

	




		
		
		
	
/0	

	

*	

	

$
.	5	


		
1/

' +!	88	
	
		

		






	

' 
88	
	



	

B

''
	
'


	
==(!
!9-	,
Appendix I

GAO’s July 9, 2001, Briefing

Page 62 GAO-01-961 SSA IT Management

,:

			1		
	



	

	



/	

	
1

	


"		
.	

A$!

	

	1
	

		
		

8
/

	
1	1	

@
	
.
.	
/

-!	


	

		
	




	*


		
E1



 

*//!G@K!0	@!
/+,

	

	
1!	
	
!	

	
	

	
 

/






	

	




	
1




/

;


! 
 

''
	
'


	
==+!	

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 63 GAO-01-961 SSA IT Management

,=



	*	

		


		/

		


		!	
		!
8	
	
0
!

	
	
8

8	

!			



		/	

			

	
2
8


/




		


	
		
1
	



/;
!	


		
	


	

+

+
	
	!

	
	2

		
	
/


9



 

''
	
'


	
==+!	-	,


!

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 64 GAO-01-961 SSA IT Management

,?










			
/	

	



1	
!	
	
*
		




	

/0
	
	


	


@
	
.
.	
@..
	!	

			

	

1

	






@..%

	
/






	

8


	

1	

	


8
1

		
/


	8	

	

	
	


*	

/

'	





''
	
'


	
==+!	-	,



		


/

	
B

	

	

&(

	

!		
"4.
8/


	
		


	
		





/-!	





	

		
E1

 



/0	

!2


		




	
		
	
	

	



			


2



	

B	




	

	/


 







!

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 65 GAO-01-961 SSA IT Management

(6


	
	!
!	

 

	 	
1 	
/





	

	
B




/


	
1
!




	



8



	
	



	
			

	



	

/	
	!	

					



	
	

	


		
1/



	

	

	
1



/-!	



	
	



	


		1E

 

/





	

	

1!		



		



	  

/


 

''
	
'


	
==+!	

.9;





!

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 66 GAO-01-961 SSA IT Management

(&

	

	


	



/;	
	!;		
"		


A$	
			


		

,8/-!

	
	
	
	
	
	

+



+
	
		
	


/	


	!	






	

	

	
E1

 

/

	

	


	

	



	
	
		



	




!	
	
	*!	

	

		
	/

+!	


 

''
	
'


	
==+!	


!

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 67 GAO-01-961 SSA IT Management

(

	




		
	



			
	

/


	
	


%/;

2
!
!
1	




%,

1	//!



	
		
		
	
	

/-!

	
		
	
	
	



	

E1
	
	




	
 

/	

	





	
	


1


	
		
	


	!	
!	

	







/






+!	 
! 
 

''
	
'


	
==+!	-	,

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 68 GAO-01-961 SSA IT Management

(#

' 0


	


	*

		
E1

 



!
1

			


 



	
	
1	
/
1	






	


	

		
	








	
	
1	
/

''
	
'


 	
;
Appendix I

GAO’s July 9, 2001, Briefing

Page 69 GAO-01-961 SSA IT Management

(%

	


	

 
!


7

' 
	
	
	


1

	
E1
	


	


	

	
 


/

' +
	
	
	*	

			
	
 




/

' G





	

	
	


	

B	




/
Appendix I

GAO’s July 9, 2001, Briefing

Page 70 GAO-01-961 SSA IT Management

(,

	


'

	
;



		
		

		

1		

		
C	




		


	

/
		
7

' 
	




	

E1
	
	

	






66&/

' 

	



/

' 	
	

		




	
	
		
1




/
Appendix I

GAO’s July 9, 2001, Briefing

Page 71 GAO-01-961 SSA IT Management

((

-	

	
		



		B
		

		
	
	
/


	!


	

	B
	!	




	
	



1
/

	
				



!
	B
	
	




7

' :	
88
1	
	1

	





	

				


' !88
	
1	
	1

	


	


		



' ;
 88


	
	

	

	!
		!		

	





	

*	
		

	

' '

!	88

			





!	





	
	
	



	B
		





''
	
'


	 ==(!
!9
Appendix I

GAO’s July 9, 2001, Briefing

Page 72 GAO-01-961 SSA IT Management

(:

0


			

	
.
	8

.	
	!-.
	%
$

	.

	


/

/

:

''
	
'


	 ==(!
!9-	,

:CE.C8668&%C!	&!
666/
Appendix I

GAO’s July 9, 2001, Briefing

Page 73 GAO-01-961 SSA IT Management

(=


	
	
	!

	!

		
B	


		
*	
	

		

	*

	
		/


	

	
				



	
	


	*/-!


	
		
2



	1




	/	
		
 



1				


*




	!
		!
	/


 

''
	
'


	 ==+!	

:	



!

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 74 GAO-01-961 SSA IT Management

(?

	
			

1	
	1



	

/





	




1





	




	B
		
	

		
			


	
	
	/;	
	!






	
		

	



	
1	

	
	1

/




	
	


	

	



		
	
		!

	

	

		
/@	

!

1	
	1



		
!		
		


	


2

		
	

*	
	

2
	
	/


 

''
	
'


	 ==+!	-	,

!


!

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 75 GAO-01-961 SSA IT Management

:6


	


	


			



/+


.	
81

	

	


	

	
			

	

	


	


/;
!
		






	/-!


	


	
B
	

	


1

	
	/

'



!	


!
	!		





/	
!








	

		



	2		





	

	/



B


	
		!
				

	


!		



	
	
	



/-!
		


1



	
	



	

	1



	


		
	
	



/

;




 


 

''
	
'


	 ==+!	-	,


!

$
1	
	3



1


	






	38




.	!	

	3




!!	

	



	
Appendix I

GAO’s July 9, 2001, Briefing

Page 76 GAO-01-961 SSA IT Management

:&

' 0



		
!
1	






	

	



*

1	
	1



	

	
	
	

		








	/



	

 








2

&!##?!
%#	
!
	


	


666	6&6!:(:


/

' 0

			
1	
	1

!
1	





B	

	
1/
!

	

	


2
	

1

/	
		




1

	
	/

' 0

	
B			
	

	
1



	
	!		1
1	




	

1	
	1

/

''
	
'


 	 ;
Appendix I

GAO’s July 9, 2001, Briefing

Page 77 GAO-01-961 SSA IT Management

:

	 

	

 
!



7

' 

		

	
	
1	
	1

	

' 
		
				

	

1	
	1



' 		


	
2

		
	



*	
		

	

' 	


1






	


' 	
B		


	



	!
		!	
		

		
!	



	
	

	




Appendix I

GAO’s July 9, 2001, Briefing

Page 78 GAO-01-961 SSA IT Management

:#

	 

'

	 ;







7

' 
1	


	B
	


		



	

	

	
1

		



' 	1		


	
8	
	





	
	


/
	


!


1		



			

/

' 

	

	










+
.	


	

	
	
	

		

	



	
	
	
	/
Appendix I

GAO’s July 9, 2001, Briefing

Page 79 GAO-01-961 SSA IT Management

:%




		
		

	!


' 


	
	

' 

		
	



		
1			
	
	

' 
	!		
	
	

Page 80 GAO-01-961 SSA IT Management

Appendix II

Comments From the Social Security 

Administration ApendixI
Appendix II

Comments From the Social Security 

Administration

Page 81 GAO-01-961 SSA IT Management
Appendix II

Comments From the Social Security 

Administration

Page 82 GAO-01-961 SSA IT Management
Appendix II

Comments From the Social Security 

Administration

Page 83 GAO-01-961 SSA IT Management
Appendix II

Comments From the Social Security 

Administration

Page 84 GAO-01-961 SSA IT Management
Appendix II

Comments From the Social Security 

Administration

Page 85 GAO-01-961 SSA IT Management
Appendix II

Comments From the Social Security 

Administration

Page 86 GAO-01-961 SSA IT Management
Appendix II

Comments From the Social Security 

Administration

Page 87 GAO-01-961 SSA IT Management
Appendix II

Comments From the Social Security 

Administration

(310409) Letr Page 88 GAO-01-961 SSA IT Management
Ordering Information The first copy of each GAO report is free. Additional copies of 

reports are $2 each. A check or money order should be made out to 

the Superintendent of Documents. VISA and MasterCard credit 

cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address are 

discounted 25 percent.

Orders by mail:

U.S. General Accounting Office

P.O. Box 37050

Washington, DC 20013

Orders by visiting:

Room 1100

700 4th St. NW (corner of 4th and G Sts. NW)

U.S. General Accounting Office

Washington, DC

Orders by phone:

(202) 512-6000

fax: (202) 512-6061

TDD (202) 512-2537

Each day, GAO issues a list of newly available reports and 

testimony. To receive facsimile copies of the daily list or any list 

from the past 30 days, please call (202) 512-6000 using a touchtone 

phone. A recorded menu will provide information on how to obtain 

these lists.

Orders by Internet:

For information on how to access GAO reports on the Internet, 

send an e-mail message with “info” in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web home page at: 

http://www.gao.gov

To Report Fraud, 

Waste, or Abuse in 

Federal Programs

Contact one:

• Web site: http://www.gao.gov/fraudnet/fraudnet.htm

• e-mail: fraudnet@gao.gov

• 1-800-424-5454 (automated answering system)

United States

General Accounting Office

Washington, D.C. 20548-0001

Official Business

Penalty for Private Use $300

Address Correction Requested

Presorted Standard

Postage & Fees Paid

GAO

Permit No. GI00