COMPUTER 

MATCHING ACT

OMB and Selected 

Agencies Need to 

Ensure Consistent 

Implementation

Report to Congressional Requesters

January 2014

GAO-14-44

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-14-44, a report to 

congressional requesters

January 2014

COMPUTER MATCHING ACT

OMB and Selected Agencies Need to Ensure 

Consistent Implementation 

Why GAO Did This Study

Computerized matching of data from two 

or more information systems is one 

method of data analysis that can assist in 

detecting and preventing fraud, waste, 

and abuse in government programs, and 

it is commonly used to help identify 

improper payments in federal benefit 

programs and activities. However, 

computer matching may also pose 

privacy risks to individuals. To ensure 

that federal agency computer matching 

programs protect individuals’ privacy 

rights, from 1988 through 1990 Congress 

enacted amendments to the Privacy Act 

of 1974 (collectively referred to in this 

report as the Computer Matching Act). 

GAO was asked to review issues relating 

to computer matching. This report 

examines (1) agencies’ responsibilities 

under the Computer Matching Act, (2) 

how selected agencies are implementing 

the act with regard to federal benefits 

programs, and (3) the views of officials at 

selected agencies on the process of 

developing and implementing computer 

matching agreements. GAO reviewed the 

act’s provisions and OMB guidance. It 

also interviewed officials and examined 

documents at seven agencies with high

expenditures in benefits and assistance 

programs.

What GAO Recommends

GAO is recommending that OMB revise 

its guidance and that selected agencies 

develop and implement policies and 

procedures for cost-benefit analyses and 

ensure annual reviews and reporting. In 

their comments, agencies concurred with 

GAO’s recommendations, with the 

exception of Education. OMB did not 

state whether the agency agreed or

disagreed. GAO continues to believe that 

the recommendations are valid, as 

discussed in the report.

What GAO Found

The Office of Management and Budget (OMB) is responsible for developing 

guidelines and providing assistance to agencies on implementing the Computer 

Matching Act, while agencies have a variety of implementation responsibilities. 

Agency responsibilities include (1) developing computer matching agreements 

(CMA) containing specific elements for each proposed matching program and 

notifying Congress, OMB, and the public of such activities; (2) conducting costbenefit analyses for proposed matching programs; and (3) establishing data 

integrity boards to oversee matching programs.

The seven agencies GAO reviewed (the Departments of Agriculture, Education, 

Health and Human Services, Homeland Security, Labor, Veterans Affairs, and 

the Social Security Administration) have taken a number of steps to implement 

the act’s requirements. They have all established processes for creating CMAs, 

and the agreements generally included the elements required by the act. 

However, implementation among these agencies was inconsistent in several 

ways. First, the selected agencies differed in their understanding of whether 

CMAs were required for data queries. OMB’s guidance is not clear on whether 

such queries are covered by the act. Second, while the selected agencies 

generally developed cost-benefit analyses for their CMAs, they did not 

consistently address key elements needed to assess the value of computer 

matching programs. OMB stated in 1989 that it would issue specific guidance for 

cost-benefit analyses of computer matching programs, but it has not done so. 

Finally, agency data integrity boards have not consistently reported to OMB on 

agencies’ computer matching activities as required by the act. OMB guidance 

requires biennial reporting, which varies from the act’s requirement for annual 

reports. The lack of clear guidance from OMB has contributed to the inconsistent 

implementation of the act at the agencies GAO reviewed.

Several agency and office of inspector general officials stated that the act’s 

rigorous requirements and short time frames discouraged them from pursuing 

CMAs. Officials at six agencies stated that CMA review processes were lengthy 

and resource-intensive and that statutory durations for conducting matching 

activities were too short. Similarly, officials from offices of the inspector general at 

four agencies stated that the length of the approval process and the requirement 

that proposed agreements be approved by data integrity boards discouraged 

them from computer matching. The figure below shows the number of active 

computer matching agreements at the agencies GAO reviewed.

Number of Computer Matching Agreements at Seven Federal Agencies as of September 20, 2013

View GAO-14-44. For more information, 

contact Gregory C. Wilshusen at (202) 512-

6244 or wilshuseng@gao.gov. 
Page i GAO-14-44 Computer Matching Act

Letter 1

Background 3

OMB and Agencies Have a Variety of Responsibilities under the 

Computer Matching Act 8

Agencies We Reviewed Have Established Procedures for

Implementing the Computer Matching Act, but Implementation 

Has Been Inconsistent 14

Several Factors May Discourage Implementation of CMAs at 

Selected Agencies 24

Conclusions 28

Recommendations for Executive Action 29

Agency Comments and Our Evaluation 31

Appendix I Objectives, Scope, and Methodology 35

Appendix II Comments from the Department of Agriculture 37

Appendix III Comments from the Department of Education 38

Appendix IV Comments from the Department of Homeland Security 41

Appendix V Comments from the Department of Labor 44

Appendix VI Comments from the Department of Veterans Affairs 45

Appendix VII Comments from the Social Security Administration 48

Appendix VIII GAO Contact and Staff Acknowledgments 50

Contents
Page ii GAO-14-44 Computer Matching Act

Tables

Table 1: Selected Agencies’ and Labor’s Inclusion of Key 

Elements in Cost-Benefit Analyses 18

Table 2: Summary of Data Integrity Board Membership 20

Table 3: Agencies’ Computer Matching Report Submissions, 

2008-2012 22

Figures

Figure 1: Number of Active CMAs at Seven Agencies as of 

September 20, 2013 15

Figure 2: The Computer Matching Agreement Process 25
Page iii GAO-14-44 Computer Matching Act

Abbreviations

CIGIE Council of the Inspectors General on Integrity and 

 Efficiency 

CMA computer matching agreement

DHS Department of Homeland Security

DIB Data Integrity Board

ED Department of Education

FISMA Federal Information Security Management Act

FR Federal Register

HHS Department of Health and Human Services

IPERIA Improper Payments Elimination and Recovery 

 Improvement Act

Labor Department of Labor

NIST National Institute of Standards and Technology

OIG office of inspector general

OMB Office of Management and Budget

PII personally identifiable information

Recovery Board Recovery Accountability and Transparency Board 

SSA Social Security Administration

Treasury Department of the Treasury 

USDA Department of Agriculture 

VA Department of Veterans Affairs

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-14-44 Computer Matching Act

441 G St. N.W.

Washington, DC 20548

January 13, 2014

The Honorable Thomas R. Carper

Chairman

The Honorable Tom Coburn, M.D.

Ranking Member

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Claire McCaskill

Chairman

Subcommittee on Financial and Contracting Oversight

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Susan M. Collins

United States Senate

Computerized matching of data from two or more information systems is 

one method of data analysis that can assist in detecting and preventing 

fraud, waste, and abuse in government programs, and it is commonly 

used to help identify improper payments in federal benefit programs and 

activities. However, computer matching may also pose risks to the privacy 

of individuals whose data are involved. To ensure that federal agency 

computer matching programs are effective and protect individuals’ privacy 

rights, from 1988 through 1990 Congress enacted amendments to the 

Privacy Act of 1974. These amendments established conditions for the 

use of information about individuals for, among other things, establishing 

or verifying eligibility for federal benefits programs. They also established 

protections to ensure procedural uniformity in carrying out computer 

matches and included due process rights for individuals whose benefits 

may be affected. Throughout the remainder of this report, we refer to 

these amendments as the Computer Matching Act.

You asked us to examine agencies’ efforts to share data through the 

Computer Matching Act. Specifically, our objectives were to (1) determine 

agencies’ responsibilities under the Computer Matching Act, (2) 

determine how selected agencies are implementing that act with regard to 

federal benefits programs, and (3) describe the views of officials at 

selected agencies on the process of developing and implementing 

computer matching agreements (CMA). To describe agencies’ 

responsibilities under the Computer Matching Act, we reviewed the act’s 
Page 2 GAO-14-44 Computer Matching Act

provisions, as well as other relevant laws, policies, and guidance that 

address computer matching for program integrity purposes. We also 

interviewed agency officials and examined agency documents, including 

policies and procedures on computer matching programs and processes. 

We selected for review federal agencies with the highest expenditures in 

benefits and assistance programs, specifically the Departments of 

Agriculture (USDA), Education (ED), Health and Human Services (HHS), 

Homeland Security (DHS), and Veterans Affairs (VA), and the Social 

Security Administration (SSA). We added the Department of Labor 

(Labor) because it oversees significant employment benefit programs and 

there were some indications that the Labor Office of Inspector General 

(OIG) had faced challenges in using CMAs. Labor is also one of the 10 

federal agencies with the highest expenditures in benefits and assistance 

programs. We also reviewed guidance developed by the Office of 

Management and Budget (OMB). In addition, we obtained information 

from the Department of the Treasury (Treasury) on the Do Not Pay 

Working System1

We conducted this performance audit from January 2013 to January 2014 

in accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

and its relationship to the Computer Matching Act. To 

assess agencies’ implementation of the act, we compared the 

requirements of the act with agencies’ computer matching agreements 

relating to benefits programs, including accompanying cost-benefit 

analyses and agency processes for approving the agreements. To 

describe the views of officials at selected agencies on the process of 

developing and implementing CMAs, we interviewed agency officials on 

how they implemented the act with regard to federal benefits programs. 

Further, we obtained the views of inspectors general at the agencies we 

reviewed on the implementation of the act.

 1

The Treasury Do Not Pay Working System was developed to enable federal agencies to 

reduce improper payments by checking various databases before making payments or 

awards in order to identify ineligible recipients and prevent fraud or errors from being 

made. This effort was first required by a Presidential Memorandum issued on June 18, 

2010, and was established in law as the Do Not Pay Initiative, by the Improper Payments 

Elimination and Recovery Improvements Act of 2012 (IPERIA, Pub. L. No. 112-248, Jan. 

10, 2013). 
Page 3 GAO-14-44 Computer Matching Act

conclusions based on our audit objectives. Appendix I contains additional 

details on the objectives, scope, and methodology of our review.

Sharing information is an important tool in improving the efficiency and 

integrity of government programs. By sharing data, agencies can often 

reduce errors, improve program efficiency, evaluate program 

performance, and reduce information collection burdens on the public. 

Technological advances have broadened the government’s ability to 

share data for these uses. Likewise, such advances have enhanced the 

government’s ability to use computerized analysis to identify and reduce 

fraud, waste, and abuse. One important analytical technique is computer 

matching, a term commonly used to refer to the computerized comparison 

of information, generally including personally identifiable information (PII), 

such as names and Social Security numbers, in two or more information 

systems.

Agencies use computer matching in a variety of ways to help ensure that 

federal benefits are distributed appropriately. For example, the National 

Directory of New Hires, established in 1996 under the Personal 

Responsibility and Work Opportunity Reconciliation Act, is used to match 

new-hire information from states with information from other states and 

federal programs to detect and prevent erroneous payments for the 

Temporary Assistance for Needy Families program, Supplemental 

Nutrition Assistance Program, unemployment insurance, Medicaid, and 

other benefit programs. In another example, according to the Chairman of 

the House Committee on Ways and Means,2

 2

Hearing on the Use of Data Matching to Improve Customer Service, Program Integrity, 

and Taxpayer Savings. Committee on Ways and Means, Subcommittee on Human 

Resources, U.S. House of Representatives, Mar. 4, 2011.

SSA collects prisoner data 

from states and local governments to identify incarcerated individuals who 

should not receive Supplemental Security Income benefits. The chairman 

stated that from 1997 to 2009 computer matching had helped SSA 

identify over 720,000 inmates who were improperly receiving benefits, 

contributing to billions of dollars in savings to the federal government. 

Due to the success of this program, prisoner data are now shared with 

child support enforcement and Supplemental Nutrition Assistance 

programs as well. Likewise, the chairman also reported that the Public 

Assistance Reporting Information System was being used to match state 

enrollment data for the Temporary Assistance for Needy Families 

Background
Page 4 GAO-14-44 Computer Matching Act

program, Supplemental Nutrition Assistance Program, Medicaid, and 

child care programs with data from participating states and a selected 

group of federal databases to identify potentially inappropriate payments. 

According to the Subcommittee on Human Resources of the House 

Committee on Ways and Means,3

Much computer matching is done for program integrity purposes, but it 

has other uses as well. For example, Secure Flight, a program run by 

DHS’s Transportation Security Administration, matches information about 

passengers provided by the airlines against government watch lists to 

detect individuals on the No Fly List and prevent them from boarding 

aircraft and to identify individuals for additional screening. Another 

example is E-Verify, an Internet-based system developed by U.S. 

Citizenship and Immigration Services that allows businesses to determine 

the eligibility of potential employees to work in the United States.

the State of Colorado realized a return 

on investment of 4000 percent from using the system, and the state of 

New York annually saves an average of $62 million through its 

participation in the system.

While computer matching programs have been successful in identifying 

fraud, waste, and abuse in federal benefit programs, if proper controls are 

not in place, they can also adversely affect the privacy and due process 

rights of individuals whose records are being matched. The data that are 

exchanged through matching programs involve personal information such 

as Social Security numbers and income and employment data. Without 

adequate protection, individuals’ information could be compromised 

through inappropriate use, modification, or disclosure.

In addition, without effective due process protections, individuals could 

unfairly lose government benefits if decisions were made to reduce or 

terminate those benefits based on inaccurate or misleading computer

matches. For example, according to a senior policy analyst of the Center 

of Law and Social Policy, a computer match authorized under the 

Children’s Health Insurance Program Reauthorization Act of 2009, which 

allowed states to verify the citizenship of Medicaid and Children’s Health 

Insurance Program applicants by matching Social Security records rather 

than using clients’ birth certificates, produced matches of questionable 

 3

Hearing Advisory for the Hearing on the Use of Data Matching to Improve Customer 

Service, Program Integrity, and Taxpayer Savings. Committee on Ways and Means, 

Subcommittee on Human Resources, House of Representatives, Mar. 4, 2011.
Page 5 GAO-14-44 Computer Matching Act

accuracy. Specifically, according to this analyst, in the first year of using 

this matching program, the state of Alabama incorrectly identified over 

1,000 children who would have been denied benefits if the results had not 

been verified.4

The major requirements for computer matching and the protection of 

personal privacy by federal agencies come from two laws, the Privacy Act 

of 19745 and the privacy provisions of the E-Government Act of 2002.6

The Privacy Act places limitations on agencies’ collection, disclosure, and 

use of personal information maintained in systems of records. The act 

defines a “record” as any item, collection, or grouping of information about 

an individual that is maintained by an agency and contains his or her 

name or another individual identifier. It defines a “system of records” as a 

group of records under the control of any agency from which information 

is retrieved by the name of the individual or other individual identifier. The 

Privacy Act requires that when agencies establish or make changes to a 

system of records, they must notify the public through a system of records 

notice in the Federal Register that identifies, among other things, the 

categories of data collected, the categories of individuals about whom 

information is collected, the intended “routine” uses of data, and 

procedures that individuals can use to review and contest its content.7

In 2002, Congress enacted the E-Government Act to, among other things, 

enhance protection for personal information in government information 

systems. Toward this end, the act requires agencies to conduct privacy 

impact assessments before developing or procuring information systems 

that will collect or process personal information. These assessments 

provide a means for agencies to analyze and document the privacy 

 4

Testimony of Elizabeth Lower Basch, Senior Policy Analyst at the Center for Law and 

Social Policy (CLASP), Hearing on the Use of Data Matching to Improve Customer 

Service, Program Integrity, and Taxpayer Savings. Committee on Ways and Means, 

Subcommittee on Human Resources, House of Representatives, Mar. 4, 2011.

5

Pub. L. No. 93-579 (Dec. 31, 1974); 5 U.S.C. 552a.

6

Sec. 208, Pub. L. No. 107-347 (Dec. 17, 2002). 

7

Under the Privacy Act of 1974, the term “routine use” means (with respect to the 

disclosure of a record) the use of such a record for a purpose that is compatible with the 

purpose for which it was collected. 5 U.S.C. § 552a(a)(7) 5 U.S.C. 552a.

Key Laws That Address 

Computer Matching
Page 6 GAO-14-44 Computer Matching Act

protections they have established for uses of automated data, such as 

computer matching and other data-sharing activities.

Because of concerns about agency use of personal information in 

computer matching programs, Congress passed the Computer Matching 

and Privacy Protection Act in 1988 as an amendment to the Privacy Act.8

The provisions were intended to create procedures that would require 

serious deliberation and prevent data “fishing expeditions” that could 

reduce or terminate benefits without verifying the information and 

notifying affected individuals of the matching program. In 1989 and 1990,9

Under these sets of amendments, which we collectively refer to as the 

Computer Matching Act, computer matching is defined as the 

computerized comparison of records for the purpose of establishing or 

verifying eligibility or recouping payments for a federal benefit program or 

relating to federal personnel management. To ensure procedural 

uniformity in carrying out matching programs and to provide due process 

for potentially affected individuals, the law established a number of 

requirements for covered agency computer matching programs, including

Congress enacted further amendments to, among other things, require 

due process procedures for agency computer matching programs, 

including independent verification of “hits” and a 30-day notice for 

individuals affected by a matching program.

• agencies must have computer matching agreements with participating 

agencies that specify, among other things, the purpose and legal 

authority of the program and a justification for the program, including a 

specific estimate of any savings;

• Data Integrity Boards (DIB) must be established to approve and 

review all agency computer matching programs covered by the 

Computer Matching Act, including the costs and benefits of such 

programs; and

• OMB must prescribe guidance for agencies on conducting computer 

matching programs as part of implementation of the Privacy Act.

 8

Computer Matching and Privacy Protection Act of 1988. Pub. L. No. 100-503. (Oct 18, 

1988).

9

Computer Matching and Privacy Protection Act Amendments of 1989, Pub. L. No. 101-56 

(July 19, 1989), and Computer Matching and Privacy Protection Amendments of 1990, 

sec. 7201, Pub. L. No. 101-508 (Nov. 5, 1990).
Page 7 GAO-14-44 Computer Matching Act

These requirements do not, however, apply to all federal agency 

computer matching activities. For example, the law’s definitions exclude 

matches of federal agency information with commercial data and matches 

of federal agency payments, grants, or loans to entities other than 

individuals. Further, the law exempts a number of matching activities. For 

example, the initial 1988 amendments included exemptions for matches 

for statistical or research purposes, law enforcement investigations of 

specific individuals, and certain tax-related matches. In 1999, an 

exemption was added for Social Security Act-related matches of prisoner 

data.10 In addition, in 2010, the Patient Protection and Affordable Care 

Act11

Most recently, in January 2013, the Improper Payments Elimination and 

Recovery Improvement Act (IPERIA)

exempted matches by HHS relating to potential fraud, waste, and 

abuse.

12

In addition, IPERIA established in law the Do Not Pay Initiative, 

coordinated by the Department of the Treasury, to require agencies to 

reduce improper payments by reviewing a number of databases, 

including the SSA Death Master File and the Department of Housing and 

Urban Development Credit Alert System, before issuing any payments. 

IPERIA also required OMB to ensure the establishment of a working 

system to provide agencies with access to these databases, and to report 

to Congress on the operations of the Do Not Pay Initiative. OMB’s August

16, 2013, guidance also contained instructions for agencies on 

implementing this initiative, including responsibilities for agency DIBs. For 

provided, among other things, that 

data-matching activities conducted by agencies and offices of inspectors 

general (OIG) that assist in the detection and prevention of improper 

payments would be subject to requirements that differ from those of the 

Computer Matching Act. These include a 60-day time limit on DIB review, 

approvals extended up to 3 years, and a waiver on the requirement for a 

specific estimate of savings in a computer matching agreement.

 10Sec. 402(a), Ticket to Work and Work Incentives Improvement Act of 1999, Pub. L. No. 

106-170 (Dec. 17, 1999); 5 U.S.C. § 552a(a)(8)(B)(viii).

11Sec. 6402(b)(2), Pub. L. No. 111-148 (Mar. 23, 2010); 5 U.S.C. § 552a(8)(B)(ix).

12Sec. 5(e), Pub. L. No. 112-248 (Jan. 10, 2013). Under sec. 2(2) of IPERIA, the term 

“improper payments” means, in part, “any payment that should not have been made or 

that was made in an incorrect amount.” 
Page 8 GAO-14-44 Computer Matching Act

example, the guidance states that DIBs should be properly trained and 

should meet annually to evaluate agency matching programs.13

OMB is responsible for developing guidelines and providing continuing 

assistance to agencies on the implementation of the Computer Matching 

Act, while agencies have a variety of implementation responsibilities. 

Agency responsibilities can be grouped into three major areas: (1) 

developing computer matching agreements containing specific elements 

for each proposed matching program and notifying Congress, OMB, and 

the public of computer matching activities; (2) conducting cost-benefit 

analyses for proposed computer matching programs; and (3) establishing 

DIBs to oversee computer matching programs, including reviewing and 

approving computer matching agreements.

The Privacy Act gives OMB responsibility for developing guidelines and 

providing continuing assistance to agencies on the implementation of the 

Computer Matching Act. OMB has periodically published guidance for 

implementing the act, including documents issued in 1989,14 1991,15

2000,16 and 2013.17 In addition, Circular No. A-130 includes instructions 

to agencies for reporting on computer matching activities.18

 13OMB, Protecting Privacy while Reducing Improper Payments with the Do Not Pay 

Initiative, M-13-20 (Aug. 16, 2013).

14OMB, Privacy Act of 1974: Final Guidance Interpreting the Provisions of Public Law 100-

503, the Computer Matching and Privacy Protection Act of 1988, 54 FR 25818 (June 19, 

1989).

15OMB, Proposed guidance, The Computer Matching and Privacy Protection 

Amendments of 1990 and the Privacy Act of 1974, 56 FR 18599 (Apr. 23, 1991). While 

the proposed 1991 guidance was never issued as a final guidance document, OMB has 

included it on its website as applicable Privacy Act computer matching guidance.

16OMB, Guidance on Inter-Agency Sharing of Personal Data–Protecting Personal Privacy, 

M-01-05 (Dec. 20, 2000).

17OMB, M-13-20.

18OMB Circular No. A-130, Management of Federal Information Resources, Transmittal

No. 4. For current provisions most directly relating to computer matching, see OMB 

Circular No. A-130, Appendix I, “Federal Agency Responsibilities for Maintaining Records 

about Individuals,” http://www.whitehouse.gov/omb/circulars_a130_a130appendix_i. 

OMB and Agencies 

Have a Variety of 

Responsibilities under 

the Computer 

Matching Act

OMB Has Primary 

Responsibility for 

Providing Assistance to 

Agencies for Privacy and 

Computer Matching
Page 9 GAO-14-44 Computer Matching Act

The 1989 guidance provided explanations for agencies on interpreting 

various provisions of the 1988 amendments, including examples of 

activities that should be treated as computer matching programs covered 

by the act, types of information that should be in computer matching 

agreements (CMAs), and responsibilities for fulfilling reporting 

requirements. The 1989 guidance also addressed required cost-benefit 

analyses and the responsibilities of DIBs.

The 1991 guidance was intended to help implement changes made in the 

1990 computer matching amendments to simplify several due process 

requirements after agencies experienced difficulties implementing the 

requirements established in 1988.

OMB Circular No. A-130, Management of Federal Information Resources, 

includes guidance on implementation of a number of information and 

information technology laws. According to OMB staff, the Circular A-130 

requirements provide guidance to agencies on meeting the reporting 

requirements for computer matching activities. The circular’s Appendix I, 

“Federal Agency Responsibilities for Maintaining Records about 

Individuals,” provides specific instructions for agencies on reporting 

requirements relating to computer matching.

OMB’s 200019 memorandum reinforced existing Privacy Act 

requirements, while its 201320 memorandum on reducing improper 

payments provided guidance on implementing the requirements in 

IPERIA as well as some additional clarifications on computer matching 

programs.

Agencies are required to establish computer matching programs when 

conducting any computer matches, which are defined as a “computerized 

comparison of records for the purpose of establishing or verifying 

eligibility or recouping payments for a federal benefit program or relating 

to federal personnel management.” Agencies first need to determine 

whether their planned activity falls within the scope of the law under this 

definition. If a proposed match is covered by the Computer Matching Act, 

 19OMB, M-01-05.

20OMB, M-13-20.

Agencies Are Required to 

Develop and Report on 

Formal Agreements to 

Conduct Computer 

Matches
Page 10 GAO-14-44 Computer Matching Act

a CMA must be developed and approved by all participating agencies.21

• the purpose and legal authority for conducting the program;

Among other things, the act requires that CMAs include

• the justification for the program and the anticipated results, including a 

specific estimate of any savings;

• a description of the records that will be matched, including each data 

element that will be used, the approximate number of records that will 

be matched, and the projected starting and completion dates of the 

matching program;

• procedures for providing individual notice at the time of application, 

and notice periodically thereafter as directed by the DIB (subject to 

OMB guidance), to applicants or recipients of federal benefits;

• procedures for verifying information produced in the matching 

program as required to ensure that no benefits action is taken before 

the information acquired through computer matching is verified and 

potentially affected individuals are notified and have an opportunity to 

contest findings;

• procedures for the retention and timely destruction of identifiable 

records created by a recipient agency or nonfederal agency in the 

matching program;

• procedures for ensuring the administrative, technical, and physical 

security of the records matched and the results of the matching 

programs; and

• information on assessments that have been made on the accuracy of 

the records that will be used in the program.

After the CMA has been approved by all participating agencies, the 

agency that receives the data and derives benefit from the matching 

program is responsible for publishing a notice describing the details of the 

CMA in the Federal Register and must notify Congress and OMB prior to 

implementation. The act requires agencies to

• annually review each ongoing matching program in which the agency 

has participated during the year and

 21Participation in computer matching programs involves both recipient agencies and 

source agencies. A recipient agency is one that receives information contained in a 

system of records from a source agency for use in a matching program. A source agency 

is one that discloses information contained in a system of records to be used in a 

matching program. These entities may be federal, state, or local government agencies as 

well as contractors for such agencies.
Page 11 GAO-14-44 Computer Matching Act

• submit a copy of every CMA to the House Committee on Oversight 

and Government Reform and the Senate Committee on Homeland 

Security and Governmental Affairs.

The Computer Matching Act also requires that agencies conduct costbenefit analyses in conjunction with the development of CMAs. The act 

states that agency CMAs must include a specific estimate of any savings 

from the matching program and that DIBs shall not approve any CMA 

without a cost-benefit analysis of the proposed program that 

demonstrates that the program is likely to be cost-effective.22

According to OMB’s 1989 guidance, the intent of this requirement is to 

ensure that sound management practices are followed when agencies 

use records from Privacy Act systems of records in matching programs. 

According to OMB, cost-effectiveness must be established before a CMA 

is approved and matching can occur, the goal being to ensure that when 

agencies are conducting matching programs they do not drain agency 

resources that could be better spent elsewhere. OMB guidance states 

that the cost-benefit information from CMAs helps Congress evaluate the 

effectiveness of statutory matching requirements.

The act does not specify the elements of the required cost-benefit 

analyses, and OMB’s guidance provides only a general outline of the 

costs and benefits that should be considered. In its 1989 guidance, OMB 

referred agencies to a GAO report published in 198623

 22The act provides for the waiver of cost-benefit analyses in certain circumstances. 

Further, IPERIA states that CMAs for computer matching programs by agencies and OIGs 

that assist in the detection and prevention of improper payments are not required to 

contain a specific estimate of any associated savings, although a justification for the 

program and the anticipated results is still required.

on assessing the 

costs and benefits of computer matching programs as one source for 

conducting a computer matching cost-benefit analysis, and stated that it 

would issue a checklist providing a step-by-step methodology for such 

analyses at a later date. However, according to OMB staff, it has not 

issued such a checklist. Officials at three agencies we reviewed stated 

that they used our report as a source of guidance on the expected 

contents of cost-benefit analyses for computer matching. Without more 

recent guidance, our 1986 report is the only guidance available to 

23GAO, Computer Matching: Assessing Its Costs and Benefits, GAO/PEMD-87-2

(Washington, D.C.: Nov. 10, 1986).

Agencies Are Required to 

Perform a Cost-Benefit 

Analysis
Page 12 GAO-14-44 Computer Matching Act

agencies specifically for developing cost-benefit analyses for computer 

matching programs.

While different computer matching programs may have unique costs and 

benefits, our 1986 report24

• Costs:

identified the following key elements as 

common types of costs and benefits associated with computer matching:

• Personnel costs, such as salaries and fringe benefits, for 

personnel involved in the matching process, including staff time 

dedicated to performing the match.

• Computer costs related to the processing of computer matching 

programs, such as the maintenance and use of computers at 

facilities.

• Benefits:

• Avoidance of future improper payments: the prevention of future 

overpayments by identifying and correcting an error.

• Recovery of improper payments and debts: the detection of an 

overpayment or debt already made and the collection of the 

money owed to an agency.

The Computer Matching Act also requires that each agency participating 

in a computer matching program establish a DIB to oversee computer 

matching activities. The act requires that the DIBs be composed of senior 

officials designated by the head of each agency. According to the act, 

duties of the DIBs include the following:

• Reviewing, approving, and maintaining all written agreements for 

receipt or disclosure of agency records under computer matching 

programs.

• Determining the agency’s compliance with applicable laws, 

regulations, guidelines, and agency agreements.

• Assessing the costs and benefits of matching programs and 

approving only those for which a cost-benefit analysis demonstrates 

that the program is likely to be cost-effective.25

 24GAO/PEMD-87-2.

25In certain circumstances, such as when specified in statute, the cost-benefit analysis 

may not be required.

Agencies Are Required to 

Establish a Data Integrity 

Board with Specific 

Responsibilities
Page 13 GAO-14-44 Computer Matching Act

• Reviewing all recurring matching programs for continued justification.

• Annually reviewing all matching programs in which the agency 

participated during the year, either as source or recipient.

• Compiling an annual report describing the matching activities of the 

agency, which is to be submitted to the head of the agency and OMB 

and made available to the public. The annual report should include a 

description of matching programs, matching agreements disapproved 

by the DIB, waivers of a cost-benefit analysis, and any violations of 

matching agreements.

In addition, OMB’s1989 guidance specifies that DIBs are to include the 

inspector general and a senior official responsible for the implementation 

of the Privacy Act. The inspector general may not serve as the chairman 

of the DIB. OMB recommended, but did not require, that the Privacy Act 

officer serve as the board secretary.

According to OMB’s 1989 guidance, reviewing computer matching 

agreements is the foremost responsibility of the DIBs, and they are 

required to meet often enough to ensure that the agency’s matching 

programs are carried out efficiently, expeditiously, and in conformance 

with the Privacy Act.

More generally, OMB’s 1989 guidance noted that the DIBs should serve 

as an information resource on matching for agencies, be placed at the top 

of the agency’s organization, be staffed with senior personnel, and ensure 

that their reasons for either approving or denying a matching program are 

well documented. Among other things, the guidance also explained that 

the law’s requirement for annual DIB review of agency matching 

programs was to (1) determine whether the matches have been, or are 

being, conducted in accordance with appropriate authorities and under 

the terms of the matching agreements and (2) assess the utility of the 

programs in terms of their costs and benefits. The act and OMB guidance 

also state that if a matching agreement is disapproved by the DIB, any 

party to such agreement may appeal the disapproval to the Director of 

OMB.

OMB Circular No. A-130 also instructs agencies to submit a biennial 

report (rather than an annual report, as required by the act) to OMB 

summarizing the agency’s computer matching activities. The report is to 

include the names of the DIB members and a list of each matching 

program, including its purpose, the participating agency, and a brief 

description of the program. For each matching program, the report is to 
Page 14 GAO-14-44 Computer Matching Act

state whether a cost-benefit analysis provided a favorable ratio or if the 

cost-benefit analysis was waived, the reason why.

The agencies we reviewed have taken a number of steps to implement 

the requirements of the act. All seven agencies had established 

processes for creating and approving computer matching agreements, 

and the agreements they implemented generally included the elements 

required by the act. However, implementation among these seven 

agencies was inconsistent in several ways:

• Agencies differed in their understanding of what circumstances and 

types of data-sharing the act applied to, such as whether CMAs were 

required for “front-end”26 data queries.

• While these agencies generally developed cost-benefit analyses for 

their computer matching agreements, they did not consistently 

address key costs and benefits needed to assess the value of their 

computer matching programs.

• Agency DIBs, which are required to review and approve computer 

matching agreements, did not always regularly meet or thoroughly 

review proposed CMAs or cost-benefit analyses. DIBs have also not 

consistently reported to OMB on agencies’ computer matching 

activities, as required by the act, leading to reduced transparency of 

these programs.

Further, OMB has provided little assistance to agencies in implementing 

the act, which may contribute to inconsistent implementation.

For the matching programs that the agencies believe are covered by the 

act, the seven agencies we reviewed had 82 CMAs in place that 

addressed the act’s requirements. All seven agencies also issued 

agency-wide policies and guidance that address compliance with the act, 

and the CMAs these agencies had in place met basic requirements, 

including stating the purpose and legal authority for conducting the match, 

justification for the program and anticipated results, descriptions of 

records to be matched, procedures for providing individual notice, 

 26To perform online queries to verify records related to specific individuals.

Agencies We 

Reviewed Have 

Established 

Procedures for 

Implementing the 

Computer Matching 

Act, but 

Implementation Has 

Been Inconsistent

Agencies We Reviewed 

Have Established 

Computer Matching 

Programs but Have 

Interpreted the Scope of 

the Act Inconsistently
Page 15 GAO-14-44 Computer Matching Act

procedures for verifying information, procedures for retention and timely 

destruction of records, procedures for ensuring the physical security of 

the records, and assessments of the accuracy of the records used.

Figure 1 shows the number of active CMAs at each of these agencies.

Figure 1: Number of Active CMAs at Seven Agencies as of September 20, 2013

While the seven selected agencies were in compliance with the basic 

requirements of the act with regard to developing CMAs for activities they 

identified as covered by the act, they differed in how they interpreted the 

scope and application of the act to their data-sharing activities.

Specifically, three agencies interpreted the law to apply only to the 

matching of an entire system of records against another database, but not 

to other types of comparisons. For example:

• Officials from DHS and VA stated that they interpret the act to apply 

only to automated comparisons of two complete systems of records 

(e.g., a batch comparison of two entire databases identified under the 

Privacy Act as “systems of records”). They believe that single-record 

comparisons, such as checks performed by front-end verification 
Page 16 GAO-14-44 Computer Matching Act

systems or individual queries of information within a system of 

records, are exempt.

• Similarly, no CMAs were established for certain data-sharing 

arrangements between SSA and VA. Specifically, SSA established 

information exchange agreements with VA by which it provides 

information via online queries about individuals for program integrity 

and benefit accuracy purposes. According to SSA officials, a CMA 

with VA was not necessary because VA employees directly accessed 

SSA data using a computer terminal. An SSA official also commented 

that they preferred using information exchange agreements because 

they were quicker to process and approve than CMAs.

• Likewise, DHS offers a web-based service that federal, state, and 

local benefit-issuing agencies, institutions, and licensing agencies use 

to verify the immigration status of benefit applicants so that only those 

entitled to benefits receive them. According to DHS officials, this 

service is also not covered by the act because it does not involve 

comparison of two complete systems of records.

In contrast, officials from USDA’s Food and Nutrition Service noted that a 

CMA was established between the states and SSA for performing frontend verification of Supplemental Nutrition Assistance Program eligibility. 

Similarly, ED officials stated that they require CMAs for front-end queries 

that establish eligibility for federal student aid. In addition, HHS officials 

stated that they believe the Computer Matching Act requires CMAs to 

cover front-end queries. Labor officials indicated that they do not use 

front-end verification to establish benefits eligibility.

Moreover, the Do Not Pay Working System, an online portal run by the 

Department of the Treasury that can conduct online queries similar to 

computer matching, is not currently covered by any CMAs. The system is 

run as part of the Do Not Pay Initiative, which was established by law in 

IPERIA on January 10, 2013. IPERIA requires federal agencies to use 

certain databases, which are to be available through the Do Not Pay 

Working System, for prepayment review of eligibility for payments and 

awards. Agencies use the portal to perform online queries to verify 

records related to specific individuals, a process known as front-end 

verification. Treasury officials stated that the initiative currently has no 

computer matching agreements in place because the portal operates only 

as a query system, which they believe does not require CMAs. They 

stated that in the future, upon establishment of a system of records, they 
Page 17 GAO-14-44 Computer Matching Act

plan to add batch matching for Privacy Act records, at which time they will 

secure computer matching agreements.

Varying agency interpretations of the scope of the act are partially due to 

unclear guidance from OMB on this subject. OMB’s 1989 matching 

guidance includes examples of front-end verification programs that are 

covered by the act, but none of OMB’s guidance documents indicate 

specifically whether queries are subject to the act. OMB’s 2013 IPERIA 

guidance addressed the subject indirectly by stating that matches 

involving “subsets” of systems of records are covered by the act. 

However, it did not clarify whether front-end verification queries qualify as 

subsets of systems of records or are otherwise covered, thus continuing 

to leave the subject unclear.

According to OMB, it is up to agencies to adhere to the act and official 

guidance. OMB staff stated that the types of data-sharing covered by the 

act are determined on a case-by-case basis, and OMB’s IPERIA 

guidance states that the act applies to matches involving a “subset” of 

records from a system of records. However, OMB has not clarified 

whether the law applies to front-end verification, which generally involves 

just one record, or only to the matching of larger sets of records against 

another database. Without clear guidance on the scope of the act, 

agencies are likely to continue to interpret what the act covers in varying 

ways, and its privacy protections are likely to continue to be inconsistently 

applied.

While agency CMAs generally included cost-benefit analyses, the 

completeness of their analyses varied. Of the 82 CMAs from the seven 

agencies we reviewed, 68 included cost-benefit analyses. Eleven CMAs 

from the seven agencies were for statutorily required programs that did 

not require cost-benefit analyses.27

 27Under the act, cost-benefit analyses are waived when statutorily required matches are 

first negotiated but required when such matches are renegotiated at a later date.

For the other 3 CMAs, SSA did not 

conduct cost-benefit analyses because, according to officials, it was the 

source agency for these matching programs. According to OMB’s 1989 

guidance, while recipient agencies are suggested to take the lead in 

developing cost-benefit analyses, such analyses should be provided to 

source agencies to assist in their decision to approve or deny a CMA.

Agencies We Reviewed 

Did Not Always Include 

Key Elements for CostBenefit Analyses
Page 18 GAO-14-44 Computer Matching Act

While most agencies submitted a cost-benefit analysis with their CMAs, 

they did not always address all four key elements identified by GAO’s 

1986 report.28

Table 1 provides more detail on the seven selected agencies’ inclusion of 

key elements in their cost-benefit analyses.

More specifically, of the 68 cost-benefit analyses from the 

seven agencies that we reviewed, 2 included all the key elements, 63 

included some but not all key elements, and 3 did not address any of the 

key elements. Fourteen cost-benefit analyses did not include personnel 

costs, and 14 did not include computer costs. Additionally, 13 did not 

include the avoidance of future improper payments, and 33 did not 

include an estimate of the recovery of improper payments and debts. The 

DIBs approved all CMAs even though most cost-benefit analyses did not 

include all key information.

Table 1: Selected Agencies’ and Labor’s Inclusion of Key Elements in Cost-Benefit Analyses

Agency

Total

cost-benefit 

analyses

Number of cost-benefit analyses that did not address key elements

Costs Benefits

Personnel Computer 

Avoidance of future 

improper payments

Recovery of improper

payments and debts

USDA 1 1 1 1 1

ED 8 1 0 2 5

HHS 9 3 2 0 3

DHS 9 4 2 1 7

Labor 2 0 1 1 1

VA 14a 2 3 2 4

SSA 25 3 5 6 12

Total 68 14 14 13 33

Source: GAO analysis of agency data.

a

VA prepared a combined computer matching agreement and cost-benefit analysis for two of its 

computer matching programs.

The act requires that agencies conduct cost-benefit analyses in 

conjunction with the development of CMAs. The act states that agency 

CMAs must include a specific estimate of any savings from the matching 

 28GAO/PEMD-87-2 identified key elements of cost (personnel and computer costs) and

benefits (avoidance of future improper payment and recovery of improper payments and 

debts).
Page 19 GAO-14-44 Computer Matching Act

program and that DIBs shall not approve any CMA without a cost-benefit 

analysis of the proposed program that demonstrates that the program is 

likely to be cost-effective. According to OMB guidance, the goal is to 

ensure that sound management practices are followed when agencies 

conduct matching programs and that they do not drain agency resources 

that could be better spent elsewhere.

OMB’s general guidance for conducting cost-benefit analyses for federal 

programs is contained in Circular A-94.29 However, specific guidance for 

cost-benefit analyses on computer matching programs, which was 

promised in OMB’s1989 guidance, has never been developed. In the 

absence of specific OMB guidance, three agencies developed their own 

interim guides for cost-benefit analyses, while the others had no 

established methodology. Specifically, VA, ED, and SSA had policies and 

procedures on developing cost-benefit analyses: VA had guidance that 

included formulas staff should use to calculate each of the key elements, 

while ED used the prior GAO report;

30 and SSA used OMB Circular No. 

A-94. The other four agencies—DHS, USDA, HHS, and Labor—did not 

develop or document guidance for conducting cost-benefit analyses. 

Without guidance from OMB that specifically addresses the necessary 

elements of cost-benefit analyses for computer matching, agencies are 

likely to continue to inconsistently assess the costs and benefits of their 

proposed matches and may be unable to demonstrate that such matches 

are a cost-effective use of resources.

While they varied in size and composition, all seven agencies we 

reviewed established DIBs as required by the act. As required by the act, 

all of the DIBs included senior officials and the inspector general, as 

shown in table 2.

 29OMB, Guidelines and Discount Rates for Benefit-Cost Analysis of Federal Programs, 

Circular No. A-94 Revised (Oct. 29, 1992). This guidance is general guidance on costbenefit analysis and not specific to computer matching programs.

30GAO/PEMD-87-2.

Agency Data Integrity 

Boards Did Not Always 

Comply with 

Requirements
Page 20 GAO-14-44 Computer Matching Act

Table 2: Summary of Data Integrity Board Membership

Department

Number of

senior officials Inspector general on board

USDA 4 Yes

ED 6 Yes

HHS 3 Yes

DHS 8 Yes

Labor 6 Yes

VA 8 Yes

SSA 8 Yes

Source: GAO analysis of agency data.

All seven agencies also have issued agency-wide policy and guidance 

that addresses DIB membership and responsibilities, in compliance with 

the act. According to these agency policies, the DIBs’ primary purpose is 

to review and provide final approval of CMAs and associated cost-benefit 

analyses. Each of the 82 CMAs from the seven agencies we reviewed 

showed evidence that they were reviewed and approved by the DIBs.

However, as noted previously, DIBs approved cost-benefit analyses that 

did not always include all key data elements. For example, the DIB at 

USDA approved one cost-benefit analysis that did not include any 

estimate of cost or benefits and provided no estimated value. In addition, 

DIBs at the seven agencies we selected for review approved 13 costbenefit analyses that did not identify an estimate of the avoidance of 

future improper payments, as well as 33 cost-benefit analyses that did not 

identify an estimate of the recovery of improper payments and debts.

Without the DIBs ensuring that cost-benefit analyses include key costs 

and benefits, agencies will have less assurance that their computer 

matching programs are a cost-effective use of resources.

In addition to reviewing specific proposed CMAs and their associated 

cost-benefit analyses, the Computer Matching Act requires DIBs to 

conduct an annual review of agency matching programs. These annual 

reviews are an important element of the act’s privacy protections and are 

intended to (1) determine whether matches have been or are being 

conducted in accordance with appropriate authorities and under the terms 

of the matching agreements and (2) assess the utility of the programs in 

terms of their costs and benefits. Appendix I to OMB Circular No. A-130, 

on the management of federal information resources, includes guidance 
Page 21 GAO-14-44 Computer Matching Act

for implementing the reporting requirements for computer matching 

agreements.

However, the DIBs have not always followed the review and reporting 

requirements of the act or OMB guidance. Of the seven agencies, only 

VA provided evidence of an annual DIB review and report of computer 

matching activities.31

OMB staff agreed that they have required agencies to submit only 

biennial reports rather than the annual reports required by the act: OMB 

guidance requires DIBs to report on computer matching activity every 2 

years. This guidance is inconsistent with the Computer Matching Act, 

which requires an annual reporting of computer matching activity. OMB 

did not revise its guidance to reflect amendments to the act in 1995 and 

1998.

According to officials at HHS and ED, they do not 

submit such a report because OMB guidance only requires the 

submission of a biennial report. Without annual reviews, agencies and 

OMB have less assurance that matches are being conducted in 

accordance with the terms of matching agreements and that the 

programs are justified and viable in terms of cost and benefits. In addition, 

the transparency of agency computer matching programs may be limited 

if annual reviews are not conducted.

32

While only VA submitted annual reports, other agencies submitted the 

OMB-required biennial reports only intermittently:

However, OMB staff stated that OMB guidance still requires DIBs 

to conduct annual reviews of all computer matching programs, even if it 

does not require them to report on those reviews annually as required by 

the act.

• While the DIBs at VA, ED, and SSA have submitted biennial reports 

over the last 5 years, HHS did not submit one in 2012.

 31DHS prepares an annual privacy report, as required by 6 U.S.C. 142, and includes a 

high-level summary of computer matching activities.

32Appendix I of OMB Circular No. 130 (as reflected in 1993, 1996, and 2000 revisions), 

states that the act requires DIB reporting on computer matching activity every 2 years; 

however, this is inconsistent with the Computer Matching Act (specifically, 5 U.S.C. §

552a(u) and (s)), as amended by sec. 1301 of Pub. L. No. 105-362 (Nov. 10, 1998), and 

sec. 3003 of Pub. L. No. 104-66 (Dec. 21, 1995).
Page 22 GAO-14-44 Computer Matching Act

• Labor’s DIB did not submit biennial reports in 2008 or 2012. Officials 

stated they were waiting for instructions from OMB to send their latest 

one.

• USDA did not submit two of the last three biennial reports. USDA 

officials stated that they were not able to send past reports due to 

resource constraints.

• DHS’s DIB has not submitted any biennial reports. However, it reports 

summary information on computer matching programs annually in the 

privacy portion of its Federal Information Security Management Act 

(FISMA) report to OMB. According to DHS officials, this reporting 

meets the requirements of the act.

Table 3 shows submission of biennial reports from 2008 through 2012 by 

the seven agencies we reviewed.

Table 3: Agencies’ Computer Matching Report Submissions, 2008-2012

Agency 2008 2010 2012

USDA No No Yes

ED Yes Yes Yes

HHS Yes Yes No

DHS No No No

Labor No Yes No

VA Yes Yes Yes

SSA Yes Yes Yes

Source: GAO analysis of agency data.

In addition, while the law does not specifically require agencies to publish 

reports on their websites, it does require they be made publicly available. 

However, existing reports were not always accessible on six agencies’ 

websites. Only one agency, VA, had a recent biennial report posted 

online. DHS had posted its annual privacy report, which includes 

information on new CMAs, on its website. ED officials stated they are in 

the process of upgrading their website and plan to post the reports at a 

future date. SSA and USDA require that individual requests be submitted 

to gain access to their biennial reports. Labor does not post any reports, 

and officials said they are not aware of any public requests for them.

Also, we found that the agencies submitting biennial reports (USDA, ED, 

HHS, Labor, VA, and SSA) did not always include all the information 

required by OMB guidance. For example, VA was the only agency 

included in our review that submitted biennial reports with cost-benefit 
Page 23 GAO-14-44 Computer Matching Act

analysis ratios; however, for certain programs it was not able to determine 

cost savings information or whether the program had a favorable costbenefit ratio. Labor did not include in its biennial report whether the CMAs 

approved or conducted during the 2 years covered by the report had a 

favorable cost-benefit ratio. Other agencies (USDA, ED, HHS, and SSA) 

stated in their biennial reports that all their matching programs had 

favorable ratios but did not provide specific cost-benefit information for 

any of the programs. As stated previously, not all CMAs included costbenefit analyses or savings information; therefore, statements in agency 

biennial reports that all their matching programs had favorable costbenefit ratios could be unjustified.

Without consistent DIB review and reporting, agencies’ computer 

matching programs are not being regularly evaluated for effectiveness by 

agencies and are less transparent to OMB, Congress, and the public.

The Computer Matching Act gave OMB responsibility for providing 

continuing assistance to agencies in their implementation of the act and 

the other provisions of the Privacy Act. However, agency officials stated 

that they have not received consistent assistance from OMB. According 

to USDA, DHS, Labor, VA, and SSA officials, OMB has not provided 

assistance to them on conducting CMAs or submitting biennial reports. 

However, officials at ED stated that OMB had briefed them on the CMA 

process, and HHS officials have not received any specific instruction from 

OMB on conducting CMAs. In addition, officials at the HHS OIG and SSA 

stated they had no knowledge of actions taken by OMB with regard to 

CMAs, notices, or related reports submitted to OMB.

According to OMB, it is up to agencies to adhere to the act and OMB 

guidance. When asked what happens if an agency does not submit a 

biennial report as required by OMB guidance, OMB staff said they may 

reach out and discuss it with the agency. However, OMB staff gave no 

evidence of knowing the extent to which agencies have not submitted the 

biennial reports or following up with any of the agencies. For example, 

USDA did not submit a report between 2000 and 2013. Further, Labor 

officials stated that one reason for not submitting the 2012 biennial report 

is that they have been waiting for OMB to provide specific reporting 

instructions. The Labor officials also stated that they do not even know 

where to send the biennial reports at OMB. When informed of this, OMB 

staff said that is not consistent with the requirement to submit a report 

biennially to OMB. Without taking steps to follow up on reporting 

OMB Has Provided Little 

Assistance to Agencies
Page 24 GAO-14-44 Computer Matching Act

requirements or to provide assistance to agencies, OMB may be allowing 

agencies to implement the act inconsistently.

Agency officials at six of the seven agencies we reviewed told us that the 

act’s rigorous requirements and the CMA review processes within and 

among agencies were lengthy and resource-intensive and that statutory 

time frames for conducting matching activities were too short, 

discouraging implementation of CMAs. Similarly, OIG officials at four

agencies stated that, given the short duration of CMAs, the typical length 

of the CMA approval process discouraged them from computer matching, 

as did the requirement that their proposed agreements be approved by 

agency DIBs.

For example, officials at DHS told us they avoid attempting to implement 

CMAs because the internal review processes are lengthy and resourceintensive and because of the relatively short duration of approved CMAs. 

Officials at ED, HHS, Labor, SSA, and VA agreed that the CMA review 

process is lengthy and resource-intensive. They said that the fact that 

proposed CMAs must be reviewed by both the source and recipient 

agencies created extensive review processes that often took a long time 

to complete. In contrast, officials at USDA did not think the review 

process was overly lengthy or resource-intensive.

To implement the requirements of the act, agencies we reviewed typically 

adhere to the following CMA process, which involves an extensive 

sequence of multiple reviews:

• Development of the Computer Matching Agreement: The agency that 

wants to run a match on its program records (the recipient) develops a 

proposed CMA to receive records from another agency (the source) to 

match against its records. The proposed CMA must include a costbenefit analysis that adheres to all the act’s requirements, which can 

add to the time and cost of developing a CMA. Reaching agreement 

on the CMA frequently involves negotiation between the agencies 

over what data will be matched and how the data will be transferred. 

Upon reaching a draft agreement, the proposed CMA is reviewed and 

approved by multiple offices, including separate legal and privacy 

office reviews, in each agency. Officials said that the negotiation 

process and legal and privacy reviews often took many months to 

complete.

Several Factors May 

Discourage 

Implementation of 

CMAs at Selected 

Agencies
Page 25 GAO-14-44 Computer Matching Act

• Data Integrity Board Review: The proposed CMA is reviewed and 

must be approved by DIBs at both the source and recipient agencies.

• Agency Head Approval: Following DIB approval, the proposed CMA 

must also be approved by both agency heads, requiring that the draft 

agreement be vetted through officials at additional offices within each 

agency.

• Notice to Congress: Recipient agencies must allow an additional 40 

days to notify the Senate Committee on Homeland Security and 

Governmental Affairs, the House Committee on Oversight and 

Government Reform, and OMB to provide an opportunity for review 

and comments prior to implementation of the match.

• Public Notice: A notice of the computer matching program must be 

published in the Federal Register at least 30 days prior to 

implementation to provide an opportunity for interested persons to 

submit comments. (This public notice period can occur at the same 

time as notice is given to OMB and Congress.)

Figure 2 provides an overview of the typical CMA approval process.

Figure 2: The Computer Matching Agreement Process
Page 26 GAO-14-44 Computer Matching Act

According to agency officials, following these steps can be a lengthy 

process, often taking 3 months or longer to complete. For example:

• An ED official stated that new CMAs usually take 9-10 months and 

renewals take 6 months to complete.

• According to officials from the HHS Administration for Children and 

Families, CMAs with Supplemental Nutrition Assistance Program 

agencies typically take 6 to 9 months, while those with state workforce 

programs take up to a year.

• According to officials from the DHS privacy office, the CMA process at 

DHS can take up to 6 months.

• According to officials from VA’s Veterans Benefits Administration, 

CMAs can take 3 months to 1 year.

• According to officials from the SSA privacy office, on average, CMAs 

take about a year to process or to be renewed; however, the process 

can take longer. Officials at VA and HHS stated that CMAs with SSA 

must be planned a year in advance.

Not all agency officials reported that the CMA process was lengthy. For 

example, USDA officials stated that the CMA process could take up to 45 

days to complete. 

In addition, agency officials generally believed that CMAs do not last long 

enough. Given the lengthy internal review processes, agency officials 

from ED, HHS, DHS, VA, and SSA indicated that the statutory 

requirement that agreements be effective for only 18 months with a 

possible extension for 12 additional months was too short. Given such 

constraints, the approval process can last nearly as long as the proposed 

matching program itself.33

 33Under OMB’s IPERIA guidance, computer matching programs associated with the Do 

Not Pay Working System and OIG matching activities that assist in the detection and 

prevention of improper payments may be renewed for up to 3 years.

These officials said that when they have a 

continuing need to maintain permanent matching programs they have to 

restart the approval process nearly as soon as a CMA is approved in 

order to get either a 12-month extension or to reinstate the CMA as a new 

agreement after an existing 12-month extension has expired. As a result 

of the lengthy administrative process, agencies could be discouraged 

from pursuing CMAs.
Page 27 GAO-14-44 Computer Matching Act

Similarly, DHS privacy office officials stated that the review requirements 

and limited duration of CMAs discouraged implementation in the 

department. They said that the department’s other review processes 

provided protections that were as good as those afforded by the act. For 

example, they stated that privacy protections were examined in privacy 

impact assessments and were assessed for all data-sharing agreements, 

including those that fell outside of the act. In addition, DHS privacy impact 

assessments are publicly available on the agency’s website and thus 

contribute to the transparency of the programs. 

OIG officials also had concerns with the approval process for CMAs. 

Specifically, OIG officials at ED, DHS, SSA, and Labor stated that they 

were reluctant to make the effort to establish CMAs because it could take 

6 months to several years to get them approved, which could overly delay 

their planned audit and investigative work. OIGs that did not have active 

CMAs, including those at USDA, ED, DHS, and Labor, said they perform 

computer matches only when they do not need to seek new CMAs, such 

as when they can use data already obtained by other entities within their 

departments or gathered by the states. In both such cases, separate 

CMAs are not required. ED OIG officials also added that although the 

lengthy computer matching approval process may be acceptable for 

agency programs that may last for multiple years, OIG's needs generally 

are confined to investigations and audits with limited time frames, and 

CMAs are less practical in those circumstances. An OIG official at HHS 

stated that the HHS OIG was exempt by law from having to prepare 

CMAs.

OIG officials at ED and representatives from the Council of the Inspectors 

General on Integrity and Efficiency (CIGIE) and Recovery Accountability 

and Transparency Board (Recovery Board) also expressed concerns 

about their independence in initiating and conducting computer matching 

programs. Specifically, they said that because agency management 

officials sit on the Data Integrity Boards that approve CMAs, the agency is 

informed of OIG investigations that intend to use computer matching, 

which could compromise certain investigations.34

 34On the basis of this concern the council has supported legislation before Congress to 

amend the Privacy Act to provide more flexibility to OIGs with regard to computer 

matching. See GAO, Highlights of a Forum: Data Analytics for Oversight and Law 

Enforcement,

Lastly, an official from 

the DHS OIG expressed the opinion that because the OIG’s role is 

GAO-13-680SP (Washington, D.C.: July 15, 2013).
Page 28 GAO-14-44 Computer Matching Act

advisory in nature and does not involve making official eligibility 

determinations based on computer matching results, the OIG should be 

exempt from having to establish CMAs in order to do computer matching.

Not all OIG officials agreed that CMAs were problematic. For example, 

OIG officials from Labor and USDA said they had not experienced 

independence issues at their agencies. In addition, an official from the VA 

OIG stated that while the computer matching process usually takes 6 to 9 

months, she did not feel the requirements posed a problem for 

investigative projects that were adequately planned in advance. For 

example, the VA OIG official pointed out that the act allowed for pilot data 

matches (under its exemption for statistical matching) that provide an 

opportunity for investigative methods to be tested in advance of 

developing a CMA. The official stated that in one case the VA OIG had 

conducted pilot matches using a small data subset to determine whether 

it would be productive to perform a match of the entire dataset. After the 

pilot showed the value of conducting the match, the VA OIG initiated a 

CMA with the source agency, and matching under this CMA is currently 

under way. In this case, the length of time required to get the CMA 

approved was not problematic because the OIG had planned for it in 

advance.

Further, officials from privacy offices in several agencies, such as USDA, 

ED, and SSA, stated that requirements of the Computer Matching Act 

were valuable to their agencies as privacy protections and did not 

discourage use. For example, an official in the USDA Privacy Office 

stated that USDA ensures that mechanisms similar to those in the 

Computer Matching Act are incorporated in policies and practices relating 

to all applicable computer matching and data-sharing activities regardless 

of whether they are statutorily covered by the act. Similarly, officials from 

ED said they have applied the CMA process to data-sharing agreements 

not covered by the act, including a data-sharing agreement with SSA, to 

ensure that that program had privacy protections comparable to those 

provided by the act. Furthermore, officials from SSA stated that the 

provisions play an important role for members of the public by providing 

protections for their information.

The seven agencies we reviewed have responded to the Computer 

Matching Act by developing policies and procedures that comply with its 

requirements; however these agencies have also implemented the act 

inconsistently. Interpretations of the act’s scope have varied, cost-benefit 

analyses have not always addressed key elements, and DIBs have not 

Conclusions
Page 29 GAO-14-44 Computer Matching Act

always met requirements. Inconsistent implementation has led to reduced 

transparency of computer matching programs and raises questions of 

whether privacy is being protected consistently for these agencies’ 

computer matching activities. OMB has also not taken steps to ensure 

consistent implementation of the act. For example, OMB guidance does 

not resolve questions about what types of matching are covered by the 

act, as well as how to assess costs and benefits, resulting in confusion 

among the agencies. Without clearer guidance and assistance from OMB, 

the agencies we reviewed are likely to continue implementing the act 

inconsistently and potentially conducting computer matching programs 

that are neither cost-effective nor protective of privacy, as provided for by 

the act.

Further, the act contains a number of provisions that pose challenges for 

agencies, such as the act’s definitions and limited time frames for 

conducting computer matches. To the extent that agencies avoid 

performing matches because of the extensive and time-consuming 

process for establishing CMAs, they may be losing opportunities to 

identify improper payments that could result in savings to the government.

To make government-wide computer matching program planning efforts 

more consistent, we recommend that the Director of OMB take the 

following four actions:

• revise guidance on computer matching to clarify whether front-end 

verification queries are covered by the Computer Matching Act,

• direct agencies to address all key elements when preparing costbenefit analyses,

• ensure that DIBs prepare and submit annual reports of agency-wide 

computer matching activities, and

• ensure that agencies receive assistance in implementing computer 

matching programs as envisioned by the act.

We are also making specific recommendations for the seven agencies in 

our review to improve the implementation of the act as follows.

We recommend that the Secretary of Agriculture

• develop and implement policies and procedures for cost-benefit 

analyses related to computer matching agreements to include key 

elements such as personnel and computer costs, as well as 

avoidance of future improper payments and recovery of improper 

payments and debts;

Recommendations for 

Executive Action
Page 30 GAO-14-44 Computer Matching Act

• ensure the DIB reviews cost-benefit analyses to make certain cost 

savings information for the computer matching program is included 

before approving CMAs; and

• ensure the DIB performs annual reviews and submits annual reports 

on the agency’s computer matching activities, as required by the act.

We recommend that the Secretary of Education

• develop and implement policies and procedures for cost-benefit 

analyses related to computer matching agreements to include key 

elements such as personnel and computer costs, as well as 

avoidance of future improper payments and recovery of improper 

payments and debts;

• ensure the DIB reviews cost-benefit analyses to make certain cost 

savings information for the computer matching program is included 

before approving CMAs; and

• ensure the DIB performs annual reviews and submits annual reports 

on agency computer matching activities, as required by the act.

We recommend that the Secretary of Health and Human Services

• develop and implement policies and procedures for cost-benefit 

analyses related to computer matching agreements to include key 

elements such as personnel and computer costs, as well as 

avoidance of future improper payments and recovery of improper 

payments and debts;

• ensure the DIB reviews cost-benefit analyses to make certain cost 

savings information for the computer matching program is included 

before approving CMAs; and

• ensure the DIB performs annual reviews and submits annual reports 

on agency computer matching activities, as required by the act.

We recommend that the Secretary of Homeland Security

• develop and implement policies and procedures for cost-benefit 

analyses related to computer matching agreements to include key 

elements such as personnel and computer costs, as well as 

avoidance of future improper payments and recovery of improper 

payments and debts;

• ensure the DIB reviews cost-benefit analyses to make certain cost 

savings information for the computer matching program is included 

before approving CMAs; and

• ensure the DIB performs annual reviews and submits annual reports 

on agency computer matching activities, as required by the act.
Page 31 GAO-14-44 Computer Matching Act

We recommend that the Secretary of Labor

• develop and implement policies and procedures for cost-benefit 

analyses related to computer matching agreements to include key 

elements such as personnel and computer costs, as well as 

avoidance of future improper payments and recovery of improper 

payments and debts;

• ensure the DIB reviews cost-benefit analyses to make certain cost 

savings information for the computer matching program is included 

before approving CMAs; and

• ensure the DIB performs annual reviews and submits annual reports 

on agency computer matching activities, as required by the act.

We recommend that the Secretary of Veterans Affairs

• develop and implement policies and procedures for cost-benefit 

analyses related to computer matching agreements to include key 

elements such as personnel and computer costs, as well as 

avoidance of future improper payments and recovery of improper 

payments and debts; and

• ensure the DIB reviews cost-benefit analyses to make certain cost 

savings information for the computer matching program is included

before approving CMAs.

We recommend that the Administrator of Social Security

• develop and implement policies and procedures for cost-benefit 

analyses related to computer matching agreements to include key 

elements such as personnel and computer costs, as well as 

avoidance of future improper payments and recovery of improper 

payments and debts;

• ensure the DIB reviews cost-benefit analyses to make certain cost 

savings information for the computer matching program is included 

before approving CMAs; and

• ensure the DIB performs annual reviews and submits annual reports 

on agency computer matching activities, as required by the act.

We sent draft copies of this report to the seven agencies covered by our 

review as well as to the Department of the Treasury and OMB. We 

received written responses from USDA, ED, DHS, Labor, VA, and SSA.

These comments are reprinted in appendices II through VII. All of the 

agencies to which we made recommendations and received comments 

concurred with our recommendations, with the exception of ED, which 

Agency Comments 

and Our Evaluation
Page 32 GAO-14-44 Computer Matching Act

concurred with one of our three recommendations. The agencies also 

provided technical comments, which we have incorporated as appropriate 

into the final report. The HHS GAO Intake Coordinator indicated via email that HHS agreed with our recommendations and offered no further 

comments. The Executive Director of the Bureau of Fiscal Services at 

Treasury provided technical comments via e-mail, which we have 

addressed as appropriate. OMB staff provided technical comments via email which we have considered and included as appropriate. The OMB 

staff did not state whether the agency agreed or disagreed with our 

recommendations.

USDA concurred with all our recommendations and stated that it plans to

move forward with implementing them. USDA noted the need for 

consistent, clear instructions and assistance from OMB on implementing 

the computer matching programs.

ED concurred with one of our recommendations, to ensure the DIB 

performs annual reviews and submits annual reports on agency computer 

matching activities, as required by the Computer Matching Act. However,

ED did not concur with the other two recommendations. Regarding our

recommendation to develop and implement policies and procedures for 

cost-benefit analyses that include all key elements, ED stated that it 

agreed that the elements of our recommendation are important but stated 

that its analyses included appropriate key elements. Specifically, the 

department argued that not all key elements apply to every computer 

matching program. For example, ED did not think it appropriate to 

address the recovery of improper payments and debts for matching 

programs to establish eligibility. However, we believe all key elements 

should be addressed in cost benefit analyses, even if only to note that 

certain types of benefits have been considered and determined not to be 

applicable in the specific circumstances of a given computer matching 

program. Without a thorough assessment, the DIB may not have 

sufficient information to determine whether a thorough cost analysis has 

been conducted. Regarding our recommendation to ensure that the DIB 

reviews cost-benefit analyses to make certain cost savings information for 

CMAs are included before approval, ED did not concur and stated that 

the DIB has consistently reviewed cost-benefit analyses before approving 

CMAs and that no change in agency practices was needed. However, our 

review of ED’s eight cost-benefit analyses showed that two did not 

address avoidance of future improper payments and five did not address

recovery of improper payments and debts. Given that ED’s cost-benefit 

analyses did not mention these costs, which are key elements of cost 

savings information, the DIB would not have been able to make a full
Page 33 GAO-14-44 Computer Matching Act

review of costs and benefits to ensure that cost savings information was

included in CMAs before approving them. We continue to believe it is

important that agency DIBs perform comprehensive reviews of costbenefit analyses to ensure that benefits outweigh costs.

DHS stated that it will work to update its guidance concerning CMAs and 

the DIB and that it plans to update instructions on implementing policies 

and procedures for cost-benefit analyses to include the key elements we 

identified. In addition, the DHS Privacy Office plans to update its CMA 

process to clarify the DIB’s responsibilities in assessing cost-benefit 

analyses and ensure the DIB reviews and reports annually on its 

computer matching program. In addition to DHS’s written comments, a 

DHS privacy official provided technical comments in an e-mail, which we 

have incorporated as appropriate.

Labor concurred with our recommendations and provided technical 

comments. We have taken Labor’s comments into consideration and 

updated the report as appropriate. Labor also stated that it agreed that 

the computer matching process is both lengthy and resource-intensive, 

and we have noted this in the report. 

VA stated that it would revise its current policy to include the key 

elements of cost-benefit analyses within the next 12 months. 

Furthermore, VA also plans to ensure that the DIB reviews cost-benefit 

analyses to make certain that cost savings information is included in 

CMAs before approval.

SSA stated that it is currently working on an initiative to improve its costbenefit analysis process and will ensure that all CMAs comply with the 

act’s requirements and OMB’s guidance. In addition, SSA said it will

ensure that the DIB receives cost-benefit analyses for proposed computer 

matching programs that include cost savings information prior to 

approval. Lastly, SSA stated that it agrees that its DIB should conduct an 

annual review but would defer to OMB with regard to complying with the 

requirement that the DIB report annually.

As agreed with your offices, unless you publicly announce the contents of 

this report earlier, we plan no further distribution until 30 days from the 

report date. At that time, we will send copies to interested congressional 

committees, the Director of OMB, the Secretary of Treasury and the 

heads of the seven agencies in our review. In addition, the report will be 

available at no charge on the GAO website at http://www.gao.gov.
Page 34 GAO-14-44 Computer Matching Act

If you or your staff have any questions about this report, please contact 

me at (202) 512-6244 or wilshuseng@gao.gov. Contact points for our 

Offices of Congressional Relations and Public Affairs may be found on 

the last page of this report. GAO staff who made key contributions to this 

report are listed in appendix VIII.

Gregory C. Wilshusen

Director, Information Security Issues
Appendix I: Objectives, Scope, and 

Methodology

Page 35 GAO-14-44 Computer Matching Act

The objectives of our review were to (1) determine agencies’ 

responsibilities under the Computer Matching Act, (2) determine how 

selected agencies are implementing that act with regard to federal 

benefits programs, and (3) describe the views of officials at selected 

agencies on the process of developing and implementing computer 

matching agreements (CMA).

To describe agencies’ responsibilities under the Computer Matching Act, 

we reviewed the law, as well as other relevant laws, policies, and 

guidance that address computer matching for program integrity purposes. 

We also interviewed agency officials and examined agency documents on 

computer matching programs and processes. We focused on federal 

agencies with the highest expenditures in benefits and assistance 

programs, specifically the Departments of Agriculture (USDA), Education 

(ED), Health and Human Services (HHS), Homeland Security (DHS), and 

Veterans Affairs (VA), and the Social Security Administration (SSA). We 

added the Department of Labor (Labor) because it oversees significant 

employment benefit programs and there were some indications that the 

Labor Office of Inspector General (OIG) had faced challenges in using 

CMAs. Labor is also one of the 10 federal agencies with the highest 

expenditures in benefits and assistance programs. We also reviewed 

guidance developed by the Office of Management and Budget (OMB) on 

computer matching. In addition, we obtained information from the 

Department of the Treasury on the Do Not Pay Working System and the

Do Not Pay Initiative, and their relationship to the computer matching 

provisions of the Privacy Act. We analyzed the requirements of the act 

and OMB guidance and confirmed with agency officials the typical 

process for conducting computer matching programs. In addition, while 

the provisions of the act established procedural safeguards for benefit 

programs and federal personnel management, we mainly focused on 

requirements for agencies to establish or verify eligibility for federal 

benefits.

To determine selected agencies’ implementation of the act with regard to 

federal benefits programs, we compared the requirements of the act with 

agencies’ computer matching agreements, including accompanying costbenefits analyses and documentation of agency processes for reviewing 

the draft agreements. Specifically, we examined computer matching 

agreements to determine if the agreements contained information 

required by the act. In addition, we reviewed the accompanying costAppendix I: Objectives, Scope, and 

Methodology
Appendix I: Objectives, Scope, and 

Methodology

Page 36 GAO-14-44 Computer Matching Act

benefit analyses to determine if they contained relevant information to 

conclude that the matching program was beneficial to the agency. 

Specifically we reviewed the 1986 GAO report1

To describe the views of officials at selected agencies on the process of 

developing and implementing CMAs, we interviewed agency officials and 

inspectors general to determine how they implemented the act’s 

computer matching provisions. Furthermore, we solicited these officials’ 

views on the requirements of the act and whether they thought 

improvements could be made.

for criteria on cost-benefit 

analyses since OMB guidance refers agencies to it and because 

agencies we reviewed used it. We selected four key elements of costs 

and benefits (cost: personnel and computer costs; benefits: avoidance of 

future improper payment and recovery of improper payments and debts) 

and determined whether the agencies’ cost-benefit analyses included 

these key elements. We also reviewed the activities and documentation 

of the Data Integrity Boards (DIB) to determine if they followed the 

requirements of the law. Specifically, we examined the structure of the 

DIBs and determined whether they disapproved CMAs that included costbenefit analyses that lacked key elements. Also, we reviewed the 

reporting requirements of the DIBs to determine if they issued computer 

matching reports as required. We also reviewed OMB’s guidance and 

queried agency officials to determine whether they interpreted the 

guidance consistently.

We conducted this performance audit from January 2013 to January 2014 

in accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

 1

GAO/PEMD-87-2.
Appendix II: Comments from the Department 

of Agriculture

Page 37 GAO-14-44 Computer Matching Act

Appendix II: Comments from the Department 

of Agriculture
Appendix III: Comments from the Department 

of Education

Page 38 GAO-14-44 Computer Matching Act

Appendix III: Comments from the 

Department of Education
Appendix III: Comments from the Department 

of Education

Page 39 GAO-14-44 Computer Matching Act
Appendix III: Comments from the Department 

of Education

Page 40 GAO-14-44 Computer Matching Act
Appendix IV: Comments from the Department 

of Homeland Security

Page 41 GAO-14-44 Computer Matching Act

Appendix IV: Comments from the 

Department of Homeland Security
Appendix IV: Comments from the Department 

of Homeland Security

Page 42 GAO-14-44 Computer Matching Act
Appendix IV: Comments from the Department 

of Homeland Security

Page 43 GAO-14-44 Computer Matching Act
Appendix V: Comments from the Department 

of Labor

Page 44 GAO-14-44 Computer Matching Act

Appendix V: Comments from the Department 

of Labor
Appendix VI: Comments from the Department 

of Veterans Affairs

Page 45 GAO-14-44 Computer Matching Act

Appendix VI: Comments from the 

Department of Veterans Affairs
Appendix VI: Comments from the Department 

of Veterans Affairs

Page 46 GAO-14-44 Computer Matching Act
Appendix VI: Comments from the Department 

of Veterans Affairs

Page 47 GAO-14-44 Computer Matching Act
Appendix VII: Comments from the Social 

Security Administration

Page 48 GAO-14-44 Computer Matching Act

Appendix VII: Comments from the Social 

Security Administration
Appendix VII: Comments from the Social 

Security Administration

Page 49 GAO-14-44 Computer Matching Act
Appendix VIII: GAO Contact and Staff 

Acknowledgments

Page 50 GAO-14-44 Computer Matching Act

Gregory C. Wilshusen, (202) 512-6244 or wilshuseng@gao.gov

In addition to the individuals named above, key contributions to this report 

were made by John de Ferrari (Assistant Director), Wilfred B. Holloway, 

Tammi N. Kalugdan, Lee A. McCracken, Mimi Nguyen, David F. Plocher, 

and Tina M. Torabi.

Appendix VIII: GAO Contact and Staff 

Acknowledgments

GAO Contact

Staff 

Acknowledgments

(311099)
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http://www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Please Print on Recycled Paper.