GAO 

United States Government Accountability Office

Report to the Chairman, Committee on 

Finance, U.S. Senate 

INFORMATION 

TECHNOLOGY 

Social Security 

Administration’s Data 

Exchanges Support 

Current Programs, but 

Better Planning Is 

Needed to Meet 

Future Demands 

September 2009 

GAO-09-966 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

September 2009

INFORMATION TECHNOLOGY 

Social Security Administration's Data Exchanges

Support Current Programs, but Better Planning Is

Highlights of GAO-09-966, a report to the Needed to Meet Future Demands

Chairman, Committee on Finance, U.S. 

Senate 

The Social Security Administration 

(SSA) receives electronic data from 

other agencies to support its own 

programs, and provides electronic 

data to support more than 800 state 

and federal agency partners. This 

information aids in, among other 

things, the processing and 

distribution of beneficiary 

payments and the delivery of 

services such as driver’s license 

issuance and voter registration. 

SSA relies on its information 

technology (IT) infrastructure—its 

databases, applications, networks, 

and IT management practices—to 

support its current and future 

needs for exchanging data with its 

state and federal partners. GAO 

was asked to (1) determine the 

extent to which SSA’s IT 

infrastructure effectively and 

efficiently supports current data 

exchanges, and any system-related 

problems affecting its exchange 

partners; and (2) describe SSA’s 

efforts to ensure that its IT 

infrastructure can support the 

agency’s and its partners’ future 

data exchange environment. To do 

this, GAO analyzed agency 

documentation and interviewed 

SSA officials, as well as federal and 

state data exchange partners. 

Systems-related problems that affect SSA’s ability to support outgoing data 

exchange programs have been few, and the agency has established effective 

procedures and mechanisms for addressing the problems that do occur. In 

this regard, SSA provides help-desk and on-site support to data exchange 

partners to help prevent or resolve problems, and uses procedures supported 

by a problem-identification and tracking system to facilitate problem 

resolution. State and federal partners with whom GAO held discussions stated 

that these efforts resulted in quick responses from SSA and effective 

resolution of problems that occurred. For example, a system that provides 

information for two data exchange programs that support driver’s license 

issuance and voter registration in all 50 states was reported to have had 

almost 100 percent availability during the hours specified in the agreements 

governing these data exchanges. Further, all of the data exchange partners 

with whom GAO held discussions reported that the data that SSA provided 

were reliable. As a result, these partners stated that their ability to conduct 

business operations that depend on SSA data was not adversely affected by 

systems-related problems associated with SSA’s IT infrastructure. 

SSA and its partners anticipate that the number of requests for outgoing data 

exchanges will continue to increase and that the exchanges will become more 

complex as agencies request that these exchanges take place through online, 

real-time transactions. However, SSA officials stated that the agency’s existing 

IT infrastructure may not be able to support the increased demand that they 

and their partners anticipate. To address overall agency needs for a more costeffective and efficient computing environment, the agency is taking steps to 

modernize its computing capabilities and supporting infrastructure. For 

example, the agency is in the process of implementing an updated database 

environment and upgrading its software applications—steps that are intended 

to enable expanded and more efficient IT service delivery, including the 

electronic exchange of data. However, the agency has not fully implemented 

IT management practices specifically related to its outgoing data exchange 

environment, such as conducting thorough analyses to project the expected 

increase in requests for data and online access. Conducting these analyses and 

using this information as input to the agency’s target architecture (i.e., a 

formal description of the agency’s future environment) are important 

practices to clearly define future requirements to guide the direction of the 

agency’s data exchange programs. Implementing these management practices 

is essential to ensuring that the agency is well positioned to meet the growing 

needs of its data exchange partners. 

What GAO Recommends

GAO is recommending that SSA 

conduct the analyses needed to 

define requirements for delivering 

data exchange services to its 

partners in the future and use the 

results of these analyses to update 

its target architecture. In written 

comments on a draft of this report, 

SSA agreed with the 

recommendations. 

View GAO-09-966 or key components.

For more information, contact Valerie C. 

Melvin at (202) 512-6304 or 

melvinv@gao.gov. 
Page i GAO-09-966 

Contents 

Letter 1

Background 3 

SSA’s IT Infrastructure Supports Its Current Data Exchange 

Environment 11 

SSA Is Taking Steps to Prepare for a Future Data Exchange 

Environment, but Has Not Effectively Planned for Increasing 

Demands for Outgoing Data 15 

Conclusions 24 

Recommendations for Executive Action 24 

Agency Comments and Our Evaluation 25 

Appendix I Objectives, Scope, and Methodology 27 

Appendix II Comments from the Social Security 

Administration 32 

Appendix III GAO Contact and Staff Acknowledgments 34 

Tables 

Table 1: Contents of SSA’s Databases 4 

Table 2: SSA’s Key Batch Application Systems Providing Data to 

State and Federal Partners 6 

Table 3: SSA’s Key Online, Real-time Application Systems 

Providing Data to State and Federal Partners 7 

Table 4: Increase in the Number of Requests for SSA Data from 

Seven Key Data Exchange Applications, Fiscal Years 2007 

to 2008 16 

Table 5: SSA Regions Reporting Requests for Online Real-Time 

Access to the State Online Query system 18 

Table 6: States and Agencies That We Contacted 30 

Figure 

Figure 1: SSA Databases and Key Systems That Support Outgoing 

Data Exchange Programs 8 

 Information Technology 
Abbreviations 

AAMVA American Association of Motor Vehicle Administrators 

BENDEX Beneficiary and Earnings Data Exchange 

EIEI Electronic Information Exchange Initiative 

EVS Enumeration Verification System 

FOLQ Federal Online Query 

HAVV Help America Vote Verification 

IT information technology 

MADAM Master Data Access Method 

MBR Master Beneficiary Record 

MEF Master Earnings File 

Numident Number Holder Identification 

PUPS Prisoner Update Processing System 

SDX State Data Exchange 

SOLQ State Online Query 

SSA Social Security Administration 

SSOLV Social Security Online Verification 

SSR Supplemental Security Record 

SVES State Verification and Exchange System 

UIQ Unemployment Insurance Query 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately. 

Page ii GAO-09-966 Information Technology
Page 1 GAO-09-966 

 

United States Government Accountability Office

Washington, DC 20548 

 

September 16, 2009 

The Honorable Max Baucus 

Chairman 

Committee on Finance 

United States Senate 

Dear Mr. Chairman: 

Through more than 3,000 agreements with federal and state agencies, the 

Social Security Administration (SSA) both receives incoming data to 

support its own programs and provides outgoing data to support state and 

other federal agencies’ programs. Specifically: 

• Information provided to SSA by other federal agencies aids in the 

processing and electronic disbursement of, for example, beneficiary 

payments or premium withholdings for entitlement programs such as the 

Retirement, Survivors, and Disability Insurance Program and the 

Supplemental Security Income Program. 

• Information that SSA provides to state and other federal agencies enables 

more efficient processing of services such as driver’s license issuance, 

voter registration, social services administration (such as food stamps), 

employment verification and eligibility, and passport issuance. 

The data that SSA provides are essential to helping state and federal 

partners streamline operations, reduce costs, and eliminate overpayments 

and fraud. To carry out these transactions—over 1 billion each year—the 

agency relies on an information technology (IT) infrastructure consisting 

of the hardware, software, networks, and management practices that 

support capabilities to provide electronic data to and communicate with a 

variety of external systems belonging to the agency’s data exchange 

partners.1

Given the significance of the data provided by these transactions, you 

requested that we examine the effectiveness of the agency’s IT 

infrastructure in supporting data exchanges that provide information to 

1

In this context, the term “data exchange” refers to an ongoing mechanism for exchanging 

data, and the term “transaction” refers to an instance of exchanged data, such as the 

verification of a single Social Security number. 

 Information Technology 
 

state and other federal agencies. Our objectives were to (1) determine the 

extent to which SSA’s IT infrastructure effectively and efficiently supports 

its current data exchange programs, and describe any systems-related 

problems that affect the agency’s state and federal data exchange partners 

and (2) describe SSA’s efforts to ensure that its IT infrastructure can 

support the agency’s and its partners’ future data exchange environment. 

As requested, we focused our study on SSA’s data exchange programs that 

affect the ability of state and federal partners’ to provide services to 

individuals. These data exchanges provide electronic information that is 

used to support state and other federal agencies’ programs—that is, 

“outgoing” data exchanges—through the use of several components of 

SSA’s IT infrastructure.2

 SSA considers these to be “non-program” data 

exchanges since they do not support the agency’s mission. 

To address both of the objectives, we identified the components of SSA’s 

IT infrastructure that support the agency’s data exchange programs, and 

obtained and analyzed agency documentation describing these 

components and SSA’s data exchange operations as well as plans to make 

improvements to the agency’s IT infrastructure. We interviewed SSA 

officials, including two regional office data exchange coordinators from 

New York City and Kansas City,3

 as well as officials of selected state and 

federal data exchange partners, to obtain their views on the effectiveness 

of SSA’s IT infrastructure in supporting data exchanges and on the 

agency’s plans for improvements. We spoke with and collected 

documentation from partners who represent various state agencies in New 

York, California, Idaho, North Carolina, and Iowa, and from federal data 

exchange partners within the Departments of Veterans Affairs, State, 

Homeland Security, and Health and Human Services. We determined that 

the data provided by SSA about the agency’s data exchange IT 

infrastructure were sufficiently reliable for the purposes of our 

 

2

SSA also provides information, such as Social Security number verification, to other 

external entities, such as private companies. The scope of this study did not include those 

partners. We also did not include exchanges from SSA to the Department of the Treasury in 

the scope of our study because these administrative exchanges are conducted so that 

Treasury can provide payments (through checks and electronic transfers) to beneficiaries 

on behalf of SSA; these exchanges do not support Treasury programs. 

3

We held discussions with these two region coordinators based on the extent of their 

experiences with data exchanges and the number of data exchange programs that they 

support. The New York City region includes New York, New Jersey, Puerto Rico, and the 

U.S. Virgin Islands; the Kansas City region includes Kansas, Missouri, Iowa, and Nebraska. 

Page 2 GAO-09-966 Information Technology
 

engagement. Appendix I contains more details on our objectives, scope, 

and methodology. 

We conducted this performance audit from December 2008 to September 

2009 at SSA’s headquarters in Baltimore, Maryland. We also met with state 

agency officials in New York, California, Idaho, North Carolina, and Iowa 

and with federal agency officials with the Departments of Veteran Affairs, 

State, Homeland Security, and Health and Human Services in Washington, 

D.C. We conducted our work in accordance with generally accepted 

government auditing standards. Those standards require that we plan and 

perform the audit to obtain sufficient, appropriate evidence to provide a 

reasonable basis for our findings and conclusions based on our audit 

objectives. We believe that the evidence obtained provides a reasonable 

basis for our findings and conclusions based on our audit objectives. 

SSA currently maintains over 800 agreements that support exchanges 

through which the agency provides data to state and federal partners 

(approximately 700 state and almost 100 federal agency partners). These 

agreements define the requirements, terms, and conditions under which 

the data will be provided to the partners. In many cases, legislation 

mandates the agency to provide electronic data in support of certain 

programs.4

 For example, SSA is required to provide data to the Veterans 

Benefits Administration, which is part of the Department of Veterans 

Affairs, in support of the Veterans Benefits Administration’s efforts to 

determine benefits eligibility. In other cases, SSA voluntarily enters into 

data exchange agreements with state and other federal agency partners. 

Background 

IT Infrastructure 

Components Supporting 

SSA Data Exchanges 

SSA’s existing IT infrastructure—databases, applications, networks, and 

management practices—supports the agency’s daily operations and core 

mission activities, such as administering monthly Retirement, Survivors, 

and Disability Insurance and Supplemental Security Income benefits, as 

well as its data exchange programs.5

 Data provided to SSA’s data 

 

4

According to SSA, of the over 800 agreements with state and federal partners, about 530 

are legislatively mandated to support programs such as veterans’ and Medicare benefits 

administration, voter registration, and employment eligibility verifications. 

5

SSA’s core mission is to administer the Retirement, Survivors, and Disability Insurance 

program, which provides benefits to workers who have paid into the Social Security trust 

fund, and the Supplemental Security Income program, which provides or supplements the 

income of aged, blind, or disabled individuals with limited income and resources. 

Page 3 GAO-09-966 Information Technology
 

exchange partners are accessed from the same database infrastructure 

that supports the agency’s overall operations and mission. This 

infrastructure includes several databases that store and maintain 

beneficiary data related to SSA’s benefits programs. These databases are 

briefly described in table 1. 

Table 1: Contents of SSA’s Databases 

Database Contents 

Master Beneficiary Record (MBR) 

ance benefits enrollment and 

All data related to Retirement, Survivors, and

Disability Insur

contributions 

Master Earnings File (MEF) Wage data reported by employers for their 

employees 

Supplemental Security Record (SSR) Data about Supplemental Security Income 

eligibility and payments 

Number Holder Identification 

(Numident) 

mber application was processed and 

Social Security number holders’ name, date of 

birth, place of birth, parents’ names, citizenship 

status at the time of application, date of death (if 

applicable), and the office where the Social 

Security nu

approved 

Prisoner database nformation that various 

prisons report to SSA 

Prisoner confinement i

Source: GAO analysis of SSA data. 

Among the databases, the Master Beneficiary Record, Master Earnings

File, and Supplemental Security Record databases are included in the 

agency’s legacy database infrastructure, referred to as the Master Data 

Access Method, or MADAM. The Number Holder Identification 

has recently been updated to a mor

database 

e modern system based on 

commercially available software.6

ide 

e. 

 

SSA also maintains various application systems that were designed and

developed specifically to process data exchange transactions and that 

generally support multiple data exchanges. These applications prov

Social Security number matching and verification information that 

supports various types of federal and state programs, such as driver’s 

license issuance, voter registration, social services administration (e.g., 

food stamps), employment eligibility verification, and passport issuanc

6

The Prisoner database is a separate database that resides outside of the MADAM 

infrastructure. 

Page 4 GAO-09-966 Information Technology
 

The applications accept requests for information from SSA’s partners, 

retrieve and attempt to match or verify data from the databases against the

information submitted by the partners, and then transmit responses—that 

is, the results of the data matching and verification—to the data excha

partners who initiated the requests. The applications primarily match 

Social Security number, name, and date-of-birth information submitted by 

the partners against data stored in the databases. The request transactions 

are processed and the responses pro

nge 

vided through the use of either batch 

file or online, real-time processing.7

ts 

ale 

application systems process over 1 billion transactions annually. 

in 

 a 

rs 

 files. Table 2 

describes these batch processing application systems. 

 

SSA relies on 11 key application systems to process information reques

from and provide response data to its state and federal data exchange 

partners. These data exchange applications provide data to programs 

associated with 582 of the state-level agreements and 26 of the feder

level agreements—about 75 percent of the outgoing data exchange 

agreements that the agency supports.8

 These 11 key data exchang

Six of the 11 applications process transaction requests and responses 

batch mode. That is, they return single files that contain matching or 

verification information in response to multiple transaction requests (i.e.,

“batch”). The majority of SSA’s state and federal data exchange partne

receive transaction responses from the agency in batch

7

Batch transaction processing sequentially matches data files containing one or more data 

items against records in SSA’s databases and returns responses to multiple requests for 

data in one file at a scheduled time. Online, real-time processes return responses to 

individual requests for data at the time that the requests are made. 

8

The remaining 25 percent of SSA’s outgoing data exchange agreements are supported by 

various applications that provide data to several different state and federal agencies. For 

example, one such application was developed to provide all states with information to 

identify individuals who may be eligible for Medicaid continuation following a Retirement, 

Survivors, and Disability Insurance cost-of-living adjustment. 

Page 5 GAO-09-966 Information Technology
 

Table 2: SSA’s Key Batch Application Systems Providing Data to State and Federal Partners 

System Function Databases accessed 

Number of data 

exchange agreements 

State Verification and 

Exchange System 

(SVES) 

Provides verification of Social Security numbers 

and benefits information used to establish 

eligibility for income and health maintenance 

programs. The system allows users to request 

data from other SSA data exchange applications. 

In these cases, SVES filters the requesting 

transactions to determine the appropriate 

applications for processing. SVES then passes 

the requests to the applications, which process 

the requests and return responses to the 

partners. 

• Master Beneficiary 

Record 

• Supplemental Security 

Record 

• Number Holder 

Identification 

214 state, territory, and 

District of Columbia, and 

5 federal agency 

agreements 

Beneficiary and Earnings 

Data Exchange 

(BENDEX) 

Provides Retirement, Survivors, and Disability 

Insurance benefit information to states and 

territories, and provides earnings and employer 

data for the last calendar year. 

• Master Beneficiary 

Record 

• Master Earnings File 

96 state, territory, and 

District of Columbia 

agency agreements 

Prisoner Update 

Processing System 

(PUPS) 

Provides prisoner record information to federal 

and state agencies to establish eligibility or 

ineligibility for various programs. 

• Prisoner database Included in SVES 

agreements 

Earnings System Provides earnings information and Social 

Security information to federal, state, or local 

agencies for the purpose of validating Social 

Security numbers used in administering cash or 

noncash income maintenance programs or 

health maintenance programs, and provides 

information to employers or former employers for 

correcting or reconstructing earnings records for 

Social Security tax purposes. 

• Master Earnings File 4 federal agency 

agreements 

State Data Exchange 

(SDX) 

Provides Supplemental Security Income data to 

states for administering income maintenance or 

health maintenance programs, such as state 

supplementation, interim assistance payments, 

and Medicaid. 

• Supplemental Security 

Record 

51 state, territory, and 

District of Columbia 

agency agreements 

Enumeration Verification 

System (EVS) 

Provides Social Security number verifications to 

several partners, including employers and 

federal and state benefits-paying agencies for a 

number of purposes, such as processing 

individuals’ applications for welfare benefits. 

• Number Holder 

Identification 

33 state, 15 federal, and 

District of Columbia 

agency agreements 

Source: GAO analysis of SSA data. 

Of the 11 key data exchange application systems, 5 process transaction 

requests and responses in online, real-time mode. These systems retrieve 

data from SSA’s databases in several ways. For example, using online, realtime processing, a state partner can initiate a query transaction from 

within a state system. The query is transmitted to SSA systems via various 

transmission mechanisms, such as dedicated lines or Internet connections, 

Page 6 GAO-09-966 Information Technology
 

which process the query and then provide an immediate, or real-time, 

response to the requester. In other cases, employees of some federal 

agencies are allowed to remotely log on to SSA systems and execute 

online database inquiry transactions, to which they receive a real-time 

response. Table 3 shows the key application systems that support online 

data exchange transactions. 

Table 3: SSA’s Key Online, Real-time Application Systems Providing Data to State and Federal Partners 

System Function Databases accessed 

Number of data 

exchange agreements 

State Online Query 

(SOLQ)/Federal Online 

Query (FOLQ)a

Provides verifications of Social Security numbers 

and benefits information to both state and federal 

partners to establish eligibility for income and 

health maintenance programs. 

• Master Beneficiary 

Record 

• Supplemental Security 

Record 

• Number Holder 

Identification 

48 state and 2 federal 

agency agreements 

Unemployment Insurance 

Query (UIQ) 

Provides Social Security number verification and 

Social Security benefit information that are used 

by state unemployment insurance representatives 

to offset unemployment payments with the receipt 

of SSA payments. The Unemployment Insurance 

Query is part of SOLQ. 

• Master Beneficiary 

Record 

• Number Holder 

Identification 

36 state agency 

agreements 

E-Verify Provides confirmation or noncomfirmation of newly 

hired employees’ Social Security numbers to aid 

employers in verifying employment eligibility under 

the E-Verify program administered by the 

Department of Homeland Security. 

• Number Holder 

Identification 

1 federal agency 

agreement 

Social Security Online 

Verification (SSOLV) 

Provides Social Security number verification 

primarily to state motor vehicle agencies for the 

issuance of driver’s licenses and state 

identification cards, through the American 

Association of Motor Vehicle Administrators 

(AAMVA) network.b

 

• Number Holder 

Identification 

52 state, territory, and 

District of Columbia 

agency agreements 

Help America Vote 

Verification (HAVV) 

Provides to AAMVA verifications of the last four 

digits of Social Security numbers of voter 

registrants who do not have driver’s licenses for 

use by state AAMVA partners to register new 

voters. 

• Number Holder 

Identification 

45 state, territory, and 

District of Columbia 

agency agreements 

Source: GAO analysis of SSA data. 

a

When the system is used to provide data to federal partners, it is referred to as Federal Online 

Query. The SOLQ/FOLQ application is an online version of the batch application State Verification 

and Exchange System. 

b

The AAMVA network serves as the conduit for transmitting verification requests from individual state 

driver’s licensing agencies to SSA, as well as receiving verification responses from SSA and 

transmitting them to individual states. 

Page 7 GAO-09-966 Information Technology
 

Figure 1 provides an overview of the databases and application systems, 

and the data flow between them and the agency’s state and federal 

partners. 

Figure 1: SSA Databases and Key Systems That Support Outgoing Data Exchange Programs 

Source: GAO analysis of SSA data. 

SSA systems

MEF MBR SSR Numident Prisoner

data

SSOLV SSA 

E-Verify

State and 

federal users

Query and 

response

Query and 

response

Query and 

Response response

Query and response

HAVV

SVES

Earnings BENDEX system

SDX

State agencies

through AAMVA

Department of

Homeland 

Security

SOLQ/FOLQ

Filter to other systems UIQ

State and 

federal systems

Prisoner EVS system

Batch systems Online systems

Note: Tables 1, 2, and 3 of this report provide the definitions of abbreviations and acronyms and 

descriptions of systems and databases. 

Funding and Management 

of SSA’s Outgoing Data 

Exchange Programs 

SSA’s outgoing data exchange programs are funded through various 

sources. These include the agency’s annual budget and reimbursements 

from the data exchange partners, which are established through the data 

exchange agreement process. For example, the agreement between SSA 

and the Veterans Benefits Administration states that SSA will provide data 

at no cost. In this case, SSA’s annual budget provides funds to support the 

administrative and systems-related activities that are required to support 

this agreement, such as the development of agreements and technical 

support for the data exchange partners. SSA receives reimbursements 

from a number of its external partners, including the American 

Page 8 GAO-09-966 Information Technology
 

Association of Motor Vehicle Administrators (AAMVA)9 along with 2 state 

agencies and 14 other federal agencies, for data exchanges. For example, 

according to agency documentation, SSA’s agreement with AAMVA to 

provide electronic Social Security number verifications to all states for 

processing driver’s license applications resulted in reimbursements in the 

amount of $230,882 to the agency in 2007. The amounts of 

reimbursements, if any, are determined on the basis of provisions 

established by the agreements with each data exchange partner. For 364 of 

these agreements, SSA provides electronic data at no cost to state and 

federal partners.10

According to agency documentation, during fiscal year 2007, SSA received 

about $10 million in total reimbursements for its outgoing data exchanges, 

primarily from federal data exchange partners. The documentation 

indicates that about half of this amount was reimbursed on the basis of 

agreements with the Departments of Homeland Security and Health and 

Human Services. 

The management and oversight of SSA’s data exchange programs span 

multiple agency components. Among these, the Associate Commissioner 

for the Office of Earnings, Enumeration and Administrative Systems, has 

primary responsibility for systems activities related to SSA’s data 

exchange programs, and the Office of Budget, Finance, and Management, 

Office of Strategic Services has primary responsibility for data exchange 

agreements. 

Prior GAO Reports on 

SSA’s IT Management 

Practices 

We have previously reported on SSA’s IT management practices and 

challenges. Most recently, we studied and reported on the agency’s ability 

to effectively deliver services, including those related to electronic data 

exchanges. In our reports, we made recommendations directed toward the 

agency’s need to strengthen its plans for delivering services to 

 

9

AAMVA reimburses SSA for data exchange services for all 53 partners: 50 states, 2 

territories, and the District of Columbia. 

10Data exchange agreements with partners are established for varying timeframes. For 

example, many non-reimbursable agreements are generally established for an 18-month 

timeframe with 12-month renewal. Reimbursable agreements, such as those with AAMVA, 

are generally established for 5 years, with annual financial commitment agreements. 

Page 9 GAO-09-966 Information Technology
 

beneficiaries and to address challenges associated with a growing and 

increasingly complex data exchange environment.11

In December 2008, we reported specifically on SSA’s data exchange 

environment and identified challenges that the agency faced in supporting 

data exchange programs.12 Among these, we noted that the agency faced 

challenges in retaining the expertise needed and maintaining the 

technology required to support an adequate technical infrastructure to 

meet future needs. We also described an agency initiative to study ways to 

better manage the data exchange environment and address current and 

future challenges and limitations. This initiative identified actions that the 

agency should take to address challenges related to management and 

systems-related issues. We recommended in our report that SSA set 

milestones for undertaking these actions. The Commissioner of Social 

Security concurred with our recommendation and stated that the agency 

had established milestones for taking action. 

Also in January 2009, we reported that increases in retirement and 

disability filings, along with ongoing and expected increases in retirements 

of SSA’s most experienced staff, posed difficult challenges for the agency 

in meeting future service delivery needs. We recommended that the 

agency take steps to address these challenges and develop a plan that 

describes how it will deliver quality service in the future while managing 

growing work demands and constrained resources.13 In response, SSA 

stated that it had intensive planning efforts in place, but agreed to develop 

a single planning document that would describe service delivery and 

staffing plans. 

 

11We have also reported on SSA’s implementation of IT management practices, including 

the definition of an enterprise architecture and IT investment management. See GAO, 

Information Technology: SSA Has Taken Key Steps for Managing Its Investments, but 

Needs to Strengthen Oversight and Fully Define Policies and Procedures, GAO-08-1020

(Washington, D.C.: Sept. 12, 2008); and Enterprise Architecture: Leadership Remains Key 

to Establishing and Leveraging Architectures for Organizational Transformation, 

GAO-06-831 (Washington, D.C.: Aug. 14, 2006). 

12GAO, Information Technology: Demand for the Social Security Administration’s 

Electronic Data Exchanges Is Growing and Presents Future Challenges, GAO-09-126

(Washington, D.C.: Dec. 4, 2008). 

13GAO, Social Security Administration: Service Delivery Plan Needed to Address Baby 

Boom Retirement Challenges, GAO-09-24 (Washington, D.C.: Jan. 9, 2009). 

Page 10 GAO-09-966 Information Technology
 

SSA has implemented technology and procedures within its existing IT 

infrastructure to support its current data exchange environment, including 

processes to identify, track, and resolve systems-related problems. Those 

data exchange partners we included in our study14 indicated that the 

agency’s IT infrastructure had effectively supported the exchanges in 

which they participate. The partners reported that they had experienced 

few systems-related problems and none that had a significant impact on 

their ability to conduct business. 

SSA’s IT 

Infrastructure 

Supports Its Current 

Data Exchange 

Environment 

SSA Has Established 

Practices and Procedures 

for Supporting Data 

Exchange Services 

An effective IT infrastructure provides performance capabilities, such as 

system availability and reliable data, that are essential to enabling the 

efficient and economical exchange of electronic data.15 The Software 

Engineering Institute defines practices for providing effective IT services, 

including those that are key to an agency’s ability to ensure that its 

infrastructure supports business operations.16 These practices include, 

among other things, the establishment of (1) monitoring capabilities to 

proactively identify problems; (2) help desks to collect information on 

incidents and initiate problem-solving actions; and (3) capabilities to 

prioritize incidents, track the status and progress of incident resolution, 

and validate the complete resolution of incidents. By implementing 

practices to monitor, track, and resolve systems-related problems, 

agencies can reduce the risk that when problems occur, their information 

systems and support mechanisms will fall short of effectively supporting 

business operations and service commitments. 

To ensure that SSA’s IT infrastructure meets the performance 

requirements of the agency’s data exchange partners, SSA and its partners 

establish, through data exchange agreements, specific and detailed 

performance standards (e.g., system availability, scheduled outages, data 

accuracy, and response times for each exchange, along with protocols for 

 

14These partners represented various state agencies in New York, California, Idaho, North 

Carolina, and Iowa, and federal data exchange partners within the Departments of Veterans 

Affairs, State, Homeland Security, and Health and Human Services. See appendix I for more 

details. 

15GAO, Executive Guide: Measuring Performance and Demonstrating Results of 

Information Technology Investments, GAO/AIMD-98-89 (Washington, D.C.: Mar. 1, 1998). 

16Software Engineering Institute, CMMI for Services, Version 1.2 (Pittsburgh, Pa.: February 

2009). The Software Engineering Institute is a nationally recognized, federally funded 

research and development center established at Carnegie Mellon University to address 

software engineering practices. 

Page 11 GAO-09-966 Information Technology
 

reporting and resolving systems-related problems). These elements are 

critical to an effective IT infrastructure that enables the efficient and 

economical exchange of electronic data.17 For example: 

• The data exchange agreement with AAMVA specifies that SSA will provide 

responses for 95 percent of all Social Security Online Verification system 

requests received from AAMVA within 3 seconds or less and that 

responses to 99 percent of requests will be provided within 5 seconds or 

less. The agreement also defines the hours of system availability and 

scheduled outages. 

• The data exchange agreement with the Veterans Benefits Administration 

specifies that SSA is to provide a 99 percent data accuracy rate in support 

of the administration of veterans’ benefits. 

To address any systems-related problems that might occur and affect its 

data exchange partners, SSA has implemented several key practices for 

providing effective IT services, as defined by the Software Engineering 

Institute. Specifically, the agency has established processes to identify, 

track, and resolve systems-related problems. For example, the agency 

established a national help desk for responding to systems-related 

problems, and employs a process for recording, prioritizing, tracking, and 

solving IT problems. This process is supported by the Change Asset and 

Problem Reporting System, which is a system that is used agencywide to 

prioritize systems-related problems, track the status and progress of 

resolutions, and validate the resolution of problems. System reports from 

January 2008 to February 2009 identified approximately 35 systems-related 

problems that affected data exchanges. These problems were primarily 

temporary outages lasting less than 1 minute, including several problems 

lasting just seconds. 

Additionally, network support personnel proactively monitor data 

exchange components through the agency’s full-time (24 hours a day, 7 

days a week) network operations and monitoring centers, which provide 

support for agencywide IT infrastructure components. Other SSA support 

staff also regularly monitor systems resource usage and work with state 

and federal partners to help resolve problems as they occur. For example, 

according to SSA officials, if a partner notifies the agency of slow response 

time, support staff members monitor the partner site’s bandwidth usage 

 

17GAO/AIMD-98-89. 

Page 12 GAO-09-966 Information Technology
 

and make upgrades as necessary. SSA has established other specific 

procedures for speedy response to resolve systems-related problems. For 

example, according to AAMVA partners, SSA’s network operations and 

monitoring centers are responsible for monitoring the performance of the 

data exchange system that is used to support driver’s license issuance and 

voter registration (the Social Security On-Line Verification system). When 

SSA personnel at the centers receive an alert indicating that the system is 

not performing properly, they investigate the problem and assign 

responsibility for resolving the problem to the appropriate SSA unit. 

Responsible personnel then notify AAMVA of the problem and the status 

of the resolution process, which is updated through the Change Asset and 

Problem Reporting System. Reports from the reporting system show that, 

in one case of a system outage, SSA support staff resolved the problem in 

34 seconds by moving the AAMVA network connection to a backup 

system. 

SSA Has Effectively 

Provided Data to Support 

Partners’ Business 

Operations 

All of the federal and state data exchange partners included in our study 

stated that SSA’s IT infrastructure adequately supported the performance 

standards established by existing agreements and effectively provided data 

that supported their business operations. They agreed that SSA was 

responsive and quickly resolved problems when they did occur and stated 

that, as a result of SSA’s efforts, their ability to conduct business 

operations that depend on data provided by the agency had not been 

adversely affected by systems-related problems associated with SSA’s IT 

infrastructure. These partners, which had been receiving electronic data 

from SSA for 2 to more than 30 years, reported that they experienced no or 

only minor systems-related problems caused by SSA’s IT infrastructure. 

For example: 

• AAMVA partners reported that the SSA system that supports their data 

exchange historically was fully available during the hours of system 

availability specified in their exchange agreement. According to these 

officials, the system experienced virtually no downtime through calendar 

year 2008—it was operational 99.8 percent of the time that the system was 

available. 

• Officials with Idaho’s Departments of Labor and Transportation told us 

that SSA’s problem resolution procedures and support staff were effective 

and provided ample support and timely response to reported problems. 

These officials added that while 4 percent of Social Security number 

verification responses that they received from SSA via the AAMVA system 

were not confirmed, these nonverifications were predominantly caused by 

Page 13 GAO-09-966 Information Technology
 

name changes that were not updated by the Social Security number 

holders (e.g., changes from maiden names to married names), rather than 

by problems with SSA’s data exchange systems or data. 

• Officials with the Iowa state agencies stated that SSA’s systems 

performance was satisfactory. Specifically, officials with the state’s 

Department of Transportation, which receives data through the AAMVA 

network, reported that although they occasionally experienced 

unscheduled outages and slow system response times, SSA’s overall 

performance was satisfactory. Officials with the state’s Department of 

Human Services said that they had not experienced any problems. 

• Officials with the eight California agencies included in our study reported 

no problems associated with SSA’s data exchange systems.18

Beyond these reports, the two SSA regional office data exchange 

coordinators with whom we spoke stated that state and territory agency 

partners within their regions, New York City and Kansas City,19 had not 

reported systems-related problems associated with SSA’s existing IT 

infrastructure. Specifically, the Kansas City coordinator stated that the 

region had not reported any problems with data exchange systems since 

the coordinator came on board in September 2008. 

Similarly, the federal data exchange partners with whom we met did not 

report any problems associated with SSA’s IT infrastructure that 

negatively affected their ability to carry out business operations. For 

example: 

 

18The eight California agencies are the State Controller’s Office, Employment Development 

Department, Franchise Tax Board, Health Care Services, Social Services, Board of 

Equalization, Department of Motor Vehicles, and Child Support Services. 

19SSA’s New York region includes New York, New Jersey, Puerto Rico, and the U.S. Virgin 

Islands, and the Kansas region includes Kansas, Missouri, Iowa, and Nebraska. 

Page 14 GAO-09-966 Information Technology
 

• Data exchange officials with the Department of Homeland Security 

reported as of June 2009 that no systems-related problems had affected 

their ability to conduct business.20

• Veterans Benefits Administration and Veterans Health Administration 

officials also stated that SSA’s IT infrastructure was effective in delivering 

data that supported their benefits administration programs and that they 

had experienced no problems with the quality or delivery of data from 

SSA’s systems. 

• Officials with the Centers for Medicare and Medicaid Services stated that 

they occasionally experienced late delivery of files that delayed the 

processing of Medicare entitlement information. However, these officials 

described this matter as a situation that they considered to be within the 

norm, given the very large amounts of data that are being exchanged 

between systems. These partners did not view these occasional late 

deliveries to be a significant issue with the SSA systems that provided 

data. 

Although SSA’s existing IT infrastructure is sufficient to support current 

outgoing data exchanges, SSA officials and the agency’s partners 

anticipate that the number of these exchanges will continue to increase 

and become more complex, placing greater demands on the infrastructure 

and systems. To address overall agency needs for a more cost-effective 

and efficient computing environment, SSA is currently taking steps to 

modernize its IT infrastructure, including components that support its data 

exchange programs. For example, the agency is updating its 30-year-old 

database infrastructure, converting outdated software applications, and 

expanding its physical data processing capacity. However, the agency has 

not established and executed IT management practices needed to 

effectively guide and oversee the direction of its outgoing electronic data 

exchange programs, such as conducting the analyses required to project 

future workload needs and performance requirements—information that 

is essential to developing a target architecture that identifies business and 

SSA Is Taking Steps to 

Prepare for a Future 

Data Exchange 

Environment, but Has 

Not Effectively 

Planned for 

Increasing Demands 

for Outgoing Data 

 

20At the conclusion of our study in September 2009, the Department of Homeland Security 

reported that, since our initial discussions in June 2009, the department had experienced 

two extended outages related to SSA’s E-Verify system when the direct line between SSA 

and the Department of Homeland Security failed. The outages prevented the department 

from completing E-Verify queries. According to department officials, SSA addressed the 

problem and has plans to implement enhancements intended to prevent the loss of data if 

the direct lines fail in the future. 

Page 15 GAO-09-966 Information Technology
 

technical requirements for a future data exchange environment. If these 

analyses are not completed, SSA’s ability to provide and maintain an IT 

infrastructure that meets requirements to effectively support its data 

exchange programs in the future could be at risk. 

SSA and Partners 

Anticipate Increased 

Demand for Data 

Exchanges 

Based on recent increased numbers of requests for data provided by data 

exchange services, both SSA and its data exchange partners anticipate that 

the agency’s outgoing data exchange programs will continue to grow and 

will outpace current capabilities. SSA reported that from fiscal years 2007 

to 2008, the number of data requests made to seven of SSA’s key data 

exchange applications increased from 1.19 billion to 1.37 billion, or about 

15 percent. Table 4 shows details of the increase in data requests for these 

applications. 

Table 4: Increase in the Number of Requests for SSA Data from Seven Key Data Exchange Applications, Fiscal Years 2007 to 

2008 

Number of data requests, by fiscal year 

(in millions) 

System Description 2007 2008

EVS Batch verifications other than for Social Security numbers, and for 

non-SVES users (up to 250,000 numbers per requester per file) 

377.3 451.4 

Social Security number batch verifications through EVS 62.6 88.7 

SVES batch verifications through EVS 497.8 542.2

E-Verify Online, real-time verifications for employers via Department of 

Homeland Security 

3.3 6.7

SSOLV Online, real-time verifications for state motor vehicle departments 

via AAMVA 

18.3 20.2

HAVV Online, real-time verifications for voter registration via AAMVA 2.3 7.7

SOLQ/ 

FOLQ 

Online, real-time verifications for federal and state agencies 

(includes UIQ) 

32.8 41.3

BENDEX Benefit Information to the states 157.8 (starting 

February 2007) 

180.0

SDX State Data Exchange—Daily File 38.4 30.0

Total 1.19 billion 1.37 billion 

Source: SSA. 

Note: Tables 1, 2, and 3 of this report provide the definitions of system abbreviations. 

An example of one data exchange application that has been required to 

process large increases in data requests for Social Security number 

confirmations is SSA’s E-Verify application. This application supports the 

Page 16 GAO-09-966 Information Technology
 

Department of Homeland Security E-Verify program, which is used to help 

employers verify the employment eligibility of newly hired workers.21

Participation in the program has been voluntary at the private and state 

levels since its implementation 10 years ago and, since then, utilization of 

SSA’s E-Verify application has increased dramatically. In the past 2 years 

alone, usage has doubled twice. Further, federal legislation has been 

proposed to, among other things, require the use of the E-Verify program 

by employers across the nation. If such legislation is enacted, agency 

officials estimate that the number of queries to E-Verify could quickly 

surpass 60 million per year—nearly 10 times the number of requests in 

fiscal year 2008. 

SSA and Partners 

Anticipate Expanded Need 

for Online Access to Data 

Exchange Systems 

In addition to growth in the numbers of data exchange requests, the 

complexity of the exchanges is expected to increase, in that agencies are 

increasingly asking for online access (a more complex requirement than 

batch access). Officials from four of the state and federal agencies with 

whom we spoke stated that their needs for online access to SSA’s data 

exchange systems are expanding. For example, officials with New York, 

Idaho, and California reported that their programs will need expanded 

online access to SSA’s data exchange systems to support increasing 

workloads and to provide more efficient processing of data requests. 

Specifically, officials with New York’s Office of Temporary and Disability 

Assistance explained that their programs will be requiring increased online 

or Web-based service from SSA in the future to support expected general 

workload growth as their need for Social Security number verifications 

and other SSA information grows. Officials with California’s Department 

of Child Support Services stated that online access is needed to improve 

efficiencies in caseworkers’ ability to verify benefits, schedule court 

hearings to determine amounts of child support payments, and process 

and close eligible cases. Officials with Idaho’s Department of Labor also 

projected that they would need more online access to SSA’s data exchange 

systems through Web-based transaction processing to support more 

efficient case processing and access to SSA’s data exchange systems 24 

hours a day, 7 days a week. 

 

21The Department of Homeland Security’s employment verification program, also called 

E-Verify, is used by employers to verify employment eligibility. Employers query the 

Department of Homeland Security’s E-Verify Web site for information, which then requests 

Social Security confirmation from SSA’s E-Verify application system. The data exchange 

this report describes is between the two departments’ systems—that is, SSA’s outgoing 

exchange that provides information to the Department of Homeland Security’s system. 

Page 17 GAO-09-966 Information Technology
 

In 2008, SSA officials polled the agency’s 10 regional offices to identify 

current data exchange partners that had requested online, real-time access 

to the agency’s State Online Query system over the previous 24 months.22

The poll identified state partners in 8 of the regions that had made such 

requests.23 Table 5 shows these regions along with the 24 state agencies 

that had requested online access for their programs (in addition to the 50 

partners that already had access to the State Online Query system). 

Table 5: SSA Regions Reporting Requests for Online Real-Time Access to the State Online Query system 

SSA region State Agencies and programs 

Boston Rhode Island • Department of Labor Temporary Disability Insurance and Worker’s 

Compensation 

Philadelphia Virginia • Department of Medical Assistance Services 

New York New York • Human Services Organizations, including: 

• Child Support Enforcement 

• State Children’s Health Insurance Program and state health programs 

• Home Energy Assistance 

• Foster Care and Adoption 

• Prescription coverage for the elderly 

• Lifeline state-funded, low cost telephone service 

New Jersey • Human Services Organizations, including: 

• Foster Care and Adoption 

• Home Energy Assistance 

• State Children’s Health Insurance Program and state health programs 

• Commission for the Blind and Visually Handicapped 

Chicago Illinois • Department of Human Services’ Division of Vocational Rehabilitation 

Services 

Michigan • Workers’ Compensation Agency 

Dallas Arkansas • Department of Human Services’ Foster Care Program 

Denver Wyoming • Department of Human Services’ State Child Protection Services 

San Francisco California • Department of Health and Human Services for county General Assistance 

programs 

 

22SSA’s current policy limits access to the State Online Query system to Temporary 

Assistance to Needy Families and Medicaid agencies. This decision was made by the SSA’s 

Acting Commissioner in February 2001. 

23The Atlanta and Kansas regional offices did not identify any partners that had requested 

State Online Query access. 

Page 18 GAO-09-966 Information Technology
 

SSA region State Agencies and programs 

Seattle Washington • Department of Labor and Workforce Development for Vocational 

Rehabilitation Program and Workers Compensation Program 

• Department of Health and Welfare for Vocational Rehabilitation Program, 

Child Welfare Programs, State Payment Accuracy, Aging and Disability 

Services, Welfare Fraud, Institutional Revenue, Overpayment Writing Unit 

• Tribal Entities for Temporary Assistance for Needy Families, Food Stamps, 

Medicaid 

• Department of Services for the Blind for Blind and Visually Impaired Services 

and Programs, Vocational Rehabilitation Program 

• Youth Authority for Temporary Assistance for Needy Families, Food Stamps, 

Medicaid 

• Vocational Rehabilitation Commission for Vocational Rehabilitation Services 

• Public Utility Commission for Utility Assistance Program 

Source: SSA. 

SSA Is Taking Steps to 

Modernize Its IT 

Infrastructure, but It Has 

Not Effectively Planned for 

Increasing Demands on Its 

Outgoing Data Exchange 

Programs 

Office of Management and Budget Circular A-130 and industry best 

practices stress the importance of agencies taking advantage of costeffective technology to improve operations.24 Additionally, industry studies 

have shown that modern technology can offer organizations more efficient 

and effective automation capabilities to meet service delivery demands. 

Further, more advanced technology is important to support online, realtime transaction processing, which is more demanding than batch 

processing due to the need for increased systems availability and more 

sophisticated technology.25

SSA officials are taking steps to update key components of the agency’s IT 

infrastructure, including those that directly support its data exchange 

services, to provide expanded and extended processing capabilities. In 

particular, the agency is in the process of modernizing the agency’s 

database infrastructure, upgrading software, and building new data 

centers. 

 

24Office of Management and Budget Circular A-130, Management of Federal Information 

Resources; and GAO/AIMD 98-89. 

25Specifically, online real-time processing requires full-time system availability (24 hours a 

day, 7 days a week) and technology, such as Web-based software, that enables direct, 

online access to computing services and the ability to respond to data requests as soon as 

they are received. In contrast, batch processing transactions are processed at scheduled 

intervals and transmit all responses to requests for data at the same scheduled time. 

Page 19 GAO-09-966 Information Technology
 

According to an SSA Senior Enterprise Architect, the agency’s legacy 

database infrastructure—MADAM—was created in-house in the early 

1980s and, over time, became outdated and difficult to support, limiting 

the agency’s ability to provide expanded data processing services.26 For 

example, the MADAM databases must be backed up and maintained daily 

and are not available during the time that maintenance occurs. This down 

time prevents the agency from providing complete data processing 

services 24 hours a day, 7 days a week to support the agency’s core 

mission and operations as well as its data exchange programs.27

Thus, SSA is in the process of converting its MADAM environment to a 

modern and commercially available system that is intended to support 

online processing 24 hours a day, 7 days a week. According to SSA 

officials, the agency has already converted its Numident database, and 

plans to convert its Master Earnings File, Supplemental Security Record, 

and Master Beneficiary Record databases in 2009, 2011, and 2012, 

respectively. Further, SSA is in the process of updating its E-Verify data 

exchange operating environment. In this regard, the agency is 

implementing an environment in which E-Verify data requests will be 

processed against a dedicated database and will provide continuity of 

operations and disaster recovery capabilities, which are currently not 

available. These upgrades are intended to support the projected increase 

in demand for E-Verify services and reduce the risks of system slowdowns 

and disruptions. The E-Verify upgrades are expected to be completed and 

implemented in August 2009. 

The agency is also upgrading its current systems environment, including 

the systems that support data exchanges. This environment contains aging 

software that is based on about 36 million lines of COBOL code, a 

programming language that is generally viewed as obsolete and that makes 

it difficult to implement new business processes and new service delivery 

models, such as online, real-time processing. According to SSA officials, 

the agency is upgrading its software applications to Web-based technology 

 

26The MADAM databases include the Master Earnings File, Supplemental Security Record, 

and Master Beneficiary Record databases. 

27According to SSA officials, the agency’s MADAM databases accept traffic during this 

down time, even if the data processing systems themselves are unavailable. These data 

requests are held, then processed when the systems become available. In this regard, the 

legacy database environment is available 24 hours a day, 7 days a week, but is not able to 

complete data processing transactions during maintenance down time. 

Page 20 GAO-09-966 Information Technology
 

that is intended to better enable online, real-time access to data processing 

services. 

Further, SSA has recently built a new data center to provide expanded 

data processing capacity in addition to that provided by its National 

Computer Center. The agency also has plans to replace the 30-year-old 

National Computer Center to, according to SSA officials, provide more 

efficient and economical processing capabilities and support growing 

requirements of a full-time electronic service delivery operation.28 By 

taking these steps to modernize its agencywide IT infrastructure, including 

components that support data exchange programs, SSA is aiming to 

provide the computing capabilities needed to support increasing and 

future demands for electronic data exchange services. 

SSA’s IT strategic plan reflects the priorities that are intended to guide the 

agency’s operational and tactical IT planning through fiscal year 2012.29

Regarding data exchanges, the plan discusses an agency initiative that is 

intended to study various data exchanges and ways to allow partners to 

link more efficiently to the agency’s systems. Also, the agency’s IT vision 

document30 describes plans to replace various methods of sharing data 

with an easy-to-use, Web-based portal that provides data to partners 

through a menu-driven system, along with a plan to use a single 

registration process and a secure, controlled environment that ensures 

data are protected. The vision document identifies as a key initiative the 

need to maintain a robust data exchange architecture that fully supports 

the growing demand for information sharing. 

Even as SSA proceeds with planned updates to its IT infrastructure, the 

agency has not fully implemented IT management practices that are 

essential to help guide its direction related to data exchanges. Sound 

management practices require organizations to perform the necessary 

planning for investments to ensure that they effectively support current 

and future business needs, such as a more demanding data exchange 

 

28Provisions of the American Recovery and Reinvestment Act of 2009 made available $500 

million for SSA’s replacement of the National Computer Center and for associated IT costs. 

29Social Security Administration, Social Security Information Resources Management 

Strategic Plan, Fiscal Year 2007.

30Social Security Administration, Information Technology Vision: 2009–2014. 

Page 21 GAO-09-966 Information Technology
 

environment.31 In planning for future business operations, agencies should 

also, among other things, project their programs’ anticipated workloads, 

such as increases in data requests and transaction volumes—information 

that is essential for making informed decisions concerning workload 

management and the technological solutions needed to sustain efficient 

and effective performance in the future.32 Further, this information can 

provide critical input to the agency’s planning efforts, including the 

development of a target architecture. 

Nevertheless, according to agency officials, SSA has not conducted 

detailed analyses to project future workload requirements resulting from 

the increasing demand and expanded need for outgoing electronic data 

exchanges. Specifically, the agency has not projected increases in the 

number of requests for data or the need for more online, real-time access 

to its data exchange systems. The agency’s Director of the Division of 

Information, Verification and Exchange Services and the Director of the 

Office of Systems Security Operations Management maintain that the 

agency’s tactical plans for delivering electronic services will be sufficient 

to address future needs for data exchanges. However, these plans have not 

yet been developed. Further, while the agency’s strategic direction and 

vision for its data exchange environment are important, they do not 

substitute for the more detailed analysis that is essential to identifying the 

specific business and technical requirements for its data exchange 

programs and partners. 

Moreover, in the absence of such detailed analysis, SSA cannot be assured 

that it will achieve the robust data exchange architecture that it envisions. 

According to federal guidance, an agency should develop an enterprise 

architecture, or modernization blueprint, that describes in both business 

and technology terms how it operates today and how it intends to operate 

and support projected needs in the future—that is, its target architecture.33

Federal guidance states that enterprise architectures should identify the 

data that are to be exchanged, the frequency and nature of the exchanges, 

 

31OMB Circular No. A-130 and Planning, Budgeting, Acquisition, and Management of 

Capital Assets, Circular No. A-11, Part 7 (Washington, D.C.: July 2003). 

32GAO, Assessing Risks and Returns: A Guide for Evaluating Federal Agencies’ IT 

Investment Decision-making, GAO/AIMD-10.1.13 (Washington, D.C.: February 1997); 

Software Engineering Institute, CMMI for Services, Version 1.2.

33OMB Circular A-130. 

Page 22 GAO-09-966 Information Technology
 

and the business processes supported by the data exchanges.34 For SSA to 

ensure that its target architecture provides for a future IT infrastructure 

that will support its expanding data exchange environment, the agency 

should conduct the analyses needed to project the numbers of data 

exchange transactions along with the frequency and nature of the data 

exchanges (that is, whether the transactions are batch or online, and how 

frequently they will be conducted) expected from its partners in the 

future. 

Agency officials have recognized the need for a target architecture that 

addresses requirements for data exchanges. For example, in 2008, an SSA 

workgroup conducted an analysis to address management and technical 

issues related to its data exchanges, which was intended to support 

planning for its growing data exchange program.35 Among other things, the 

workgroup recommended to the Commissioner of Social Security that the 

agency devote sufficient resources to develop a well-defined target 

architecture that is sufficiently scalable to meet the agency’s future needs 

for supporting data exchanges.36

However, while SSA has developed a target architecture describing 

applications and service components that are used to support the agency’s 

business operations, according to the Directors of the Division of 

Information, Verification and Exchange Services, and of the Office of 

Strategic Services, the agency has not developed a target architecture that 

addresses specific business and technical requirements for supporting the 

 

34Management of Federal Information Resources; DOD Architecture Framework, Version 

1.5, Volume II (Apr. 23, 2007). 

35This activity, called the Electronic Information Exchange Initiative, resulted in a report 

issued in September 2008, that included recommendations intended to help address 

challenges related to data exchange management and systems-related issues. Among other 

things, the workgroup found that there was no clear direction regarding the 

implementation of new technologies within the existing or a future data exchange 

environment, and that the agency did not have a clearly stated target architecture for data 

exchanges. 

36Although the Commissioner stated in December 2008 that the agency had established 

milestones for acting on these recommendations (the statement was in response to our 

recommendation that the Commissioner act on the Electronic Information Exchange 

Initiative recommendations; GAO-09-126), the agency’s Director of the Division of 

Information, Verification and Exchange Services recently stated that while the EIEI report 

provided a significant amount of information pertaining to SSA’s electronic data exchange 

activities, the recommendations no longer reflected the agency’s current position. The 

official told us that the recommendations are being reassessed to determine which ones are 

viable in the agency’s current and future operating environments. 

Page 23 GAO-09-966 Information Technology
 

agency’s data exchange programs. Moreover, these directors stated that 

the current agencywide target architecture does not specifically address 

data exchanges with external organizations. 

Lacking sound projections of future workloads, SSA will not be able to 

clearly define specific requirements for meeting the increasing demands 

on its data exchange environment. Moreover, without a target architecture 

that addresses specific requirements for supporting the agency’s data 

exchange programs, the agency cannot be assured that its IT 

infrastructure will provide the resources and levels of service required to 

meet the future needs of its data exchange partners. Consequently, SSA’s 

ability to continue to effectively and efficiently support its partners’ future 

needs for electronic data exchange services could be jeopardized. 

SSA’s existing IT infrastructure effectively supports its current outgoing 

electronic data exchange environment and provides the agency’s partners 

with data that support and enhance their abilities to carry out business 

operations. The state and federal partners included in our study 

experienced few or no problems associated with the agency’s IT 

infrastructure. However, the agency and its partners anticipate that the 

demand for these exchanges will grow, and that the methods for 

conducting the exchanges will become more complex. Nonetheless, SSA 

has not performed the detailed analyses needed to project the workload 

and performance requirements of a future data exchange environment. 

While it has defined an agencywide target architecture, this architecture 

does not address specific business and technical requirements for 

supporting the agency’s data exchange programs. Until it conducts these 

analyses, the agency will lack information essential to developing a target 

architecture for an IT infrastructure that effectively supports the ability of 

data exchange partners to carry out their business operations in the 

future. 

To help ensure that SSA’s IT infrastructure effectively supports the 

anticipated increase in demand for electronic data exchange services, we 

recommend that the Commissioner of Social Security direct the Associate 

Commissioner, Office of Earnings, Enumeration and Administrative 

Systems to 

Conclusions 

Recommendations for 

Executive Action 

• conduct detailed analyses to determine workload projections and define 

requirements for effectively and efficiently delivering data exchange 

services to the agency’s partners in the future and 

Page 24 GAO-09-966 Information Technology
 

• use the results of these analyses to update the agency’s target architecture 

to address business and technical requirements of a future data exchange 

environment. 

The Commissioner of Social Security provided written comments on a 

draft of this report. In the comments, the agency agreed with our 

recommendations and stated that it would conduct detailed analyses to 

determine workload projections and define future requirements for 

delivering data exchange services as funding is available. Further, the 

Commissioner stated that it would use the results of the analyses to 

update the agency’s target architecture to ensure that it addresses the 

business and technical requirements of a future data exchange 

environment. If these actions are taken, the agency should be better 

positioned to meet the growing needs of its data exchange partners. 

Agency Comments 

and Our Evaluation 

SSA also provided technical comments, which we have incorporated into 

the report as appropriate. The agency’s written comments are reproduced 

in appendix II. 

As agreed with your office, unless you publicly announce its contents 

earlier, we plan no further distribution of this report until 30 days from the 

date of this letter. At that time, we will send copies of the report to 

interested congressional committees, the Commissioner of Social Security, 

and other interested parties. This report will also be available at no charge 

on our Web site at http://www.gao.gov. 

Page 25 GAO-09-966 Information Technology
 

Should you or your staff have questions on matters discussed in this 

report, please contact me at (202) 512-6304 or melvinv@gao.gov. Contact 

points for our Offices of Congressional Relations and Public Affairs may 

be found on the last page of this report. GAO staff who made major 

contributions to this report are listed in appendix III. 

Sincerely yours, 

Valerie C. Melvin 

Director, Information Management 

 Human Capital Issues 

Page 26 GAO-09-966 Information Technology
Appendix I: Objectives, Scope, and 

Methodology 

Page 27 GAO-09-966 

Appendix I: Objectives, Scope, and 

Methodology 

Our objectives were to (1) determine the extent to which the Social 

Security Administration’s (SSA) information technology (IT) infrastructure 

effectively and efficiently supports its current data exchange programs, 

and describe any systems-related problems affecting the agency’s data 

exchange partners and (2) describe SSA’s efforts to ensure that its IT 

infrastructure can support the agency’s and its partners’ future data 

exchange environment. 

To address both of these objectives, we focused our study on SSA’s data 

exchanges that provide information to support state and other federal 

agencies’ programs, and that affect partners’ abilities to provide services 

to individuals—that is, “outgoing” data exchanges.1

 To determine whether 

SSA’s existing IT infrastructure is effective in supporting the agency’s data 

exchange programs, we first identified the components of the 

infrastructure that support the agency’s data exchange programs. To do 

this, we obtained and analyzed agency documentation, such as internal 

management reports; spreadsheets describing data exchange programs, 

partners, and systems; descriptions of systems development and IT 

management processes; and descriptions of IT infrastructure components. 

To assess the reliability of the data provided by SSA, we held discussions 

with agency officials who were knowledgeable about the agency’s data 

exchange infrastructure and determined that the data were sufficiently 

reliable for the purposes of our engagement. 

From our assessment of this information, we identified and selected 

systems that are key to enabling the exchange of electronic data—that is, 

those that support the largest number of outgoing data exchanges, are 

used by the most partners, and process the largest number of data 

requests. We verified our selection through discussions with the Director, 

Division of Information, Verification and Exchange Services. We held 

discussions with additional agency officials, including the Associate 

Commissioner, Office of Earnings, Enumeration and Administrative 

Systems; Associate Commissioner, Office of Systems, Electronic Services; 

Assistant Associate Commissioner, Office of Telecommunications and 

Systems Operations; Director, Office of Systems Security Operations 

Management; Director, Office of Electronic Information Exchange; and 

Director, Office of Strategic Services. We also reviewed documentation 

describing the agency’s plans to make improvements to its IT 

 

1

SSA also provides data, such as Social Security Number verification, to other external 

entities, such as private companies. The scope of our work did not include those partners. 

 Information Technology 
Appendix I: Objectives, Scope, and 

Methodology 

infrastructure and discussed these plans with agency officials. 

Additionally, we interviewed state and federal data exchange partners to 

obtain their views on the ability of SSA’s IT infrastructure to provide data 

that support their business operations. 

To determine the extent to which systems-related problems exist and 

affect SSA’s data exchange partners and their ability to carry out business 

operations, and how the agency resolves these problems, we selected and 

obtained the views of partners from multiple agencies in five states, a 

third-party consortium that represents states and territories that 

participate in two of SSA’s data exchange programs, and four federal 

agency partners. Together, these state and federal partners represented 

24 programs that are supported by SSA’s data exchanges. Our criteria and 

methodology for selecting these partners are described later in this 

appendix. We discussed with these partners their experiences with SSA’s 

data exchanges, including the extent to which their ability to conduct 

business operations are affected by systems-related problems associated 

with the agency’s IT infrastructure. We reviewed and assessed 

documentation provided to us that described the types of systems-related 

problems that partners encountered in exchanging data. We also 

interviewed two SSA regional office data exchange coordinators to discuss 

any systems-related problems identified or reported to them by the 

partners they support, and to obtain information about programs that 

together fully utilize the IT infrastructure components that support the 

data exchange environment. 

To describe SSA’s efforts to ensure that its IT infrastructure can support 

the agency’s and its partners’ future data exchange environment, we held 

discussions with the agency officials and state and federal partners that 

we have previously described and examined data provided by SSA that 

illustrated increased transaction volume from 2007 to 2008. We also 

obtained and reviewed documentation that described increased requests 

for online access to certain data exchange systems over the past 24 

months. Additionally, we reviewed relevant SSA strategic planning 

documents, including its IT strategic plan and vision document to identify 

plans related specifically to data exchanges.2

 We assessed these plans to 

identify activities specifically related to data exchanges and to determine 

the extent to which they addressed projected data exchange workloads 

 

2

Social Security Administration, Social Security Information Resources Management 

Strategic Plan, Fiscal Year 2007; and Information Technology Vision, 2009–2014.

Page 28 GAO-09-966 Information Technology
Appendix I: Objectives, Scope, and 

Methodology 

and the IT resource requirements for efficiently and effectively supporting 

future requirements. In addition, we interviewed SSA officials and data 

exchange stakeholders familiar with the agency’s data exchange programs 

to identify the agency’s plans for addressing future data exchange 

workloads, including ensuring that its IT infrastructure can adequately 

support future demands for outgoing data exchanges to other federal and 

state agencies. 

We confirmed the information gathered from SSA’s regional data exchange 

coordinators and systems officials by corroborating it with selected other 

state and federal exchange partners. We determined that the information 

gathered was sufficiently reliable for the purposes of our review. Further, 

at the conclusion of our study in September 2009, we validated the 

examples of state and federal agencies’ experiences with SSA’s data 

exchanges with officials from those agencies. 

To select state and federal data exchange partners for this study, we 

identified a nonprobability sample based on our review of information 

provided by agency officials that listed and described all of the data 

exchange programs supported by SSA. From the list provided by the 

agency, we identified 814 outgoing data exchanges—those through which 

SSA provides data to state and other federal agencies. Of these exchanges, 

we identified 663 that provide SSA data to agencies in all 50 states, the 

District of Columbia, and 4 territories (American Samoa, American Virgin 

Islands, Guam, and Puerto Rico), and 83 that provide data to 16 federal 

agencies. 

Method for Selecting 

Data Exchange 

Partners 

From the 50 states, we selected 5 states based on the number of SSA data 

exchange programs in which they participate and the types of state 

programs the exchanges support (e.g., driver’s license issuance, voter 

registration, unemployment benefits administration, social services 

administration, and other programs). In selecting the 5 states, we 

identified 2 states that participated in the most data exchanges, 1 state that 

participated in a intermediate number of exchanges, and 2 states that 

participated in the fewest data exchanges. 

• The 2 states participating in the most data exchanges were New York and 

California (25 and 19 data exchanges, respectively). 

• The 1 state we selected with the intermediate number of data exchanges 

was Idaho (12 data exchanges). 

Page 29 GAO-09-966 Information Technology
Appendix I: Objectives, Scope, and 

Methodology 

• The 2 states participating in the fewest data exchanges were North 

Carolina and Iowa (10 and 9 data exchanges, respectively). 

We held discussions with officials from each of the states’ agencies that 

receive data through SSA’s data exchange programs to obtain information 

about any systems-related problems they may have experienced and the 

actions taken by SSA to resolve problems. Table 6 shows the states and 

agencies within those states that we contacted. 

Table 6: States and Agencies That We Contacted 

States Agencies 

New York Six programs under the Office of Temporary and 

Disability Assistance: 

• Family Assistance 

• Emergency Assistance to Families 

• Home Energy Assistance 

• Food Stamps 

• Temporary Assistance to Needy Families 

• Medicaid 

California State Controller’s Office 

Employment Development Department 

Franchise Tax Board 

Health Care Services 

Social Services 

Board of Equalization 

Department of Motor Vehicles 

Child Support Services 

Iowa Department of Human Services 

Department of Transportation 

North Carolina Board of Elections 

Employment Security Commission 

Idaho Department of Motor Vehicles 

Department of Labor 

Department of Human Services 

Source: GAO. 

We also held discussions with SSA’s major stakeholder user group 

organization—the American Association of Motor Vehicle Administrators 

(AAMVA)—which provides data exchange support to state driver’s 

licensing administrations and supports voter registration through the Help 

America Vote Verification system. We contacted chief information officers 

from each of the five selected states and AAMVA to obtain contact 

Page 30 GAO-09-966 Information Technology
Appendix I: Objectives, Scope, and 

Methodology 

information for the officials responsible for the programs and systems that 

receive electronic data through participation in SSA’s data exchange 

programs. 

We based our selection of federal data exchange partners on the scope 

and impact of the agencies’ programs supported by SSA’s data exchanges 

on the country’s population, including veterans’ programs beneficiaries, 

government and private employers, U.S. passport holders and applicants, 

U.S. tax filers, and Medicare beneficiaries. We held discussions with 

agency officials regarding the following federal programs to obtain 

information about their experiences with SSA’s data exchange programs 

and the systems that support them: 

• the Department of Veteran Affairs, Veterans Benefits Administration’s 

benefits and insurance programs, and the Veterans Health Administration 

health care administration program; 

• the Department of Homeland Security employment eligibility program; 

• the Department of State’s passport verification and foreign service retiree 

benefit payment programs; and 

• the Department of Health and Human Services, Centers for Medicare and 

Medicaid Services’ Medicare benefits administration program. 

Since we selected a nonprobability sample, the information obtained 

through discussions with the selected state and federal data exchange 

partners is not generalizable across the entire population of SSA’s data 

exchange partners. 

Page 31 GAO-09-966 Information Technology
Appendix II: Comments from the Social Appendix II: Comments from the Social Security Administration 

Security Administration 

Page 32 GAO-09-966 Information Technology 
Appendix II: Comments from the Social 

Security Administration 

Page 33 GAO-09-966 Information Technology
Appendix III: GAO

A

 Contact and Staff 

cknowledgments 

Page 34 GAO-09-966 

Appendix III: GAO Contact and Staff 

Acknowledgments 

Valerie C. Melvin, (202) 512-6304 or melvinv@gao.gov

In addition to the contact named above, key contributions to this report 

were also made by Teresa F. Tucker, Assistant Director; Michael A. 

Alexander; Tonia B. Brown; Barbara S. Collier; Rebecca E. Eyler; Neil J. 

Doherty; Nancy E. Glover; Jacquelyn K. Mai; Lee A. McCracken; Thomas E. 

Murphy; Madhav S. Panwar; and Brandon S. Pettis. 

 Information Technology 

GAO Contact 

Staff 

Acknowledgments 

(310932) 
GAO’s Mission The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday afternoon, GAO 

posts on its Web site newly released reports, testimony, and 

correspondence. To have GAO e-mail you a list of newly posted products, 

go to www.gao.gov and select “E-mail Updates.” 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s Web site, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information. 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, DC 20548 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548 

Public Affairs 

Please Print on Recycled Paper