U.S. RAILROAD RETIREMENT BOARD

OFFICE OF INSPECTOR GENERAL 

The Implementation of the 

Disability Program Improvement 

Plan at the Railroad Retirement 

Board Did Not Result in a Fully 

Established Fraud Risk 

Assessment Process

Report No. 19-15 September 27, 2019
OFFICE OF INSPECTOR GENERAL 

U.S. RAILROAD RETIREMENT BOARD

The Implementation of the Disability Program Improvement Plan 

at the Railroad Retirement Board Did Not Result in a Fully 

Established Fraud Risk Assessment Process

Report Summary September 27, 2019 Report No. 19-15

What DP George & Company Found

DP George & Company (DP George) determined that the 

implementation of the Disability Program Improvement Plan

(DPIP) and other related program improvements did not result 

in a fully established fraud risk assessment process that is 

specific to the Railroad Retirement Board’s (RRB) disability 

programs. Specifically, the actions taken did not: 1) establish a 

dedicated entity within the RRB to lead the fraud risk 

management process; 2) establish an ongoing fraud risk 

assessment process tailored to the disability programs that 

routinely determines and updates the fraud risk profile for the 

programs; and 3) establish an on-going fraud risk monitoring 

process to evaluate the effectiveness of corrective actions and 

identify new risks.

What DP George Recommends

To address the weaknesses identified in this audit, DP George 

made three recommendations. The first recommendation was

to establish a permanent entity within RRB responsible for 

continuously assessing fraud risk, implementing corrective 

actions, and monitoring the effectiveness of those actions as 

they relate to the RRB disability program. The second

recommendation was to establish an on-going fraud risk 

assessment process that regularly gathers information about 

disability program fraud risk, assesses the potential likelihood 

and impact, determines fraud risk tolerance, examines the 

suitability of existing fraud and documents the fraud risk 

profile. The third recommendation was to conduct risk-based 

monitoring tied to the fraud risk profile of the disability 

program to evaluate the effectiveness of preventive activities 

and use the results to improve the design and implementation 

of fraud risk management activities within the disability 

program.

RRB management concurred with the three recommendations,

but stated that they do not have the authority to take these 

actions. As such, these recommendations will be forwarded to 

the RRB Board for consideration.

What We Did

The Office of Inspector General (OIG) 

for the RRB engaged DP George to 

conduct a performance audit to assess 

the implementation of RRB’s DPIP.

This audit was conducted in 

accordance with the performance 

audit standards established by 

Generally Accepted Government 

Auditing Standards. DP George is 

responsible for the audit report and 

the conclusions expressed therein. 

RRB OIG does not express any 

assurance on the conclusions 

presented in DP George’s audit report.

The objective was to assess RRB’s 

implementation of its DPIP and other 

related program integrity 

improvements to determine the 

efficiency and effectiveness of actions 

taken to prevent future fraud and 

abuse in RRB’s disability programs. In 

order to complete this work, DP 

George identified criteria in laws, 

regulations, and best practices;

identified applicable RRB policies, 

procedures; and obtained and 

reviewed RRB’s DPIP. DP George also 

interviewed applicable agency staff, 

and determined actions taken to 

implement the DPIP & other related 

improvements.

The scope of our audit covered 

actions taken in response to the DPIP 

and other related program integrity 

through September 2018.
The Implementation of the 

Disability Program 

Improvement Plan at the

Railroad Retirement Board 

Did not Result in a Fully 

Established Fraud Risk 

Assessment Process

 

 
TABLE OF CONTENTS

Executive Summary ......................................................................................................................... 1

Objective(s), Scope, and Methodology ........................................................................................... 2

Background...................................................................................................................................... 2

Audit Results.................................................................................................................................... 3

Finding #1: No Dedicated Entity to Lead Fraud Risk Management ............................. 3

Finding #2: Insufficient Fraud Risk Assessment Process ............................................... 4

Appendix I: Management Comments ............................................................................................. 6
1

EXECUTIVE SUMMARY

September 25, 2019

Mr. Martin Dickman, Inspector General

Railroad Retirement Board

Office of Inspector General

844 North Rush Street

Chicago, IL 60611-1275

Dear Mr. Dickman,

DP George & Company, LLC (DPG) audited the implementation of the Railroad Retirement Board (RRB) Disability 

Program Improvement Plan (DPIP) and related program integrity improvements against relevant RRB policies 

and procedures, internal control guidance, and GAO’s A Framework for Managing Fraud Risks in Federal 

Programs. Performance against these criteria is the responsibility of RRB’s management. DPG’s responsibility is 

to make a determination regarding RRB’s performance against the criteria.

DPG conducted the audit in accordance with Generally Accepted Government Auditing Standards (GAGAS) 

issued by the Comptroller General of the United States (2011 Revision, as amended). Those standards require 

that DPG plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for 

its findings, conclusions, and recommendations based on the audit objective. The stated objective for our audit 

was to:

Assess RRB’s implementation of the DPIP and other related program integrity improvements to 

determine the efficiency and effectiveness of actions taken to prevent future fraud and abuse in RRB’s 

disability programs.

The evidence obtained provides a reasonable basis for DPG’s findings, conclusions, and recommendations based 

on the audit objectives.

Based on the test work performed, our audit determined that the implementation of the DPIP and other related 

program improvements did not result in a fully established fraud risk assessment process that is specific to the 

RRB’s disability programs. The detailed findings for the audit are presented in the Audit Results section of this 

report. 

We appreciate the cooperation and assistance extended by RRB and the OIG staff during the audit. 

Sincerely,

DP George & Company, LLC

Alexandria, Virginia
2

OBJECTIVE(S), SCOPE, AND METHODOLOGY

The objective of the audit was to assess the Railroad retirement Board’s (RRB’s) implementation of its Disability 

Program Improvement Plan (DPIP) and other related program integrity improvements to determine the 

efficiency and effectiveness of actions taken to prevent future fraud and abuse in RRB’s disability programs.

To accomplish our objective, we:

• identified criteria provided in applicable laws, regulations, and best practices related to RRB’s 

disability program;

• identified and reviewed applicable RRB policies and procedures related to RRB’s disability programs;

• obtained and reviewed RRB’s DPIP and other related program integrity improvements;

• interviewed RRB management and disability staff;

• determined the actions taken to implement the DPIP and other related program integrity 

improvements; and 

• assessed the actions taken against the applicable criteria identified.

The scope of our audit covered actions taken in response to the DPIP and other related program integrity 

through September 2018.

We conducted this performance audit in accordance with GAGAS. Those standards require that we plan and 

perform the audit to obtain sufficient appropriate evidence to provide a reasonable basis for our findings, 

conclusions, and recommendations based on the audit objective. We believe that the evidence obtained 

provides a reasonable basis for our findings, conclusions, and recommendations based on our audit objective.

We conducted our fieldwork from October 2018 through August 2019. During our audit, we performed site visits 

to RRB headquarters in Chicago, Illinois in October 2018, April 2019, and June 2019.

BACKGROUND

The RRB administers the retirement, survivor, unemployment and sickness programs mandated by the Railroad 

Retirement Act (RRA) and the Railroad Unemployment Insurance Act (RUIA). The RRA provides for payment of 

retirement benefits based on age and service in the railroad industry and to those who are permanently 

disabled from work in their regular railroad occupation or who are totally disabled from any regular 

employment.

Beginning in late 2011, the Department of Justice issued several indictments in a physician assisted disability 

benefit fraud scheme involving former employees of the Long Island Railroad (LIRR). As a result of the LIRR 

investigation and a combination of related or similar audit reports and letters issued by the RRB Inspector 

General (IG) and the General Accountability Office (GAO), multiple recommended corrective actions were 

presented to RRB management concerning the RRB disability programs. As a means of summarizing the adopted 

corrective actions, the Fraud Prevention Task Force developed the DPIP. The original plan identified the five 

sources that led to the corrective actions and provided a summary for each of the 17 adopted improvements. 

Eventually, the plan increased to 18 improvements and was converted into a tracking matrix identifying subtasks related to each overall improvement, the projected and actual completion dates for the tasks, and the 

owner of each task. The Fraud Prevention task Force met on a regular basis to review and manage completion of 

the corrective actions. In September 2018, the last of the identified sub-tasks within the DPIP was completed. 
3

AUDIT RESULTS

Our audit determined that the actions taken as a result of the DPIP were not fully effective in establishing a risk 

based approach to prevent future fraud and abuse in RRB’s disability programs. Specifically, the actions taken 

did not, 1) establish a dedicated entity within RRB to the lead the fraud risk management process; 2) establish a 

fraud risk assessment process tailored to the disability programs that routinely determines and updates the 

fraud risk profile for the programs; and 3) establish an on-going fraud risk monitoring process to evaluate the 

effectiveness of corrective actions and identify new risks.

We provide three recommendations aimed at addressing these weaknesses.

Finding #1: No Dedicated Entity to Lead Fraud Risk Management

The actions taken as a result of the DPIP did not establish a dedicated entity to lead fraud risk management.

While the Fraud Risk Detection Task Force managed the corrective actions identified in the DPIP to 

implementation, it was not established as a permanent entity with responsibility for continuously assessing 

fraud risk, implementing corresponding corrective actions, and monitoring the effectiveness of those actions. 

The Fraud Risk Task force is not currently meeting and there is no clearly established entity in place to 

specifically assess and monitor fraud risk.

The Standards for Internal Control in the Federal Government require management to assess fraud risk to 

consider the types of fraud that can occur within the entity, identify potential fraud risk, and develop responses 

so that fraud risks are effectively mitigated. 

The GAO document A Framework for Managing Fraud Risks in Federal Programs also establishes leading 

practices for fraud risk management. Leading Practice 1.2 provides that agencies should designate an entity to 

design and oversee fraud risk management activities that:

• understands the program and its operations, as well as the fraud risks and controls throughout the 

program;

• has defined responsibilities and the necessary authority across the program;

• has a direct reporting line to senior-level managers within the agency; and 

• is located with the agency and not the Office of the Inspector General, so the latter can retain its 

independence to serve its oversight role.

In carrying out its role, the antifraud entity, among other things:

• serves as the repository of knowledge on fraud risks and controls;

• manages the fraud risk-assessment process;

• leads or assists with trainings and other fraud-awareness activities; and 

• coordinates antifraud initiatives across the program.

The lack of a designated entity to manage the fraud risk assessment and monitoring process increases the risk 

that new fraud risks arise or existing fraud risks are not addressed appropriately within the RRB Disability 

Programs. 
4

RECOMMENDATION

We recommend that the Office of Programs in coordination with the Railroad Retirement Board (RRB) Executive

Committee:

1. establish a permanent entity within RRB responsible for continuously assessing fraud risk, 

implementing corrective actions, and monitoring the effectiveness of those actions as they relate to 

the RRB disability programs. There are two existing entities, the Fraud Prevention Task Force and 

the Internal Controls Assessment Team that could be considered for this designation.

MANAGEMENT’S COMMENTS 

The Office of Programs concurred with the recommendation. However, it indicated that it does not have the 

authority to take the recommended action and will forward the recommendation to the RRB Board for 

consideration.

DPG RESPONSE

The focus of our audit was on the efficiency and effectiveness of actions taken to prevent future fraud and abuse 

in RRB’s disability programs. We stress that the Office of Programs has primary responsibility for managing those 

programs and therefore, should take a proactive role in establishing a fraud risk assessment process that 

efficiently and effectively evaluates the potential for fraud to occur within the RRB disability programs.

Finding #2: Insufficient Fraud Risk Assessment Process

The actions taken as a result of the DPIP did not establish an on-going fraud risk assessment process that 

determines the fraud risk profile for the disability program and monitors the effectiveness of fraud risk 

prevention activities. Management documents control risks associated with its internal quality control function, 

the Program Evaluation and Management Services (PEMS) organization, and risks related to processing disability 

payments in a timely manner but not specifically risks related to internal or external fraud.

Performing a fraud risk assessment consists of, 1) identifying risks and defining risk tolerances (as applicable); 2) 

defining control objectives that align to each risk; and 3) analyzing risks that could prevent achieving the control 

objectives. The risk assessment then provides a basis for responding to the risks identified.

The Standards for Internal Control in the Federal Government state that management should define objectives 

clearly to enable the identification of risks and define risk tolerances. Additionally, management should identify, 

analyze, and respond to risks related to achieving the defined objectives. These standards also require 

management to assess fraud risk to consider the types of fraud that can occur within the entity, identify 

potential fraud risk, and develop responses so that fraud risks are effectively mitigated.

The GAO document A Framework for Managing Fraud Risks in Federal Programs also establishes leading 

practices for fraud risk management. Leading Practice 2.1 provides that management should plan regular fraud 

risk assessments that are tailored to the program while Leading Practice 2.2 establishes that management 

should identify and assess risks to determine the program’s fraud risk profile. Leading Practice 4.1 provides 

guidance on conducting risk-based monitoring and evaluating the components of the fraud risk framework. 

Without a sufficient risk assessment, the RRB lacks assurance that it has the right controls in place to effectively 

prevent and detect fraud in its disability program and continues to expose the program to fraud risks. We noted 

for instance that DPIP corrective action #18 to install a permanent Chief Medical Officer was implemented 

initially but the position has now been vacant since 2017. We also noted that the Anti-Fraud Assessment report 

prepared in response to corrective action #13 contained multiple recommendations with respect to improving 
5

the culture of fraud within RRB and establishing stronger preventive controls within the risk process that could 

be implemented over a multi-year period. However, there is no monitoring on the part of the RRB to indicate if 

the recommendations have been implemented and if not, why. These are examples of new or continuing fraud 

risks that should be included and monitored through an RRB fraud risk profile.

RECOMMENDATIONS

We recommend that Office of Programs in coordination with the Railroad Retirement Board Executive

Committee:

2. establish an on-going fraud risk assessment process that regularly gathers information about 

disability programs fraud risk, assesses the potential likelihood and impact, determines fraud risk 

tolerance, examines the suitability of existing fraud and documents the fraud risk profile specifically 

for the disability programs; and

3. conduct risk-based monitoring tied to the fraud risk profile of the disability programs to evaluate the 

effectiveness of preventive activities and use the results to improve the design and implementation 

of fraud risk management activities within the disability programs.

MANAGEMENT COMMENTS

The Office of Programs concurred with the recommendations. However, it indicated that it does not have the 

authority to take the recommended actions and will forward the recommendations to the RRB Board for 

consideration.

DPG RESPONSE

The focus of our audit was on the efficiency and effectiveness of actions taken to prevent future fraud and abuse 

in RRB’s disability programs. We stress that the Office of Programs has primary responsibility for managing those 

programs and therefore, should take a proactive role in establishing a fraud risk assessment process that 

efficiently and effectively evaluates the potential for fraud to occur within the RRB disability programs.
6

APPENDIX I: MANAGEMENT COMMENTS
7