U.S. RAILROAD RETIREMENT BOARD

OFFICE OF INSPECTOR GENERAL 

Management Information Report

Management and Performance Challenges 

Facing the Railroad Retirement Board for 

Fiscal Year 2020

Report No. 21-02 December 3, 2020
OFFICE OF INSPECTOR GENERAL

U.S. RAILROAD RETIREMENT BOARD

Management Information Report -

Management and Performance Challenges

Facing the Railroad Retirement Board for Fiscal Year 2020

Report Summary December 3, 2020 Report No. 21-02

What We Found

The Reports Consolidation Act of 2000 and Office of 

Management and Budget (OMB) Circular A- 136 require the 

Inspectors General to identify what they consider the most 

serious management challenges facing its respective agency and 

briefly assess the agency's progress in addressing these 

challenges.

We present the following six major management and 

performance challenges facing the RRB:

Improve Agency Disability Program Integrity

Improve Information Technology Security and Complete 

System Modernization

Improve Management of Railroad Medicare

Improve Payment Accuracy and Transparency

Financial Management and Reporting Issues

Compliance Concerns Identified

Management’s Comments and Our 

Response

RRB provided written comments, which are reprinted in 

Appendix B. While RRB management provided comments and 

disagreements with some of the challenges we identified, our 

assessment of the major challenges facing RRB remains

unchanged.

What We Did

Our identification of management 

challenges facing the Railroad 

Retirement Board (RRB) is based 

on recent audits, evaluations, 

investigations, and current issues 

of concern to the Office of 

Inspector General (OIG). RRB OIG 

identified six major management 

challenges facing RRB during fiscal 

year 2020.

We previously provided these 

management challenges to the RRB

for inclusion in its fiscal year 2020

Performance and Accountability 

Report. 

Objective and Scope

Our objective was to identify and 

assess the most serious challenges 

facing RRB management during

fiscal year 2020.
OFFICE OF INSPECTOR GENERAL – U.S. RAILROAD RETIREMENT BOARD 

 

Contents

INTRODUCTION 1

MANAGEMENT’S COMMENTS AND OUR RESPONSE 1

CHALLENGE 1 – IMPROVE AGENCY DISABILITY PROGRAM INTEGRITY 3

CHALLENGE 2 – IMPROVE INFORMATION TECHNOLOGY SECURITY AND COMPLETE SYSTEM 

MODERNIZATION 5

CHALLENGE 3 – IMPROVE MANAGEMENT OF RAILROAD MEDICARE 6

CHALLENGE 4 – IMPROVE PAYMENT ACCURACY AND TRANSPARENCY 8

CHALLENGE 5 – FINANCIAL MANAGEMENT AND REPORTING ISSUES 10

CHALLENGE 6 – COMPLIANCE CONCERNS IDENTIFIED 13

APPENDIX A: AUDIT REPORTS 15

APPENDIX B: MANAGEMENT COMMENTS 18
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 1

INTRODUCTION

The Reports Consolidation Act of 2000 and Office of Management and Budget (OMB) Circular A136 require the Inspectors General to identify what they consider the most serious 

management challenges facing their respective agency and briefly assess the agency's progress 

in addressing these challenges.

The Railroad Retirement Board (RRB) is an independent agency in the executive branch of the 

Federal Government. The RRB’s primary function is to administer comprehensive retirementsurvivor and unemployment-sickness benefit programs for the nation’s railroad workers and 

their families, under the Railroad Retirement and Railroad Unemployment Insurance Acts. As 

part of the retirement program, the RRB also has administrative responsibilities under the 

Social Security Act for certain benefit payments and railroad workers’ Medicare coverage. 

In fiscal year 2019, the RRB paid retirement-survivor benefits of nearly $13 billion to about 

535,000 beneficiaries. The RRB also paid net unemployment-sickness benefits of $88 million 

(including recoveries of about $100,000 in expired temporary extended unemployment benefits 

under the American Recovery and Reinvestment Act of 2009, the Worker, Homeownership, and 

Business Assistance Act of 2009, and subsequent reauthorizing legislation) to about 23,000 

claimants.

This year's management challenges are:

 Improve Agency Disability Program Integrity 

 Improve Information Technology Security and Complete System Modernization

 Improve Management of Railroad Medicare 

 Improve Payment Accuracy and Transparency 

 Financial Management and Reporting Issues 

 Compliance Concerns Identified 

The challenges this year include items relating to prior Office of Inspector General (OIG) 

concerns or those identified in prior audits, the President’s Management Agenda, and areas 

related to the RRB’s ability to meet its core mission. 

Management’s Comments and Our Response

These management challenges were provided to RRB for inclusion in its fiscal year 2020

Performance and Accountability Report. Subsequently, RRB management provided written 

comments, which are provided in Appendix B.

In its comments, RRB management acknowledged some of the challenges identified by OIG and 

disagreed with some of the concerns, indicating that they do not give rise to a serious 
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 2

management concern or challenge. RRB management described actions implemented, 

approaches taken, and improvements underway to improve the functions and operations of the 

agency to address the challenges identified. Some of the actions described by the RRB do not 

always meet the intent of OIG recommendations nor do they always address the weaknesses 

that remain. 

While RRB management provided comments and rebuttals, our assessment of the major 

challenges facing RRB remains unchanged. As responsible public stewards, RRB management 

must implement an effective control system to ensure that all agency programs are managed 

efficiently.
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 3

Challenge 1 – Improve Agency Disability Program Integrity

Why is this a serious management challenge? The OIG has been concerned about fraud and 

abuse in the disability program for many years and RRB management has not been receptive of 

our recommendations for corrective action. The Government Accountability Office (GAO) has 

also audited the RRB’s disability program and reported that “a nearly 100 percent approval rate 

in a federal disability program is troubling, and could indicate lax internal controls in RRB’s 

decision-making process, weakness in program design, or both.”1 The RRB’s approval rate for 

occupational disabilities was 97.54 percent during fiscal year 2019.

The RRB adjudicates and processes disability benefit payments to railroad employees in support 

of total and permanent and occupational disabilities. Occupational disabilities are awarded if a 

physical or mental impairment permanently disqualifies the railroad employee from performing 

his or her regular railroad occupation, even though the employee may be able to perform other 

types of work. 

During fiscal year 2019, the RRB paid approximately $643 million to 13,900 occupationally 

disabled annuitants. The average monthly occupational disability annuity was $3,266. 

Management has overall responsibility for establishing internal controls to manage the risk of 

fraud. Fraud can jeopardize an agency’s mission by diverting resources from their intended 

purpose. While the RRB previously had a Fraud Risk Detection Task Force, it was not established 

as a permanent entity with responsibility for continuously assessing fraud risk, implementing 

corresponding corrective actions, and monitoring the effectiveness of those actions. As a result, 

in September 2019, our contracted auditor determined that the actions taken as a result of the 

RRB’s Disability Program Improvement Plan (DPIP), were not fully effective in establishing a risk 

based approach to prevent future fraud and abuse in the RRB’s disability programs. Our 

contracted auditor issued three recommendations to: establish a dedicated entity within RRB to 

lead the fraud risk management process, establish a fraud risk assessment process specifically 

for disability programs to routinely determine and update the RRB’s fraud risk profile, and 

establish an ongoing fraud risk monitoring process to evaluate the effectiveness of corrective 

actions and identify new risks.

The Office of Programs concurred with the three recommendations to address these 

weaknesses, but indicated they did not have the authority to take the recommended actions 

and would forward them to the RRB Board. Although OIG has received correspondence 

indicating that the RRB established a Fraud Risk Assessment Committee (FRAC) in fiscal 

year 2020, the OIG has not received any requests to close these recommendations to date, and 

all three remain open.

In addition to the above contracted audit, OIG contracted two other disability program audits. 

For one of these audits, our contracted auditor determined that the RRB did not effectively 

consider fraud risk indicators in the disability decision process and provided three 

recommendations. For the other audit, our contracted auditor determined that RRB medical 

 1 Government Accountability Office (GAO), Railroad Retirement Board: Review of Commuter Railroad Occupational 

Disability Claims Reveals Potential Program Vulnerabilities, GAO-09-821R (Washington, D.C.: Sept. 9, 2009). 
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 4

experts did not always reach a consistent medical assessment based on the medical evidence, 

and provided two recommendations. RRB management did not concur with any of these 

recommendations. However, all five remain open because we continue to see the need for 

these improvements. 

Because these five recommendations, and many others from other reports remain open, the 

RRB’s disability program continues to be at risk of fraud and abuse. 

This paragraph, and the other paragraphs that follow, summarize some of the actions RRB 

management has taken to address its disability program and related performance. In response 

to our performance and management challenge related to disability program integrity outlined 

in the Fiscal Year 2019 Performance and Accountability Report (PAR), RRB management’s 

comments acknowledged the importance of identifying and mitigating fraud risk throughout 

the programs the agency administers. They discussed establishment of the FRAC whose 

purpose is to assess, and offer solutions to mitigate, fraud risk in the administration of all of the 

RRB’s programs, including the disability program.

In August 2020, the RRB issued a press release announcing the appointment of a Chief Medical 

Officer (CMO) who is to provide expert medical guidance to the RRB’s Office of Programs and 

train examiners on medical issues. During fiscal year 2020, the FRAC worked with the Board to 

initiate changes documented in Board Orders 20-23 and 20-37. The main change was to 

eliminate the mandatory use of specialist medical exams for some medical conditions, with 

additional specific requirements that included some reviews by RRB staff, contracted medical 

professionals, and the RRB’s CMO. The RRB stated that the policy change to eliminate the 

mandatory use of specialist medical exams for some medical conditions in initial disability 

adjudication will save time and money. While we acknowledge that this policy change would 

save time and money, OIG still remains concerned that the policy change could increase the risk 

of fraud, if the proposed compensating controls are not fully implemented. 

In the fiscal year 2019 PAR, RRB management stated that in 2018, the Disability Benefits 

Division (DBD) lost experienced disability staff due to promotions and reassignments to other 

types of work. They further stated that to assist in managing the increased workloads, DBD 

hired additional staff and a supervisor. However, RRB management also stated that it takes two 

to three years to acquire the knowledge and skills required for proficient adjudication, 

therefore, at the end of the fiscal year, more than half of the staff had less than one year of 

experience. In the Fiscal Year 2021 Budget Justification, RRB management acknowledged that 

currently only two initial survivor claims examiners have more than three years of experience 

and only two initial retirement claims examiners have more than five years of experience. 

In addition, RRB Management stated that the performance plan for goal II-A-7 is to pay or deny 

a disability benefit within 100 days of the date the application is filed, but in fiscal year 2019, 

this goal was met only 12.5 percent of the time. RRB Management also noted that a study was 

conducted that showed it takes about 245 days to make a disability decision, therefore, RRB is 

re-baselining the performance goal for this measure.
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 5

Although RRB management has taken some actions to address disability program and 

performance, many more improvements are needed, and the RRB’s disability program 

continues to be at risk for fraud and abuse.

Refer to Appendix A for a list of relevant reports for this challenge.

Challenge 2 – Improve Information Technology Security and Complete 

System Modernization

Why is this a serious management challenge? Improving cybersecurity and modernizing the 

RRB’s systems is vital to support the ability to meet its core mission. Managing cybersecurity 

risks is critical to improvement of the security posture of the federal networks and critical 

infrastructure. Executive Order 13800 emphasizes the importance of strengthening the 

cybersecurity of federal networks. In the Fiscal Year 2021 RRB Budget Justification, RRB 

acknowledged that they had a total committed/obligated cost of $13,894,709 as of 

January 21, 2020, towards alignment of the information technology (IT) initiatives to the 

proposed Phased RRB Transformation. The RRB Transformation Roadmap consists of three 

phases – Stabilize (fiscal years 2020-2021), Modernize (fiscal years 2021-2023), and Perform 

(fiscal years 2023- 2024). In its effort to complete the Stabilize phase and begin work in the 

Modernize phase, the agency is requesting $13,850,000 for fiscal year 2021 and plans to 

request $21,325,000 for fiscal years 2022 and 2023 to complete the Transformation.

RRB is required by the Federal Information System Modernization Act (FISMA) to report the 

status of its information security program to OMB and FISMA metrics to the Department of 

Homeland Security. An annual independent assessment of the agency’s IT program is 

performed for the cybersecurity of RRB networks and critical infrastructure. 

In the annual FISMA audits for fiscal years 2019 and 2018, the OIG’s contractor found that RRB 

did not comply with FISMA legislation and OMB guidance and that sampled security controls 

selected from National Institute of Science and Technology Special Publication 800-53, Rev.4 

demonstrated ineffectiveness, and thus the RRB’s Information Security Program (ISP) did not 

provide reasonable assurance of adequate security.

In fiscal year 2019, the OIG’s contractor determined that policies and procedures were not 

regularly updated and had not been developed for the majority of systems and controls, system 

owners and IT management failed to communicate with each other resulting in missing security 

controls and processes, and resource constraints had not been properly addressed through 

changes in IT strategy. The contractor also reported that the RRB’s ISP was not operating 

effectively, because the program’s overall maturity did not reach Level 4: Managed and 

Measurable. A total of 19 detailed recommendations were made to address these identified 

weaknesses. RRB management concurred with all of the recommendations. RRB management 

comments stated that the Chief Information Officer and the Chief Information Security Officer 

recognized that improvement was required to have an effective ISP. OIG has not received any 

requests to close any of these recommendations, thus all 19 remain open. For the fiscal 

year 2018 FISMA audit, although findings were consistent with prior FISMA audit results, RRB 

management disagreed with the conclusion that the RRB’s ISP was not providing adequate 
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 6

assurance of adequate security. The report included 31 recommendations for improvement. 

The RRB has implemented 8 of these recommendations and 23 remain open.

In the Fiscal Year 2019 PAR, RRB management stated that significant investment is essential to 

update the agency’s outdated IT systems, reduce cybersecurity risk, and sustain mission 

operations. They also stated that RRB’s Annual Performance Plan for fiscal year 2019 reflects 

one strategic objective that focuses on the specifics of achieving this goal of legacy systems 

modernization. Also in fiscal year 2019, the Chief Information Officer introduced an initiative 

called “On Track to Tomorrow.” The initiative is composed of several IT projects that are 

designed to help RRB improve efficiency of operations, adhere to governance, and provide 

increased value to the railroad community. In the fiscal year 2019 PAR, RRB stated that in fiscal 

year 2020, they will complete the re-platform of legacy mainframe applications currently 

developed using COBOL/CICS/DB2. In addition, the contract, which was to assess RRB’s core 

current businesses and develop a To-Be Blueprint for modernization, has been completed.

However OIG auditors were informed that the contract to complete the re-platform of legacy 

mainframe applications was terminated in September 2020 and that a replacement contract is 

not in place.

In the Fiscal Year 2021 Budget Justification Performance Plan, the RRB identified five new 

performance goals for RRB’s Transformation (formerly Legacy Systems Modernization), which 

are all related to the strategic goal to modernize IT operations that will sustain mission essential 

services.

In response to our concerns from the fiscal year 2019 PAR regarding improving the RRB’s IT 

security and system modernization, RRB management’s comments acknowledged the OIG’s 

concern to establish and maintain a secure and reliable IT environment for its data, 

applications, and systems. They stated that they intend to comply with FISMA, to ensure 

adequate security protections for federal information systems and information. RRB 

management anticipates that the cybersecurity posture of the agency will improve and be 

sustained at an acceptable level, as they continue with the development and implementation of 

the IT modernization initiatives. They also stated that the RRB will continue to make 

incremental steps to reach the overall maturity goal of Level 4 – Managed and Measurable. 

Refer to Appendix A for a list of relevant reports for this challenge.

Challenge 3 – Improve Management of Railroad Medicare

Why is this a serious management challenge? The Medicare topic is included on the 

President’s Management Agenda.

Under the Social Security Act, (see 42 U.S.C § 1842(g)) the RRB has the authority to administer 

certain aspects of the Medicare program for qualified railroad beneficiaries.

Some of these provisions include eligibility determination, enrollment or removal from 

enrollment, premium collection, processing state buy-ins, and selection of a contractor to 

process Medicare Part B claims. The RRB administers the Railroad Medicare (RM) program for 

railroad workers and, since 2000, has contracted with Palmetto GBA, LLC (Palmetto), to process 
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 7

Medicare Part B claims on behalf of RRB beneficiaries.2 Within the RRB, the Office of Programs 

(Programs) is responsible for quality assurance and contract oversight of the RM contract with 

Palmetto.

At the end of fiscal year 2019, approximately 465,500 qualified railroad retirement beneficiaries 

were enrolled in RM Part A, and approximately 446,300 were also enrolled in Medicare Part B. 

During fiscal year 2019, Palmetto processed more than 8.5 million RM claims, and made 

approximately $832 million in benefit payments for Part B medical services. The Centers for 

Medicare and Medicaid Services (CMS) transferred/reimbursed RRB for $32 million in RM 

program costs during fiscal year 2019. Of that amount, approximately $18.3 million was 

transferred to fund the RRB’s Specialty Medicare Administrative Contractor (SMAC), Palmetto, 

and $13.6 million was reimbursed for RRB expenses incurred for administering the program. In 

fiscal year 2018, the transfer was recorded as a reimbursement. Beginning fiscal year 2019, the 

amount transferred to fund the SMAC contract was recorded as a transfer rather than a 

reimbursement. This change was agreed to by CMS for intragovernmental reporting. 

Over the years, the OIG has disagreed with RRB as to which RM related responsibilities 

belonged to the RRB, Palmetto, or CMS. In response to our recent audits, agency management 

continued to state that the Medicare program should be treated as one program and that CMS 

is responsible for the overall program, including RM. 

In May 2020, an OIG audit found that the RRB did not publish payment integrity information or 

improper payment data for RM and determined that RRB’s performance in reducing RM 

improper payments was inadequate. Three of the five recommendations that OIG made were 

directly related to RM. RRB disagreed with all three recommendations and stated that 

“...although Section 1842(g) of the Social Security Act provides the RRB with the authority to 

contract with and to oversee a contractor to perform Medicare Part B functions, including the 

functions of determining Medicare Part B payment amounts and of making these Medicare Part 

B payments, CMS and RRB agree that Medicare FFS (Fee-for-Service) is one program for 

improper payment reporting purposes.” OIG disagreed and stated that they determined that 

the RRB should continue to separately report RM payment integrity information in its PAR due 

to the unique characteristics of the RRB’s SMAC, its extended enterprise relationship with CMS, 

the lack of transparency for a separate RM program, and the less than optimal sampling of the 

RRB’s SMAC, Palmetto. 

Although RRB disagreed with our findings for this report for the reasons stated above, 

Programs stated that the RRB and CMS were working on an updated Memorandum of 

Understanding (MOU) between RRB and CMS, which would clarify each agency’s 

responsibilities regarding RM reporting of improper payments. At the time of our report in 

May 2020, they stated that they expected the agreement (updated MOU) to be finalized by the 

end of 2020. Programs provided the OIG a recent update which stated that several meetings 

were held with RRB and CMS stakeholders to discuss updates to the MOU during the first half 

 2 Palmetto GBA is the Railroad Specialty Medicare Administrative Contractor (RRB SMAC) that processes Part B 

claims for Railroad Retirement beneficiaries nationwide. As the SMAC, Palmetto has administrative responsibility 

for processing Railroad Retirement beneficiary claims only.
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 8

of fiscal year 2020 and significant progress was made; however, the meetings were postponed 

due to the shifting of resources to COVID-19 activities. Programs management indicated that 

the meetings with CMS will resume in the early part of fiscal year 2021 timeframe to finalize the 

changes. 

Our previous audits identified improper payments that could have been prevented, 

improvements needed for improper payment reporting, and the need for improved controls 

and support to validate the accuracy of reimbursements the RRB receives to administer the RM 

program. In response, RRB management stated that it is not responsible for the RM program, 

they only review Palmetto’s contract performance, and they believe that some improper 

payments related to RM can only be recovered under special limited circumstances. Due to RRB 

management’s stance on this matter, they did not concur with many of our previous 

recommendations. We continue to disagree with RRB management that the RRB is not 

responsible for oversight and reporting responsibilities for this program. We stand by the 

recommendations made in our recent audit reports, many of which remain open. It is the RRB 

OIG’s position that until CMS absorbs the administration of RM, including contract oversight of 

Palmetto, the RRB should continue to report RM payment integrity data and implement RM 

related audit recommendations. If not, there is a lack of transparency, as the RRB would not be 

held accountable for its role in maintaining effective oversight of Palmetto. 

Due to the RRB’s indifference to oversight of the RM program and the inefficiency of 

maintaining it as a separate program, there is no practical reason for its existence, thus 

elimination should be considered.

See Appendix A for a list of relevant reports.

Challenge 4 – Improve Payment Accuracy and Transparency

Why is this a serious management challenge? The topics of data, accountability and 

transparency are included on the President’s Management Agenda. 

One of the key drivers in the President’s Management Agenda is an initiative to improve 

delivery of better results to the public and improving accountability to taxpayers. A specific 

strategy to accomplish this initiative is to improve the data available for decision-making and 

accountability. Fostering accountability and transparency is one way to improve data for both 

internal and external uses. Recent audits have identified instances where inaccurate reporting 

indicates the need to improve transparency at RRB. 

• Payment Accuracy

The Coronavirus Aid, Relief, and Economic Security Act (CARES Act) provided funding for the 

RRB that consisted of an appropriation of $425 million to pay for the increase in unemployment 

benefits, with an additional $50 million provided to cover the cost of eliminating a waiting 

period for unemployment or sickness benefits. CARES Act funding also included $5 million to 

prevent, prepare for, and respond to the coronavirus. Issuance of these benefits required 

modifications to RRB systems, training for RRB staff, and revisions of RRB procedures. 
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 9

Our oversight of CARES Act funds is ongoing, but we issued an interim report to discuss our 

current concerns. We determined that CARES Act benefits are being issued without any 

concurrent checks against state wages and unemployment benefits for the same periods. The 

RRB’s current state wage match program will not begin to compare the RRB’s CARES Act 

payments to state wage and benefit data for at least six months depending on the schedule 

with each particular state. RRB management indicated that the state wage match runs, that 

contain payments under the CARES Act, will begin in the spring of 2021 and will be completed 

by the end of calendar year 2021. The RRB’s state wage match program is operating based on 

previously negotiated agreements that are not providing wage and unemployment data in a 

timely manner, and because of the timing, it decreases program integrity for CARES Act benefit 

payments. This extensive lag period severely impedes the timely identification of fraudulent 

situations under the CARES Act. To address these concerns, we recommended that the RRB 

obtain state wage match and unemployment data in a timelier manner. Agency management 

did not concur with this recommendation, stating that the RRB’s ability to recover fraudulent 

benefit payments is not diminished because of the timing of the state wage match program. 

The OIG’s finding remains unchanged and as such, we continue to see the need for our 

recommendation to be implemented. 

• Transparency

The transparency issues discussed below represent our most recent concerns for these areas, 

and note that we previously reported challenges for these same audit topics. Our previously 

reported concerns continue to exist and are compounded by these newer audit findings. 

Agencies are required to report improper payment data for the programs it administers in the 

payment integrity portion of the agency’s PAR. As discussed in Challenge 3, our most recent 

improper payments report determined that the RRB did not publish payment integrity 

information or improper payment data for RM in its fiscal year 2019 PAR, as required. The RRB 

did not publish RM improper payment data, citing that CMS is responsible for the program as a 

whole, and is, therefore, responsible for improper payment reporting. We disagreed and 

determined that the RRB is responsible for RM reporting. RM improper payment data is not 

transparent within the overall Medicare data reported by CMS. By not reporting RM, the RRB 

was not transparent in publicly reporting several aspects related to RM, the most significant of 

which was that RM improper payments was approximately $107.1 million for fiscal year 2018, 

that the RM improper payment rate had increased considerably, and it exceeded the threshold 

allowable by improper payments legislation. Our audit made four recommendations related to 

action plans to reduce improper payments, reconciliation of data, and resuming RM reporting. 

RRB Management did not concur with three of the four recommendations. As stated 

previously, we disagree with the RRB’s position and maintain that the RRB is responsible for RM 

reporting. We continue to see the need for our recommended corrective actions. These four 

recommendations and other prior recommendations remain open. 

Federal agencies are required by the Digital Accountability and Transparency Act (DATA Act) to 

publish transparent financial data. Our recent audit determined that improvements are needed 

in RRB internal controls for the DATA Act. The RRB’s Data Quality Plan did not exist when the 

DATA Act submission was made. As a result, associated risks to data quality in the RRB’s 
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 10

spending data might not have been identified or managed. In addition, we found that RRB 

management’s quarterly assurance statement did not contain the required statement of 

accountability to confirm the RRB’s efforts to support data quality and assurance for 

connectivity/linkages across all data files. This occurred because agency management was 

unaware of the requirement for an accountability assurance statement. We identified 

deficiencies in RRB policies and procedures for the DATA Act that could impact the 

completeness, accuracy, timeliness, and quality of data submitted. For these specific DATA Act 

findings, we made four recommendations for improvement. RRB management concurred with 

all four recommendations. Three of these recommendations and prior DATA Act 

recommendations remain open. Previously, RRB management stated that they continue to 

make great strides in ensuring that the agency’s DATA Act submissions are complete, accurate, 

and agree to applicable source systems. As such, they disagreed that this matter contributes to 

a serious management concern or challenge. In order for RRB to provide consistent, reliable, 

and searchable spending data that are displayed accurately for taxpayers and policymakers, we 

continue to see the need for our recommendations to be implemented in compliance with the 

DATA Act. 

See Appendix A for a list of relevant reports.

Challenge 5 – Financial Management and Reporting Issues

Why is this a serious management challenge? Financial management and reporting issues 

continue to be a challenge for RRB management, as is outlined in many of our prior audit 

reports, as well as our audit concerns discussed in the following paragraphs.

OIG has continued to render a disclaimer audit opinion on the RRB’s financial statements since 

fiscal year 2013, because OIG auditors have not been permitted to communicate with the RRB’s 

component auditor as required by financial statement audit guidance. The audit firm employed 

by the National Railroad Retirement Investment Trust (NRRIT) is the RRB’s component auditor. 

The NRRIT held approximately $25.4 billion of the RRB’s $32.8 billion (77 percent) assets as 

reported in the RRB’s fiscal year 2019 financial statements. 

Our audit opinion on the RRB’s fiscal year 2019 financial statements also included two material 

weaknesses that are discussed in this challenge. 

Financial Reporting

This overall material weakness for financial reporting has been reported since fiscal year 2014. 

Within this overall material weakness, we discussed our fiscal year 2019 financial reporting 

concerns regarding ineffective controls, communication with the NRRIT’s auditor, and social 

insurance valuation. We continued to find the need for internal control improvements for 

financial reporting. 

Our concerns about our inability to communicate with the NRRIT’s auditor continued. RRB 

management stated that they will continue to cooperate and respond to OIG requests by

providing NRRIT related information within its possession. They also stated that it is not within 

their authority to compel NRRIT auditors to speak with OIG or provide them their workpapers. 
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 11

RRB management did not concur with the recommendation we made during our fiscal 

year 2014 financial statement audit that called for establishment of an independent committee 

that would identify a functional solution that would enable communication between OIG and 

NRRIT’s auditor. 

Our actuarial contractor identified a material understatement of $2.3 billion for the open group 

surplus amount shown on the RRB’s Statement of Social Insurance dated October 1, 2018. RRB 

management did not concur with our recommended corrective action. 

While RRB management has taken some corrective action to address our financial reporting 

concerns regarding ineffective controls, no corrective actions have been taken to address our 

recommendations regarding communication with the NRRIT’s auditor and social insurance 

valuation.

Deficient Internal Controls at the Agency-Wide Level 

In this section, we discuss the second material weakness, deficient internal controls at the 

agency-wide level, which relates to our audit concerns in several areas, including compliance 

concerns, and concerns regarding railroad service and compensation. 

• Ineffective Standards for Internal Control 

OMB guidance states that an evaluation of internal controls must be performed for the agency 

as a whole. We determined that the five required components of internal control were not 

designed, implemented, and operating effectively. The five required components of internal 

control consist of: control environment, risk assessment, control activities, information and 

communication, and monitoring. If control principles or components have not been fully 

designed and implemented, they cannot be tested and must be considered ineffective. RRB 

management acknowledged OIG’s concerns and stated that they are committed to strong 

internal control. In addition, they indicated that improvements were made and training was 

provided to responsible officials and agency leadership. Corrective actions related to this 

portion of the material weakness remain unimplemented. 

• Information Technology Security and Financial Reporting Controls

Eight FISMA metric domains were assessed not effective by our FISMA contractor for the fiscal 

year 2018 FISMA audit. As a result, during our fiscal year 2019 financial statement audit, 

information system control risk was assessed as high in accordance with GAO’s Financial Audit 

Manual guidance. RRB management disagreed with this audit finding. We did not make any 

recommendations for corrective action due to the 31 recommendations made by our 

contracted auditor. 
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 12

• Compliance with Indirect Laws, Regulations, Contracts, Treaties, and International 

Agreements

We determine that the RRB had not established effective policies and procedures for 

1) preventing agency noncompliance with indirect laws, regulations, and contracts; and 

2) identifying treaties and international agreements impacting the RRB or the NRRIT. These 

policies and procedures are required by Financial Audit Manual guidance. RRB management did 

not concur with our recommendations for corrective action. Due to the significance of these 

audit concerns, these audit recommendations remain open. 

• Compliance with RRA Benefit Payment Provisions

RRB management was not able to ensure compliance with RRA benefit payment provisions for 

fiscal year 2019 within allowable timeframes for our fiscal year 2019 financial statement audit. 

RRB management cited severe staffing shortages as the cause for delay. These quality 

assurance reviews that consisted of a sample of benefit payments totaling approximately 

$662.1 million were not completed until October 31, 2019, which was too late for us to 

complete our review. 

• Controls Over Railroad Service and Compensation

We determined that RRB controls over creditable and taxable compensation were inadequate 

due to insufficient audit coverage. The RRB received approximately $4.6 billion in payroll taxes 

as of June 30, 2019. An insufficient number of railroad audits were being conducted and, 

therefore, railroad employer audits were not effective in ensuring the accuracy of payroll tax 

amounts. RRB management acknowledged the need for improvement and explained that the 

limited number of these audits was due to staffing and funding constraints. The audit 

recommendation remains open.

• RRB’s DATA Act Policies and Procedures Need Improvement

OIG conducted an audit of RRB’s DATA Act Submission for First Quarter of Fiscal Year 2019, and 

one of the objectives was to assess the RRB’s implementation and use of the governmentwide 

financial data standards established by OMB and the Department of the Treasury. The audit

concluded that the RRB’s internal controls over DATA Act reporting were generally effective but 

need improvement. OIG’s concerns are discussed below.

Our audit determined that the RRB’s policies and procedures contained minimum standards 

and information for the RRB to manage and facilitate the reporting of financial and award data 

in accordance with the requirements of the DATA Act. Even though the procedures included 

various controls to ensure overall quality of the data, deficiencies were identified and 

improvements were needed. We also found that there were no procedures established to 

ensure File A and B totals matched. According to GAO, “[i]nternal control comprises the plans, 

methods, policies, and procedures used to fulfill the mission, strategic plan, goals, and 
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 13

objectives of the entity.” Therefore, management is responsible for designing policies and 

procedures to fit the agency’s situation. We made one recommendation and management 

concurred with our recommendation. The recommendation remains open.

Due to these audit concerns, the lack of corrective actions for most of these recommendations, 

and unimplemented corrective actions for prior reports with financial management and 

reporting concerns, agency action is needed to address this challenge. 

Refer to Appendix A for a list of relevant reports for this challenge. 

Challenge 6 – Compliance Concerns Identified

Why is this a serious management challenge? Recent OIG audits have determined that the RRB 

has been noncompliant with various guidance. Noncompliance can have a far reaching impact 

on the protection of federal trust funds, assets, information security, governmentwide 

improper payments, and the effectiveness of agency operations. 

Our recent audits found that the RRB was noncompliant in several areas, as discussed in this 

challenge. 

• Telework

Our audit of the RRB’s telework program determined that controls over the RRB’s telework 

program were not effective to ensure compliance with applicable telework laws, regulations, 

and policy. Specifically, we identified that 1) RRB’s policy did not contain appropriate telework 

managing officer information, 2) RRB’s privacy administrative circulars that support the 

telework program were outdated, 3) RRB’s controls were not fully effective for ensuring that 

telework training and written agreements were completed, and 4) RRB had not monitored or 

evaluated its telework program in accordance with applicable guidance. Further, we 

determined that the RRB submitted inaccurate and unsupported data to the Office of Personnel 

Management for fiscal years 2017 and 2018.

Adherence to applicable laws and guidance, in addition to a fully effective internal control 

system over the telework program, would help ensure the protection of privacy data and 

agency information used during teleworking. Our audit made five recommendations in these 

specific areas for improving internal controls and compliance with teleworking laws and 

regulations. RRB management concurred with two, and did not concur with three. Our 

recommendations remain as written. All five recommendations remain open.

• Improper Payment Reporting 

Our mandated improper payments audit determined that the RRB was noncompliant with 

improper payment legislation for the second consecutive year for its RM program. We cited the 

RRB with noncompliance because 1) the RM program had an improper payment rate of 

12.5 percent according to the improper payment reporting data provided by CMS in fiscal year 

2019, which exceeded the 10 percent threshold, for improper payment reporting, 2) the RRB 

did not publish a corrective action plan for the prior year RM improper payment rate of 
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 14

10.53 percent, and 3) the RRB did not publish an annual reduction target in its payment 

integrity report or meet the prior year’s published rate of 9.93 percent.3

Although the RRB was required to report RM improper payment data in its payment integrity 

report, it did not report RM data because RRB management determined that CMS is 

responsible for reporting all Medicare data as a whole and, if RRB reported this data, it would 

duplicate the data reported by CMS. However we found that the RRB did not have appropriate 

documentation to support their claim that RM was included in CMS’ overall Medicare improper 

payment reporting. We continue to disagree that CMS is responsible for the RM program as 

discussed in Challenge 3. Because RRB management does not agree that they are 

noncompliant, they did not concur with our recommended actions this year or last year. Our 

recommendations restated corrective actions required by improper payment legislation. 

However, RRB management has not taken the corrective actions required by legislation. 

• Information Technology Security

As discussed in Challenge 2, the RRB has been noncompliant with FISMA legislation and OMB 

guidance for two consecutive years. Although agency management acknowledged the need for 

improvement, corrective actions have only been made for 8 of the 50 recommendations issued 

in the fiscal year 2019 and 2018 FISMA reports. 

Compliance with applicable authoritative guidance continues to be a challenge for RRB 

management as discussed in the audit reports referenced for this challenge, as well as other 

prior compliance audits conducted by our office, or, for our office, through contracted audits. 

Many compliance related recommendations from our prior reports remain open, and thus we 

remain concerned about RRB’s efforts to be compliant with authoritative guidance. 

Refer to Appendix A for a list of relevant reports for this challenge.

We plan to continue our oversight in all areas emphasized in this letter through audits, 

investigations, and other follow-up activities. We encourage RRB to take meaningful action on 

these challenges in order to prevent fraud, waste, and abuse in the programs and operations of 

RRB, and to reduce improper payments in all of its programs. 

Original Signed By:

Martin J. Dickman 

Inspector General

 3 The information provided is according to a CMS’s Comprehensive Error Rate Testing (CERT) report titled 

November 2018 Final Report For Contractor RRB. The report included reviewed claims data from the sampling 

period July 2016 through June 2017.
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 15

APPENDIX A: AUDIT REPORTS

Please visit https://www.rrb.gov/OurAgency/InspectorGeneral/Library for our audit reports.

Improve Agency Disability Program Integrity

 Railroad Retirement Board (RRB) Office of Inspector General (OIG), Audit of Job Duty 

Verification Procedures for Long Island Rail Road Occupational Disability Applicants, 

Report No. 13-02 (Chicago, IL: January 15, 2013).

 RRB OIG, Control Weaknesses Diminish the Value of Medical Opinions in the Railroad 

Retirement Board Disability Determination Process, Report No. 16-05

(Chicago, IL: March 9, 2016).

 RRB OIG, The Implementation of the Disability Program Improvement Plan at the 

Railroad Retirement Board Did Not Result in a Fully Established Fraud Risk Assessment 

Process, Report No. 19-15 (Chicago, IL: September 27, 2019).

 RRB OIG, The Railroad Retirement Board Disability Programs Do Not Effectively Consider 

Fraud Risk Indicators in the Disability Process, Report No. 19-16 

(Chicago, IL: September 27, 2019).

 RRB OIG, The Use of Medical Experts During Disability Determinations at the Railroad 

Retirement Board Can Be Improved, Report No. 19-17 (Chicago, IL: September 27, 2019).

Improve Information Technology Security and Complete System Modernization

 RRB OIG, Performance Audit of RRB's Compliance with the Federal Information Security 

Modernization Act of 2014 Fiscal Year 2018, Report No. 19-03 

(Chicago, IL: December 19, 2018).

 RRB OIG, Selected General Information System Controls at the Railroad Retirement 

Board Were Not Always Adequate, Report No. 19-07 (Chicago, IL: May 14, 2019).

 RRB OIG, Performance Audit of RRB's Compliance with the Federal Information Security 

Modernization Act of 2014 Fiscal Year 2019, Report No. 20-04 

(Chicago, IL: December 18, 2019).

Improve Management of Railroad Medicare

 RRB OIG, Railroad Retirement Board Did Not Calculate Reimbursed Medicare Costs in 

Accordance with Federal Requirements, Report No. 16-10 (Chicago, IL: August 22, 2016).

 RRB OIG, Audit of Railroad Retirement Board's Compliance with Improper Payments 

Elimination and Recovery Act in Fiscal Year 2018 Performance and Accountability Report,

Report No. 19-09 (Chicago, IL: May 30, 2019).

 RRB OIG, Railroad Medicare Controls Over Evaluation and Management Services Were 

Not Fully Adequate, Report No. 19-10 (Chicago, IL: August 5, 2019).
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 16

 RRB OIG, Audit of Railroad Retirement Board's Compliance with Improper Payments 

Reporting in the Fiscal Year 2019 Performance and Accountability Report, 

Report No. 20-06 (Chicago, IL: May 12, 2020).

 RRB OIG, Controls over Medicare Premium Penalties and Refunds Can Be Improved, 

Report No. 20-07 (Chicago, IL: June 4, 2020). 

Improve Payment Accuracy and Transparency

 RRB OIG, Railroad Retirement Board’s Initial DATA Act Submission, While Timely, Was 

Not Complete or Accurate, Report No. 18-01 (Chicago, IL: November 8, 2017).

 RRB OIG, Audit of Railroad Retirement Board's Compliance with Improper Payments 

Elimination and Recovery Act in Fiscal Year 2018 Performance and Accountability Report,

Report No. 19-09 (Chicago, IL: May 30, 2019).

 RRB OIG, Audit of Railroad Retirement Board's Digital Accountability and Transparency 

Acts of 2014 Submission for First Quarter of FY 2019, Report No. 20-01

(Chicago, IL: November 6, 2019).

 RRB OIG, Audit of Railroad Retirement Board's Compliance with Improper Payments 

Reporting in the Fiscal Year 2019 Performance and Accountability Report, 

Report No. 20-06 (Chicago, IL: May 12, 2020).

 RRB OIG, Management Information Report: Interim Report Regarding CARES Act 

Expenditures and Controls, Report No. 20-08 (Chicago, IL: September 28, 2020).

Financial Management and Reporting Issues

 RRB OIG, Fiscal Year 2014 Financial Statement Audit Letter to Management,

Report No. 15-05 (Chicago, IL: March 31, 2015).

 RRB OIG, Enterprise Risk Management Process At The Railroad Retirement Board Was 

Not Fully Effective, Report No. 18-07 (Chicago, IL: July 9, 2018).

 RRB OIG, Report on the Railroad Retirement Board's Financial Statements 

Fiscal Year 2018, Report No. 19-01 (Chicago, IL: November 15, 2018).

 RRB OIG, Performance Audit of RRB's Compliance with the Federal Information Security 

Modernization Act of 2014 Fiscal Year 2018, Report No. 19-03 

(Chicago, IL: December 19, 2018).

 RRB OIG, Audit of Railroad Retirement Board's Digital Accountability and Transparency 

Acts of 2014 Submission for First Quarter of FY 2019, Report No. 20-01 

(Chicago, IL: November 6, 2019).

 RRB OIG, Report on the Railroad Retirement Board’s Financial Statements 

Fiscal Year 2019, Report No. 20-02 (Chicago, IL: November 15, 2019).

 RRB OIG, Management and Performance Challenges Facing the Railroad Retirement 

Board, Report No. 20-03 (Chicago, IL: November 21, 2019).
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 17

Compliance Concerns Identified

 RRB OIG, Performance Audit of RRB's Compliance with the Federal Information Security 

Modernization Act of 2014 Fiscal Year 2019, Report No. 20-04 

(Chicago, IL: December 18, 2019).

 RRB OIG, Railroad Retirement Board’s Telework Program Needs Improvement 

Report No. 20-05 (Chicago, IL: April 24, 2020).

 RRB OIG, Audit of Railroad Retirement Board's Compliance with Improper Payments 

Reporting in the Fiscal Year 2019 Performance and Accountability Report,

Report No. 20-06 (Chicago, IL: May 12, 2020).
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 18

APPENDIX B: MANAGEMENT COMMENTS
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 19
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 20
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 21
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 22
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 23
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 24
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 25
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 26
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 27
OFFICE OF INSPECTOR GENERAL - RAILROAD RETIREMENT BOARD

Management and Performance Challenges for Fiscal Year 2020 - Report No. 21-02 28