Social Security Administration: Effective Planning and Management Practices Are Key to Overcoming IT Modernization Challenges
Published: 2016-07-14T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: SSA delivers services that touch the lives of almost every American, and the agency relies heavily on IT resources to do so. Its computerized information systems support a range of activities—from processing Disability Insurance and Supplemental Security Income payments, to calculating and withholding Medicare premiums, and issuing Social Security numbers and cards. For fiscal year 2015, the agency reported spending approximately $1.3 billion on hardware and software, computer maintenance, and contractor support, among other things. SSA's IT infrastructure is aging and, thus, increasingly difficult and expensive to maintain. In its fiscal year 2017 budget, the agency has requested $300 million, to be spread over 4 years, to modernize its IT environment.
This statement summarizes challenges that SSA has previously encountered in managing and modernizing its IT, as described in prior GAO reports. It also highlights selected best practices that GAO identified as essential to effectively planning and managing IT modernization efforts.
section_title: What GAO Found
paragraphs: GAO's reports have highlighted various challenges in the Social Security Administration's (SSA) information technology (IT) planning and management. Overall, these reports identified weaknesses in, among other areas, system development practices, IT governance, requirements management, and strategic planning. The reports, collectively, stressed the need for the agency to strengthen its IT management controls. In previously reporting on SSA's implementation of a new electronic disability system in March 2004, GAO noted that the agency had proceeded without (1) conducting testing that was adequate to evaluate the performance of all system components collectively and (2) evidence that it had consistently applied established procedures to guide the system's development. Additionally, GAO's April 2012 review of the agency's IT modernization approach pointed out that SSA did not have an updated IT strategic plan to guide its efforts and its enterprise architecture lacked important content that would have allowed the agency to more effectively plan its investments. Beyond the challenges identified in these previous reports, GAO's May 2016 report on federal agencies' IT legacy systems highlighted the increasing costs that agencies, including SSA, may be faced with as they continue to operate and maintain at-risk legacy systems.
Prior GAO work has shown that effectively managing IT needs depends on federal departments and agencies, including SSA, having key processes in place. Toward this end, GAO has identified and reported on a set of essential and complementary management disciplines that provide a sound foundation for IT management. Among these practices are:
Strategic planning to define what an organization seeks to accomplish and identify the strategies it will use to achieve desired results.
IT investment management that includes instituting an investment board, selecting investments that meet business needs, providing investment oversight, and capturing investment information.
Systems development and acquisition that includes defining requirements, managing project risk, reliably estimating cost, and developing an integrated and reliable master schedule, among other actions.
Information security and privacy which are essential for preventing data tampering, disruptions in operations, fraud, and inappropriate disclosure of sensitive information.
Service management for ensuring that IT services, such as server management and desktop support, are aligned with and actively support the business needs of the organization.
Leadership for driving change, providing oversight, and ensuring accountability for results.
Given the longstanding challenges with IT management and modernization efforts, it is important for SSA to implement a clearly established, rigorous, and disciplined approach for its current efforts to modernize its aging IT systems. Without doing so, challenges like those that the agency experienced with its past initiatives could continue to be an impediment to the agency in achieving the more modernized IT environment that is necessary to support its service-delivery mission.
section_title: What GAO Recommends
paragraphs: GAO has made numerous recommendations to SSA to mitigate challenges in planning for and managing its IT. Among other things, GAO has recommended strengthening the roles and responsibilities of the agency's investment board, improving post-implementation reviews, and establishing an enterprise architecture to effectively guide modernization activities. The agency has taken a number of actions intended to address them.

section_title: Letter
paragraphs: I am pleased to be here today to participate in your hearing on  modernizing the Social Security Administration’s (SSA) information  technology (IT). SSA is responsible for delivering services that touch the  lives of almost every American, and the agency relies heavily on IT  resources to do so. Its computerized information systems support a wide  range of activities—from processing Disability Insurance and  Supplemental Security Income payments to calculating and withholding  Medicare premiums and issuing Social Security numbers and cards. For  fiscal year 2015, the agency reported spending approximately $1.3 billion  on hardware and software, computer maintenance, and contractor  support, among other things.
SSA has acknowledged the increasing age of its IT environment and has  reported that some of its databases are at least 40 years old. Moreover,  our recent reporting on federal agencies’ legacy IT has noted the  increasing cost for agencies, including SSA, to operate and maintain their  outdated systems. SSA has initiated various projects over the past two  decades that were intended to update and improve parts of its  infrastructure. More recently, it announced plans to pursue an agency- wide IT modernization initiative.
At your request, my testimony today summarizes results from a number  of our previous reports on SSA’s IT efforts. Additionally, in anticipation of  the agency’s planned modernization initiative, my testimony highlights  selected best practices that we have identified as being essential to an  agency’s effective planning and management for such an initiative.
In developing this testimony, we relied on reports that we have previously  issued. These reports, cited throughout this statement, include detailed  information on the scope and methodology for our reviews. The work on  which this statement is based was conducted in accordance with  generally accepted government auditing standards. Those standards  require that we plan and perform audits to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions.
We believe that the evidence obtained provided a reasonable basis for  our findings and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: SSA’s mission is to deliver Social Security services that meet the  changing needs of the public. The Social Security Act and amendments  established three programs that the agency administers:
Old-Age and Survivors Insurance—provides monthly retirement and  survivors benefits to retired and disabled workers, their spouses and  their children, and the survivors of insured workers who have died.  SSA has estimated that, in fiscal year 2017, $813 billion in old-age  and survivors insurance benefits are expected to be paid to a monthly  average of approximately 52 million beneficiaries.
Disability Insurance provides monthly benefits to disabled workers  and their spouses and children. The agency estimates that, in fiscal  year 2017, a total of approximately $149 billion in disability insurance  benefits will be paid to a monthly average of about 11 million eligible  workers.
Supplemental Security Income is a needs-based program financed  from general tax revenues that provides benefits to aged adults, blind  or disabled adults, and children with limited income and resources.  For fiscal year 2017, SSA estimates that nearly $59 billion in federal  benefits and state supplementary payments will be made to a monthly  average of approximately 8.4 million recipients.
SSA relies on its IT resources to support the administration of its  programs and related activities. For example, among other things, its  systems are used to handle millions of transactions on the agency’s  website, maintain records for the millions of beneficiaries and recipients of  its programs, and evaluate evidence and make determinations of  eligibility for benefits. According to the agency’s most recent Information  Resources Strategic Plan, its systems supported the processing of an  average daily volume of about 185 million individual transactions in fiscal  year 2015.
SSA’s Office of the Deputy Commissioner for Systems is responsible for  developing, overseeing, and maintaining the agency’s IT systems.  Comprised of approximately 3,800 staff, the office is headed by the  Deputy Commissioner, who also serves as the agency’s Chief Information  Officer (CIO).
SSA’s acting commissioner has stated that the agency’s aging IT  infrastructure is not sustainable because it is increasingly difficult and  expensive to maintain. Accordingly, the agency has requested $300  million in its fiscal year 2017 budget to be spread over 4 years to  modernize its IT environment. As reflected in the budget, these  modernization efforts are expected to include projects such as updating  database designs by converting them to relational databases, eliminating  the use of outdated code, and upgrading infrastructure.
Among the agency’s priority IT spending initiatives expected to be  covered in the budget is its Disability Case Processing System. This  system is intended to replace the 54 disparate Disability Determination  Services’ component systems, support, and maintenance processes with  a modern, common case processing system. According to SSA, the new  system was to modernize the entire claims process, including case  processing, correspondence, and workload management. However, SSA  and others have reported substantial difficulty in the agency’s ability to  carry out this initiative, citing software quality and poor system  performance as issues. Consequently, as of June 2016, the initiative had  been placed on the Office of Management and Budget’s government-wide  list of 10 high-priority programs requiring attention.
section_title: SSA Has Faced Long-Standing Challenges in IT Management and Modernization Efforts
paragraphs: We have issued previous reports highlighting various challenges in SSA’s  management of its IT. Overall, these reports identified weaknesses in,  among other areas, system development practices, IT governance,  requirements management, and strategic planning. Our reports,  collectively, stressed the need for the agency to strengthen its IT  management controls.
In previously reporting on SSA’s implementation of a new electronic  disability system, we noted that the agency had proceeded without  (1) conducting testing that was adequate to evaluate the performance  of all system components collectively and (2) evidence that it had  consistently applied established procedures to guide the system’s  development. In view of the risks and the technological complexity,  scope, and size of the initiative, we recommended that the agency,  before continuing with its national rollout of the electronic disability  system, ensure that all critical problems identified in pilot testing of the  system were resolved and that end-to-end testing of the interrelated  systems was performed; and ensure that all software that had been  developed was approved and that systems were certified for  production. SSA disagreed with the need for the end-to-end testing,  stating that to perform such testing would delay the project and the  agency’s ability to realize benefits from this initiative. However, the  agency did subsequently take measures to ensure that users  approved new software and that it certified its systems for production.
In an evaluation of SSA’s investment management approach, we  noted that, while the agency had executed a majority of key IT  investment management practices, the critical process of providing  oversight was not being fully executed. Further, we reported that a  gap existed in the agency’s management of its IT in that more than  half of its budget—for acquisitions—was not being overseen as part of  the agency’s investment management process. We made seven  recommendations related to strengthening the agency’s investment  management capability. SSA agreed with six of our seven  recommendations, and took actions to address five of them. For  example, it established portfolio-level performance evaluation policies  and procedures and criteria for assessing portfolio performance; it  also tracked the status of corrective actions for underperforming IT  projects. However, the agency did not implement post-implementation  reviews and was not managing its acquisitions within its IT investment  management framework. Further, the agency disagreed with our  recommendation that it develop policies and procedures for managing  its IT acquisitions as investments and manage them using the  investment board and investment management processes. The  agency disagreed because it believed its existing investment  management framework was adequate. Given that IT product and  service acquisitions made up the majority of SSA’s IT budget,  however, the investment board’s involvement was essential to helping  ensure effective management of and full accountability for these  acquisitions.
In previously reporting on SSA’s efforts to ensure that its IT  infrastructure can support the agency’s future data exchange  environment, we noted that a detailed analysis needed to project the  workload and performance requirements was not performed. In  addition, we reported that the agency’s target enterprise architecture  environment did not address specific business and technical  requirements for supporting its data exchange program. We  recommended that SSA conduct the analyses needed to define  requirements for delivering data exchange services to its partners in  the future and use the results of these analyses to update its target  architecture. SSA agreed with these recommendations and, in  September 2013, took actions to address them. For example, it  conducted an assessment of its existing electronic exchange  architecture and identified challenges it expected to encounter as  requests for data increased, as well as descriptions of target  architectural components intended to meet requirements for  addressing the challenges.
In an examination of the agency’s IT modernization approach, we  pointed out that the approach lacked key practices to effectively guide  its efforts. Specifically, SSA did not have an updated IT strategic plan  to guide its modernization efforts and its enterprise architecture lacked  important content that would have allowed the agency to more  effectively plan its investments. We recommended that SSA take four  actions. For example, we recommended that in updating the IT  strategic plan to support the agency’s strategic plan, SSA include key  elements—such as results-oriented goals, strategies, milestones,  performance measures, and an analysis of interdependencies among  projects and activities—and use the plan to guide and coordinate IT  modernization projects and activities. We also recommended that the  agency establish an enterprise architecture plan that included key  components called for by federal guidelines and GAO’s enterprise  architecture management framework—such as the development of  a service-oriented architecture road map—to effectively guide its  modernization activities. The agency neither agreed nor disagreed  with our recommendations. However, it subsequently took action to  address two of the four recommendations by ensuring that  performance measures were defined for ongoing IT modernization  initiatives and updating its IT strategic plan to support the agency’s  strategic plan. As of this testimony, we have not yet completed our  evaluation of the agency’s actions to address the other two  recommendations related to establishing an enterprise architecture  plan and developing and clearly documenting investment review  guidance and procedures to ensure oversight reviews will be effective  in evaluating and controlling investments.
Beyond the challenges identified in the aforementioned reports, our  recent report on federal agencies’ IT legacy systems highlighted the  increasing costs that agencies, including SSA, may be faced with as they  continue to operate and maintain at-risk legacy systems. We identified  SSA’s investment in infrastructure operations and maintenance as being  among the 10 largest expenditures of federal agencies in fiscal year  2015. Further, we pointed out that legacy systems may become  increasingly more expensive as agencies have to deal with issues, such  as obsolete parts and unsupported hardware and software, and may pay  a premium to hire staff or engage contractors with the knowledge to  maintain outdated systems. For example, SSA reported re-hiring retired  employees to maintain its systems that include many programs written in  Common Business Oriented Language (COBOL).
Our prior work further emphasized the importance of federal agencies  using investment operational analyses—a key performance evaluation  and oversight mechanism required by the Office of Management and  Budget—to ensure operations and maintenance investments continue to  meet agency needs. We noted that SSA had not previously conducted  this analysis for its investments. An analysis such as this is important  because, among other things, it provides information to agency decision  makers on whether an investment’s actual annual operations and  maintenance costs are as they were planned to be and whether there is a  need to examine more cost-effective approaches to meeting agency  mission objectives. We recommended that SSA perform such an analysis  on its investment, and in January 2014 the agency did so.
section_title: Key Practices Are Essential for Managing Successful Modernizations
paragraphs: Our prior work has shown that effectively managing IT needs depends on  federal departments and agencies, including SSA, having key processes  in place. Toward this end, we have identified and reported on a set of  essential and complementary management disciplines that provide a  sound foundation to support IT modernization efforts. These include the  following:
Strategic planning: Strategic planning defines what an organization  seeks to accomplish and identifies the strategies it will use to achieve  desired results. A defined strategic planning process allows an  agency to clearly articulate its strategic direction and to establish  linkages among planning elements such as goals, objectives, and  strategies. A well-defined IT strategic planning process helps ensure  that an agency’s IT goals are aligned with its strategic goals. Also,  as part of its strategic planning efforts, an organization should develop  an enterprise architecture, which is an important tool to help guide the  organization toward achieving the goals and objectives in its IT  strategic plan. In addition, the organization should implement human  capital management practices to sustain a workforce with the skills  necessary to execute its strategic plan, which includes assessing  current and future agency skill needs.
IT investment management: IT projects can significantly improve an  organization’s performance, but they can also become costly, risky,  and unproductive. Agencies can maximize the value of these  investments and minimize the risks of acquisitions by having an  effective and efficient IT investment management and governance  process, which would include instituting an investment board,  selecting investments that meet business needs, providing investment  oversight, and capturing investment information. Emphasizing the  importance of investment management, the Clinger-Cohen Act  requires executive branch agencies to establish a process for  selecting, managing, and evaluating IT investments in order to  maximize the value and assess and manage the risks of the  acquisitions.
Systems development and acquisition: Our prior reviews have  shown that proper implementation of disciplined practices for  developing or acquiring IT systems can significantly increase the  likelihood of delivering promised system capabilities on time and  within budget. These practices include defining the requirements  that address the needs of the system users, managing project risk to  identify potential problems before they occur, reliably estimating cost  to help managers evaluate affordability and performance against a  project’s plans, and developing an integrated and reliable master  schedule that defines when and how long work will occur and how  each activity is related to the others, among other actions. Best  practices in these areas have been identified by organizations such as  the Software Engineering Institute and GAO.
Information security and privacy: Effective security for federal IT  systems and data is essential to prevent data tampering, disruptions  in critical operations, fraud, and inappropriate disclosure of sensitive  information, including personal information entrusted to the  government by members of the American public. Recognizing the  importance of information security and privacy, Congress enacted the  Federal Information Security Modernization Act of 2014, which  requires executive branch agencies to develop, document, and  implement an agency-wide information security program.  Additionally, in order to help agencies develop such a program, the  National Institute of Standards and Technology has developed  guidance for information security and privacy.
Service management: Agencies should develop and implement a  process for ensuring that IT services, such as server management  and desktop support, are aligned with and actively support the  business needs of the organization. The Information Technology  Infrastructure Library identifies key practices for successful service  management. These include developing a service catalog that  identifies all IT services delivered by the service provider, as well as  establishing service-level agreements between the IT service provider  and its customer on the expected service-level targets.
Leadership: Effective leadership, such as that of a CIO, can drive  change, provide oversight, and ensure accountability for results.  Congress has also recognized the importance of having a strong  agency CIO. For example, as part of the Clinger-Cohen Act, Congress  required executive branch agencies to establish the position of  agency CIO. The act also gave these officials responsibility and  accountability for IT investments, including IT acquisitions, monitoring  the performance of IT programs, and advising the agency head on  whether to continue, modify, or terminate such programs. More  recently, in December 2014, Congress passed federal information  technology acquisition reform legislation (commonly referred to as  FITARA), which strengthened the role that agency CIOs are to play in  managing IT. For instance, the law requires the head of covered  agencies to ensure that the CIO has a significant role in the decision  process for IT budgeting, as well as the management, governance,  and oversight processes related to IT.
In conclusion, given SSA’s longstanding challenges with IT management  and modernization efforts, it will be important for the agency to implement  a clearly established, rigorous, and disciplined approach for its current  efforts to manage and modernize its aging IT systems. Leveraging IT  management best practices that we and others have identified and clearly  documenting what is to be achieved, in what time frame, and at what cost  could help position the agency to overcome challenges like those  encountered with past IT efforts. Without doing so, such challenges could  continue to be an impediment to the agency achieving the more  modernized IT environment that it needs.
Chairman Johnson, Ranking Member Becerra, and Members of the  Subcommittee, this concludes my prepared statement. I would be  pleased to respond to any questions that you or other members of the  Subcommittee may have.
section_title: GAO Contact and Acknowledgments
paragraphs: If you or your staff have any questions about this testimony, please  contact Valerie C. Melvin, Director, Information Management and  Technology Resources Issues, at (202) 512-6304 or melvinv@gao.gov.  Contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this testimony statement. GAO  staff who made key contributions to this statement are Nicole Jarvis  (Assistant Director), Nancy Glover, Monica Perez-Nelson, Scott Pettis,  and Christy Tyson (Analyst in Charge).
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.