SSA Disability Benefits: Comprehensive Strategic Approach Needed to Enhance Antifraud Activities
Published: 2017-04-17T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: SSA's Disability Insurance (DI) and Supplemental Security Income (SSI) programs provide cash benefits to millions of Americans with disabilities who are unable to work. Collectively, payments from DI and SSI were about $200 billion in fiscal year 2015. Although the extent of fraud in these programs is unknown, recent high-profile cases have highlighted instances in which individuals fraudulently obtained millions of dollars in benefits. GAO was asked to review SSA's fraud risk management.
This report examines SSA's actions to manage fraud risks and the extent to which these actions align with leading practices for (1) establishing an organizational culture and structure conducive to fraud risk management, (2) identifying, assessing, and addressing fraud risks, and (3) monitoring and evaluating its antifraud activities. GAO reviewed SSA documents, such as training materials and operational guidance; and interviewed SSA officials at the agency's headquarters, its three fraud examination units, and selected state disability determination offices chosen for their proximity to antifraud initiatives. GAO assessed those actions against leading practices identified in its Fraud Risk Framework.
section_title: What GAO Found
paragraphs: The Social Security Administration (SSA) has taken steps to establish an organizational culture and structure conducive to fraud risk management in its disability programs, but its new antifraud office is still evolving. In recent years, SSA instituted mandatory antifraud training, established a centralized antifraud office to coordinate and oversee the agency's fraud risk management activities, and communicated the importance of antifraud efforts. These actions are generally consistent with GAO's Fraud Risk Framework, a set of leading practices that can serve as a guide for program managers to use when developing antifraud efforts in a strategic way. However, SSA's new antifraud office, the Office of Anti-Fraud Programs (OAFP), faced challenges establishing itself as the coordinating body for the agency's antifraud initiatives. For example, the OAFP has had multiple acting leaders, but SSA recently appointed a permanent leader of OAFP to provide accountability for the agency's antifraud activities.
SSA has taken steps to identify and address fraud risks in its disability programs, but it has not yet comprehensively assessed these fraud risks or developed a strategic approach to help ensure its antifraud activities effectively mitigate those risks. Over the last year, SSA gathered information about fraud risks, but these efforts generally have not been systematic and did not assess the likelihood, impact, or significance of all risks that were identified. SSA also has several prevention and detection activities in place to address known fraud risks in its disability programs such as fraud examination units, which review disability claims to help detect fraud perpetrated by third parties. However, SSA has not developed and documented an overall antifraud strategy that aligns its antifraud activities to its fraud risks. Leading practices call for federal program managers to conduct a fraud risk assessment and develop a strategy to address identified fraud risks. Without conducting a fraud risk assessment that aligns with leading practices and developing an antifraud strategy, SSA's disability programs may remain vulnerable to new fraud schemes, and SSA will not be able to effectively prioritize its antifraud activities.
SSA monitors its antifraud activities through the OAFP and its National Anti-Fraud Committee (NAFC), which serves as an advisory board to the OAFP, but the agency does not have effective performance metrics to evaluate the effect of such activities. The OAFP has responsibility for monitoring SSA's antifraud activities and establishing performance and outcome-oriented goals for them. It collects metrics to inform reports about its antifraud initiatives, and the NAFC receives regular updates about antifraud initiatives. However, the quality of the metrics varies across initiatives and some initiatives do not have metrics. Of the 17 initiatives listed in SSA's 2015 report on antifraud initiatives, 10 had metrics that did not focus on outcomes, and 4 did not have any metrics. For example, SSA lacks a metric to help monitor the effectiveness of its fraud examination units. Leading practices in fraud risk management call for managers to monitor and evaluate antifraud initiatives with a focus on measuring outcomes. Without outcome-oriented performance metrics, SSA may not be able to evaluate its antifraud activities, review progress, and determine whether changes are necessary.
section_title: What GAO Recommends
paragraphs: GAO recommends SSA (1) conduct a comprehensive fraud risk assessment for its disability programs, (2) develop a corresponding antifraud strategy, (3) develop outcome-oriented metrics for antifraud activities, and (4) review progress and change activities as necessary. SSA agreed with GAO's recommendations.

section_title: Letter
paragraphs: The Social Security Administration (SSA) provides cash benefits through  two main programs to millions of Americans with disabilities who are  unable to work: Disability Insurance (DI) and Supplemental Security  Income (SSI). Collectively, payments from these programs were about  $200 billion in fiscal year 2015. Although the extent of fraud in these  programs is unknown, high-profile cases have highlighted instances in  which individuals fraudulently obtained benefits. For example, according  to a report from SSA’s Office of the Inspector General (OIG), over 70  individuals in New York pled guilty in 2014 to participating in a conspiracy  to obtain at least $14 million in fraudulent SSA disability benefits. DI and  SSI are on the Office of Management and Budget’s list of programs  designated as high risk for improper payments, which include but are not  limited to payments made as a result of fraud. In addition, we include  federal disability programs on our high-risk list of agencies and programs  that are vulnerable to fraud, waste, abuse, and mismanagement or are  most in need of transformation.
You asked us to review SSA’s approach to managing fraud risks in light  of our July 2015 A Framework for Managing Fraud Risks in Federal  Programs (Fraud Risk Framework), which describes leading practices  that agencies can follow to proactively and strategically manage fraud  risks. This report examines SSA’s actions to manage fraud risks in its  disability programs and the extent to which these actions align with  leading practices for (1) establishing an organizational culture and  structure conducive to fraud risk management, (2) identifying, assessing,  and addressing fraud risks in its disability programs, and (3) monitoring  and evaluating its fraud risk management activities.
To identify and examine SSA’s actions, we reviewed SSA documents  including its 2014 and 2015 annual antifraud reports as well as  operational guidance, training materials, and prior SSA OIG and GAO  reports. We also interviewed SSA officials from across the agency’s  headquarters including those in the Office of Anti-Fraud Programs  (OAFP), as well as in the Operations, Disability Adjudication and Review,  Learning, and Communications components. In addition, we interviewed  staff in all three of SSA’s fraud examination units, visiting those in New  York, New York, and San Francisco, California. To gain additional  insights about SSA’s actions to manage fraud risk in its disability  programs, we conducted site visits in Baltimore County, Maryland, and  New York, New York. We selected Baltimore County, Maryland, because  SSA’s headquarters including the OAFP is located there, and New York,  New York, because it is the location of SSA’s first fraud examination unit,  which was established in response to two high-profile fraud schemes. To  assess SSA’s actions, we compared them with leading practices  identified in the Fraud Risk Framework. In addition, we assessed SSA’s  actions against federal internal control standards such as those related to  managing fraud risks. We did not evaluate the effectiveness of SSA’s  actions to combat particular fraud schemes.
We conducted this performance audit from November 2015 to April 2017  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: SSA provides benefits to individuals with disabilities through two main  programs: DI and SSI. Individuals are generally considered disabled if  they are unable to do their previous work and, considering age,  education, and work experience, are unable to engage in any other kind  of substantial gainful work and their disability has lasted or is expected to  last at least 1 year or is expected to result in death. See table 1 for  additional key features and requirements of the DI and SSI programs.
SSA’s process for determining eligibility for disability benefits—which is  generally the same for DI and SSI claimants—starts when an individual  submits a claim to SSA. First, an SSA field office employee reviews the  claim to determine whether the claimant meets SSA’s nonmedical  eligibility requirements and, if so, forwards the claim to a state Disability  Determination Services (DDS) office. A DDS examiner then reviews the  claim to make a determination of medical eligibility. If the claim is denied,  the claimant has several opportunities for appeal within SSA, starting with  a reconsideration at the DDS level and then a hearing before an  administrative law judge. Claims at all levels for which the claimant is  determined to be eligible for DI or SSI benefits, also called favorable  claims, are forwarded to other SSA offices for payment. See figure 1 for  an overview of SSA’s eligibility determination process for disability  programs.
subsections: section_title: SSA Disability Fraud Identification, Investigation, and Oversight
paragraphs: SSA has policies and guidance on how SSA and DDS employees should  document and report suspected fraud. According to SSA’s policy, fraud  generally occurs when an individual makes or causes to be made false  statements of material facts or conceals such facts for use in determining  rights to benefits, with intent to defraud. SSA guidance includes a list of  factors that may indicate potential fraud for field office staff and DDS  examiners to consider when processing disability claims. According to  SSA’s policy, employees should gather enough information to either  remove suspicion or determine that there is potential fraud. If they  determine that potential fraud exists, they should refer the case to the  SSA OIG. They are also expected to develop the referral with as much  information as possible, including who allegedly committed fraud, how,  and when. See figure 2 for an overview of SSA’s fraud referral process.
To help investigate some potential disability fraud cases, the OIG and  SSA collaborate through Cooperative Disability Investigation (CDI) and  fraud examination units:
CDI units are staffed with a mix of SSA, DDS, and OIG staff, as well  as state or local law-enforcement officers, to obtain evidence when  potential fraud is suspected. CDI investigators often work undercover.  As of January 2017, there were 39 CDI units covering 33 states, the  District of Columbia, and Puerto Rico.
Fraud examination units are staffed by SSA employees with disability  determination expertise. Prompted by OIG requests and at the  direction of SSA’s Operations component, they review claims to help  detect patterns of disability fraud perpetrated by third parties such as  physicians, attorneys, or claimant representatives. As of January  2017, fraud examination units were located in New York City, San  Francisco, and Kansas City, but each of the three units works on  cases from anywhere in the nation.
SSA’s OAFP provides centralized oversight and accountability of the  agency’s antifraud initiatives. The OAFP’s efforts include managing fraud  risks in all of SSA’s programs including its disability programs. SSA’s  National Anti-Fraud Committee (NAFC) provides a forum for agency  executives to collaborate on antifraud strategies and serves as an  advisory board for the OAFP in determining what initiatives to monitor,  among other things. The NAFC is cochaired by SSA’s Deputy  Commissioner for Budget, Finance, Quality, and Management and the  agency’s Inspector General. All SSA deputy commissioners are voting  members of the NAFC. The Associate Commissioner for the OAFP, who  reports to the Deputy Commissioner for Budget, Finance, Quality, and  Management, serves as the agency’s chief fraud prevention officer and is  a nonvoting member of the NAFC. The NAFC is at a higher level than the  OAFP and has cross-agency authority. See figure 3 for an overview of  SSA’s antifraud management structure.
section_title: Fraud Risk Management Standards and Guidance
paragraphs: According to federal standards and guidance, executive-branch agency  managers are responsible for managing fraud risks and implementing  practices for combating those risks. Federal internal control standards call  for agency managers to assess fraud risks as part of their internal control  activities. The Fraud Risk Framework provides a comprehensive set of leading practices that serves as a guide for agency managers to use  when developing efforts to combat fraud in a strategic, risk-based way.  The Fraud Risk Framework describes leading practices in four  components:  1.  Commit—Commit to combating fraud by creating an organizational  culture and structure conducive to fraud risk management;  2.  Assess—Plan regular fraud risk assessments and assess risks to  determine a fraud risk profile;  3.  Design and Implement—Design and implement a strategy with  specific control activities to mitigate assessed fraud risks and  collaborate to help ensure effective implementation; and  4.  Evaluate and Adapt—Evaluate outcomes using a risk-based approach  and adapt activities to improve fraud risk management.
In addition, the Fraud Risk Framework reflects activities related to  monitoring and feedback mechanisms, which include ongoing practices  that apply to all four components, as depicted in figure 4.
In July 2016, the Office of Management and Budget published guidance  about enterprise risk management and internal controls in federal  executive departments and agencies. Among other things, this guidance  affirms that managers should adhere to the leading practices identified in  the Fraud Risk Framework. In addition, the Fraud Reduction and Data  Analytics Act of 2015, enacted in June 2016, requires the Office of  Management and Budget to establish guidelines for federal agencies to  establish controls to identify and assess fraud risks and design and  implement antifraud control activities. The act requires the Office of  Management and Budget to incorporate the leading practices from the  Fraud Risk Framework in the guidelines. Further, the act requires federal  agencies to submit to Congress a progress report each year for 3  consecutive years on the implementation of the controls established  under the Office of Management and Budget guidelines, among other  things.
section_title: SSA Has Demonstrated an Organizational Commitment to Combating Fraud, but Its New Antifraud Office Is Still Evolving
paragraphs: SSA has taken steps to establish an organizational culture and structure  that are conducive to managing fraud risks in its disability programs. The  agency has demonstrated a senior-level commitment to combating fraud  in its disability programs and has worked to involve all levels of the  agency in setting an antifraud tone. For example, in April 2014, SSA  reestablished the NAFC to provide support for national and regional  antifraud activities. The NAFC is composed of deputy commissioners  from across the agency and other SSA executives who meet at least  quarterly, which helps to demonstrate a senior-level commitment to  combating fraud—one of the Fraud Risk Framework’s leading practices.  The NAFC invites regional staff to its regular meetings and to an annual  conference to report on the progress of SSA’s antifraud initiatives, which  helps involve multiple levels of the agency in setting an antifraud tone— another leading practice in the Fraud Risk Framework. SSA also  demonstrated a commitment to combating fraud at all levels of the  agency when it implemented the first annual mandatory antifraud training  in 2014 for all SSA and DDS staff. As discussed further below, the  training describes indicators of potential fraud and instructs staff on how  to report it. According to SSA officials, 97 percent of SSA employees and  all DDS employees except for those on extended leave completed the  most recent annual antifraud training.
SSA further demonstrated a commitment to antifraud efforts by  conducting a study to evaluate its fraud risk management approach and  shortly thereafter establishing a dedicated antifraud office within the  agency. SSA contracted with a consulting firm in April 2014 to identify  leading practices for managing fraud risks and, according to SSA officials,  sought input from other federal agencies about their efforts. The  consulting firm’s study identified the importance of establishing a  dedicated antifraud office. SSA subsequently established the OAFP in  November 2014.
The OAFP is responsible for coordinating antifraud efforts, developing  antifraud policies, and creating and implementing fraud mitigation plans  across SSA, among other things. These responsibilities are consistent  with leading practices. According to the Fraud Risk Framework, agency  managers can show commitment to combating fraud by creating a  structure with a dedicated entity to lead fraud risk management activities  and coordinate antifraud initiatives across the agency. In addition, leading  practices call for the designated antifraud entity to, among other things,  serve as the repository of knowledge on fraud risks and controls and lead  or assist with trainings and other fraud-awareness activities. Since the  OAFP was established, the office has performed several of these  activities. For example, the OAFP has taken steps to coordinate antifraud  initiatives across SSA by gathering information about progress on the  initiatives, and has helped create antifraud training materials for the  agency. In addition, the OAFP formed a committee in 2015, made up of  associate commissioners from across the agency, to work on antifraud  initiatives.
SSA’s Acting Commissioner has reinforced SSA’s commitment to  combating fraud by communicating the importance of antifraud efforts in  multiple ways. For example, the Acting Commissioner highlighted SSA’s  antifraud efforts in a March 2015 virtual town hall meeting, which more  than 27,000 SSA staff participated in by video or in person, and issued a  “Commissioner’s broadcast” to all employees, encouraging staff to  provide suggestions for combating fraud via an e-mail box launched in  March 2014. From March 2014 through the end of December 2016, SSA  received 399 suggestions and implemented 8 of them by, for example,  adding examples and a cross-reference in SSA’s operations manual to  help employees identify potential beneficiary fraud. In addition, the Acting  Commissioner included preventing waste, fraud, and abuse as a guiding  principle in SSA’s strategic plan and supported the launch in early 2015 of  SSA’s antifraud website, which includes a link for the public to report  suspected fraud to the OIG.
Although these steps are generally consistent with leading practices in  fraud risk management, the OAFP faced challenges during its first 2  years to fully establish itself within the agency. Specifically, the OAFP  faced challenges related to a lack of consistent leadership and  established institutional relationships. However, recent actions may help  to address these challenges:
Lack of consistent leadership: Until recently, the OAFP had not had a  permanent leader who provided accountability for the agency’s  antifraud initiatives. When the OAFP was established, SSA  designated the OAFP associate commissioner as the agency’s chief  fraud prevention officer. According to SSA officials, from the summer  of 2015 until September 2016, two Senior Executive Service (SES)  candidates served successive 6-month periods as the OAFP’s acting  associate commissioner. In September 2016, a third SES candidate  was appointed as the acting associate commissioner of the OAFP.  Upon confirmation as a member of the SES, he became the OAFP’s  permanent associate commissioner and assumed the role of SSA’s  chief fraud prevention officer in October 2016, according to SSA  officials.
Lack of established institutional relationships: The OAFP is a relatively  new, small office that is still building relationships and establishing its  role across the agency for which it is charged with overseeing fraud  risk management efforts. According to SSA officials, the process of  building relationships across the agency will likely require additional  time to become more fully implemented. The OAFP is relatively small  compared with the size and complexity of SSA’s 11 components. In  fiscal year 2016, the OAFP had approximately 60 full-time equivalent  staff, who were in charge of coordinating antifraud initiatives, among  other tasks, across SSA, which employs over 60,000 full-time  equivalent staff, excluding DDS staff. The OAFP is also in the process  of overcoming perceptions of mission overlap. For example, according  to SSA officials, there were initial concerns about the OAFP’s role in  identifying potential fraud overlapping with the OIG’s role in  investigating potential fraud. In August 2015, the Acting  Commissioner of SSA approved a memo to components across the  agency including the OIG that clarified the function and  responsibilities of the OAFP.
section_title: SSA Has Taken Steps to Identify and Address Disability Fraud Risks but Has Not Conducted a Comprehensive Fraud Risk Assessment or Developed an Antifraud Strategy
subsections: section_title: Steps Taken to Identify Fraud Risks in Disability Programs but Not to Conduct a Comprehensive Fraud Risk Assessment
paragraphs: SSA has undertaken efforts over the last year to identify fraud risks in its  disability programs but has not comprehensively assessed the fraud risks  identified through those efforts. Leading practices in fraud risk  management call for the agency’s designated antifraud entity to lead  fraud risk assessments and plan to conduct updated assessments on a  regular basis. In planning the fraud risk assessment, leading practices call  for managers to tailor the fraud risk assessment to the program by,  among other things, identifying appropriate tools, methods, and sources  for gathering information about fraud risks and involving relevant  stakeholders in the assessment process. Fraud risk assessments that  align with leading practices involve (1) identifying inherent fraud risks  affecting the program, (2) assessing the likelihood and impact of those  fraud risks, (3) determining fraud risk tolerance, (4) examining the  suitability of existing fraud controls and prioritizing residual fraud risks,  and (5) documenting the results. There is no universally accepted  approach for conducting fraud risk assessments because circumstances  among programs vary.
In spring 2016, SSA took steps to identify fraud risks in its disability  programs by contracting with a third party, but this effort was not intended  to be a comprehensive fraud risk assessment. According to the  contractor’s report, the initial goals of the project were to develop a fraud  risk assessment methodology that could be refined and updated over  time and to conduct a pilot study of fraud risks in SSA’s disability  programs by applying the risk assessment method. The contractor  developed risk profiles for four fraud risks in SSA’s disability programs,  including a qualitative assessment of the likelihood, impact, and  significance of each risk, as well as potential responses to each risk. The  contractor also included several other examples of fraud risks in SSA’s  disability programs in its final report but did not assess these other risks.  Both the contractor and SSA cited the limited time frame for the effort as  a reason for not completing the initial project goal of applying the fraud  risk assessment method more comprehensively. For example, because of  the limited time frame, the contractor was not able to include disability- program experts on the risk assessment team or review risk information  beyond information included in documents provided by SSA stakeholders.  Although it was not able to conduct a comprehensive assessment of fraud  risks in SSA’s disability programs, the contractor stated in its final report  that its assessment of four fraud risks provided a successful proof-of- concept of its risk assessment method and that SSA could apply and  update that method over time.
SSA also identifies fraud risks in other ways. Specifically, according to  SSA officials, the OAFP hired a contractor to conduct interviews of SSA  and DDS staff in the spring and summer of 2016 to gather information on  patterns and characteristics of fraud in its disability programs to help  develop an antifraud data-analytics model. However, they noted that the  final report will not be available until mid-2017. In addition, according to  SSA officials, SSA may become aware of fraud risks through information  provided by the OIG’s Office of Investigations and from SSA field offices  and hearing offices. These ongoing activities may provide SSA  information on fraud risks in its disability programs but do not provide an  overall assessment of fraud risks.
SSA plans to assess fraud risks, but it is unclear when or how an  assessment of its disability programs will occur and whether it will follow  leading practices. SSA’s antifraud plans for 2016 to 2018 include an  objective to conduct regular fraud risk assessments but do not specify  which programs will be included. In addition, it is uncertain when or how  SSA will conduct these assessments because the plans do not describe  interim steps or specific time frames. SSA’s plans include reassessing  fraud risks in its programs on a regular basis, but the plans do not provide  timelines for updating its risk assessments. Further, it is not clear which  agency stakeholders will be involved in the process or what specific tools,  methods, and sources SSA will use to gather information about fraud  risks. SSA’s plans state that it will use information produced by its data- analytics system to assist with its risk assessments but, as discussed  below, this data-analytics system is in the early stages of development  and it may be years before the system produces information on disability  fraud schemes and trends that could be incorporated into a fraud risk  assessment. According to a senior OAFP official, the risk-assessment  effort is on hold because the OAFP is focusing its staff resources on  developing its data-analytics system. However, information on the relative  likelihood and impact of fraud risks identified through a fraud risk  assessment can help ensure that the data-analytics system is  appropriately targeted and that the OAFP’s resources are focused on  SSA’s most significant fraud risks.
Conducting fraud risk assessments that involve relevant stakeholders and  align with other leading practices, and updating such assessments on a  regular basis, can help identify fraud vulnerabilities before any actual  fraud occurs and better position management to take steps to strengthen  antifraud controls. Without planning and conducting regular,  comprehensive assessments of fraud risks in its disability programs and  documenting the results, SSA does not have reasonable assurance that it  has implemented antifraud controls to mitigate risks in its disability  programs and may be vulnerable to new or emerging fraud risks.
section_title: SSA Has Several Control Activities to Address Fraud but Lacks a Risk-Based Strategy to Guide Its Efforts
paragraphs: SSA has several control activities that seek to prevent, detect, and  respond to fraud in its disability programs. However, SSA has not  developed and documented an overall antifraud strategy to guide its  design and implementation of antifraud activities and help ensure it has  sufficient and appropriate controls in place to mitigate its most significant  fraud risks. Leading practices in fraud risk management call for managers  to document an antifraud strategy that links antifraud activities to the  program’s most significant fraud risks. Although SSA has not developed  and documented an overall antifraud strategy, SSA has implemented  several initiatives, some of which it created after identifying specific fraud  risks. For example, after large-scale fraud schemes in SSA’s New York  region highlighted the possibility that third parties could facilitate fraud  against SSA, the agency established fraud examination units in 2014 to  help detect these types of fraud schemes in the future. In addition, after  identifying an issue in 2011 with the case management system used by  administrative law judges that could potentially allow judges to improperly  reassign cases, SSA officials said that they took steps such as changing  system access rules to reduce the likelihood that this issue could occur.
SSA performs several control activities that are designed to prevent,  detect, and respond to disability program fraud. SSA considers risk when  implementing some of these activities, for example by considering the  likelihood an individual transaction may be fraudulent or the overall  amount of funds involved. SSA’s antifraud activities include the following,  among others:
Cooperative Disability Investigation (CDI) units: SSA and the OIG  established CDI units in fiscal year 1997 to help prevent and detect  potential disability fraud and have increased the number and  coverage of the units in recent years. A typical CDI unit is staffed with  an OIG agent who serves as the unit leader, SSA program specialists  and DDS examiners who serve as experts on SSA disability policies  and procedures, and state or local law-enforcement officers who  gather evidence through covert surveillance operations or interviews.  As of January 2017, there were 39 CDI units covering 33 states, the  District of Columbia, and Puerto Rico, which is up from 26 units  covering 22 states and Puerto Rico in fiscal year 2014.
Most referrals come to CDI units from DDS examiners who identify  suspicious information during an initial eligibility determination or  reconsideration, but referrals can also come from administrative law  judges during their review of appealed decisions, as well as from  other sources such as SSA field offices and the general public. Unit  leaders screen referrals and, if the case is accepted, law-enforcement  officers conduct an investigation. Staff from one CDI unit we  interviewed said they spend more investigative resources on cases  that could have more of a financial effect, such as younger individuals  who could potentially receive more benefits over their lifetimes. After  an investigation, CDI units prepare a summary report of their findings  that DDS or SSA staff are required to consider in making a disability  determination, which could help prevent or stop fraudulent benefits  from being paid.
Categories of Fraud Control Activities  Control activities for managing fraud risks fall  into three general categories—prevention,  detection, and response. These categories  are interdependent, and activities can often  serve more than one purpose.  Fraud prevention activities include efforts to  mitigate the risk of fraud occurring or to  identify potential fraud before making  payments.  Fraud detection activities help discover fraud  that has already occurred.  Response activities include actions to  address instances of potential fraud, such as  referring potential fraud cases for investigation  and prosecution, as well as actions to remedy  the harm caused by proven fraud.  Preventive activities generally offer the most  cost efficient use of resources, since they  enable managers to avoid a costly and  inefficient “pay-and-chase” model in which  fraudulent transactions are detected and then  attempts are made to recover funds after  payments have occurred.
Fraud examination units: SSA established fraud examination units in  2014. These units help detect potential third-party disability fraud and  help respond to known fraud cases perpetrated by doctors,  representatives, and other third parties. The units are staffed with  SSA disability examiners from regional offices who assist the OIG with  disability fraud investigations involving third parties and help  reevaluate disability claims that could have been affected by known  fraudsters. For example, unit staff can analyze groups of potentially  fraudulent cases to identify trends or suspicious information, such as  inconsistencies, altered medical records, or similar or identical  medical evidence used in multiple claims. After their analysis,  examiners share their findings with the OIG to consider in its  investigation. In addition, fraud examination unit staff reevaluate  disability claims that have evidence from third parties involved in fraud  schemes, such as a case that was uncovered in Puerto Rico where  third-party facilitators conspired with claimants to submit evidence for  fabricated or exaggerated disabilities, resulting in 27 defendants  sentenced as of September 2014, according to a report from SSA’s  OIG. During a reevaluation, unit examiners help evaluate whether  there is sufficient evidence of a claimant’s disability after evidence  from a physician or other third party involved in a fraud scheme is  excluded, or whether other evidence and further evaluation is needed  to support the claim.
Antifraud training and awareness-raising for SSA employees: As  mentioned earlier in this report, SSA has annual mandatory antifraud  training for all staff and multiple activities designed to raise awareness  among employees about fraud, which can help deter and detect  potential disability fraud by educating staff on how to identify and  report suspicious activity. Since 2014, SSA has developed three 30- minute antifraud training videos that explain fraud and fraud-related  terms, highlight OIG success stories and agency antifraud activities,  and instruct employees on how to report potential fraud. Employees  view the training through SSA’s online learning management  system—which tracks completion of the course—or in other ways,  such as in group settings. SSA requires managers to certify that  employees completed the training. In addition, SSA has multiple  sources of fraud-awareness information, such as newsletters, an  internal website page, memos, and OIG presentations that highlight  agency antifraud activities and instruct staff on how to identify and  report potential fraud.
Antifraud communications to the public: SSA promotes fraud  awareness externally, which can help prevent fraud by deterring  potential fraudsters and detect potential fraud by encouraging the  public to report suspicious activity. For instance, SSA provides fact  sheets, posters, articles, web graphics, and social media posts on its  website for groups, organizations, and individuals to use to help  promote SSA’s antifraud messages. SSA’s website also contains  information on how to report suspected fraud, a message from the  Acting Commissioner warning the public that SSA will find and  prosecute fraudsters, and examples of what SSA is doing to combat  fraud. In addition, SSA includes antifraud language on notices to  beneficiaries, which includes the OIG’s hotline number and website.
Antifraud data analytics: SSA is in the beginning stages of developing  a data-analytics system to help prevent and detect potential fraud.  According to agency officials, this system will include multiple models,  and SSA plans to contract for a disability-related model after mid- fiscal year 2017 that will likely use data from several SSA databases  to help identify pending disability claims that may be fraudulent on the  basis of conditions that are indicative of disability fraud. As previously  discussed, the OAFP worked with a contractor in fiscal year 2016 to  conduct interviews with SSA staff who are familiar with the disability  programs to help understand how fraud might occur in those  programs. The OAFP plans to use that information to help guide its  development of the model and what data may be required.  According to OAFP officials, the agency plans to develop models that  will rank claims by the likelihood of potential fraud so that analysts can  focus on reviewing highly ranked claims more closely. SSA plans for  the system to run in real time, which would allow SSA to examine  questionable claims before they are fully processed and prevent  potentially fraudulent benefits from being paid.
Prosecution and sanctions: SSA has additional activities to respond to  fraud and potential fraud and has taken steps to improve its  processes. For example, SSA has provided attorneys to serve as  fraud prosecutors to supplement the prosecutorial resources of the  Department of Justice, which has responsibility for criminally  prosecuting SSA fraud cases. Specifically, SSA doubled the number  of fraud attorneys to 24 in fiscal year 2015 compared with early fiscal  year 2014. In fiscal year 2015, the SSA attorneys secured 171  convictions resulting in over $16 million in restitution, according to an  SSA report. Additionally, SSA can impose administrative sanctions—a  temporary suspension of benefit payments for 6 to 24 months—on  individuals who knowingly provide false or misleading information to  SSA or fail to disclose information that is material to determining a  right to benefits. In 2013, SSA implemented a new process to  increase the consistency of imposing administrative sanctions and  implemented a tool for improved tracking and monitoring of  administrative sanctions in 2016.
SSA has other program integrity activities that can help detect potential  fraud in its disability programs, although these activities were not  designed for this specific purpose. For example, SSA performs analytics  to prevent and detect suspicious online transactions, such as unusual  direct deposit requests. According to SSA officials, in fiscal year 2016,  SSA reviewed over 29,000 suspicious online transactions and referred  1,460 of those transactions to the OIG. Some of these transactions may  involve disability benefits. According to SSA officials, the agency’s system  to prevent and detect suspicious online transactions ranks such  transactions by the likelihood of potential fraud, which helps focus reviews  on the cases that are most likely to be fraudulent. SSA also uses data- matching techniques and participates in external data-sharing  agreements to help determine benefit eligibility and detect improper  payments, of which some may be fraudulent disability benefit payments.  For example, SSA uses the Department of Health and Human Services’  National Directory of New Hires—a database containing quarterly wage  data—to help determine an individual’s initial and continued eligibility for  DI and SSI benefits. Another data match enables the agency to verify SSI  applicants’ and recipients’ bank account balances to determine whether  they failed to report monetary resources that could affect their benefit  amount or render them ineligible. Additionally, DDS examiners conduct  periodic continuing disability reviews of disability beneficiaries to  determine whether they remain eligible for benefits. If examiners identify  suspicious evidence, such as conflicting medical information, during these  reviews and perceive potential fraud, they are instructed to refer the case  to the OIG for investigation.
SSA has reported on the status of its antifraud initiatives and has a plan  that includes high-level goals and objectives for managing fraud risks.  However, it is unclear whether SSA’s antifraud initiatives are targeting the  most significant fraud risks in SSA’s disability programs because SSA has  not developed or documented an antifraud strategy that aligns antifraud  activities to the most significant fraud risks identified through a  comprehensive fraud risk assessment. SSA reported to the  Subcommittee on Social Security, Committee on Ways and Means, in the  House of Representatives in December 2014 and November 2015 on its  antifraud initiatives, but these reports essentially provide summaries of  antifraud efforts rather than a proactive strategy to guide SSA’s efforts  moving forward. In particular, the reports generally do not clearly link  antifraud activities to specific fraud risks by, for example, describing how  the activities can address identified fraud risks. In September 2016, SSA  completed a high-level antifraud plan that lists the agency’s antifraud- related goals for 2016 to 2018. The plan outlines specific initiatives  related to each goal but generally does not describe how these initiatives  can help SSA address identified fraud risks. For example, the plan  includes an initiative to increase the number of attorneys that serve as  fraud prosecutors for SSA. The plan states that officials responsible for  the initiative will determine strategic locations for the prosecutors but does  not indicate how SSA will consider fraud risk in different areas when  identifying locations for the prosecutors.
Without developing and documenting an antifraud strategy that considers  the likelihood and impact of fraud risks along with its tolerance for these  risks and its existing activities to mitigate them, as called for in leading  practices, SSA cannot ensure that it has a coordinated approach to  address the range of fraud risks in its disability programs and  appropriately target the most significant risks. Developing an antifraud  strategy can help SSA ensure that it has an appropriate balance of fraud  prevention and detection activities to address its risks and can help SSA  target its program integrity resources to the antifraud activities that would  most cost effectively mitigate its fraud risks.
section_title: SSA Does Not Have Effective Metrics to Monitor and Evaluate Its Antifraud Activities
paragraphs: SSA monitors its antifraud activities—including those to protect its  disability programs—through the OAFP and NAFC, but the metrics SSA  uses do not enable effective monitoring and evaluation. According to SSA  documents, the OAFP is responsible for monitoring SSA’s antifraud  activities and establishing performance and outcome-oriented goals for  them. The OAFP receives updates from the components that are  responsible for each antifraud initiative and has shared these updates  with the NAFC through periodic meetings and with Congress through  reports about SSA’s antifraud initiatives. The OAFP provides flexibility to  the SSA components in developing and identifying the metrics that are  used to assess and report on antifraud initiatives, and, according to an  OAFP official, the office does not revise the metrics submitted by  components. Leading practices identified in the Fraud Risk Framework  call for managers to develop outcome-oriented measures to monitor and  evaluate fraud risk management activities and to adapt activities based  on the results. In addition, according to federal internal control standards,  managers should establish and operate activities to monitor the internal  control system and evaluate the results, which may be compared against  an established baseline. Furthermore, agency-wide strategic planning  requirements established under the Government Performance and  Results Act of 1993 (GPRA) and enhanced by the GPRA Modernization  Act of 2010 required agencies to establish outcome-oriented goals and a  balanced set of performance indicators, including output and outcome  indicators as appropriate, in measuring or assessing progress toward  goals. Although these requirements apply at the agency level, in our  prior work we have reported that these requirements can serve as leading  practices for strategic planning at lower levels within federal agencies,  such as planning for individual divisions, programs, or initiatives.
However, we found that SSA does not track most of its antifraud  initiatives via outcome-oriented metrics to help the agency regularly  measure progress in achieving targets. Of the 17 ongoing initiatives listed  in SSA’s 2015 antifraud initiatives report, we found that 10 had metrics  that were not outcome-oriented, and 4 did not have any metrics. For  example, the percentage of staff trained in fraud detection and prevention  methods (an output) is listed as a metric of the antifraud training initiative, but SSA does not evaluate the outcomes associated with those trainings  such as the change in particular behaviors following the trainings (e.g.,  the number of referrals to OIG about schemes covered during the  trainings). In addition, the 2015 report lists the fraud examination units  and fraud case reviews as initiatives but does not include metrics for  either. Further, the majority of antifraud initiatives do not provide targets  against which to measure performance and track progress relative to a  baseline. For example, the initiative to add antifraud language to SSA  notices states the “number of notices issued annually with antifraud  language is over 186 million notices” as a metric but does not include a  target.
As previously mentioned, the NAFC receives updates on SSA’s antifraud  initiatives from the OAFP, but it plays a limited role in monitoring and  making decisions about the initiatives. SSA antifraud initiatives reports  state that the NAFC monitors certain antifraud initiatives. For example,  the 2015 report notes that the NAFC identified 10 major antifraud  initiatives to monitor that year. Although not all NAFC members attend its  meetings, the NAFC meets at least quarterly to sustain attention on  antifraud initiatives. The NAFC meetings provide an opportunity to  present updates and ensure committee members are aware of ongoing  initiatives. However, our review of summaries from the seven NAFC  meetings held during fiscal year 2016 found that the NAFC generally did  not take an active role in monitoring the initiatives. For example, six of the  seven NAFC meeting minutes did not indicate instances in which the  NAFC requested further information to determine whether antifraud  initiatives were meeting their intended goals or recommend changes to  improve antifraud initiatives. According to SSA officials with responsibility  for implementing antifraud initiatives, the NAFC serves as a forum for  updates about antifraud initiatives, including efforts being implemented in  SSA’s regions, but makes few decisions about the initiatives and  performs limited monitoring of them.
SSA recognizes the importance of monitoring, but it is unclear how it  plans to evaluate its antifraud activities and adapt them if necessary. We  have previously reported that agencies may face challenges measuring  outcomes of fraud risk management activities in a reliable way. These  challenges include the difficulty of measuring the extent of deterred fraud,  isolating potential fraud from legitimate activity or other forms of improper  payments, and determining the amount of undetected fraud. However, as described in the Fraud Risk Framework, it is possible for agencies to  gather additional information on the short-term or intermediate outcomes  of some antifraud initiatives, which may be more readily measured than  ultimate benefits. For example, although SSA does not have a metric to  monitor the fraud examination units or to evaluate their effect on fraud, it  is possible for SSA to identify more immediate outcomes such as the  number of potential fraud patterns that the units uncover doing  nonreevaluation work. SSA’s antifraud strategic plan for 2016 to 2018  includes an objective to “adapt fraud risk management activities and  communicate the results of monitoring and evaluations to management.”  Although the plan highlights the importance of monitoring to help  strengthen fraud risk management activities, it does not include specific  steps for monitoring its antifraud initiatives. Identifying performance  metrics, including baselines and targets as appropriate, and requiring  additional information from the responsible components on progress  made would help the OAFP and NAFC better monitor whether SSA is  achieving its antifraud goals. Without this information, the OAFP and  NAFC may not be able to determine whether SSA’s antifraud activities  are operating effectively or determine whether changes are necessary.
section_title: Conclusions
paragraphs: Proactively managing fraud risks can help facilitate SSA’s mission by  ensuring that government services function as intended, and SSA has  taken some steps to manage these risks. Many of SSA’s actions such as  establishing an entity dedicated to coordinating fraud risk management  activities and instituting annual antifraud training throughout the agency  are consistent with leading practices and demonstrate a commitment to  managing fraud risks. However, gaps exist in the agency’s fraud risk  assessment, corresponding strategy design, and monitoring of antifraud  activities. Despite some foundational efforts such as piloting a method for  conducting future assessments by profiling four particular risks, until it  conducts a thorough, systematic assessment of its fraud risks, SSA will  lack robust information on the risks that may most affect the integrity of its  disability programs. As a result, SSA may be using its resources to  combat fraud schemes that are unlikely to materialize or that have a  relatively minimal effect on SSA’s finances or reputation. Although SSA  plans to assess fraud risks, it is unclear when an assessment of its  disability programs will occur and whether it will reflect leading practices.
Absent a comprehensive fraud risk assessment that aligns with leading  practices and is regularly updated, SSA will not be equipped to address  the fraud schemes to its disability programs that are considered to be the  most significant before they occur. Similarly, without developing,  documenting, and implementing a comprehensive antifraud strategy that  builds on a comprehensive risk assessment, as called for by leading  practices, SSA cannot ensure that its antifraud control activities are  targeted to its fraud risks, and therefore may be using its resources for  program integrity efforts inefficiently.
Further, by creating the OAFP and reestablishing the NAFC, SSA has laid  some important groundwork for monitoring and evaluating SSA’s  antifraud activities. However, without establishing outcome-oriented  metrics and then regularly reviewing progress toward meeting these  goals, the OAFP will not be able to determine whether the agency’s  antifraud control activities are working as intended. The OAFP is charged  with coordinating among SSA’s components that lead particular antifraud  efforts and establishing outcome-oriented goals; the NAFC—with its  higher, cross-agency authority—is well-positioned to consider, act on, and  help enforce the OAFP’s recommendations. If the OAFP does not review  progress toward meeting antifraud goals and then recommend changes  to any antifraud control activities that are not meeting goals, SSA will be  hard-pressed to address known fraud risks and to respond to emerging  risks that could undermine the agency’s antifraud efforts.
section_title: Recommendations for Executive Action
paragraphs: We recommend that the Commissioner (or Acting Commissioner) of SSA  direct the OAFP to take the following four actions for its disability  programs:  lead a comprehensive fraud risk assessment that is consistent with  leading practices, and develop a plan for regularly updating the  assessment; develop, document, and implement an antifraud strategy that is  aligned to its assessed fraud risks; work with components responsible for implementing antifraud  initiatives to develop outcome-oriented metrics, including baselines  and goals, where appropriate for antifraud activities; and  review progress toward meeting goals on a regular basis, and  recommend that the NAFC make changes to control activities or take  other corrective actions on any initiatives that are not meeting goals.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to SSA for review and comment, and its  written comments are reproduced as appendix I in this report. SSA  agreed with our recommendations and emphasized its commitment to  preventing and detecting fraud. The agency also provided technical  comments, which we incorporated into the report as appropriate. SSA  described how it plans to address our recommendations as follows:
Regarding our recommendation to lead a comprehensive fraud risk  assessment of SSA’s disability programs, SSA agreed and stated that  it will conduct a fraud risk assessment on its major lines of business  on a recurring schedule, beginning with disability in fiscal year 2017.  The agency stated that it will conduct this assessment after  developing a fraud risk management strategy that is consistent with  leading practices identified in the Fraud Risk Framework. Although it  is important to take a strategic approach to assessing fraud risks, we  maintain that an effective fraud risk management strategy is based on  a comprehensive fraud risk assessment.
Regarding our recommendation to develop, document, and implement  an antifraud strategy that is aligned to assessed fraud risks, SSA  agreed and stated that it will prioritize and align the agency’s antifraud  strategy to the outcomes of the fraud risk assessment.
Regarding our recommendation to work with components responsible  for implementing antifraud initiatives to develop outcome-oriented  metrics, including baselines and goals, where appropriate for antifraud  activities, SSA agreed and noted that it will collaborate with  stakeholders, including its OIG, to implement this recommendation.
Regarding our recommendation to review progress toward meeting  goals on a regular basis and to recommend that the NAFC make  changes to any control activities or initiatives that are not meeting  goals, SSA agreed. The agency stated that, as it develops its  antifraud strategy, the NAFC will measure and recommend necessary  corrective action to ensure that its initiatives achieve SSA’s stated  objectives and goals. In addition, SSA stated that it will seek  opportunities to prioritize initiatives and activities through a risk-based  approach to mitigating the risk of program fraud.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send a copy to the Acting Commissioner  of Social Security. In addition, the report will be available at no charge on  the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  Seto J. Bagdoyan at (202) 512-6722 or bagdoyans@gao.gov or Cindy  Brown Barnes at (202) 512-7215 or brownbarnesc@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. GAO staff who made key  contributions to this report are listed in appendix II.
section_title: Appendix II: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to the contacts named above, Tonita Gillich (Assistant  Director), Joel Green (Analyst-in-Charge), Daniel Bertoni, Erin  McLaughlin, and Bridgette Savino made key contributions to this report.  Also contributing to the report were Holly Dye, Alexander Galuten, Erin  Godtland, Maria McMullen, Kevin Metcalfe, James Murphy, Shana  Wallace, David Watsula, and Greg Whitney.