SSA Disability Benefits: Antifraud Efforts Need a Comprehensive Strategic Approach
Published: 2017-04-26T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: This testimony summarizes the information contained in GAO's April 2017 report, entitled SSA Disability Benefits: Comprehensive Strategic Approach Needed to Enhance Antifraud Activities ( GAO-17-228 ).
section_title: What GAO Found
paragraphs: The Social Security Administration (SSA) has taken steps to establish an organizational culture and structure conducive to fraud risk management in its disability programs, but its new antifraud office is still evolving. In recent years, SSA instituted mandatory antifraud training, established a centralized antifraud office to coordinate and oversee the agency's fraud risk management activities, and communicated the importance of antifraud efforts. These actions are generally consistent with GAO's Fraud Risk Framework, a set of leading practices that can serve as a guide for program managers to use when developing antifraud efforts in a strategic way. However, SSA's new antifraud office, the Office of Anti-Fraud Programs (OAFP), faced challenges establishing itself as the coordinating body for the agency's antifraud initiatives. For example, the OAFP has had multiple acting leaders, but SSA recently appointed a permanent leader of OAFP to provide accountability for the agency's antifraud activities.
SSA has taken steps to identify and address fraud risks in its disability programs, but it has not yet comprehensively assessed these fraud risks or developed a strategic approach to help ensure its antifraud activities effectively mitigate those risks. Over the last year, SSA gathered information about fraud risks, but these efforts generally have not been systematic and did not assess the likelihood, impact, or significance of all risks that were identified. SSA also has several prevention and detection activities in place to address known fraud risks in its disability programs such as fraud examination units, which review disability claims to help detect fraud perpetrated by third parties. However, SSA has not developed and documented an overall antifraud strategy that aligns its antifraud activities to its fraud risks. Leading practices call for federal program managers to conduct a fraud risk assessment and develop a strategy to address identified fraud risks. Without conducting a fraud risk assessment that aligns with leading practices and developing an antifraud strategy, SSA's disability programs may remain vulnerable to new fraud schemes, and SSA will not be able to effectively prioritize its antifraud activities.
SSA monitors its antifraud activities through the OAFP and its National Anti-Fraud Committee (NAFC), which serves as an advisory board to the OAFP, but the agency does not have effective performance metrics to evaluate the effect of such activities. The OAFP has responsibility for monitoring SSA's antifraud activities and establishing performance and outcome-oriented goals for them. It collects metrics to inform reports about its antifraud initiatives, and the NAFC receives regular updates about antifraud initiatives. However, the quality of the metrics varies across initiatives and some initiatives do not have metrics. Of the 17 initiatives listed in SSA's 2015 report on antifraud initiatives, 10 had metrics that did not focus on outcomes, and 4 did not have any metrics. For example, SSA lacks a metric to help monitor the effectiveness of its fraud examination units. Leading practices in fraud risk management call for managers to monitor and evaluate antifraud initiatives with a focus on measuring outcomes. Without outcome-oriented performance metrics, SSA may not be able to evaluate its antifraud activities, review progress, and determine whether changes are necessary.

section_title: Letter
paragraphs: I am pleased to be here today to discuss the Social Security  Administration’s (SSA) approach to managing fraud risks in its disability  programs. SSA provides cash benefits through two main programs to  millions of Americans with disabilities who are unable to work: Disability  Insurance (DI) and Supplemental Security Income (SSI). Collectively,  payments from these programs were about $200 billion in fiscal year  2015. Although the extent of fraud in these programs is unknown, high- profile cases have highlighted instances in which individuals fraudulently  obtained benefits. For example, according to a report from SSA’s Office  of the Inspector General (OIG), over 70 individuals in New York pled  guilty in 2014 to participating in a conspiracy to obtain at least $14 million  in fraudulent SSA disability benefits. DI and SSI are on the Office of  Management and Budget’s list of programs designated as high risk for  improper payments, which include, but are not limited to, payments made  as a result of fraud.
Today, we are publicly releasing a report that addresses SSA’s actions to  manage fraud risk in its disability programs and the extent to which these  actions align with leading practices. My statement highlights the key  findings and recommendations from that report. Specifically, my  statement discusses SSA’s actions for managing fraud risks in its  disability programs and the extent to which these actions align with  leading practices for (1) establishing an organizational culture and  structure conducive to fraud risk management, (2) identifying, assessing,  and addressing fraud risks in its disability programs, and (3) monitoring  and evaluating its fraud risk management activities.
To identify and examine SSA’s actions, we reviewed SSA documents  including annual antifraud reports, operational guidance, and prior SSA  OIG and GAO reports. We also interviewed SSA officials from across the  agency’s headquarters including those in the Office of Anti-Fraud  Programs (OAFP). In addition, we interviewed staff in all three of SSA’s  fraud examination units. To assess SSA’s actions, we compared them  with leading practices identified in our July 2015 A Framework for  Managing Fraud Risks in Federal Programs (Fraud Risk Framework). In  addition, we assessed SSA’s actions against federal internal control  standards such as those related to managing fraud risks. The report  being released today includes further details about our methodology. Our  work was performed in accordance with generally accepted government  auditing standards.
With respect to the first set of leading practices, we found that SSA has  taken steps to establish an organizational culture and structure that are  conducive to managing fraud risks in its disability programs, but some  efforts are relatively recent. The agency has demonstrated a senior-level  commitment to combating fraud in its disability programs and has worked  to involve all levels of the agency in setting an antifraud tone. For  example, in April 2014, SSA reestablished the National Anti-Fraud  Committee (NAFC) to provide support for national and regional antifraud  activities. The NAFC is composed of deputy commissioners from across  the agency and other SSA executives who meet at least quarterly, which  helps to demonstrate a senior-level commitment to combating fraud—one  of the Fraud Risk Framework’s leading practices. The NAFC invites  regional staff to its regular meetings and to an annual conference to  report on the progress of SSA’s antifraud initiatives, which helps involve  multiple levels of the agency in setting an antifraud tone. SSA also  demonstrated a commitment to combating fraud at all levels of the  agency when it implemented the first annual mandatory antifraud training  in 2014 for all SSA and Disability Determination Services (DDS) staff.  According to SSA officials, 97 percent of SSA employees and all DDS  employees except for those on extended leave completed the annual  antifraud training in 2016.
SSA further demonstrated a commitment to antifraud efforts when it  established the OAFP in November 2014. The OAFP is responsible for  coordinating antifraud efforts, developing antifraud policies, and creating  and implementing fraud mitigation plans across SSA, among other things.
These responsibilities are consistent with leading practices. According to  the Fraud Risk Framework, agency managers can show commitment to  combating fraud by creating a structure with a dedicated entity to lead  fraud risk management activities and coordinate antifraud initiatives  across the agency. In addition, leading practices call for the designated  antifraud entity to, among other things, serve as the repository of  knowledge on fraud risks and controls and lead or assist with trainings  and other fraud-awareness activities. Since the OAFP was established,  the office has performed several of these activities. For example, the  OAFP has taken steps to coordinate antifraud initiatives across SSA by  gathering information about progress on the initiatives, and has helped  create antifraud training materials for the agency.
Although these and other actions are generally consistent with leading  practices in fraud risk management, the OAFP faced challenges during its  first 2 years to fully establish itself within the agency. Specifically, the  OAFP faced challenges related to a lack of consistent leadership and  established institutional relationships. However, recent actions, if  sustained, may help to address these challenges:
Lack of consistent leadership: Until recently, the OAFP had not had a  permanent leader who provided accountability for the agency’s  antifraud initiatives. When the OAFP was established, SSA  designated the OAFP associate commissioner as the agency’s chief  fraud prevention officer. According to SSA officials, from the summer  of 2015 until September 2016, two Senior Executive Service (SES)  candidates served successive 6-month periods as the OAFP’s acting  associate commissioner. In September 2016, a third SES candidate  was appointed as the acting associate commissioner of the OAFP.  Upon confirmation as a member of the SES, he became the OAFP’s  permanent associate commissioner and assumed the role of SSA’s  chief fraud prevention officer in October 2016, according to SSA  officials.
Lack of established institutional relationships: The OAFP is a relatively  new, small office that is still building relationships and establishing its  role across the agency for which it is charged with overseeing fraud  risk management efforts. According to SSA officials, the process of  building relationships across the agency will likely require additional  time to become more fully implemented. The OAFP is relatively small  compared with the size and complexity of SSA’s 11 components. In  fiscal year 2016, the OAFP had approximately 60 full-time equivalent  staff, who were in charge of coordinating antifraud initiatives, among  other tasks, across SSA, which employs over 60,000 full-time  equivalent staff, excluding DDS staff. The OAFP is also in the process  of overcoming perceptions of mission overlap. For example, according  to SSA officials, there were initial concerns about the OAFP’s role in  identifying potential fraud overlapping with the OIG’s role in  investigating potential fraud. In August 2015, the Acting  Commissioner of SSA approved a memo to components across the  agency including the OIG that clarified the function and  responsibilities of the OAFP.
With respect to the leading practices for identifying, assessing, and  addressing fraud risks—the second area we addressed in our report—we  found that SSA has undertaken efforts over the last year to identify fraud  risks in its disability programs but has not comprehensively assessed the  identified risks. For example, in spring 2016, SSA engaged a contractor to  develop a fraud risk assessment methodology that could be refined and  updated over time and to conduct a pilot study of fraud risks in SSA’s  disability programs by applying the risk assessment method. However,  this effort was not intended to be a comprehensive fraud risk assessment,  according to SSA officials. Leading practices in fraud risk management  call for the agency’s designated antifraud entity to lead fraud risk  assessments and plan to conduct updated assessments on a regular  basis. In planning the fraud risk assessment, leading practices call for  managers to tailor the fraud risk assessment to the program by, among  other things, identifying appropriate tools, methods, and sources for  gathering information about fraud risks and involving relevant  stakeholders in the assessment process. Fraud risk assessments that  align with leading practices involve (1) identifying inherent fraud risks  affecting the program, (2) assessing the likelihood and impact of those  fraud risks, (3) determining fraud risk tolerance, (4) examining the  suitability of existing fraud controls and prioritizing residual fraud risks,  and (5) documenting the results.
SSA plans to assess fraud risks, but it is unclear when or how an  assessment of its disability programs will occur and whether it will follow  leading practices. SSA’s antifraud plans for 2016 to 2018 include an  objective to conduct regular fraud risk assessments but do not specify  which programs will be included. In addition, it is uncertain when or how  SSA will conduct these assessments because the plans do not describe  interim steps or specific time frames. Further, it is not clear which agency  stakeholders will be involved in the process or what specific tools,  methods, and sources SSA will use to gather information about fraud  risks. SSA’s plans state that it will use information produced by its data- analytics system to assist with its risk assessments but this data-analytics  system is in the early stages of development and it may be years before  the system produces information on disability fraud schemes and trends  that could be incorporated into a fraud risk assessment. According to a  senior OAFP official, the risk-assessment effort is on hold because the  OAFP is focusing its staff resources on developing its data-analytics  system. However, information on the relative likelihood and impact of  fraud risks identified through a fraud risk assessment can help ensure  that the data-analytics system is appropriately targeted and that the  OAFP’s resources are focused on SSA’s most significant fraud risks.
Moreover, although SSA has several control activities that seek to  prevent, detect, and respond to fraud in its disability programs, it has not  developed and documented an antifraud strategy to guide its design and  implementation of these activities and help ensure it has sufficient and  appropriate controls in place to mitigate its most significant fraud risks, as  called for in leading practices. SSA’s antifraud activities include, among  other things, specialized units that investigate potential disability fraud  and antifraud communications to the public. In addition, after large-scale  fraud schemes in SSA’s New York region highlighted the possibility that  third parties could facilitate fraud against SSA, the agency established  fraud examination units in 2014 to help detect these types of fraud  schemes in the future. SSA has other program integrity activities that can  help detect potential fraud in its disability programs, although these  activities were not designed for this specific purpose. For example, SSA  performs analytics to prevent and detect suspicious online transactions,  such as unusual direct deposit requests. According to SSA officials, in  fiscal year 2016, SSA reviewed over 29,000 suspicious online  transactions and referred 1,460 of those transactions to the OIG. Some of  these transactions may involve disability benefits. SSA has reported on  the status of its antifraud initiatives and has a plan that includes high-level  goals and objectives for managing fraud risks. However, it is unclear if  SSA’s antifraud initiatives are targeting the most significant fraud risks in  SSA’s disability programs because SSA has not developed or  documented an antifraud strategy that aligns antifraud activities to its  most significant fraud risks.
With respect to the leading practices for monitoring and evaluating  activities—the third area we addressed in our report—we found that SSA  monitors its antifraud activities for its disability and other programs  through the OAFP and NAFC, but the metrics SSA uses do not enable  effective monitoring and evaluation. According to SSA documents, the  OAFP is responsible for monitoring SSA’s antifraud activities and  establishing performance and outcome-oriented goals for them. The  OAFP receives updates from the components that are responsible for  each antifraud initiative and has shared these updates with the NAFC  through periodic meetings and with Congress through reports about  SSA’s antifraud initiatives. However, we found that SSA does not track  most of its antifraud initiatives via outcome-oriented metrics to help the  agency regularly measure progress in achieving targets. Of the 17  ongoing initiatives listed in SSA’s 2015 antifraud initiatives report, we  found that 10 had metrics that were not outcome-oriented, and 4 did not  have any metrics. For example, the percentage of staff trained in fraud  detection and prevention methods (an output) is listed as a metric of the  antifraud training initiative, but SSA does not evaluate the outcomes  associated with those trainings such as the change in particular behaviors  following the trainings (e.g., the number of referrals to the OIG about  schemes covered during the trainings). In addition, the 2015 report lists  the fraud examination units and fraud case reviews as initiatives but does  not include metrics for either. Further, the majority of antifraud initiatives  do not provide targets against which to measure performance and track  progress relative to a baseline.
SSA recognizes the importance of monitoring, but it is unclear how it  plans to evaluate its antifraud activities and adapt them if necessary. We  have previously reported that agencies may face challenges measuring  outcomes of fraud risk management activities in a reliable way. These  challenges include the difficulty of measuring the extent of deterred fraud,  isolating potential fraud from legitimate activity or other forms of improper  payments, and determining the amount of undetected fraud. However,  as described in the Fraud Risk Framework, managers can gather  additional information on the short-term or intermediate outcomes of  some antifraud initiatives, which may be more readily measured than  ultimate benefits. For example, although SSA does not have a metric to  monitor the fraud examination units or to evaluate their effect on fraud, it  is possible for SSA to identify more immediate outcomes such as the  number of potential fraud patterns that the units uncover while reviewing  disability claims that may involve third-party fraud. Although SSA’s  antifraud strategic plan for 2016 to 2018 highlights the importance of  monitoring to help strengthen fraud risk management activities, it does  not include specific steps for monitoring its antifraud initiatives. Identifying  performance metrics, including baselines and targets as appropriate, and  requiring additional information from the responsible components on  progress made would help the OAFP and NAFC better monitor whether  SSA is achieving its antifraud goals. Without this information, the OAFP  and NAFC may not be able to determine whether SSA’s antifraud  activities are operating effectively or determine whether changes are  necessary.
In conclusion, although many of SSA’s actions are consistent with leading  practices and demonstrate a commitment to managing fraud risks, gaps  exist in the agency’s fraud risk assessment, corresponding strategy  design, and monitoring of antifraud activities. Despite some foundational  efforts such as piloting a method for conducting future assessments, until  it conducts a thorough, systematic assessment of its fraud risks, SSA will  lack robust information on the risks that may most affect the integrity of its  disability programs. As a result, SSA may be using its resources to  combat fraud schemes that are unlikely to materialize or that have a  relatively minimal effect on SSA’s finances or reputation. Although SSA  plans to assess fraud risks, it is unclear when an assessment of its  disability programs will occur and whether it will reflect leading practices.  Absent a comprehensive fraud risk assessment that aligns with leading  practices and is regularly updated, SSA will not be equipped to address  the fraud schemes that are considered to be the most significant before  they occur. Similarly, without developing, documenting, and implementing  a comprehensive antifraud strategy that builds on a comprehensive risk  assessment, as called for by leading practices, SSA cannot ensure that  its antifraud control activities are targeted to its fraud risks, and therefore  may be using its resources for program integrity efforts inefficiently.  Further, without establishing outcome-oriented metrics and then regularly  reviewing progress toward meeting these goals, the OAFP will not be  able to determine whether the agency’s antifraud control activities are  working as intended.
In the report that we publicly released today, we make several  recommendations to address gaps in SSA’s management of fraud risks.  Specifically, we recommend that the Acting Commissioner of SSA direct  the OAFP to take the following four actions for its disability programs:  lead a comprehensive fraud risk assessment that is consistent with  leading practices, and develop a plan for regularly updating the  assessment; develop, document, and implement an antifraud strategy that is  aligned to its assessed fraud risks; work with components responsible for implementing antifraud  initiatives to develop outcome-oriented metrics, including baselines  and goals, where appropriate for antifraud activities; and  review progress toward meeting goals on a regular basis, and  recommend that the NAFC make changes to control activities or take  other corrective actions on any initiatives that are not meeting goals.
In reviewing a draft of the report, SSA agreed with our recommendations  and emphasized its commitment to preventing and detecting fraud.
Chairman Johnson, Ranking Member Larson, and Members of the  Subcommittee, this concludes my prepared remarks. I would be happy to  answer any questions that you may have at this time.
subsections: section_title: GAO Contact and Staff Acknowledgments
paragraphs: For further information regarding this testimony, please contact Seto J.  Bagdoyan, (202) 512-6722 or bagdoyans@gao.gov. In addition, contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this statement. Individuals who made key  contributions to this testimony are Cindy Brown Barnes (Director), Tonita  Gillich (Assistant Director), Holly Dye, Erin Godtland, Joel Green, and  Erin McLaughlin.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.