Information Technology: Social Security Administration's Data Exchanges Support Current Programs, but Better Planning Is Needed to Meet Future Demands
Published: 2009-09-17T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Social Security Administration (SSA) receives electronic data from other agencies to support its own programs, and provides electronic data to support more than 800 state and federal agency partners. This information aids in, among other things, the processing and distribution of beneficiary payments and the delivery of services such as driver's license issuance and voter registration. SSA relies on its information technology (IT) infrastructure--its databases, applications, networks, and IT management practices--to support its current and future needs for exchanging data with its state and federal partners. GAO was asked to (1) determine the extent to which SSA's IT infrastructure effectively and efficiently supports current data exchanges, and any system-related problems affecting its exchange partners; and (2) describe SSA's efforts to ensure that its IT infrastructure can support the agency's and its partners' future data exchange environment. To do this, GAO analyzed agency documentation and interviewed SSA officials, as well as federal and state data exchange partners.
section_title: What GAO Found
paragraphs: Systems-related problems that affect SSA's ability to support outgoing data exchange programs have been few, and the agency has established effective procedures and mechanisms for addressing the problems that do occur. In this regard, SSA provides help-desk and on-site support to data exchange partners to help prevent or resolve problems, and uses procedures supported by a problem-identification and tracking system to facilitate problem resolution. State and federal partners with whom GAO held discussions stated that these efforts resulted in quick responses from SSA and effective resolution of problems that occurred. For example, a system that provides information for two data exchange programs that support driver's license issuance and voter registration in all 50 states was reported to have had almost 100 percent availability during the hours specified in the agreements governing these data exchanges. Further, all of the data exchange partners with whom GAO held discussions reported that the data that SSA provided were reliable. As a result, these partners stated that their ability to conduct business operations that depend on SSA data was not adversely affected by systems-related problems associated with SSA's IT infrastructure. SSA and its partners anticipate that the number of requests for outgoing data exchanges will continue to increase and that the exchanges will become more complex as agencies request that these exchanges take place through online, real-time transactions. However, SSA officials stated that the agency's existing IT infrastructure may not be able to support the increased demand that they and their partners anticipate. To address overall agency needs for a more cost-effective and efficient computing environment, the agency is taking steps to modernize its computing capabilities and supporting infrastructure. For example, the agency is in the process of implementing an updated database environment and upgrading its software applications--steps that are intended to enable expanded and more efficient IT service delivery, including the electronic exchange of data. However, the agency has not fully implemented IT management practices specifically related to its outgoing data exchange environment, such as conducting thorough analyses to project the expected increase in requests for data and online access. Conducting these analyses and using this information as input to the agency's target architecture (i.e., a formal description of the agency's future environment) are important practices to clearly define future requirements to guide the direction of the agency's data exchange programs. Implementing these management practices is essential to ensuring that the agency is well positioned to meet the growing needs of its data exchange partners.

section_title: Letter
paragraphs: Through more than 3,000 agreements with federal and state agencies, the  Social Security Administration (SSA) both receives incoming data to  support its own programs and provides outgoing data to support state and  other federal agencies’ programs. Specifically:  Information provided to SSA by other federal agencies aids in the  processing and electronic disbursement of, for example, beneficiary  payments or premium withholdings for entitlement programs such as the  Retirement, Survivors, and Disability Insurance Program and the  Supplemental Security Income Program.
Information that SSA provides to state and other federal agencies enables  more efficient processing of services such as driver’s license issuance,  voter registration, social services administration (such as food stamps),  employment verification and eligibility, and passport issuance.
The data that SSA provides are essential to helping state and federal  partners streamline operations, reduce costs, and eliminate overpayments  and fraud. To carry out these transactions—over 1 billion each year—the  agency relies on an information technology (IT) infrastructure consisting  of the hardware, software, networks, and management practices that  support capabilities to provide electronic data to and communicate with a  variety of external systems belonging to the agency’s data exchange  partners.
Given the significance of the data provided by these transactions, you  requested that we examine the effectiveness of the agency’s IT  infrastructure in supporting data exchanges that provide information to  state and other federal agencies. Our objectives were to (1) determine the  extent to which SSA’s IT infrastructure effectively and efficiently supports  its current data exchange programs, and describe any systems-related  problems that affect the agency’s state and federal data exchange partners  and (2) describe SSA’s efforts to ensure that its IT infrastructure can  support the agency’s and its partners’ future data exchange environment.
As requested, we focused our study on SSA’s data exchange programs that  affect the ability of state and federal partners’ to provide services to  individuals. These data exchanges provide electronic information that is  used to support state and other federal agencies’ programs—that is,  “outgoing” data exchanges—through the use of several components of  SSA’s IT infrastructure. SSA considers these to be “non-program” data  exchanges since they do not support the agency’s mission.
To address both of the objectives, we identified the components of SSA’s  IT infrastructure that support the agency’s data exchange programs, and  obtained and analyzed agency documentation describing these  components and SSA’s data exchange operations as well as plans to make  improvements to the agency’s IT infrastructure. We interviewed SSA  officials, including two regional office data exchange coordinators from  New York City and Kansas City, as well as officials of selected state and  federal data exchange partners, to obtain their views on the effectiveness  of SSA’s IT infrastructure in supporting data exchanges and on the  agency’s plans for improvements. We spoke with and collected  documentation from partners who represent various state agencies in New  York, California, Idaho, North Carolina, and Iowa, and from federal data  exchange partners within the Departments of Veterans Affairs, State,  Homeland Security, and Health and Human Services. We determined that  the data provided by SSA about the agency’s data exchange IT  infrastructure were sufficiently reliable for the purposes of our  engagement. Appendix I contains more details on our objectives, scope,  and methodology.
We conducted this performance audit from December 2008 to September  2009 at SSA’s headquarters in Baltimore, Maryland. We also met with state  agency officials in New York, California, Idaho, North Carolina, and Iowa  and with federal agency officials with the Departments of Veteran Affairs,  State, Homeland Security, and Health and Human Services in Washington,  D.C. We conducted our work in accordance with generally accepted  government auditing standards. Those standards require that we plan and  perform the audit to obtain sufficient, appropriate evidence to provide a  reasonable basis for our findings and conclusions based on our audit  objectives. We believe that the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: SSA currently maintains over 800 agreements that support exchanges  through which the agency provides data to state and federal partners  (approximately 700 state and almost 100 federal agency partners). These  agreements define the requirements, terms, and conditions under which  the data will be provided to the partners. In many cases, legislation  mandates the agency to provide electronic data in support of certain  programs. For example, SSA is required to provide data to the Veterans  Benefits Administration, which is part of the Department of Veterans  Affairs, in support of the Veterans Benefits Administration’s efforts to  determine benefits eligibility. In other cases, SSA voluntarily enters into  data exchange agreements with state and other federal agency partners.
subsections: section_title: IT Infrastructure Components Supporting SSA Data Exchanges
paragraphs: SSA’s existing IT infrastructure—databases, applications, networks, and  management practices—supports the agency’s daily operations and core  mission activities, such as administering monthly Retirement, Survivors,  and Disability Insurance and Supplemental Security Income benefits, as  well as its data exchange programs. Data provided to SSA’s data  exchange partners are accessed from the same database infrastructure  that supports the agency’s overall operations and mission. This  infrastructure includes several databases that store and maintain  beneficiary data related to SSA’s benefits programs. These databases are  briefly described in table 1.
Master Beneficiary Record (MBR)
Master Earnings File (MEF)
Supplemental Security Record (SSR)
Number Holder Identification  (Numident)
Among the databases, the Master Beneficiary Record, Master Earnings File, and Supplemental Security Record databases are included in the  agency’s legacy database infrastructure, referred to as the Master Data  Access Method, or MADAM. The Number Holder Identification  has recently been updated to a mor e modern system based on   commercially available software.
SSA also maintains various application systems that were designed and developed specifically to process data exchange transactions and that  generally support multiple data exchanges. These applications provide  Social Security number matching and verification information that  supports various types of federal and state programs, such as driver’s  license issuance, voter registration, social services administration (e.g.,  food stamps), employment eligibility verification, and passport issuanc e.
The applications accept requests for information from SSA’s partners,  retrieve and attempt to match or verify data from the databases against the information submitted by the partners, and then transmit responses—that  is, the results of the data matching and verification—to the data excha nge  partners who initiated the requests. The applications primarily match  Social Security number, name, and date-of-birth information submitted by  the partners against data stored in the databases. The request transactions  are processed and the responses pro file or online, real-time processing.  vided through the use of either batch  SSA relies on 11 key application systems to process information reques from and provide response data to its state and federal data exchange  partners. These data exchange applications provide data to programs  associated with 582 of the state-level agreements and 26 of the feder level agreements—about 75 percent of the outgoing data exchange  agreements that the agency supports. These 11 key data exchang e  application systems process over 1 billion transactions annually.
section_title: Funding and Management of SSA’s Outgoing Data Exchange Programs
paragraphs: SSA’s outgoing data exchange programs are funded through various  sources. These include the agency’s annual budget and reimbursements  from the data exchange partners, which are established through the data  exchange agreement process. For example, the agreement between SSA  and the Veterans Benefits Administration states that SSA will provide data  at no cost. In this case, SSA’s annual budget provides funds to support the  administrative and systems-related activities that are required to support  this agreement, such as the development of agreements and technical  support for the data exchange partners. SSA receives reimbursements  from a number of its external partners, including the American  Association of Motor Vehicle Administrators (AAMVA) along with 2 state  agencies and 14 other federal agencies, for data exchanges. For example,  according to agency documentation, SSA’s agreement with AAMVA to  provide electronic Social Security number verifications to all states for  processing driver’s license applications resulted in reimbursements in the  amount of $230,882 to the agency in 2007. The amounts of  reimbursements, if any, are determined on the basis of provisions  established by the agreements with each data exchange partner. For 364 of  these agreements, SSA provides electronic data at no cost to state and  federal partners.
According to agency documentation, during fiscal year 2007, SSA received  about $10 million in total reimbursements for its outgoing data exchanges,  primarily from federal data exchange partners. The documentation  indicates that about half of this amount was reimbursed on the basis of  agreements with the Departments of Homeland Security and Health and  Human Services.
The management and oversight of SSA’s data exchange programs span  multiple agency components. Among these, the Associate Commissioner  for the Office of Earnings, Enumeration and Administrative Systems, has  primary responsibility for systems activities related to SSA’s data  exchange programs, and the Office of Budget, Finance, and Management,  Office of Strategic Services has primary responsibility for data exchange  agreements.
section_title: Prior GAO Reports on SSA’s IT Management Practices
paragraphs: We have previously reported on SSA’s IT management practices and  challenges. Most recently, we studied and reported on the agency’s ability  to effectively deliver services, including those related to electronic data  exchanges. In our reports, we made recommendations directed toward the  agency’s need to strengthen its plans for delivering services to  beneficiaries and to address challenges associated with a growing and  increasingly complex data exchange environment.
In December 2008, we reported specifically on SSA’s data exchange  environment and identified challenges that the agency faced in supporting  data exchange programs. Among these, we noted that the agency faced  challenges in retaining the expertise needed and maintaining the  technology required to support an adequate technical infrastructure to  meet future needs. We also described an agency initiative to study ways to  better manage the data exchange environment and address current and  future challenges and limitations. This initiative identified actions that the  agency should take to address challenges related to management and  systems-related issues. We recommended in our report that SSA set  milestones for undertaking these actions. The Commissioner of Social  Security concurred with our recommendation and stated that the agency  had established milestones for taking action.
Also in January 2009, we reported that increases in retirement and  disability filings, along with ongoing and expected increases in retirements  of SSA’s most experienced staff, posed difficult challenges for the agency  in meeting future service delivery needs. We recommended that the  agency take steps to address these challenges and develop a plan that  describes how it will deliver quality service in the future while managing  growing work demands and constrained resources. In response, SSA  stated that it had intensive planning efforts in place, but agreed to develop  a single planning document that would describe service delivery and  staffing plans.
section_title: SSA’s IT Infrastructure Supports Its Current Data Exchange Environment
paragraphs: SSA has implemented technology and procedures within its existing IT  infrastructure to support its current data exchange environment, including  processes to identify, track, and resolve systems-related problems. Those  data exchange partners we included in our study indicated that the  agency’s IT infrastructure had effectively supported the exchanges in  which they participate. The partners reported that they had experienced  few systems-related problems and none that had a significant impact on  their ability to conduct business.
subsections: section_title: SSA Has Established Practices and Procedures for Supporting Data Exchange Services
paragraphs: An effective IT infrastructure provides performance capabilities, such as  system availability and reliable data, that are essential to enabling the  efficient and economical exchange of electronic data. The Software  Engineering Institute defines practices for providing effective IT services,  including those that are key to an agency’s ability to ensure that its  infrastructure supports business operations. These practices include,  among other things, the establishment of (1) monitoring capabilities to  proactively identify problems; (2) help desks to collect information on  incidents and initiate problem-solving actions; and (3) capabilities to  prioritize incidents, track the status and progress of incident resolution,  and validate the complete resolution of incidents. By implementing  practices to monitor, track, and resolve systems-related problems,  agencies can reduce the risk that when problems occur, their information  systems and support mechanisms will fall short of effectively supporting  business operations and service commitments.
To ensure that SSA’s IT infrastructure meets the performance  requirements of the agency’s data exchange partners, SSA and its partners  establish, through data exchange agreements, specific and detailed  performance standards (e.g., system availability, scheduled outages, data  accuracy, and response times for each exchange, along with protocols for  reporting and resolving systems-related problems). These elements are  critical to an effective IT infrastructure that enables the efficient and  economical exchange of electronic data. For example:    The data exchange agreement with AAMVA specifies that SSA will provide  responses for 95 percent of all Social Security Online Verification system  requests received from AAMVA within 3 seconds or less and that  responses to 99 percent of requests will be provided within 5 seconds or  less. The agreement also defines the hours of system availability and  scheduled outages.
The data exchange agreement with the Veterans Benefits Administration  specifies that SSA is to provide a 99 percent data accuracy rate in support  of the administration of veterans’ benefits.
To address any systems-related problems that might occur and affect its  data exchange partners, SSA has implemented several key practices for  providing effective IT services, as defined by the Software Engineering  Institute. Specifically, the agency has established processes to identify,  track, and resolve systems-related problems. For example, the agency  established a national help desk for responding to systems-related  problems, and employs a process for recording, prioritizing, tracking, and  solving IT problems. This process is supported by the Change Asset and  Problem Reporting System, which is a system that is used agencywide to  prioritize systems-related problems, track the status and progress of  resolutions, and validate the resolution of problems. System reports from  January 2008 to February 2009 identified approximately 35 systems-related  problems that affected data exchanges. These problems were primarily  temporary outages lasting less than 1 minute, including several problems  lasting just seconds.
Additionally, network support personnel proactively monitor data  exchange components through the agency’s full-time (24 hours a day, 7  days a week) network operations and monitoring centers, which provide  support for agencywide IT infrastructure components. Other SSA support  staff also regularly monitor systems resource usage and work with state  and federal partners to help resolve problems as they occur. For example,  according to SSA officials, if a partner notifies the agency of slow response  time, support staff members monitor the partner site’s bandwidth usage  and make upgrades as necessary. SSA has established other specific  procedures for speedy response to resolve systems-related problems. For  example, according to AAMVA partners, SSA’s network operations and  monitoring centers are responsible for monitoring the performance of the  data exchange system that is used to support driver’s license issuance and  voter registration (the Social Security On-Line Verification system). When  SSA personnel at the centers receive an alert indicating that the system is  not performing properly, they investigate the problem and assign  responsibility for resolving the problem to the appropriate SSA unit.  Responsible personnel then notify AAMVA of the problem and the status  of the resolution process, which is updated through the Change Asset and  Problem Reporting System. Reports from the reporting system show that,  in one case of a system outage, SSA support staff resolved the problem in  34 seconds by moving the AAMVA network connection to a backup  system.
section_title: SSA Has Effectively Provided Data to Support Partners’ Business Operations
paragraphs: All of the federal and state data exchange partners included in our study  stated that SSA’s IT infrastructure adequately supported the performance  standards established by existing agreements and effectively provided data  that supported their business operations. They agreed that SSA was  responsive and quickly resolved problems when they did occur and stated  that, as a result of SSA’s efforts, their ability to conduct business  operations that depend on data provided by the agency had not been  adversely affected by systems-related problems associated with SSA’s IT  infrastructure. These partners, which had been receiving electronic data  from SSA for 2 to more than 30 years, reported that they experienced no or  only minor systems-related problems caused by SSA’s IT infrastructure.  For example:    AAMVA partners reported that the SSA system that supports their data  exchange historically was fully available during the hours of system  availability specified in their exchange agreement. According to these  officials, the system experienced virtually no downtime through calendar  year 2008—it was operational 99.8 percent of the time that the system was  available.
Officials with Idaho’s Departments of Labor and Transportation told us  that SSA’s problem resolution procedures and support staff were effective  and provided ample support and timely response to reported problems.  These officials added that while 4 percent of Social Security number  verification responses that they received from SSA via the AAMVA system  were not confirmed, these nonverifications were predominantly caused by  name changes that were not updated by the Social Security number  holders (e.g., changes from maiden names to married names), rather than  by problems with SSA’s data exchange systems or data.
Officials with the Iowa state agencies stated that SSA’s systems  performance was satisfactory. Specifically, officials with the state’s  Department of Transportation, which receives data through the AAMVA  network, reported that although they occasionally experienced  unscheduled outages and slow system response times, SSA’s overall  performance was satisfactory. Officials with the state’s Department of  Human Services said that they had not experienced any problems.
Officials with the eight California agencies included in our study reported  no problems associated with SSA’s data exchange systems.
Beyond these reports, the two SSA regional office data exchange  coordinators with whom we spoke stated that state and territory agency  partners within their regions, New York City and Kansas City, had not  reported systems-related problems associated with SSA’s existing IT  infrastructure. Specifically, the Kansas City coordinator stated that the  region had not reported any problems with data exchange systems since  the coordinator came on board in September 2008.
Similarly, the federal data exchange partners with whom we met did not  report any problems associated with SSA’s IT infrastructure that  negatively affected their ability to carry out business operations. For  example:    Data exchange officials with the Department of Homeland Security  reported as of June 2009 that no systems-related problems had affected  their ability to conduct business.
Veterans Benefits Administration and Veterans Health Administration  officials also stated that SSA’s IT infrastructure was effective in delivering  data that supported their benefits administration programs and that they  had experienced no problems with the quality or delivery of data from  SSA’s systems.
Officials with the Centers for Medicare and Medicaid Services stated that  they occasionally experienced late delivery of files that delayed the  processing of Medicare entitlement information. However, these officials  described this matter as a situation that they considered to be within the  norm, given the very large amounts of data that are being exchanged  between systems. These partners did not view these occasional late  deliveries to be a significant issue with the SSA systems that provided  data.
section_title: SSA Is Taking Steps to Prepare for a Future Data Exchange Environment, but Has Not Effectively Planned for Increasing Demands for Outgoing Data
paragraphs: Although SSA’s existing IT infrastructure is sufficient to support current  outgoing data exchanges, SSA officials and the agency’s partners  anticipate that the number of these exchanges will continue to increase  and become more complex, placing greater demands on the infrastructure  and systems. To address overall agency needs for a more cost-effective  and efficient computing environment, SSA is currently taking steps to  modernize its IT infrastructure, including components that support its data  exchange programs. For example, the agency is updating its 30-year-old  database infrastructure, converting outdated software applications, and  expanding its physical data processing capacity. However, the agency has  not established and executed IT management practices needed to  effectively guide and oversee the direction of its outgoing electronic data  exchange programs, such as conducting the analyses required to project  future workload needs and performance requirements—information that  is essential to developing a target architecture that identifies business and  technical requirements for a future data exchange environment. If these  analyses are not completed, SSA’s ability to provide and maintain an IT  infrastructure that meets requirements to effectively support its data  exchange programs in the future could be at risk.
subsections: section_title: SSA and Partners Anticipate Increased Demand for Data Exchanges
paragraphs: Based on recent increased numbers of requests for data provided by data  exchange services, both SSA and its data exchange partners anticipate that  the agency’s outgoing data exchange programs will continue to grow and  will outpace current capabilities. SSA reported that from fiscal years 2007  to 2008, the number of data requests made to seven of SSA’s key data  exchange applications increased from 1.19 billion to 1.37 billion, or about  15 percent. Table 4 shows details of the increase in data requests for these  applications.
An example of one data exchange application that has been required to  process large increases in data requests for Social Security number  confirmations is SSA’s E-Verify application. This application supports the  Department of Homeland Security E-Verify program, which is used to help  employers verify the employment eligibility of newly hired workers.  Participation in the program has been voluntary at the private and state  levels since its implementation 10 years ago and, since then, utilization of  SSA’s E-Verify application has increased dramatically. In the past 2 years  alone, usage has doubled twice. Further, federal legislation has been  proposed to, among other things, require the use of the E-Verify program  by employers across the nation. If such legislation is enacted, agency  officials estimate that the number of queries to E-Verify could quickly  surpass 60 million per year—nearly 10 times the number of requests in  fiscal year 2008.
section_title: SSA and Partners Anticipate Expanded Need for Online Access to Data Exchange Systems
paragraphs: In addition to growth in the numbers of data exchange requests, the  complexity of the exchanges is expected to increase, in that agencies are  increasingly asking for online access (a more complex requirement than  batch access). Officials from four of the state and federal agencies with  whom we spoke stated that their needs for online access to SSA’s data  exchange systems are expanding. For example, officials with New York,  Idaho, and California reported that their programs will need expanded  online access to SSA’s data exchange systems to support increasing  workloads and to provide more efficient processing of data requests.  Specifically, officials with New York’s Office of Temporary and Disability  Assistance explained that their programs will be requiring increased online  or Web-based service from SSA in the future to support expected general  workload growth as their need for Social Security number verifications  and other SSA information grows. Officials with California’s Department  of Child Support Services stated that online access is needed to improve  efficiencies in caseworkers’ ability to verify benefits, schedule court  hearings to determine amounts of child support payments, and process  and close eligible cases. Officials with Idaho’s Department of Labor also  projected that they would need more online access to SSA’s data exchange  systems through Web-based transaction processing to support more  efficient case processing and access to SSA’s data exchange systems 24  hours a day, 7 days a week.
In 2008, SSA officials polled the agency’s 10 regional offices to identify  current data exchange partners that had requested online, real-time access  to the agency’s State Online Query system over the previous 24 months.  The poll identified state partners in 8 of the regions that had made such  requests. Table 5 shows these regions along with the 24 state agencies  that had requested online access for their programs (in addition to the 50  partners that already had access to the State Online Query system).
section_title: SSA Is Taking Steps to Modernize Its IT Infrastructure, but It Has Not Effectively Planned for Increasing Demands on Its Outgoing Data Exchange Programs
paragraphs: Office of Management and Budget Circular A-130 and industry best  practices stress the importance of agencies taking advantage of cost- effective technology to improve operations. Additionally, industry studies  have shown that modern technology can offer organizations more efficient  and effective automation capabilities to meet service delivery demands.  Further, more advanced technology is important to support online, real- time transaction processing, which is more demanding than batch  processing due to the need for increased systems availability and more  sophisticated technology.
SSA officials are taking steps to update key components of the agency’s IT  infrastructure, including those that directly support its data exchange  services, to provide expanded and extended processing capabilities. In  particular, the agency is in the process of modernizing the agency’s  database infrastructure, upgrading software, and building new data  centers.
According to an SSA Senior Enterprise Architect, the agency’s legacy  database infrastructure—MADAM—was created in-house in the early  1980s and, over time, became outdated and difficult to support, limiting  the agency’s ability to provide expanded data processing services. For  example, the MADAM databases must be backed up and maintained daily  and are not available during the time that maintenance occurs. This down  time prevents the agency from providing complete data processing  services 24 hours a day, 7 days a week to support the agency’s core  mission and operations as well as its data exchange programs.
Thus, SSA is in the process of converting its MADAM environment to a  modern and commercially available system that is intended to support  online processing 24 hours a day, 7 days a week. According to SSA  officials, the agency has already converted its Numident database, and  plans to convert its Master Earnings File, Supplemental Security Record,  and Master Beneficiary Record databases in 2009, 2011, and 2012,  respectively. Further, SSA is in the process of updating its E-Verify data  exchange operating environment. In this regard, the agency is  implementing an environment in which E-Verify data requests will be  processed against a dedicated database and will provide continuity of  operations and disaster recovery capabilities, which are currently not  available. These upgrades are intended to support the projected increase  in demand for E-Verify services and reduce the risks of system slowdowns  and disruptions. The E-Verify upgrades are expected to be completed and  implemented in August 2009.
The agency is also upgrading its current systems environment, including  the systems that support data exchanges. This environment contains aging  software that is based on about 36 million lines of COBOL code, a  programming language that is generally viewed as obsolete and that makes  it difficult to implement new business processes and new service delivery  models, such as online, real-time processing. According to SSA officials,  the agency is upgrading its software applications to Web-based technology  that is intended to better enable online, real-time access to data processing  services.
Further, SSA has recently built a new data center to provide expanded  data processing capacity in addition to that provided by its National  Computer Center. The agency also has plans to replace the 30-year-old  National Computer Center to, according to SSA officials, provide more  efficient and economical processing capabilities and support growing  requirements of a full-time electronic service delivery operation. By  taking these steps to modernize its agencywide IT infrastructure, including  components that support data exchange programs, SSA is aiming to  provide the computing capabilities needed to support increasing and  future demands for electronic data exchange services.
SSA’s IT strategic plan reflects the priorities that are intended to guide the  agency’s operational and tactical IT planning through fiscal year 2012.  Regarding data exchanges, the plan discusses an agency initiative that is  intended to study various data exchanges and ways to allow partners to  link more efficiently to the agency’s systems. Also, the agency’s IT vision  document describes plans to replace various methods of sharing data  with an easy-to-use, Web-based portal that provides data to partners  through a menu-driven system, along with a plan to use a single  registration process and a secure, controlled environment that ensures  data are protected. The vision document identifies as a key initiative the  need to maintain a robust data exchange architecture that fully supports  the growing demand for information sharing.
Even as SSA proceeds with planned updates to its IT infrastructure, the  agency has not fully implemented IT management practices that are  essential to help guide its direction related to data exchanges. Sound  management practices require organizations to perform the necessary  planning for investments to ensure that they effectively support current  and future business needs, such as a more demanding data exchange  environment. In planning for future business operations, agencies should  also, among other things, project their programs’ anticipated workloads,  such as increases in data requests and transaction volumes—information  that is essential for making informed decisions concerning workload  management and the technological solutions needed to sustain efficient  and effective performance in the future. Further, this information can  provide critical input to the agency’s planning efforts, including the  development of a target architecture.
Nevertheless, according to agency officials, SSA has not conducted  detailed analyses to project future workload requirements resulting from  the increasing demand and expanded need for outgoing electronic data  exchanges. Specifically, the agency has not projected increases in the  number of requests for data or the need for more online, real-time access  to its data exchange systems. The agency’s Director of the Division of  Information, Verification and Exchange Services and the Director of the  Office of Systems Security Operations Management maintain that the  agency’s tactical plans for delivering electronic services will be sufficient  to address future needs for data exchanges. However, these plans have not  yet been developed. Further, while the agency’s strategic direction and  vision for its data exchange environment are important, they do not  substitute for the more detailed analysis that is essential to identifying the  specific business and technical requirements for its data exchange  programs and partners.
Moreover, in the absence of such detailed analysis, SSA cannot be assured  that it will achieve the robust data exchange architecture that it envisions.  According to federal guidance, an agency should develop an enterprise  architecture, or modernization blueprint, that describes in both business  and technology terms how it operates today and how it intends to operate  and support projected needs in the future—that is, its target architecture.  Federal guidance states that enterprise architectures should identify the  data that are to be exchanged, the frequency and nature of the exchanges,  and the business processes supported by the data exchanges. For SSA to  ensure that its target architecture provides for a future IT infrastructure  that will support its expanding data exchange environment, the agency  should conduct the analyses needed to project the numbers of data  exchange transactions along with the frequency and nature of the data  exchanges (that is, whether the transactions are batch or online, and how  frequently they will be conducted) expected from its partners in the  future.
Agency officials have recognized the need for a target architecture that  addresses requirements for data exchanges. For example, in 2008, an SSA  workgroup conducted an analysis to address management and technical  issues related to its data exchanges, which was intended to support  planning for its growing data exchange program. Among other things, the  workgroup recommended to the Commissioner of Social Security that the  agency devote sufficient resources to develop a well-defined target  architecture that is sufficiently scalable to meet the agency’s future needs  for supporting data exchanges.
However, while SSA has developed a target architecture describing  applications and service components that are used to support the agency’s  business operations, according to the Directors of the Division of  Information, Verification and Exchange Services, and of the Office of  Strategic Services, the agency has not developed a target architecture that  addresses specific business and technical requirements for supporting the  agency’s data exchange programs. Moreover, these directors stated that  the current agencywide target architecture does not specifically address  data exchanges with external organizations.
Lacking sound projections of future workloads, SSA will not be able to  clearly define specific requirements for meeting the increasing demands  on its data exchange environment. Moreover, without a target architecture  that addresses specific requirements for supporting the agency’s data  exchange programs, the agency cannot be assured that its IT  infrastructure will provide the resources and levels of service required to  meet the future needs of its data exchange partners. Consequently, SSA’s  ability to continue to effectively and efficiently support its partners’ future  needs for electronic data exchange services could be jeopardized.
section_title: Conclusions
paragraphs: SSA’s existing IT infrastructure effectively supports its current outgoing  electronic data exchange environment and provides the agency’s partners  with data that support and enhance their abilities to carry out business  operations. The state and federal partners included in our study  experienced few or no problems associated with the agency’s IT  infrastructure. However, the agency and its partners anticipate that the  demand for these exchanges will grow, and that the methods for  conducting the exchanges will become more complex. Nonetheless, SSA  has not performed the detailed analyses needed to project the workload  and performance requirements of a future data exchange environment.  While it has defined an agencywide target architecture, this architecture  does not address specific business and technical requirements for  supporting the agency’s data exchange programs. Until it conducts these  analyses, the agency will lack information essential to developing a target  architecture for an IT infrastructure that effectively supports the ability of  data exchange partners to carry out their business operations in the  future.
section_title: Recommendations for Executive Action
paragraphs: To help ensure that SSA’s IT infrastructure effectively supports the  anticipated increase in demand for electronic data exchange services, we  recommend that the Commissioner of Social Security direct the Associate  Commissioner, Office of Earnings, Enumeration and Administrative  Systems to    conduct detailed analyses to determine workload projections and define  requirements for effectively and efficiently delivering data exchange  services to the agency’s partners in the future and    use the results of these analyses to update the agency’s target architecture  to address business and technical requirements of a future data exchange  environment.
section_title: Agency Comments and Our Evaluation
paragraphs: The Commissioner of Social Security provided written comments on a  draft of this report. In the comments, the agency agreed with our  recommendations and stated that it would conduct detailed analyses to  determine workload projections and define future requirements for  delivering data exchange services as funding is available. Further, the  Commissioner stated that it would use the results of the analyses to  update the agency’s target architecture to ensure that it addresses the  business and technical requirements of a future data exchange  environment. If these actions are taken, the agency should be better  positioned to meet the growing needs of its data exchange partners.
SSA also provided technical comments, which we have incorporated into  the report as appropriate. The agency’s written comments are reproduced  in appendix II.
As agreed with your office, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days from the  date of this letter. At that time, we will send copies of the report to  interested congressional committees, the Commissioner of Social Security,  and other interested parties. This report will also be available at no charge  on our Web site at http://www.gao.gov.
Should you or your staff have questions on matters discussed in this  report, please contact me at (202) 512-6304 or melvinv@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. GAO staff who made major  contributions to this report are listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to (1) determine the extent to which the Social  Security Administration’s (SSA) information technology (IT) infrastructure  effectively and efficiently supports its current data exchange programs,  and describe any systems-related problems affecting the agency’s data  exchange partners and (2) describe SSA’s efforts to ensure that its IT  infrastructure can support the agency’s and its partners’ future data  exchange environment.
To address both of these objectives, we focused our study on SSA’s data  exchanges that provide information to support state and other federal  agencies’ programs, and that affect partners’ abilities to provide services  to individuals—that is, “outgoing” data exchanges. To determine whether  SSA’s existing IT infrastructure is effective in supporting the agency’s data  exchange programs, we first identified the components of the  infrastructure that support the agency’s data exchange programs. To do  this, we obtained and analyzed agency documentation, such as internal  management reports; spreadsheets describing data exchange programs,  partners, and systems; descriptions of systems development and IT  management processes; and descriptions of IT infrastructure components.  To assess the reliability of the data provided by SSA, we held discussions  with agency officials who were knowledgeable about the agency’s data  exchange infrastructure and determined that the data were sufficiently  reliable for the purposes of our engagement.
From our assessment of this information, we identified and selected  systems that are key to enabling the exchange of electronic data—that is,  those that support the largest number of outgoing data exchanges, are  used by the most partners, and process the largest number of data  requests. We verified our selection through discussions with the Director,  Division of Information, Verification and Exchange Services. We held  discussions with additional agency officials, including the Associate  Commissioner, Office of Earnings, Enumeration and Administrative  Systems; Associate Commissioner, Office of Systems, Electronic Services;  Assistant Associate Commissioner, Office of Telecommunications and  Systems Operations; Director, Office of Systems Security Operations  Management; Director, Office of Electronic Information Exchange; and  Director, Office of Strategic Services. We also reviewed documentation  describing the agency’s plans to make improvements to its IT  infrastructure and discussed these plans with agency officials.  Additionally, we interviewed state and federal data exchange partners to  obtain their views on the ability of SSA’s IT infrastructure to provide data  that support their business operations.
To determine the extent to which systems-related problems exist and  affect SSA’s data exchange partners and their ability to carry out business  operations, and how the agency resolves these problems, we selected and  obtained the views of partners from multiple agencies in five states, a  third-party consortium that represents states and territories that  participate in two of SSA’s data exchange programs, and four federal  agency partners. Together, these state and federal partners represented   24 programs that are supported by SSA’s data exchanges. Our criteria and  methodology for selecting these partners are described later in this  appendix. We discussed with these partners their experiences with SSA’s  data exchanges, including the extent to which their ability to conduct  business operations are affected by systems-related problems associated  with the agency’s IT infrastructure. We reviewed and assessed  documentation provided to us that described the types of systems-related  problems that partners encountered in exchanging data. We also  interviewed two SSA regional office data exchange coordinators to discuss  any systems-related problems identified or reported to them by the  partners they support, and to obtain information about programs that  together fully utilize the IT infrastructure components that support the  data exchange environment.
To describe SSA’s efforts to ensure that its IT infrastructure can support  the agency’s and its partners’ future data exchange environment, we held  discussions with the agency officials and state and federal partners that  we have previously described and examined data provided by SSA that  illustrated increased transaction volume from 2007 to 2008. We also  obtained and reviewed documentation that described increased requests  for online access to certain data exchange systems over the past 24  months. Additionally, we reviewed relevant SSA strategic planning  documents, including its IT strategic plan and vision document to identify  plans related specifically to data exchanges. We assessed these plans to  identify activities specifically related to data exchanges and to determine  the extent to which they addressed projected data exchange workloads  and the IT resource requirements for efficiently and effectively supporting  future requirements. In addition, we interviewed SSA officials and data  exchange stakeholders familiar with the agency’s data exchange programs  to identify the agency’s plans for addressing future data exchange  workloads, including ensuring that its IT infrastructure can adequately  support future demands for outgoing data exchanges to other federal and  state agencies.
We confirmed the information gathered from SSA’s regional data exchange  coordinators and systems officials by corroborating it with selected other  state and federal exchange partners. We determined that the information  gathered was sufficiently reliable for the purposes of our review. Further,  at the conclusion of our study in September 2009, we validated the  examples of state and federal agencies’ experiences with SSA’s data  exchanges with officials from those agencies.
subsections: section_title: Method for Selecting Data Exchange Partners
paragraphs: To select state and federal data exchange partners for this study, we  identified a nonprobability sample based on our review of information  provided by agency officials that listed and described all of the data  exchange programs supported by SSA. From the list provided by the  agency, we identified 814 outgoing data exchanges—those through which  SSA provides data to state and other federal agencies. Of these exchanges,  we identified 663 that provide SSA data to agencies in all 50 states, the  District of Columbia, and 4 territories (American Samoa, American Virgin  Islands, Guam, and Puerto Rico), and 83 that provide data to 16 federal  agencies.
From the 50 states, we selected 5 states based on the number of SSA data  exchange programs in which they participate and the types of state  programs the exchanges support (e.g., driver’s license issuance, voter  registration, unemployment benefits administration, social services  administration, and other programs). In selecting the 5 states, we  identified 2 states that participated in the most data exchanges, 1 state that  participated in a intermediate number of exchanges, and 2 states that  participated in the fewest data exchanges.
The 2 states participating in the most data exchanges were New York and  California (25 and 19 data exchanges, respectively).
The 1 state we selected with the intermediate number of data exchanges  was Idaho (12 data exchanges).
The 2 states participating in the fewest data exchanges were North  Carolina and Iowa (10 and 9 data exchanges, respectively).
We held discussions with officials from each of the states’ agencies that  receive data through SSA’s data exchange programs to obtain information  about any systems-related problems they may have experienced and the  actions taken by SSA to resolve problems. Table 6 shows the states and  agencies within those states that we contacted.
We also held discussions with SSA’s major stakeholder user group  organization—the American Association of Motor Vehicle Administrators  (AAMVA)—which provides data exchange support to state driver’s  licensing administrations and supports voter registration through the Help  America Vote Verification system. We contacted chief information officers  from each of the five selected states and AAMVA to obtain contact  information for the officials responsible for the programs and systems that  receive electronic data through participation in SSA’s data exchange  programs.
We based our selection of federal data exchange partners on the scope  and impact of the agencies’ programs supported by SSA’s data exchanges  on the country’s population, including veterans’ programs beneficiaries,  government and private employers, U.S. passport holders and applicants,  U.S. tax filers, and Medicare beneficiaries. We held discussions with  agency officials regarding the following federal programs to obtain  information about their experiences with SSA’s data exchange programs  and the systems that support them:  the Department of Veteran Affairs, Veterans Benefits Administration’s  benefits and insurance programs, and the Veterans Health Administration  health care administration program; the Department of Homeland Security employment eligibility program; the Department of State’s passport verification and foreign service retiree  benefit payment programs; and the Department of Health and Human Services, Centers for Medicare and  Medicaid Services’ Medicare benefits administration program.
Since we selected a nonprobability sample, the information obtained  through discussions with the selected state and federal data exchange  partners is not generalizable across the entire population of SSA’s data  exchange partners.
section_title: Appendix II: Comments from the Social Security Administration
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, key contributions to this report  were also made by Teresa F. Tucker, Assistant Director; Michael A.  Alexander; Tonia B. Brown; Barbara S. Collier; Rebecca E. Eyler; Neil J.  Doherty; Nancy E. Glover; Jacquelyn K. Mai; Lee A. McCracken; Thomas E.  Murphy; Madhav S. Panwar; and Brandon S. Pettis.