SSA provides benefits to individuals with disabilities through two main programs: DI and SSI. Individuals are generally considered disabled if they are unable to do their previous work and, considering age, education, and work experience, are unable to engage in any other kind of substantial gainful work and their disability has lasted or is expected to last at least 1 year or is expected to result in death. See table 1 for additional key features and requirements of the DI and SSI programs. SSA’s process for determining eligibility for disability benefits—which is generally the same for DI and SSI claimants—starts when an individual submits a claim to SSA. First, an SSA field office employee reviews the claim to determine whether the claimant meets SSA’s nonmedical eligibility requirements and, if so, forwards the claim to a state Disability Determination Services (DDS) office. A DDS examiner then reviews the claim to make a determination of medical eligibility. If the claim is denied, the claimant has several opportunities for appeal within SSA, starting with a reconsideration at the DDS level and then a hearing before an administrative law judge. Claims at all levels for which the claimant is determined to be eligible for DI or SSI benefits, also called favorable claims, are forwarded to other SSA offices for payment. See figure 1 for an overview of SSA’s eligibility determination process for disability programs. SSA has policies and guidance on how SSA and DDS employees should document and report suspected fraud. According to SSA’s policy, fraud generally occurs when an individual makes or causes to be made false statements of material facts or conceals such facts for use in determining rights to benefits, with intent to defraud. SSA guidance includes a list of factors that may indicate potential fraud for field office staff and DDS examiners to consider when processing disability claims. According to SSA’s policy, employees should gather enough information to either remove suspicion or determine that there is potential fraud. If they determine that potential fraud exists, they should refer the case to the SSA OIG. They are also expected to develop the referral with as much information as possible, including who allegedly committed fraud, how, and when. See figure 2 for an overview of SSA’s fraud referral process. To help investigate some potential disability fraud cases, the OIG and SSA collaborate through Cooperative Disability Investigation (CDI) and fraud examination units: CDI units are staffed with a mix of SSA, DDS, and OIG staff, as well as state or local law-enforcement officers, to obtain evidence when potential fraud is suspected. CDI investigators often work undercover. As of January 2017, there were 39 CDI units covering 33 states, the District of Columbia, and Puerto Rico. Fraud examination units are staffed by SSA employees with disability determination expertise. Prompted by OIG requests and at the direction of SSA’s Operations component, they review claims to help detect patterns of disability fraud perpetrated by third parties such as physicians, attorneys, or claimant representatives. As of January 2017, fraud examination units were located in New York City, San Francisco, and Kansas City, but each of the three units works on cases from anywhere in the nation. SSA’s OAFP provides centralized oversight and accountability of the agency’s antifraud initiatives. The OAFP’s efforts include managing fraud risks in all of SSA’s programs including its disability programs. SSA’s National Anti-Fraud Committee (NAFC) provides a forum for agency executives to collaborate on antifraud strategies and serves as an advisory board for the OAFP in determining what initiatives to monitor, among other things. The NAFC is cochaired by SSA’s Deputy Commissioner for Budget, Finance, Quality, and Management and the agency’s Inspector General. All SSA deputy commissioners are voting members of the NAFC. The Associate Commissioner for the OAFP, who reports to the Deputy Commissioner for Budget, Finance, Quality, and Management, serves as the agency’s chief fraud prevention officer and is a nonvoting member of the NAFC. The NAFC is at a higher level than the OAFP and has cross-agency authority. See figure 3 for an overview of SSA’s antifraud management structure. According to federal standards and guidance, executive-branch agency managers are responsible for managing fraud risks and implementing practices for combating those risks. Federal internal control standards call for agency managers to assess fraud risks as part of their internal control activities. The Fraud Risk Framework provides a comprehensive set of leading practices that serves as a guide for agency managers to use when developing efforts to combat fraud in a strategic, risk-based way. The Fraud Risk Framework describes leading practices in four components: 1. Commit—Commit to combating fraud by creating an organizational culture and structure conducive to fraud risk management; 2. Assess—Plan regular fraud risk assessments and assess risks to determine a fraud risk profile; 3. Design and Implement—Design and implement a strategy with specific control activities to mitigate assessed fraud risks and collaborate to help ensure effective implementation; and 4. Evaluate and Adapt—Evaluate outcomes using a risk-based approach and adapt activities to improve fraud risk management. In addition, the Fraud Risk Framework reflects activities related to monitoring and feedback mechanisms, which include ongoing practices that apply to all four components, as depicted in figure 4. In July 2016, the Office of Management and Budget published guidance about enterprise risk management and internal controls in federal executive departments and agencies. Among other things, this guidance affirms that managers should adhere to the leading practices identified in the Fraud Risk Framework. In addition, the Fraud Reduction and Data Analytics Act of 2015, enacted in June 2016, requires the Office of Management and Budget to establish guidelines for federal agencies to establish controls to identify and assess fraud risks and design and implement antifraud control activities. The act requires the Office of Management and Budget to incorporate the leading practices from the Fraud Risk Framework in the guidelines. Further, the act requires federal agencies to submit to Congress a progress report each year for 3 consecutive years on the implementation of the controls established under the Office of Management and Budget guidelines, among other things. SSA has taken steps to establish an organizational culture and structure that are conducive to managing fraud risks in its disability programs. The agency has demonstrated a senior-level commitment to combating fraud in its disability programs and has worked to involve all levels of the agency in setting an antifraud tone. For example, in April 2014, SSA reestablished the NAFC to provide support for national and regional antifraud activities. The NAFC is composed of deputy commissioners from across the agency and other SSA executives who meet at least quarterly, which helps to demonstrate a senior-level commitment to combating fraud—one of the Fraud Risk Framework’s leading practices. The NAFC invites regional staff to its regular meetings and to an annual conference to report on the progress of SSA’s antifraud initiatives, which helps involve multiple levels of the agency in setting an antifraud tone— another leading practice in the Fraud Risk Framework. SSA also demonstrated a commitment to combating fraud at all levels of the agency when it implemented the first annual mandatory antifraud training in 2014 for all SSA and DDS staff. As discussed further below, the training describes indicators of potential fraud and instructs staff on how to report it. According to SSA officials, 97 percent of SSA employees and all DDS employees except for those on extended leave completed the most recent annual antifraud training. SSA further demonstrated a commitment to antifraud efforts by conducting a study to evaluate its fraud risk management approach and shortly thereafter establishing a dedicated antifraud office within the agency. SSA contracted with a consulting firm in April 2014 to identify leading practices for managing fraud risks and, according to SSA officials, sought input from other federal agencies about their efforts. The consulting firm’s study identified the importance of establishing a dedicated antifraud office. SSA subsequently established the OAFP in November 2014. The OAFP is responsible for coordinating antifraud efforts, developing antifraud policies, and creating and implementing fraud mitigation plans across SSA, among other things. These responsibilities are consistent with leading practices. According to the Fraud Risk Framework, agency managers can show commitment to combating fraud by creating a structure with a dedicated entity to lead fraud risk management activities and coordinate antifraud initiatives across the agency. In addition, leading practices call for the designated antifraud entity to, among other things, serve as the repository of knowledge on fraud risks and controls and lead or assist with trainings and other fraud-awareness activities. Since the OAFP was established, the office has performed several of these activities. For example, the OAFP has taken steps to coordinate antifraud initiatives across SSA by gathering information about progress on the initiatives, and has helped create antifraud training materials for the agency. In addition, the OAFP formed a committee in 2015, made up of associate commissioners from across the agency, to work on antifraud initiatives. SSA’s Acting Commissioner has reinforced SSA’s commitment to combating fraud by communicating the importance of antifraud efforts in multiple ways. For example, the Acting Commissioner highlighted SSA’s antifraud efforts in a March 2015 virtual town hall meeting, which more than 27,000 SSA staff participated in by video or in person, and issued a “Commissioner’s broadcast” to all employees, encouraging staff to provide suggestions for combating fraud via an e-mail box launched in March 2014. From March 2014 through the end of December 2016, SSA received 399 suggestions and implemented 8 of them by, for example, adding examples and a cross-reference in SSA’s operations manual to help employees identify potential beneficiary fraud. In addition, the Acting Commissioner included preventing waste, fraud, and abuse as a guiding principle in SSA’s strategic plan and supported the launch in early 2015 of SSA’s antifraud website, which includes a link for the public to report suspected fraud to the OIG. Although these steps are generally consistent with leading practices in fraud risk management, the OAFP faced challenges during its first 2 years to fully establish itself within the agency. Specifically, the OAFP faced challenges related to a lack of consistent leadership and established institutional relationships. However, recent actions may help to address these challenges: Lack of consistent leadership: Until recently, the OAFP had not had a permanent leader who provided accountability for the agency’s antifraud initiatives. When the OAFP was established, SSA designated the OAFP associate commissioner as the agency’s chief fraud prevention officer. According to SSA officials, from the summer of 2015 until September 2016, two Senior Executive Service (SES) candidates served successive 6-month periods as the OAFP’s acting associate commissioner. In September 2016, a third SES candidate was appointed as the acting associate commissioner of the OAFP. Upon confirmation as a member of the SES, he became the OAFP’s permanent associate commissioner and assumed the role of SSA’s chief fraud prevention officer in October 2016, according to SSA officials. Lack of established institutional relationships: The OAFP is a relatively new, small office that is still building relationships and establishing its role across the agency for which it is charged with overseeing fraud risk management efforts. According to SSA officials, the process of building relationships across the agency will likely require additional time to become more fully implemented. The OAFP is relatively small compared with the size and complexity of SSA’s 11 components. In fiscal year 2016, the OAFP had approximately 60 full-time equivalent staff, who were in charge of coordinating antifraud initiatives, among other tasks, across SSA, which employs over 60,000 full-time equivalent staff, excluding DDS staff. The OAFP is also in the process of overcoming perceptions of mission overlap. For example, according to SSA officials, there were initial concerns about the OAFP’s role in identifying potential fraud overlapping with the OIG’s role in investigating potential fraud. In August 2015, the Acting Commissioner of SSA approved a memo to components across the agency including the OIG that clarified the function and responsibilities of the OAFP. SSA has undertaken efforts over the last year to identify fraud risks in its disability programs but has not comprehensively assessed the fraud risks identified through those efforts. Leading practices in fraud risk management call for the agency’s designated antifraud entity to lead fraud risk assessments and plan to conduct updated assessments on a regular basis. In planning the fraud risk assessment, leading practices call for managers to tailor the fraud risk assessment to the program by, among other things, identifying appropriate tools, methods, and sources for gathering information about fraud risks and involving relevant stakeholders in the assessment process. Fraud risk assessments that align with leading practices involve (1) identifying inherent fraud risks affecting the program, (2) assessing the likelihood and impact of those fraud risks, (3) determining fraud risk tolerance, (4) examining the suitability of existing fraud controls and prioritizing residual fraud risks, and (5) documenting the results. There is no universally accepted approach for conducting fraud risk assessments because circumstances among programs vary. In spring 2016, SSA took steps to identify fraud risks in its disability programs by contracting with a third party, but this effort was not intended to be a comprehensive fraud risk assessment. According to the contractor’s report, the initial goals of the project were to develop a fraud risk assessment methodology that could be refined and updated over time and to conduct a pilot study of fraud risks in SSA’s disability programs by applying the risk assessment method. The contractor developed risk profiles for four fraud risks in SSA’s disability programs, including a qualitative assessment of the likelihood, impact, and significance of each risk, as well as potential responses to each risk. The contractor also included several other examples of fraud risks in SSA’s disability programs in its final report but did not assess these other risks. Both the contractor and SSA cited the limited time frame for the effort as a reason for not completing the initial project goal of applying the fraud risk assessment method more comprehensively. For example, because of the limited time frame, the contractor was not able to include disability- program experts on the risk assessment team or review risk information beyond information included in documents provided by SSA stakeholders. Although it was not able to conduct a comprehensive assessment of fraud risks in SSA’s disability programs, the contractor stated in its final report that its assessment of four fraud risks provided a successful proof-of- concept of its risk assessment method and that SSA could apply and update that method over time. SSA also identifies fraud risks in other ways. Specifically, according to SSA officials, the OAFP hired a contractor to conduct interviews of SSA and DDS staff in the spring and summer of 2016 to gather information on patterns and characteristics of fraud in its disability programs to help develop an antifraud data-analytics model. However, they noted that the final report will not be available until mid-2017. In addition, according to SSA officials, SSA may become aware of fraud risks through information provided by the OIG’s Office of Investigations and from SSA field offices and hearing offices. These ongoing activities may provide SSA information on fraud risks in its disability programs but do not provide an overall assessment of fraud risks. SSA plans to assess fraud risks, but it is unclear when or how an assessment of its disability programs will occur and whether it will follow leading practices. SSA’s antifraud plans for 2016 to 2018 include an objective to conduct regular fraud risk assessments but do not specify which programs will be included. In addition, it is uncertain when or how SSA will conduct these assessments because the plans do not describe interim steps or specific time frames. SSA’s plans include reassessing fraud risks in its programs on a regular basis, but the plans do not provide timelines for updating its risk assessments. Further, it is not clear which agency stakeholders will be involved in the process or what specific tools, methods, and sources SSA will use to gather information about fraud risks. SSA’s plans state that it will use information produced by its data- analytics system to assist with its risk assessments but, as discussed below, this data-analytics system is in the early stages of development and it may be years before the system produces information on disability fraud schemes and trends that could be incorporated into a fraud risk assessment. According to a senior OAFP official, the risk-assessment effort is on hold because the OAFP is focusing its staff resources on developing its data-analytics system. However, information on the relative likelihood and impact of fraud risks identified through a fraud risk assessment can help ensure that the data-analytics system is appropriately targeted and that the OAFP’s resources are focused on SSA’s most significant fraud risks. Conducting fraud risk assessments that involve relevant stakeholders and align with other leading practices, and updating such assessments on a regular basis, can help identify fraud vulnerabilities before any actual fraud occurs and better position management to take steps to strengthen antifraud controls. Without planning and conducting regular, comprehensive assessments of fraud risks in its disability programs and documenting the results, SSA does not have reasonable assurance that it has implemented antifraud controls to mitigate risks in its disability programs and may be vulnerable to new or emerging fraud risks. SSA has several control activities that seek to prevent, detect, and respond to fraud in its disability programs. However, SSA has not developed and documented an overall antifraud strategy to guide its design and implementation of antifraud activities and help ensure it has sufficient and appropriate controls in place to mitigate its most significant fraud risks. Leading practices in fraud risk management call for managers to document an antifraud strategy that links antifraud activities to the program’s most significant fraud risks. Although SSA has not developed and documented an overall antifraud strategy, SSA has implemented several initiatives, some of which it created after identifying specific fraud risks. For example, after large-scale fraud schemes in SSA’s New York region highlighted the possibility that third parties could facilitate fraud against SSA, the agency established fraud examination units in 2014 to help detect these types of fraud schemes in the future. In addition, after identifying an issue in 2011 with the case management system used by administrative law judges that could potentially allow judges to improperly reassign cases, SSA officials said that they took steps such as changing system access rules to reduce the likelihood that this issue could occur. SSA performs several control activities that are designed to prevent, detect, and respond to disability program fraud. SSA considers risk when implementing some of these activities, for example by considering the likelihood an individual transaction may be fraudulent or the overall amount of funds involved. SSA’s antifraud activities include the following, among others: Cooperative Disability Investigation (CDI) units: SSA and the OIG established CDI units in fiscal year 1997 to help prevent and detect potential disability fraud and have increased the number and coverage of the units in recent years. A typical CDI unit is staffed with an OIG agent who serves as the unit leader, SSA program specialists and DDS examiners who serve as experts on SSA disability policies and procedures, and state or local law-enforcement officers who gather evidence through covert surveillance operations or interviews. As of January 2017, there were 39 CDI units covering 33 states, the District of Columbia, and Puerto Rico, which is up from 26 units covering 22 states and Puerto Rico in fiscal year 2014. Most referrals come to CDI units from DDS examiners who identify suspicious information during an initial eligibility determination or reconsideration, but referrals can also come from administrative law judges during their review of appealed decisions, as well as from other sources such as SSA field offices and the general public. Unit leaders screen referrals and, if the case is accepted, law-enforcement officers conduct an investigation. Staff from one CDI unit we interviewed said they spend more investigative resources on cases that could have more of a financial effect, such as younger individuals who could potentially receive more benefits over their lifetimes. After an investigation, CDI units prepare a summary report of their findings that DDS or SSA staff are required to consider in making a disability determination, which could help prevent or stop fraudulent benefits from being paid. Categories of Fraud Control Activities Control activities for managing fraud risks fall into three general categories—prevention, detection, and response. These categories are interdependent, and activities can often serve more than one purpose. Fraud prevention activities include efforts to mitigate the risk of fraud occurring or to identify potential fraud before making payments. Fraud detection activities help discover fraud that has already occurred. Response activities include actions to address instances of potential fraud, such as referring potential fraud cases for investigation and prosecution, as well as actions to remedy the harm caused by proven fraud. Preventive activities generally offer the most cost efficient use of resources, since they enable managers to avoid a costly and inefficient “pay-and-chase” model in which fraudulent transactions are detected and then attempts are made to recover funds after payments have occurred. Fraud examination units: SSA established fraud examination units in 2014. These units help detect potential third-party disability fraud and help respond to known fraud cases perpetrated by doctors, representatives, and other third parties. The units are staffed with SSA disability examiners from regional offices who assist the OIG with disability fraud investigations involving third parties and help reevaluate disability claims that could have been affected by known fraudsters. For example, unit staff can analyze groups of potentially fraudulent cases to identify trends or suspicious information, such as inconsistencies, altered medical records, or similar or identical medical evidence used in multiple claims. After their analysis, examiners share their findings with the OIG to consider in its investigation. In addition, fraud examination unit staff reevaluate disability claims that have evidence from third parties involved in fraud schemes, such as a case that was uncovered in Puerto Rico where third-party facilitators conspired with claimants to submit evidence for fabricated or exaggerated disabilities, resulting in 27 defendants sentenced as of September 2014, according to a report from SSA’s OIG. During a reevaluation, unit examiners help evaluate whether there is sufficient evidence of a claimant’s disability after evidence from a physician or other third party involved in a fraud scheme is excluded, or whether other evidence and further evaluation is needed to support the claim. Antifraud training and awareness-raising for SSA employees: As mentioned earlier in this report, SSA has annual mandatory antifraud training for all staff and multiple activities designed to raise awareness among employees about fraud, which can help deter and detect potential disability fraud by educating staff on how to identify and report suspicious activity. Since 2014, SSA has developed three 30- minute antifraud training videos that explain fraud and fraud-related terms, highlight OIG success stories and agency antifraud activities, and instruct employees on how to report potential fraud. Employees view the training through SSA’s online learning management system—which tracks completion of the course—or in other ways, such as in group settings. SSA requires managers to certify that employees completed the training. In addition, SSA has multiple sources of fraud-awareness information, such as newsletters, an internal website page, memos, and OIG presentations that highlight agency antifraud activities and instruct staff on how to identify and report potential fraud. Antifraud communications to the public: SSA promotes fraud awareness externally, which can help prevent fraud by deterring potential fraudsters and detect potential fraud by encouraging the public to report suspicious activity. For instance, SSA provides fact sheets, posters, articles, web graphics, and social media posts on its website for groups, organizations, and individuals to use to help promote SSA’s antifraud messages. SSA’s website also contains information on how to report suspected fraud, a message from the Acting Commissioner warning the public that SSA will find and prosecute fraudsters, and examples of what SSA is doing to combat fraud. In addition, SSA includes antifraud language on notices to beneficiaries, which includes the OIG’s hotline number and website. Antifraud data analytics: SSA is in the beginning stages of developing a data-analytics system to help prevent and detect potential fraud. According to agency officials, this system will include multiple models, and SSA plans to contract for a disability-related model after mid- fiscal year 2017 that will likely use data from several SSA databases to help identify pending disability claims that may be fraudulent on the basis of conditions that are indicative of disability fraud. As previously discussed, the OAFP worked with a contractor in fiscal year 2016 to conduct interviews with SSA staff who are familiar with the disability programs to help understand how fraud might occur in those programs. The OAFP plans to use that information to help guide its development of the model and what data may be required. According to OAFP officials, the agency plans to develop models that will rank claims by the likelihood of potential fraud so that analysts can focus on reviewing highly ranked claims more closely. SSA plans for the system to run in real time, which would allow SSA to examine questionable claims before they are fully processed and prevent potentially fraudulent benefits from being paid. Prosecution and sanctions: SSA has additional activities to respond to fraud and potential fraud and has taken steps to improve its processes. For example, SSA has provided attorneys to serve as fraud prosecutors to supplement the prosecutorial resources of the Department of Justice, which has responsibility for criminally prosecuting SSA fraud cases. Specifically, SSA doubled the number of fraud attorneys to 24 in fiscal year 2015 compared with early fiscal year 2014. In fiscal year 2015, the SSA attorneys secured 171 convictions resulting in over $16 million in restitution, according to an SSA report. Additionally, SSA can impose administrative sanctions—a temporary suspension of benefit payments for 6 to 24 months—on individuals who knowingly provide false or misleading information to SSA or fail to disclose information that is material to determining a right to benefits. In 2013, SSA implemented a new process to increase the consistency of imposing administrative sanctions and implemented a tool for improved tracking and monitoring of administrative sanctions in 2016. SSA has other program integrity activities that can help detect potential fraud in its disability programs, although these activities were not designed for this specific purpose. For example, SSA performs analytics to prevent and detect suspicious online transactions, such as unusual direct deposit requests. According to SSA officials, in fiscal year 2016, SSA reviewed over 29,000 suspicious online transactions and referred 1,460 of those transactions to the OIG. Some of these transactions may involve disability benefits. According to SSA officials, the agency’s system to prevent and detect suspicious online transactions ranks such transactions by the likelihood of potential fraud, which helps focus reviews on the cases that are most likely to be fraudulent. SSA also uses data- matching techniques and participates in external data-sharing agreements to help determine benefit eligibility and detect improper payments, of which some may be fraudulent disability benefit payments. For example, SSA uses the Department of Health and Human Services’ National Directory of New Hires—a database containing quarterly wage data—to help determine an individual’s initial and continued eligibility for DI and SSI benefits. Another data match enables the agency to verify SSI applicants’ and recipients’ bank account balances to determine whether they failed to report monetary resources that could affect their benefit amount or render them ineligible. Additionally, DDS examiners conduct periodic continuing disability reviews of disability beneficiaries to determine whether they remain eligible for benefits. If examiners identify suspicious evidence, such as conflicting medical information, during these reviews and perceive potential fraud, they are instructed to refer the case to the OIG for investigation. SSA has reported on the status of its antifraud initiatives and has a plan that includes high-level goals and objectives for managing fraud risks. However, it is unclear whether SSA’s antifraud initiatives are targeting the most significant fraud risks in SSA’s disability programs because SSA has not developed or documented an antifraud strategy that aligns antifraud activities to the most significant fraud risks identified through a comprehensive fraud risk assessment. SSA reported to the Subcommittee on Social Security, Committee on Ways and Means, in the House of Representatives in December 2014 and November 2015 on its antifraud initiatives, but these reports essentially provide summaries of antifraud efforts rather than a proactive strategy to guide SSA’s efforts moving forward. In particular, the reports generally do not clearly link antifraud activities to specific fraud risks by, for example, describing how the activities can address identified fraud risks. In September 2016, SSA completed a high-level antifraud plan that lists the agency’s antifraud- related goals for 2016 to 2018. The plan outlines specific initiatives related to each goal but generally does not describe how these initiatives can help SSA address identified fraud risks. For example, the plan includes an initiative to increase the number of attorneys that serve as fraud prosecutors for SSA. The plan states that officials responsible for the initiative will determine strategic locations for the prosecutors but does not indicate how SSA will consider fraud risk in different areas when identifying locations for the prosecutors. Without developing and documenting an antifraud strategy that considers the likelihood and impact of fraud risks along with its tolerance for these risks and its existing activities to mitigate them, as called for in leading practices, SSA cannot ensure that it has a coordinated approach to address the range of fraud risks in its disability programs and appropriately target the most significant risks. Developing an antifraud strategy can help SSA ensure that it has an appropriate balance of fraud prevention and detection activities to address its risks and can help SSA target its program integrity resources to the antifraud activities that would most cost effectively mitigate its fraud risks. SSA monitors its antifraud activities—including those to protect its disability programs—through the OAFP and NAFC, but the metrics SSA uses do not enable effective monitoring and evaluation. According to SSA documents, the OAFP is responsible for monitoring SSA’s antifraud activities and establishing performance and outcome-oriented goals for them. The OAFP receives updates from the components that are responsible for each antifraud initiative and has shared these updates with the NAFC through periodic meetings and with Congress through reports about SSA’s antifraud initiatives. The OAFP provides flexibility to the SSA components in developing and identifying the metrics that are used to assess and report on antifraud initiatives, and, according to an OAFP official, the office does not revise the metrics submitted by components. Leading practices identified in the Fraud Risk Framework call for managers to develop outcome-oriented measures to monitor and evaluate fraud risk management activities and to adapt activities based on the results. In addition, according to federal internal control standards, managers should establish and operate activities to monitor the internal control system and evaluate the results, which may be compared against an established baseline. Furthermore, agency-wide strategic planning requirements established under the Government Performance and Results Act of 1993 (GPRA) and enhanced by the GPRA Modernization Act of 2010 required agencies to establish outcome-oriented goals and a balanced set of performance indicators, including output and outcome indicators as appropriate, in measuring or assessing progress toward goals. Although these requirements apply at the agency level, in our prior work we have reported that these requirements can serve as leading practices for strategic planning at lower levels within federal agencies, such as planning for individual divisions, programs, or initiatives. However, we found that SSA does not track most of its antifraud initiatives via outcome-oriented metrics to help the agency regularly measure progress in achieving targets. Of the 17 ongoing initiatives listed in SSA’s 2015 antifraud initiatives report, we found that 10 had metrics that were not outcome-oriented, and 4 did not have any metrics. For example, the percentage of staff trained in fraud detection and prevention methods (an output) is listed as a metric of the antifraud training initiative, but SSA does not evaluate the outcomes associated with those trainings such as the change in particular behaviors following the trainings (e.g., the number of referrals to OIG about schemes covered during the trainings). In addition, the 2015 report lists the fraud examination units and fraud case reviews as initiatives but does not include metrics for either. Further, the majority of antifraud initiatives do not provide targets against which to measure performance and track progress relative to a baseline. For example, the initiative to add antifraud language to SSA notices states the “number of notices issued annually with antifraud language is over 186 million notices” as a metric but does not include a target. As previously mentioned, the NAFC receives updates on SSA’s antifraud initiatives from the OAFP, but it plays a limited role in monitoring and making decisions about the initiatives. SSA antifraud initiatives reports state that the NAFC monitors certain antifraud initiatives. For example, the 2015 report notes that the NAFC identified 10 major antifraud initiatives to monitor that year. Although not all NAFC members attend its meetings, the NAFC meets at least quarterly to sustain attention on antifraud initiatives. The NAFC meetings provide an opportunity to present updates and ensure committee members are aware of ongoing initiatives. However, our review of summaries from the seven NAFC meetings held during fiscal year 2016 found that the NAFC generally did not take an active role in monitoring the initiatives. For example, six of the seven NAFC meeting minutes did not indicate instances in which the NAFC requested further information to determine whether antifraud initiatives were meeting their intended goals or recommend changes to improve antifraud initiatives. According to SSA officials with responsibility for implementing antifraud initiatives, the NAFC serves as a forum for updates about antifraud initiatives, including efforts being implemented in SSA’s regions, but makes few decisions about the initiatives and performs limited monitoring of them. SSA recognizes the importance of monitoring, but it is unclear how it plans to evaluate its antifraud activities and adapt them if necessary. We have previously reported that agencies may face challenges measuring outcomes of fraud risk management activities in a reliable way. These challenges include the difficulty of measuring the extent of deterred fraud, isolating potential fraud from legitimate activity or other forms of improper payments, and determining the amount of undetected fraud. However, as described in the Fraud Risk Framework, it is possible for agencies to gather additional information on the short-term or intermediate outcomes of some antifraud initiatives, which may be more readily measured than ultimate benefits. For example, although SSA does not have a metric to monitor the fraud examination units or to evaluate their effect on fraud, it is possible for SSA to identify more immediate outcomes such as the number of potential fraud patterns that the units uncover doing nonreevaluation work. SSA’s antifraud strategic plan for 2016 to 2018 includes an objective to “adapt fraud risk management activities and communicate the results of monitoring and evaluations to management.” Although the plan highlights the importance of monitoring to help strengthen fraud risk management activities, it does not include specific steps for monitoring its antifraud initiatives. Identifying performance metrics, including baselines and targets as appropriate, and requiring additional information from the responsible components on progress made would help the OAFP and NAFC better monitor whether SSA is achieving its antifraud goals. Without this information, the OAFP and NAFC may not be able to determine whether SSA’s antifraud activities are operating effectively or determine whether changes are necessary. Proactively managing fraud risks can help facilitate SSA’s mission by ensuring that government services function as intended, and SSA has taken some steps to manage these risks. Many of SSA’s actions such as establishing an entity dedicated to coordinating fraud risk management activities and instituting annual antifraud training throughout the agency are consistent with leading practices and demonstrate a commitment to managing fraud risks. However, gaps exist in the agency’s fraud risk assessment, corresponding strategy design, and monitoring of antifraud activities. Despite some foundational efforts such as piloting a method for conducting future assessments by profiling four particular risks, until it conducts a thorough, systematic assessment of its fraud risks, SSA will lack robust information on the risks that may most affect the integrity of its disability programs. As a result, SSA may be using its resources to combat fraud schemes that are unlikely to materialize or that have a relatively minimal effect on SSA’s finances or reputation. Although SSA plans to assess fraud risks, it is unclear when an assessment of its disability programs will occur and whether it will reflect leading practices. Absent a comprehensive fraud risk assessment that aligns with leading practices and is regularly updated, SSA will not be equipped to address the fraud schemes to its disability programs that are considered to be the most significant before they occur. Similarly, without developing, documenting, and implementing a comprehensive antifraud strategy that builds on a comprehensive risk assessment, as called for by leading practices, SSA cannot ensure that its antifraud control activities are targeted to its fraud risks, and therefore may be using its resources for program integrity efforts inefficiently. Further, by creating the OAFP and reestablishing the NAFC, SSA has laid some important groundwork for monitoring and evaluating SSA’s antifraud activities. However, without establishing outcome-oriented metrics and then regularly reviewing progress toward meeting these goals, the OAFP will not be able to determine whether the agency’s antifraud control activities are working as intended. The OAFP is charged with coordinating among SSA’s components that lead particular antifraud efforts and establishing outcome-oriented goals; the NAFC—with its higher, cross-agency authority—is well-positioned to consider, act on, and help enforce the OAFP’s recommendations. If the OAFP does not review progress toward meeting antifraud goals and then recommend changes to any antifraud control activities that are not meeting goals, SSA will be hard-pressed to address known fraud risks and to respond to emerging risks that could undermine the agency’s antifraud efforts. We recommend that the Commissioner (or Acting Commissioner) of SSA direct the OAFP to take the following four actions for its disability programs: lead a comprehensive fraud risk assessment that is consistent with leading practices, and develop a plan for regularly updating the assessment; develop, document, and implement an antifraud strategy that is aligned to its assessed fraud risks; work with components responsible for implementing antifraud initiatives to develop outcome-oriented metrics, including baselines and goals, where appropriate for antifraud activities; and review progress toward meeting goals on a regular basis, and recommend that the NAFC make changes to control activities or take other corrective actions on any initiatives that are not meeting goals. We provided a draft of this report to SSA for review and comment, and its written comments are reproduced as appendix I in this report. SSA agreed with our recommendations and emphasized its commitment to preventing and detecting fraud. The agency also provided technical comments, which we incorporated into the report as appropriate. SSA described how it plans to address our recommendations as follows: Regarding our recommendation to lead a comprehensive fraud risk assessment of SSA’s disability programs, SSA agreed and stated that it will conduct a fraud risk assessment on its major lines of business on a recurring schedule, beginning with disability in fiscal year 2017. The agency stated that it will conduct this assessment after developing a fraud risk management strategy that is consistent with leading practices identified in the Fraud Risk Framework. Although it is important to take a strategic approach to assessing fraud risks, we maintain that an effective fraud risk management strategy is based on a comprehensive fraud risk assessment. Regarding our recommendation to develop, document, and implement an antifraud strategy that is aligned to assessed fraud risks, SSA agreed and stated that it will prioritize and align the agency’s antifraud strategy to the outcomes of the fraud risk assessment. Regarding our recommendation to work with components responsible for implementing antifraud initiatives to develop outcome-oriented metrics, including baselines and goals, where appropriate for antifraud activities, SSA agreed and noted that it will collaborate with stakeholders, including its OIG, to implement this recommendation. Regarding our recommendation to review progress toward meeting goals on a regular basis and to recommend that the NAFC make changes to any control activities or initiatives that are not meeting goals, SSA agreed. The agency stated that, as it develops its antifraud strategy, the NAFC will measure and recommend necessary corrective action to ensure that its initiatives achieve SSA’s stated objectives and goals. In addition, SSA stated that it will seek opportunities to prioritize initiatives and activities through a risk-based approach to mitigating the risk of program fraud. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send a copy to the Acting Commissioner of Social Security. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact Seto J. Bagdoyan at (202) 512-6722 or bagdoyans@gao.gov or Cindy Brown Barnes at (202) 512-7215 or brownbarnesc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II. In addition to the contacts named above, Tonita Gillich (Assistant Director), Joel Green (Analyst-in-Charge), Daniel Bertoni, Erin McLaughlin, and Bridgette Savino made key contributions to this report. Also contributing to the report were Holly Dye, Alexander Galuten, Erin Godtland, Maria McMullen, Kevin Metcalfe, James Murphy, Shana Wallace, David Watsula, and Greg Whitney.

Summary: SSA's Disability Insurance (DI) and Supplemental Security Income (SSI) programs provide cash benefits to millions of Americans with disabilities who are unable to work. Collectively, payments from DI and SSI were about $200 billion in fiscal year 2015. Although the extent of fraud in these programs is unknown, recent high-profile cases have highlighted instances in which individuals fraudulently obtained millions of dollars in benefits. GAO was asked to review SSA's fraud risk management. This report examines SSA's actions to manage fraud risks and the extent to which these actions align with leading practices for (1) establishing an organizational culture and structure conducive to fraud risk management, (2) identifying, assessing, and addressing fraud risks, and (3) monitoring and evaluating its antifraud activities. GAO reviewed SSA documents, such as training materials and operational guidance; and interviewed SSA officials at the agency's headquarters, its three fraud examination units, and selected state disability determination offices chosen for their proximity to antifraud initiatives. GAO assessed those actions against leading practices identified in its Fraud Risk Framework. The Social Security Administration (SSA) has taken steps to establish an organizational culture and structure conducive to fraud risk management in its disability programs, but its new antifraud office is still evolving. In recent years, SSA instituted mandatory antifraud training, established a centralized antifraud office to coordinate and oversee the agency's fraud risk management activities, and communicated the importance of antifraud efforts. These actions are generally consistent with GAO's Fraud Risk Framework, a set of leading practices that can serve as a guide for program managers to use when developing antifraud efforts in a strategic way. However, SSA's new antifraud office, the Office of Anti-Fraud Programs (OAFP), faced challenges establishing itself as the coordinating body for the agency's antifraud initiatives. For example, the OAFP has had multiple acting leaders, but SSA recently appointed a permanent leader of OAFP to provide accountability for the agency's antifraud activities. SSA has taken steps to identify and address fraud risks in its disability programs, but it has not yet comprehensively assessed these fraud risks or developed a strategic approach to help ensure its antifraud activities effectively mitigate those risks. Over the last year, SSA gathered information about fraud risks, but these efforts generally have not been systematic and did not assess the likelihood, impact, or significance of all risks that were identified. SSA also has several prevention and detection activities in place to address known fraud risks in its disability programs such as fraud examination units, which review disability claims to help detect fraud perpetrated by third parties. However, SSA has not developed and documented an overall antifraud strategy that aligns its antifraud activities to its fraud risks. Leading practices call for federal program managers to conduct a fraud risk assessment and develop a strategy to address identified fraud risks. Without conducting a fraud risk assessment that aligns with leading practices and developing an antifraud strategy, SSA's disability programs may remain vulnerable to new fraud schemes, and SSA will not be able to effectively prioritize its antifraud activities. SSA monitors its antifraud activities through the OAFP and its National Anti-Fraud Committee (NAFC), which serves as an advisory board to the OAFP, but the agency does not have effective performance metrics to evaluate the effect of such activities. The OAFP has responsibility for monitoring SSA's antifraud activities and establishing performance and outcome-oriented goals for them. It collects metrics to inform reports about its antifraud initiatives, and the NAFC receives regular updates about antifraud initiatives. However, the quality of the metrics varies across initiatives and some initiatives do not have metrics. Of the 17 initiatives listed in SSA's 2015 report on antifraud initiatives, 10 had metrics that did not focus on outcomes, and 4 did not have any metrics. For example, SSA lacks a metric to help monitor the effectiveness of its fraud examination units. Leading practices in fraud risk management call for managers to monitor and evaluate antifraud initiatives with a focus on measuring outcomes. Without outcome-oriented performance metrics, SSA may not be able to evaluate its antifraud activities, review progress, and determine whether changes are necessary. GAO recommends SSA (1) conduct a comprehensive fraud risk assessment for its disability programs, (2) develop a corresponding antifraud strategy, (3) develop outcome-oriented metrics for antifraud activities, and (4) review progress and change activities as necessary. SSA agreed with GAO's recommendations.