SSA’s mission is to deliver Social Security services that meet the changing needs of the public. The Social Security Act and amendments established the programs that SSA administers, which include the Old Age, Survivors, and Disability Insurance program: Commonly referred to simply as “Social Security,” this program is one of the nation’s largest entitlement programs and provides monthly benefits to retired and disabled workers, their spouses and children, and the survivors of insured workers who have died; and the Supplemental Security Income program: This is a needs-based program financed from general tax revenues that provides benefits to aged adults, blind or disabled adults, and children with limited income and resources. According to SSA, in fiscal year 2011, about 54 million people received benefits from the Old Age, Survivors, and Disability program, and over 8 million people received benefits from the Supplemental Security Income program. Collectively, about 155 million people work and pay Social Security taxes. The agency’s fiscal year 2011 expenses totaled about $12.4 billion to support its programs. SSA relies extensively on IT to administer its programs and support related activities. Specifically, its systems are used to, among other things, handle millions of transactions on SSA’s toll-free telephone number, maintain records for the millions of beneficiaries and recipients of SSA’s programs, evaluate evidence and make determinations of eligibility for benefits, issue new and replacement Social Security cards, and process earnings items for crediting to workers’ earnings records. However, as the agency’s systems have aged, SSA has faced challenges in carrying out its increasing workload. Specifically, many of SSA’s existing systems software were developed in the 1960s and 1970s and are written in older computer programming languages or are past their designed life cycle. While the agency has made technical and functional upgrades throughout the years, it continues to face challenges because of the need to store, process, and share increasing amounts of data and to transition to Web-based, online access for SSA data and services, among other factors. Accordingly, in its most recent Agency Strategic Plan, SSA has identified IT as a key foundational element to achieving success in meeting its goals. Recognizing the challenges facing its IT environment, the agency has stated that it plans to, among other things, develop and implement a common system for processing disability cases, increase its use of online services for access to benefits and information, and automate its processes for reporting information. SSA’s Office of Systems is responsible for developing, overseeing, and maintaining the agency’s IT systems. Comprised of eight component offices and approximately 3,300 staff, the Office of Systems has responsibility for the agency’s IT. SSA uses its capital planning and investment control process to manage its software development projects. This process is intended to meet the by providing a framework for objectives of the Clinger-Cohen Act of 1996selecting, controlling, and evaluating investments in IT to help ensure that they meet the strategic and business objectives of the agency. This process requires a series of reviews by executive oversight bodies, including the agency’s Strategic Information Technology Assessment and Review board, to ensure that IT projects are selected that best meet the agency’s goals; that, once selected, they are performing within expected schedule and cost parameters; and finally, that once implemented, these projects are delivering results. In June 2011, in an effort to increase efficiency, the Commissioner of Social Security announced the realignment of CIO functions and associated personnel. As part of this realignment, the Office of the CIO was eliminated, and most of its responsibilities for managing IT, along with the IT budget, were reassigned to the Office of Systems. Previously, key duties of the CIO were to select and prioritize IT investments and oversee the review and approval of the annual IT budget, while the Office of Systems was responsible for managing the acquisition, development, and maintenance of IT projects. Under the realignment, the Deputy Commissioner for Systems—who heads the Office of Systems—assumed the major responsibilities of the CIO. Since 2001, SSA has reported spending more than $5 billion on the development, modernization, and enhancement of its IT systems and capabilities. SSA officials identified 120 initiatives undertaken from 2001 to 2011 that the agency considered to be key investments in modernization. These comprise a subset of the hundreds of projects and modernization activities SSA undertakes yearly, which vary greatly in level of effort, scope, and cost. These initiatives affected all of the agency’s main program areas: According to managers within SSA’s Office of Disability Systems, in an effort to reduce backlogs of disability hearings, the agency implemented a process for creating electronic “folders” for each applicant, to replace the existing paper-based process. This initiative included capabilities for electronically viewing an applicant’s folder, electronic screening for faster disability determinations, and Internet access to information on disability hearings and determinations. The Office of Retirement and Survivors Insurance Systems took steps to improve outdated legacy systems and respond to legislation or other mandates requiring new system functionality. These efforts included integrating stand-alone “post-entitlement” processes, facilitating online application for benefits, and conversion of a key database to a more modern, industry-standard one. Managers from the Office of Applications and Supplemental Security Income described initiatives to modernize large legacy databases and facilitate data sharing to streamline the claims process. These included enhancements to the electronic death registration process and the development of a Web application enabling access to data from multiple systems. SSA officials described initiatives in the area of electronically exchanging data with external partners, including states and private- sector partners such as banks and credit bureaus. SSA also noted efforts to streamline the process for administering Social Security cards, such as introducing safeguards against counterfeiting and replacing its legacy printers. In addition to these initiatives, SSA undertook a project to establish a disaster recovery capability at a secondary computing site. This project provided for continuity of operations, continuous processing of SSA’s workload, and backup of the agency’s IT assets, among other capabilities. While these improvements have yielded benefits, SSA still has a number of other major efforts under way to continue the modernization of its IT environment. These efforts involve completing the conversion of the agency’s legacy Master Data Access Method database system (used to support the storage and retrieval of SSA’s major program master files) to a modern, industry-standard database system; transitioning from its legacy system for processing retirement and survivors’ claims to a single, unified system that integrates initial and post-entitlement actions; streamlining operations and reducing duplication in disability databases and transitioning from multiple and fragmented applications to a single, unified case processing system; enhancing and refreshing telecommunications equipment and ongoing improvement of connectivity and bandwidth for data, voice, and video communications; and supporting enhancements to SSA’s Medicare initiatives, including changes required by the Patient Protection and Affordable Care Act, which are intended to improve the process for verifying the name, Social Security number, and other data on Medicare earnings reports. SSA officials noted that the agency faces several challenges in successfully carrying out these modernization efforts. These include planning for system changes within a single fiscal year budget cycle, a practice that limits the agency’s ability to make long-term modernization plans; devoting significant resources to the maintenance of existing legacy systems because of large quantities of legacy code; and diverting resources from long-term projects to shorter-term immediate requirements, such as those arising from legislative changes. Compounding these challenges, we found that SSA has not fully established performance measures or a post-implementation review process that would allow it to determine the progress it is making in its modernization efforts. Federal law requires agencies to identify performance measures for their IT investments, and we have previously reported that comprehensive measures are essential for gauging the progress and benefits of IT investments. However, while SSA developed performance measures for most of its 17 major modernization investments for fiscal year 2010, it did not identify any measures in one of four management areas identified by the Office of Management and Budget (OMB) for 3 of these investments. Moreover, the measures SSA developed did not always allow for assessments of each project’s effectiveness in meeting agency goals. For example, these measures did not always (1) identify how each project is to contribute to expected benefits; (2) include measures of investments’ effectiveness in meeting goals, requirements, or mission results; or (3) provide the means for measuring progress toward specific modernization goals. In addition, SSA has not conducted post-implementation reviews of its IT projects or systems, as called for by OMB guidance. Such a review should confirm the extent to which planned benefits were achieved, determine the cost-effectiveness of the project, and identify lessons learned and opportunities for improvement. While SSA conducts assessments of completed initiatives, these assessments lack key elements called for by OMB that would provide assurance that modernization and other IT projects are delivering expected benefits at acceptable costs and that SSA is making progress in meeting its goals. Comprehensive strategic planning is essential for successfully carrying out large-scale efforts such as SSA’s IT modernizations. Key elements of such planning include developing an IT strategic plan and an enterprise architecture that, together, outline modernization goals, measures, and timelines. An IT strategic plan serves as an agency’s vision and helps align its information resources with its business strategies and investment decisions. As such, it provides a high-level perspective of the agency’s goals and objectives, enabling the agency to prioritize how it allocates resources; proactively respond to changes; and communicate its vision and goals to management, oversight bodies, and external parties. The enterprise architecture helps to implement the strategic vision by providing a focused “blueprint” of the organization’s business processes and technology that supports them.