	Background

SSA provides benefits to individuals with disabilities through two main  programs: DI and SSI. Prompted by OIG requests and at the  direction of SSA’s Operations component, they review claims to help  detect patterns of disability fraud perpetrated by third parties such as  physicians, attorneys, or claimant representatives. SSA’s  National Anti-Fraud Committee (NAFC) provides a forum for agency  executives to collaborate on antifraud strategies and serves as an  advisory board for the OAFP in determining what initiatives to monitor,  among other things. The Fraud Risk Framework provides a comprehensive set of leading practices that serves as a guide for agency managers to use  when developing efforts to combat fraud in a strategic, risk-based way. Commit—Commit to combating fraud by creating an organizational  culture and structure conducive to fraud risk management;  2. SSA Has Demonstrated an Organizational Commitment to Combating Fraud, but Its New Antifraud Office Is Still Evolving

SSA has taken steps to establish an organizational culture and structure  that are conducive to managing fraud risks in its disability programs. SSA further demonstrated a commitment to antifraud efforts by  conducting a study to evaluate its fraud risk management approach and  shortly thereafter establishing a dedicated antifraud office within the  agency. For example, the OAFP has taken steps to coordinate antifraud  initiatives across SSA by gathering information about progress on the  initiatives, and has helped create antifraud training materials for the  agency. Although these steps are generally consistent with leading practices in  fraud risk management, the OAFP faced challenges during its first 2  years to fully establish itself within the agency. However, recent actions may help  to address these challenges:
Lack of consistent leadership: Until recently, the OAFP had not had a  permanent leader who provided accountability for the agency’s  antifraud initiatives. SSA Has Taken Steps to Identify and Address Disability Fraud Risks but Has Not Conducted a Comprehensive Fraud Risk Assessment or Developed an Antifraud Strategy

		Steps Taken to Identify Fraud Risks in Disability Programs but Not to Conduct a Comprehensive Fraud Risk Assessment

SSA has undertaken efforts over the last year to identify fraud risks in its  disability programs but has not comprehensively assessed the fraud risks  identified through those efforts. SSA’s antifraud activities include the following,  among others:
Cooperative Disability Investigation (CDI) units: SSA and the OIG  established CDI units in fiscal year 1997 to help prevent and detect  potential disability fraud and have increased the number and  coverage of the units in recent years. Fraud examination units: SSA established fraud examination units in  2014. Without developing and documenting an antifraud strategy that considers  the likelihood and impact of fraud risks along with its tolerance for these  risks and its existing activities to mitigate them, as called for in leading  practices, SSA cannot ensure that it has a coordinated approach to  address the range of fraud risks in its disability programs and  appropriately target the most significant risks. SSA Does Not Have Effective Metrics to Monitor and Evaluate Its Antifraud Activities

SSA monitors its antifraud activities—including those to protect its  disability programs—through the OAFP and NAFC, but the metrics SSA  uses do not enable effective monitoring and evaluation. According to SSA  documents, the OAFP is responsible for monitoring SSA’s antifraud  activities and establishing performance and outcome-oriented goals for  them. Leading practices identified in the Fraud Risk Framework  call for managers to develop outcome-oriented measures to monitor and  evaluate fraud risk management activities and to adapt activities based  on the results. Of the 17 ongoing initiatives listed  in SSA’s 2015 antifraud initiatives report, we found that 10 had metrics  that were not outcome-oriented, and 4 did not have any metrics. SSA’s antifraud strategic plan for 2016 to 2018  includes an objective to “adapt fraud risk management activities and  communicate the results of monitoring and evaluations to management.”  Although the plan highlights the importance of monitoring to help  strengthen fraud risk management activities, it does not include specific  steps for monitoring its antifraud initiatives. Without this information, the OAFP and  NAFC may not be able to determine whether SSA’s antifraud activities  are operating effectively or determine whether changes are necessary. However, gaps exist in the agency’s fraud risk  assessment, corresponding strategy design, and monitoring of antifraud  activities. Recommendations for Executive Action

We recommend that the Commissioner (or Acting Commissioner) of SSA  direct the OAFP to take the following four actions for its disability  programs:  lead a comprehensive fraud risk assessment that is consistent with  leading practices, and develop a plan for regularly updating the  assessment; develop, document, and implement an antifraud strategy that is  aligned to its assessed fraud risks; work with components responsible for implementing antifraud  initiatives to develop outcome-oriented metrics, including baselines  and goals, where appropriate for antifraud activities; and  review progress toward meeting goals on a regular basis, and  recommend that the NAFC make changes to control activities or take  other corrective actions on any initiatives that are not meeting goals.
Why GAO Did This Study

SSA's Disability Insurance (DI) and Supplemental Security Income (SSI) programs provide cash benefits to millions of Americans with disabilities who are unable to work. Collectively, payments from DI and SSI were about $200 billion in fiscal year 2015. Although the extent of fraud in these programs is unknown, recent high-profile cases have highlighted instances in which individuals fraudulently obtained millions of dollars in benefits. GAO was asked to review SSA's fraud risk management.
This report examines SSA's actions to manage fraud risks and the extent to which these actions align with leading practices for (1) establishing an organizational culture and structure conducive to fraud risk management, (2) identifying, assessing, and addressing fraud risks, and (3) monitoring and evaluating its antifraud activities. GAO reviewed SSA documents, such as training materials and operational guidance; and interviewed SSA officials at the agency's headquarters, its three fraud examination units, and selected state disability determination offices chosen for their proximity to antifraud initiatives. GAO assessed those actions against leading practices identified in its Fraud Risk Framework.

What GAO Found

The Social Security Administration (SSA) has taken steps to establish an organizational culture and structure conducive to fraud risk management in its disability programs, but its new antifraud office is still evolving. In recent years, SSA instituted mandatory antifraud training, established a centralized antifraud office to coordinate and oversee the agency's fraud risk management activities, and communicated the importance of antifraud efforts. These actions are generally consistent with GAO's Fraud Risk Framework, a set of leading practices that can serve as a guide for program managers to use when developing antifraud efforts in a strategic way. However, SSA's new antifraud office, the Office of Anti-Fraud Programs (OAFP), faced challenges establishing itself as the coordinating body for the agency's antifraud initiatives. For example, the OAFP has had multiple acting leaders, but SSA recently appointed a permanent leader of OAFP to provide accountability for the agency's antifraud activities.
SSA has taken steps to identify and address fraud risks in its disability programs, but it has not yet comprehensively assessed these fraud risks or developed a strategic approach to help ensure its antifraud activities effectively mitigate those risks. Over the last year, SSA gathered information about fraud risks, but these efforts generally have not been systematic and did not assess the likelihood, impact, or significance of all risks that were identified. SSA also has several prevention and detection activities in place to address known fraud risks in its disability programs such as fraud examination units, which review disability claims to help detect fraud perpetrated by third parties. However, SSA has not developed and documented an overall antifraud strategy that aligns its antifraud activities to its fraud risks. Leading practices call for federal program managers to conduct a fraud risk assessment and develop a strategy to address identified fraud risks. Without conducting a fraud risk assessment that aligns with leading practices and developing an antifraud strategy, SSA's disability programs may remain vulnerable to new fraud schemes, and SSA will not be able to effectively prioritize its antifraud activities.
SSA monitors its antifraud activities through the OAFP and its National Anti-Fraud Committee (NAFC), which serves as an advisory board to the OAFP, but the agency does not have effective performance metrics to evaluate the effect of such activities. The OAFP has responsibility for monitoring SSA's antifraud activities and establishing performance and outcome-oriented goals for them. It collects metrics to inform reports about its antifraud initiatives, and the NAFC receives regular updates about antifraud initiatives. However, the quality of the metrics varies across initiatives and some initiatives do not have metrics. Of the 17 initiatives listed in SSA's 2015 report on antifraud initiatives, 10 had metrics that did not focus on outcomes, and 4 did not have any metrics. For example, SSA lacks a metric to help monitor the effectiveness of its fraud examination units. Leading practices in fraud risk management call for managers to monitor and evaluate antifraud initiatives with a focus on measuring outcomes. Without outcome-oriented performance metrics, SSA may not be able to evaluate its antifraud activities, review progress, and determine whether changes are necessary.

What GAO Recommends

GAO recommends SSA (1) conduct a comprehensive fraud risk assessment for its disability programs, (2) develop a corresponding antifraud strategy, (3) develop outcome-oriented metrics for antifraud activities, and (4) review progress and change activities as necessary. SSA agreed with GAO's recommendations.