The five projects selected for our study included one project from each  project type, with the applicable controls depending in part on the type of  project. SSA agreed with the Inspectors General’s  recommendations and has taken steps to address the weaknesses. Selected IT Projects Did Not Fully Adhere to SSA’s Investment Management Controls or Demonstrate Improved Services

The five IT projects that we reviewed did not fully implement project  management controls consistent with SSA guidance and industry  practices. Most of the control  documents developed had limitations, such as a lack of traceability (which  is needed to trace and track the history of projects and demonstrate that  the projects met requirements) and inaccurate or incomplete information. The limitations could be attributed, in part, to the use of oversight systems  that did not include all needed data or have the capability to fully support  traceability and a quality assurance function that was limited in scope  and, thus, inadequate to assess control documents effectively. Further, while SSA indicated that its projects have resulted in  improvements to services, it was unable to demonstrate how the selected  projects had contributed such improvements. Specifically,  while project team members produced documentation that identified  certain risks to the project, the documentation did not include mitigation  plans, which are essential for avoiding, reducing, and controlling the  probability of the occurrence of identified risks. SSA has stated that its projects have contributed to improved services. In addition, the project did not establish a  performance baseline against which to measure improvements. SSA’s IT Human Capital Program Has Identified Skills and Competencies to Support Certain Needs, but Lacks Adequate Planning for the Future

Key to an agency’s success in modernizing its IT systems is sustaining a  workforce with the necessary knowledge, skills, and abilities to execute a  range of management functions that support the agency’s mission and  goals. Specifically, while the five projects developed most of the project  documentation needed to show adherence to management controls, the  majority had limitations. Given the hundreds of  IT projects SSA manages each year, ensuring that management controls  are consistently and effectively implemented is critical to the efficient use  of agency resources. In  particular, the agency has not identified IT-specific human capital needs  to support its future goals and it does not have a current IT succession  plan for replacing experienced staff. Recommendations for Executive Action

To address SSA’s project management and human capital deficiencies  for its IT modernization efforts, we recommend that the Commissioner of  Social Security direct the Deputy Commissioner for Systems/Chief  Information Officer to take the following three actions:
Perform effective oversight to ensure that key management control  documents for ongoing and future projects are developed, complete,  accurate, and readily accessible in oversight systems to better  support management, traceability, and project analysis of IT  investments. Identify future IT needs, including skills needed to support long-term  goals and priorities, in the agency’s updated human capital operating  plan and associated analysis. For example, the agency stated that it will continue to improve its  governance process by requiring both process and product reviews of  selected IT projects, improve its work to identify performance measures,  and include a comprehensive assessment of IT human capital needs in  its updated IT Human Capital Plan. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) assess selected information technology (IT)  investments to determine the extent to which they adhere to the Social  Security Administration’s (SSA) investment management controls and are  improving services; and (2) determine how SSA’s IT human capital  program, including the identification and implementation of critical skills  and competencies, is supporting its current and future modernization  efforts. We also analyzed SSA policies  and guidance to determine key documents associated with the agency’s  IT project management directive and quality assurance processes to  identify the types of management control documents, such as project  proposals, cost-benefit analyses, and project schedules, that SSA relies  on for managing its investments. The best practices and standards call for  control documentation to, among other things, be traceable, accurate,  consistent, and effectively implemented. To address the second objective, we obtained and analyzed SSA human  capital plans and data, including its Information Resources Management  (IRM) Strategic Plan for fiscal years 2012 through 2016 and the most  recent updated plan for fiscal years 2014 through 2017, 2-year IT skills  inventory gap reports, IT staffing data for fiscal years 2008-2014, agency- wide succession plan, and its agency-wide human capital plan. SSA developed all 11 documents; however, 6 had limitations.
Why GAO Did This Study

SSA relies on IT for delivering Social Security services to virtually every American. The agency reportedly spent about $1.5 billion for IT in fiscal year 2013, and it plans to continue modernizing its aging systems. Management controls and human capital are critical in helping ensure effective and efficient IT project implementation.
GAO was asked to examine SSA's IT modernization efforts. The study (1) assessed selected IT investments to determine the extent to which they adhere to SSA's investment management controls and are improving services and (2) determined how SSA's IT human capital program, including the identification and implementation of critical skills and competencies, is supporting its current and future modernization efforts. To do so, GAO reviewed key management controls for one project from each of five SSA-defined project types, including one project with the highest resources for its type and four randomly selected projects; compared human capital planning documents with relevant guidance; and interviewed relevant SSA officials.

What GAO Found

The Social Security Administration’s (SSA) selected information technology (IT) projects did not fully adhere to management controls called for by its IT project management guidance, which are essential to effectively oversee and monitor IT investments. Such controls include, among others, a cost-benefit analysis, risk mitigation plan, and project schedule. For the five projects selected, SSA developed the majority of the documents required to demonstrate adherence to management controls; however, most had limitations. One project that was required to complete 11 control documents had developed 5 without limitations, but the remaining 6 had limitations. For example, while certain risks to the project were identified, the documentation did not include risk mitigation plans, which are essential for avoiding, reducing, and controlling the probability of the occurrence of identified risks. Across the five projects, the most common limitations included a lack of traceability (which is needed to track project history and demonstrate that requirements are met) and inaccurate or incomplete information, such as project schedules that had inaccuracies in key milestone dates. The limitations could be attributed to, among other things, IT oversight systems that did not include all needed data or fully support traceability, and a quality assurance process that was not effectively implemented. The agency recently took steps that should help improve its quality assurance process.
Further, while SSA stated that its projects have resulted in improved services, it was not able to demonstrate this. In particular, while three of the five projects identified performance measures, these measures generally were not specific enough to determine projects’ contributions to improved services, and baselines against which to measure improvement were not established. Ensuring that management controls are consistently and effectively implemented would help ensure the efficient use of agency resources.
SSA’s IT human capital program has identified skills and competencies to support certain workforce needs, but lacks adequate planning for the future. The agency has developed IT human capital planning documents, such as its recent Information Resources Management plan and skills inventory gap reports, which identified near-term needs, such as skill sets for the following 2 years. Nevertheless, SSA has not adequately planned for longer-term needs because its human capital planning and analysis are not aligned with long-term goals and objectives and the agency does not have a current succession plan for its IT efforts. The agency has recognized challenges with regard to employee retirements and a recent hiring freeze, which have put constraints on resources for certain investments. While SSA officials stated that an updated human capital operating plan will be completed in June 2014, they could not specify how it would address future IT human capital needs. Until these needs are identified, SSA may lack critical plans for addressing IT resources and skills to support agency-wide IT investment goals.

What GAO Recommends

GAO is recommending that SSA (1) perform effective oversight to ensure control documents are developed, complete, and accurate and that oversight systems include needed data and support traceability; (2) ensure project control documents identify specific performance measures and baselines; and (3) identify long-term IT needs in its updated human capital operating plan. SSA agreed with GAO's recommendations.