SSA Relies Extensively on IT

SSA relies heavily on its IT resources to support the administration of its  programs and related activities. Congress and the Administration Have Undertaken Efforts to Improve Federal IT

As previously mentioned, Congress enacted federal IT acquisition reform  legislation (commonly referred to as FITARA) in December 2014. For the covered agencies, including SSA, the executive order strengthens  the role of the CIO by, among other things, requiring the CIO to report  directly to the agency head; to serve as the agency head’s primary IT  strategic advisor; and to have a significant role in all management,  governance, and oversight processes related to IT. SSA Has Improved the Management of Selected Areas of IT Acquisitions and Operations, but Has Not Fully Addressed the Role of Its CIO

SSA has taken steps to improve its management of IT acquisitions and  operations by addressing 14 of the 15 recommendations that we  previously directed to the agency regarding data center consolidation,  incremental development, IT acquisitions, and software licenses. As of September 2018, SSA had implemented all four  recommendations. OMB has emphasized the need to deliver  investments in smaller parts, or increments, in order to reduce risk,  deliver capabilities more quickly, and facilitate the adoption of  emerging technologies. In November 2017, we reported that 21 agencies, including SSA,  needed to improve their certification of incremental development. As a result of these findings, we recommended that SSA ensure that  its CIO (1) reports major IT investment information related to  incremental development accurately, in accordance with OMB  guidance; and (2) updates the agency’s policy and processes for the  certification of incremental development and confirm that the policy  includes a description of how the CIO certification will be documented. SSA agreed with our recommendations and implemented both of  them. Software licenses. Effective management of these  licenses can help avoid purchasing too many licenses, which can  result in unused software, as well as too few licenses, which can  result in noncompliance with license terms and cause the imposition  of additional fees. As such, we made six recommendations to SSA to improve its  policies and practices for managing software licenses. SSA Needs to Further Address the CIO’s Role in Its Policies

While SSA has taken steps that improved its IT management in the areas  of data center consolidation, incremental development, IT acquisitions,  and software licenses, we reported in August 2018 that the agency had  not fully addressed the role of the CIO in its policies. Within these laws and guidance, we identified IT management  responsibilities assigned to CIOs in six key IT areas:
Leadership and accountability. Information security. For example, the agency’s  policies did not address the IT workforce area at all, including the  requirements that the CIO annually assess the extent to which agency  personnel meet IT management knowledge and skill requirements,  develop strategies to address deficiencies, and report to the head of the  agency on the progress made in improving these capabilities. Further, SSA’s policies minimally addressed the requirements for IT  strategic planning. As a result of these findings, we made a recommendation to SSA to  address the weaknesses in its policies with regard to the remaining five  key management areas. In response, the agency agreed with our  recommendation and, subsequently, stated that it planned to do so by the  end of September 2018. Toward this end, the agency has taken steps to improve  its management of IT acquisitions and operations by implementing 14 of  the 15 recommendations we made from 2011 through 2018 to improve its  IT management. Nevertheless, SSA would be better positioned to  effectively address longstanding IT management challenges by ensuring  that it has policies in place that fully address the role and responsibilities  of its CIO in the five key management areas, as we previously  recommended.
Why GAO Did This Study

SSA delivers services that touch the lives of almost every American, and relies heavily on IT resources to do so. Its systems support a range of activities, such as processing Disability Insurance payments, to calculating and withholding Medicare premiums, and issuing Social Security numbers and cards. For fiscal year 2018, the agency planned to spend approximately $1.6 billion on IT.
GAO has previously reported that federal IT projects have often failed, in part, due to a lack of oversight and governance. Given the challenges that federal agencies, including SSA, have encountered in managing IT acquisitions, Congress and the administration have taken steps to improve federal IT, including enacting federal IT acquisition reform legislation and issuing related guidance.
This statement summarizes GAO's previously reported findings regarding SSA's management of IT acquisitions and operations. In developing this testimony, GAO summarized findings from its reports issued in 2011 through 2018, and information on SSA's actions in response to GAO's recommendations.

What GAO Found

The Social Security Administration (SSA) has improved its management of information technology (IT) acquisitions and operations by addressing 14 of the 15 recommendations that GAO has made to the agency. For example,
Incremental development . The Office of Management and Budget (OMB) has emphasized the need for agencies to deliver IT investments in smaller increments to reduce risk and deliver capabilities more quickly. In November 2017, GAO reported that agencies, including SSA, needed to improve their certification of incremental development. As a result, GAO recommended that SSA's CIO (1) report incremental development information accurately, and (2) update its incremental development policy and processes. SSA implemented both recommendations.
Software licenses . Effective management of software licenses can help avoid purchasing too many licenses that result in unused software. In May 2014, GAO reported that most agencies, including SSA, lacked comprehensive software license policies. As a result, GAO made six recommendations to SSA, to include developing a comprehensive software licenses policy and inventory. SSA implemented all six recommendations.
However, SSA's IT management policies have not fully addressed the role of its CIO. Various laws and related guidance assign IT management responsibilities to CIOs in six key areas. In August 2018, GAO reported that SSA had fully addressed the role of the CIO in one of the six areas (see table). Specifically, SSA's policies fully addressed the CIO's role in the IT leadership and accountability area by requiring the CIO to report directly to the agency head, among other things.
In contrast, SSA's policies did not address or minimally addressed the IT workforce and IT strategic planning areas. For example, SSA's policies did not include requirements for the CIO to annually assess the extent to which personnel meet IT management skill requirements or to measure how well IT supports agency programs. GAO recommended that SSA address the weaknesses in the remaining five key areas. SSA agreed with GAO's recommendation and stated that the agency plans to implement the recommendation by the end of this month.

What GAO Recommends

GAO has made 15 recommendations to SSA to improve its management of IT acquisitions and operations from 2011 through 2018, and 1 recommendation to improve its CIO policies. While SSA has implemented nearly all of them, it would be better positioned to overcome longstanding IT management challenges when it addresses the CIO's role in its policies.