IT Investment Management: Social Security Administration Needs to Oversee Investments in Operations and Better Evaluate Performance
Fast Facts
The Social Security Administration relies on information technology to deliver retirement, disability, and other benefits to millions of Americans. In FY 2024, it spent about $2.2 billion on IT.
We found that SSA doesn't have a process for its IT Investment Review Board to monitor its investments in operations and maintenance, infrastructure, and cybersecurity. These investments accounted for about 90% of its IT budget in FY 2024. SSA also didn't fully evaluate the performance of its investments, even though it's required to do so.
Our 7 recommendations address these issues.
Highlights
What GAO Found
The Social Security Administration (SSA) has defined processes to manage IT investments under development that are consistent with relevant federal legislation, federal guidance, and key practices. However, the agency does not have a process to oversee investments in operations—including those in operations and maintenance (O&M), infrastructure, and cybersecurity. These investments accounted for $2 billion or about 90 percent of SSA's IT budget in fiscal year 2024. SSA officials told GAO that, among other things, maintaining investments in O&M is necessary and the agency cannot have debates on whether to continue to fund them. Without a process for the IT investment review board (IRB) to oversee these investments, SSA lacks the enterprise-wide perspective to make the most appropriate strategic IT investment decisions. In addition, the agency is hampered in its ability to effectively manage the entire IT portfolio and identify opportunities for cost savings and efficiencies.
SSA has not fully evaluated investments under development and those in operations:
- While SSA has policies and procedures to oversee investments under development, it has not fully implemented them. SSA's IT IRB meeting minutes for fiscal years 2022 to 2024 showed that the board primarily focused on funding allocations for the upcoming fiscal year and did not regularly discuss investment performance. SSA officials said that this was primarily due to the uncertain budget environment. However, without regular oversight, the IT IRB will not know whether the investments are meeting performance targets. The IRB also risks identifying corrective actions late, when they are more difficult and costly to address.
- SSA did not have complete performance documentation for three selected investments under development. Without complete and current performance data, SSA is unable to determine investment progress and value.
Analysis of Selected IT Investment Management Documentation, Fiscal Years 2022 to 2024
|
|
Performance measures identified |
Return on investment documentation |
Value realization documentation |
|---|---|---|---|
|
Investment 1 |
✔ Yes |
✘ No |
△ Partial |
|
Investment 2 |
✘ No |
✘ No |
✘ No |
|
Investment 3 |
✔ Yes |
△ Partial |
△ Partial |
✔ Yes = documentation existed and was complete/current; △ Partial = documentation existed but was not complete/current; ✘ No = documentation did not exist.
Source: GAO analysis of Social Security Administration documentation. | GAO-25-107200
- SSA also does not have a process to regularly review the performance of investments in O&M, as called for in federal guidance. Officials stated that they maintain performance information for investments in O&M which is available to project staff and executives. In addition, project staff are responsible for monitoring investment performance and raising issues as needed to leadership. However, SSA's IT IRB meeting minutes did not show evidence of this. Until SSA defines and implements processes to review investments in O&M, it risks not knowing whether its multibillion-dollar IT investments continue to support agency needs.
Why GAO Did This Study
SSA relies extensively on IT to deliver retirement, disability, survivor, and family benefits programs to millions of Americans. In fiscal year 2024, SSA spent about $2.2 billion on IT.
GAO was asked to review SSA's IT investment management process. This report assesses (1) the extent to which SSA's IT investment management process complies with federal legislation, guidance, and relevant key practices; and (2) SSA's efforts to evaluate its IT investments.
In performing its work, GAO analyzed SSA's IT investment management processes and compared them to relevant provisions of federal IT acquisition legislation, federal guidance, and key practices. GAO also selected three mission-critical IT investments under development, and reviewed investment management documentation, including performance information, to determine if they were consistent with SSA's procedures. GAO also reviewed the contents of IT IRB meeting minutes and compared them to the responsibilities stated in the board's charter.
Recommendations
GAO is making seven recommendations to SSA, including that it implement a process to oversee and review performance of investments in operations, and fully implement its process to evaluate performance of investments under development. SSA agreed with all seven recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Social Security Administration | The Commissioner of SSA should direct the CIO to define and implement policies and procedures for the IT IRB to review and approve investments in operations as part of managing the entire portfolio. (Recommendation 1) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Social Security Administration | The Commissioner of SSA should direct the CIO to regularly review the agency's investment management guidance and supporting procedures, and make changes as appropriate, to ensure that information and requirements are up-to-date and consistent across documents. (Recommendation 2) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Social Security Administration | The Commissioner of SSA should ensure that the IT IRB fully implements its investment oversight responsibilities for investments under development. (Recommendation 3) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Social Security Administration | The Commissioner of SSA should ensure that investment management documentation for the Analytics and Disability Decision Support–Intelligent Medical-Language Analysis Generation investment, including return on investment analysis and value realization reporting, is complete, accurate, and regularly updated to reflect actual investment progress and value. (Recommendation 4) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Social Security Administration | The Commissioner of SSA should ensure that investment management documentation for the Disability Case Processing System 2 Enhancements investment, including performance measures, return on investment analysis, and value realization reporting, is complete, accurate, and regularly updated to reflect actual investment progress and value. (Recommendation 5) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Social Security Administration | The Commissioner of SSA should ensure that investment management documentation for the Hearings and Appeals Case Processing System, including return on investment analysis and value realization reporting, is complete, accurate, and regularly updated to reflect actual investment progress and value. (Recommendation 6) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Social Security Administration | The Commissioner of SSA should direct the CIO to define and implement policies and procedures to perform operational analyses for investments in O&M consistent with OMB guidance. (Recommendation 7) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|