OFFICE OF
THE INSPECTOR GENERAL

SOCIAL SECURITY ADMINISTRATION

ADMINISTRATIVE COSTS CLAIMED
BY THE COMMONWEALTH
OF PUERTO RICO
DISABILITY DETERMINATION PROGRAM

March 2007

A-06-06-16117

AUDIT REPORT

Mission

By conducting independent and objective audits, evaluations and investigations, we inspire public confidence in the integrity and security of SSA's programs and operations and protect them against fraud, waste and abuse. We provide timely, useful and reliable information and advice to Administration officials, Congress and the public.

Authority

The Inspector General Act created independent audit and investigative units, called the Office of Inspector General (OIG). The mission of the OIG, as spelled out in the Act, is to:

Conduct and supervise independent and objective audits and investigations relating to agency programs and operations.
Promote economy, effectiveness, and efficiency within the agency.
Prevent and detect fraud, waste, and abuse in agency programs and operations.
Review and make recommendations regarding existing and proposed legislation and regulations relating to agency programs and operations.
Keep the agency head and the Congress fully and currently informed of problems in agency programs and operations.

To ensure objectivity, the IG Act empowers the IG with:

Independence to determine what reviews to perform.
Access to all information necessary for the reviews.
Authority to publish findings and recommendations based on the reviews.

Vision

We strive for continual improvement in SSA's programs, operations and management by proactively seeking new ways to prevent and deter fraud, waste and abuse. We commit to integrity and excellence by supporting an environment that provides a valuable public service while encouraging employee development and retention and fostering diversity and innovation.

MEMORANDUM

Date: March 26, 2007:

To: Beatrice Disman
Regional Commissioner New York

From: Inspector General

Subject: Administrative Costs Claimed by the Commonwealth of Puerto Rico Disability Determination Program (A-06-06-16117)

OBJECTIVE

Our objectives were to (1) determine whether costs claimed on the State Agency Report of Obligations for Social Security Administration (SSA) Disability Programs (SSA-4513) for the period October 1, 2003 through September 30, 2005 were allowable and properly allocated and funds were properly drawn; (2) evaluate Puerto Rico Disability Determination Program's (PR-DDP) internal controls over the accounting and reporting of administrative costs; and (3) perform a limited review to assess the general security control environment.

BACKGROUND

The Disability Insurance (DI) program, established under Title II of the Social Security Act, provides benefits to wage earners and their families in the event the wage earner becomes disabled. SSA is responsible for implementing policies for the development of disability claims under the DI program. Disability determinations are performed by disability determination services (DDS) in each State, Puerto Rico and the District of Columbia. Such determinations are required to be performed in accordance with Federal law and underlying regulations. In carrying out its obligation, each DDS is responsible for determining claimants' disabilities and ensuring that adequate evidence is available to support its determinations. To assist in making proper disability determinations, each DDS is authorized to purchase medical examinations, x rays, and laboratory tests on a consultative basis to supplement evidence obtained from the claimants' physicians or other treating sources.

SSA reimburses the DDS for 100 percent of allowable reported expenditures up to its approved funding authorization. The DDS withdraws Federal funds through the Department of the Treasury's (Treasury) Automated Standard Application for Payments system to pay for program expenditures. Funds drawn down must comply with Federal regulations and intergovernmental agreements entered into by Treasury and States under the Cash Management Improvement Act of 1990. An advance or reimbursement for costs under the program must comply with Office of Management and Budget Circular A 87, Cost Principles for State, Local, and Indian Tribal Governments. At the end of each quarter of the Fiscal Year (FY), each DDS is required to submit an SSA 4513 to account for program disbursements and unliquidated obligations. The SSA 4513 reports expenditures and unliquidated obligations for Personnel Service Costs, Medical Costs, Indirect Costs, and All Other Nonpersonnel Costs. The Scope and Methodology of our review is provided in Appendix B.

PR-DDP is a component of the Puerto Rico Department of the Family (PR-DF) and is located in San Juan, Puerto Rico. PR-DF maintains PR-DDP's official accounting records used to prepare the SSA-4513. As of September 30, 2006, PR DDP reported program disbursements and unliquidated obligations on the SSA 4513 as shown below.

Amounts Reported as Disbursements and Unliquidated Obligations for PR-DDP
Reporting Item FY 2004 FY 2005
Disbursements
Personnel $7,970,166 $8,299,394
Medical 3,773,215 3,929,167
Indirect Costs 967,681 1,004,473
Other Nonpersonnel 1,395,105 1,568,866
Total Disbursements $14,106,167 $14,801,900
Unliquidated Obligations $465,323 $641,927
Total Obligations $14,571,490 $15,443,827

RESULTS OF REVIEW

For FYs 2004 and 2005, PR-DDP disbursements charged to SSA were allowable and properly allocated, and funds were properly drawn. PR-DDP had effective internal controls over the accounting and reporting of administrative costs. However, we found that PR-DDP did not timely resolve its unliquidated obligations totaling $465,323 in FY 2004 and $641,927 in FY 2005; maintenance of inventory did not comply with SSA's POMS; and PR-DDP's general security control environment was effective, except for three physical security controls, which are discussed below.

UNLIQUIDATED OBLIGATIONS

PR-DDP did not resolve unliquidated obligations timely. As of September 30, 2006, outstanding unliquidated obligations were $465,323 for FY 2004 and $641,927 for FY 2005. Unliquidated obligations consisted primarily of consultative examinations (CE), Medical Evidence of Record (MER), and applicant travel costs. According to SSA policy,

Valid unliquidated obligations should be supported by records that describe the nature of the obligations and support the amounts recorded. It is particularly important that changes in CE and MER authorizations (e.g., cancellation or modification) are reflected in the unliquidated obligations reported by the agency. State agencies should review unliquidated obligations at least once each month to cancel those no longer valid and screen CE authorizations to determine whether the unliquidated obligation represents an authorization still in effect.… States must submit a separate quarterly report by line item for each open fiscal year's obligations as long as obligations remain unliquidated. The status of unliquidated obligations-including an explanation of why unliquidated obligations remain-should be given in a narrative statement accompanying the report.

PR-DDP did not review unliquidated obligations at least once each month to cancel those that were no longer valid and did not provide the status of unliquidated obligations in a narrative statement accompanying the SSA-4513 for each quarter.

PR-DDP provided two reasons for this condition: (1) missed CE appointments were left as unliquidated obligations even after the appointments had been re-scheduled, creating additional obligations; and (2) a system upgrade error changed the coding on CE and MER obligations from paid to unliquidated. In both of these situations, the unliquidated obligations were no longer valid. In addition, when CEs were unliquidated, the attached applicant travel obligation also remained unliquidated instead of being cancelled. PR-DDP is aware of this problem and has provided a plan to deobligate the invalid obligations and provide narrative reports. Additionally, the PR DDP received a system upgrade in October 2006 that is designed to ensure that coding for CE and MER obligations is no longer incorrectly changed from paid to unliquidated.
INVENTORY

PR-DDP's inventory database lacked essential information required by SSA policy. The equipment inventory must include, for each item, the following information: description, source of funds used in purchase (State or Federal), unit cost (applicable for State purchases only), inventory or serial number, date purchased, and physical location, including building address and room or floor location. PR-DDP maintains inventory lists for electronic data processing equipment, laptops, and general inventory. The electronic data processing equipment and laptop lists were missing dates purchased and the general inventory had incomplete physical locations, and dates purchased. In addition, PR-DDP did not always update inventory listings to remove disposed items. For example, a sample item on the active inventory with a purchase price of $14,165 was not located because it had been disposed without being removed from the inventory list. Proper equipment accountability reduces the risk of loss or theft. During our audit, PR DDP initiated action to add the missing inventory information and plans to complete an update of its inventory by February 2007.

SECURITY CONTROLS

During our review, we identified three general security control weaknesses. SSA guidance instructs that if a DDS is unable to meet a guideline for physical security, a risk assessment plan should be prepared.

The following security control weaknesses were identified.

PR-DDP conducted fire drills only once a year. SSA policy indicates that evacuation drills should be conducted twice yearly.

PR-DDP's doors were constructed of thick glass in aluminum frames, creating a risk of unauthorized access. According to SSA guidance, perimeter doors should be made of solid wood core or metal sheathed. PR-DDP has compensating controls, such as round the clock building security; however, a required risk assessment plan was not prepared to establish whether sufficient controls were in place.

The computer room walls did not extend above the suspended (drop) ceiling to prevent unauthorized entry from above. According to SSA policy,

The walls of the computer room should have slab-to-slab construction to prevent unauthorized entry or the computer room must be made secure by installing chain link fences, heavy wire mesh, or motion sensor devices in the space between the false ceiling and the true ceiling of the facility.

A risk assessment plan was not prepared to establish whether sufficient controls exist in the computer room.

Inadequate security controls increase vulnerabilities to employee safety and the potential for property and/or information loss.

CONCLUSION AND RECOMMENDATIONS

PR-DDP costs claimed on the SSA-4513 for the period October 1, 2003 through September 30, 2005 were allowable and properly allocated, and funds were properly drawn. We determined internal controls over the accounting and reporting of administrative costs were sufficient; however, unliquidated obligations totaling $465,323 in FY 2004 and $641,927 in FY 2005 were not resolved timely. In addition, we found PR-DDP inventory was not in compliance with POMS and we identified general security control weaknesses.

Accordingly, we recommend SSA:
1. Ensure unliquidated obligations totaling $465,323 in FY 2004 and $641,927 in FY 2005 are reviewed and obligations no longer valid are deobligated.
2. Ensure unliquidated obligations for all open years are reviewed at least once each month to cancel those no longer valid and instruct PR-DDP to submit a narrative statement accompanying each quarterly SSA 4513 to explain unliquidated obligations.
3. Instruct the PR-DDP to maintain proper equipment inventories in compliance with POMS.
4. Instruct the PR-DDP to comply with SSA guidance for the general security controls and to correct control weaknesses in a timely manner.
5. Ensure that when PR-DDP is unable to meet a guideline for physical security, a risk assessment plan is prepared in a timely fashion, in accordance with SSA guidance.

AGENCY COMMENTS

SSA agreed with our recommendations. SSA finds the five recommendations outlined in the report are reasonable and will assist SSA in further improving the controls that are already in place. See Appendix C for the full text of the Agency's comments.

STATE AGENCY COMMENTS

The PR-DF demonstrated its agreement with our findings by correcting or initiating corrective action to address all recommendations. See Appendix D for the full text of the PR-DF's comments.

OIG RESPONSE

We appreciate the comments received from SSA and PR-DF and believe the responses and planned actions adequately address our recommendations.

Patrick P. O'Carroll, Jr.

Appendices

APPENDIX A - Acronyms
APPENDIX B - Scope and Methodology
APPENDIX C - Agency Comments
APPENDIX D - State Agency Comments
APPENDIX E - OIG Contacts and Staff Acknowledgments

Appendix A
Acronyms

CE Consultative Examination
C.F.R. Code of Federal Regulations
DDS Disability Determination Services
DI Disability Insurance
FY Fiscal Year
MER Medical Evidence of Record
POMS Program Operations Manual System
PR-DDP Puerto Rico Disability Determination Program
PR-DF Puerto Rico Department of Family
SSA Social Security Administration
SSA-4513 State Agency Report of Obligations for Social Security Administration Disability Programs
Treasury Department of the Treasury
U.S.C. United States Code

Appendix B
Scope and Methodology

We reviewed the administrative costs the Puerto Rico Disability Determination Program (PR-DDP) reported to the Social Security Administration (SSA) on State Agency Report of Obligations for SSA Disability Programs (SSA-4513) for the period October 1, 2003 through September 30, 2005. We obtained sufficient evidence to evaluate administrative costs in terms of their allowability and allocability under Office of Management and Budget Circular A-87, Cost Principles for State, Local and Indian Tribal Governments, and appropriateness, as defined by SSA's Program Operations Manual System (POMS). PR-DDP reported total obligations of $14,571,490 in Fiscal Year (FY) 2004 and $15,443,827 in FY 2005, as of September 2006.

To accomplish our audit objectives, we

Reviewed applicable Federal laws and regulations, pertinent parts of SSA's POMS and other instructions pertaining to administrative costs incurred by PR-DDP and the drawdown of SSA funds.

Obtained data from Puerto Rico's Department of the Family (PR-DF) to support amounts reported on the SSA-4513 and tested the reliability of the data by comparing disbursements, by category and in total, with amounts reported on the SSA-4513.

Reconciled the amount of Federal funds drawn for support of program operations to the allowable expenditures.

Reconciled the accounting records to the costs reported on the SSA 4513 for FYs 2004 and 2005.

Interviewed staff from SSA, PR-DF, and PR-DDP.

Documented our understanding of the PR-DF's system of internal controls over the accounting and reporting of administrative costs.

Reviewed controls over active inventory of selected PR-DDP equipment.

Conducted limited general control testing related to physical access security and security within the PR-DDP.

Selected a random sample of Personnel, Medical, and Non-personnel costs.

Reviewed a sample of 50 employees from 1 pay period in January 2005 and traced information to accounting records, timesheets, and personnel files.

Selected all 26 medical consultants on the PR-DDP staff paid during the pay period of November 2004 to determine whether the consultants were licensed and if payments to the consultants complied with the terms of their employment contract.

Sampled medical cost payments for Medical Evidence of Record payments and reviewed a sample of the batch with the highest amount paid for each year under review, which included 44 transactions in FY 2004 and 49 transactions in FY 2005.

Sampled medical cost payments for consultative examination payments and reviewed a statistical sample of 40 transactions for FY 2004 and 41 transactions for FY 2005.

Reviewed a sample of Other Nonpersonnel Cost payments, including 54 transactions from FY 2004 and 51 from FY 2005.

Evaluated the indirect cost rates claimed by PR-DDP for FYs 2004 and 2005 and the corresponding indirect cost rate agreements.

The entity audited was the PR-DDP under the Deputy Commissioner for Disability and Income Security Programs, Center for Disability Programs. We conducted our field work from May 2006 through January 2007 at the PR-DF and PR-DDP in San Juan, Puerto Rico, and the Office of the Inspector General in Dallas, Texas. We conducted the audit in accordance with generally accepted government auditing standards

Appendix C
Agency Comments

SOCIAL SECURITY

MEMORANDUM

Date: March 6, 2007

To: Inspector General

From: Regional Commissioner New York

Subject: Administrative Costs Claimed by the Commonwealth of Puerto Rico Disability Determination Program (A-06-06-16117) - REPLY

I appreciate the opportunity to review the attached draft report. I am pleased that the Puerto Rico Disability Determination Program was found to have effective internal controls over the accounting and reporting of administrative costs and that all disbursements charged to the Social Security Administration were allowable and properly allocated and that funds were properly drawn.

I find that the five recommendations outlined in the draft report are reasonable and will assist us in further improving the controls that are already in place.

If members of your staff have any questions concerning this correspondence, they may be directed to Gene Purk, (212) 264-7283 in the Center for Disability.

Beatrice M. Disman

Appendix D
State Agency Comments

Appendix E

OIG Contacts and Staff Acknowledgments
OIG Contacts
Paul Davila, Director, (214) 767-6317
Paul Wood, Audit Manager, (214) 767-0058

Acknowledgments
In addition to those named above:
Clara Soto, Auditor-in-Charge
Erica Turon, Auditor

For additional copies of this report, please visit our web site at http://ww.ssa.gov/oig or contact the Office of the Inspector General's Public Affairs Specialist at (410) 965-3218. Refer to Common Identification Number A-06-06-16117.

Overview of the Office of the Inspector General
The Office of the Inspector General (OIG) is comprised of our Office of Investigations (OI), Office of Audit (OA), Office of the Chief Counsel to the Inspector General (OCCIG), and Office of Resource Management (ORM). To ensure compliance with policies and procedures, internal controls, and professional standards, we also have a comprehensive Professional Responsibility and Quality Assurance program.

Office of Audit
OA conducts and/or supervises financial and performance audits of the Social Security Administration's (SSA) programs and operations and makes recommendations to ensure program objectives are achieved effectively and efficiently. Financial audits assess whether SSA's financial statements fairly present SSA's financial position, results of operations, and cash flow. Performance audits review the economy, efficiency, and effectiveness of SSA's programs and operations. OA also conducts short-term management and program evaluations and projects on issues of concern to SSA, Congress, and the general public.

Office of Investigations
OI conducts and coordinates investigative activity related to fraud, waste, abuse, and mismanagement in SSA programs and operations. This includes wrongdoing by applicants, beneficiaries, contractors, third parties, or SSA employees performing their official duties. This office serves as OIG liaison to the Department of Justice on all matters relating to the investigations of SSA programs and personnel. OI also conducts joint investigations with other Federal, State, and local law enforcement agencies.

Office of the Chief Counsel to the Inspector General
OCCIG provides independent legal advice and counsel to the IG on various matters, including statutes, regulations, legislation, and policy directives. OCCIG also advises the IG on investigative procedures and techniques, as well as on legal implications and conclusions to be drawn from audit and investigative material. Finally, OCCIG administers the Civil Monetary Penalty program.

Office of Resource Management
ORM supports OIG by providing information resource management and systems security. ORM also coordinates OIG's budget, procurement, telecommunications, facilities, and human resources. In addition, ORM is the focal point for OIG's strategic planning function and the development and implementation of performance measures required by the Government Performance and Results Act of 1993.