Report Summary - A-14-00-10036

Employee Access to the Earnings Record Maintenance System (Limited Distribution) (A-14-00-10036)

Our objective was to determine whether employee access to the Earnings Record Maintenance system (ERMS) is appropriately assigned to restrict unnecessary access to earnings records. ERMS is comprised of several subsystems that edit, balance, validate, and post employee wages, self-employment earnings, and earnings adjustments to the Master Earnings File. The Social Security Administration (SSA) uses commercial access control software to control access to ERMS. We sought to determine whether personnel are prohibited from accessing unneeded screens and edit functions by proper assignment of access control profiles.

We believe that by implementing the following recommendation, SSA can help prevent unauthorized access, modification, or disclosure of its sensitive information. We recommended that SSA improve the procedures for maintaining and updating the access control system.

This report contains information that is sensitive and confidential. For security reasons, distribution of this report was limited to those with a need to know.