SOCIAL SECURITY ADMINISTRATION

THE SOCIAL SECURITY ADMINISTRATION’S
IMPLEMENTATION OF
EARNED VALUE MANAGEMENT SYSTEMS

September 2006 A-14-06-26085

AUDIT REPORT

Mission

By conducting independent and objective audits, evaluations and investigations, we inspire public confidence in the integrity and security of SSA’s programs and operations and protect them against fraud, waste and abuse. We provide timely, useful and reliable information and advice to Administration officials, Congress and the public.

Authority

The Inspector General Act created independent audit and investigative units, called the Office of Inspector General (OIG). The mission of the OIG, as spelled out in the Act, is to:

 Conduct and supervise independent and objective audits and investigations relating to agency programs and operations.
 Promote economy, effectiveness, and efficiency within the agency.
 Prevent and detect fraud, waste, and abuse in agency programs and operations.
 Review and make recommendations regarding existing and proposed legislation and regulations relating to agency programs and operations.
 Keep the agency head and the Congress fully and currently informed of problems in agency programs and operations.

To ensure objectivity, the IG Act empowers the IG with:

 Independence to determine what reviews to perform.
 Access to all information necessary for the reviews.
 Authority to publish findings and recommendations based on the reviews.

Vision

We strive for continual improvement in SSA’s programs, operations and management by proactively seeking new ways to prevent and deter fraud, waste and abuse. We commit to integrity and excellence by supporting an environment that provides a valuable public service while encouraging employee development and retention and fostering diversity and innovation.

MEMORANDUM

Date: September 18, 2006 Refer To:

To: The Commissioner

From: Inspector General

Subject: The Social Security Administration’s Implementation of Earned Value Management Systems (A-14-06-26085)

OBJECTIVE

The objective of our review was to determine whether the Social Security Administration (SSA) has implemented Earned Value Management Systems (EVMS) for Information Technology (IT) projects in accordance with the Office of Management and Budget (OMB) and other related guidance.

BACKGROUND

According to OMB, “Earned value management (EVM) is a project (investment) management tool effectively integrating the investment scope of work with schedule and cost elements for optimum investment planning and control.” It is a numerical representation of project costs and schedule status. Earned Value (EV) is the budgeted value earned when the budgeted work is performed. EV is then compared to the actual costs and the planned values (budgets) to measure performance.

On August 23, 2004, OMB issued Memorandum M-04-24, Expanded Electronic Government (E-Gov) President’s Management Agenda (PMA) Scorecard Cost, Schedule and Performance Standard for Success. This memorandum sets forth the criteria to be used and evidence necessary to evaluate whether a Federal agency has complied with E-Gov EVM standard. This refers to the American National Standards Institute (ANSI) / Electronic Industries Alliance Standard 748 (ANSI Standard). To achieve a “green” level of performance for the PMA initiative, the agency’s actual performance cannot vary by more than 10 percent from its cost, schedule and performance goals.

This audit examined SSA’s initial establishment of its EVM process and systems. During this audit, we reviewed, analyzed and evaluated SSA’s EVM policies and procedures and examined SSA’s EVM process against OMB’s guidance and related standards. We also reviewed financial, budgetary and managerial systems, as well as documentation relevant to SSA's implementation and use of EVMS.

RESULTS OF REVIEW

Significant SSA Achievement

Based on our review of SSA EVM systems, processes and procedures, we have concluded that SSA has generally implemented an EVM system to manage its major IT projects in accordance with OMB guidance. According to SSA, some of the EVMS requirements were not used based on the Agency’s costs/benefits analysis. For those EVM requirements not instituted, SSA plans to periodically reevaluate its practices throughout the EVMS life cycle.

SSA has made major efforts contributing to significant achievements to comply with OMB’s guidances. SSA has:

• established its EVM Program Management Office (PMO) as the focal point of EVM;
• completed its EVM Policy and EVM System Description by the OMB deadline, December 31, 2005;
• completed Integrated Baseline Reviews (IBR) for 13 of its 14 major IT projects requiring EVM by the OMB deadline, March 31, 2006. The remaining project has been approved by OMB and is in the preparation stage of IBR;
• updated and integrated its current systems and improved the automation of its EVM processing;
• began generating and using some standard EVM reports for project management; and
• conducted extensive EVM training within SSA.

Our review showed that SSA EVMS has some areas that can be improved. These areas limit the effectiveness of SSA’s EVM process and its IT development project management. SSA uses estimated labor costs while the ANSI Standard requires the use of actual costs. We also determined that SSA has control weaknesses in its data collecting system for direct labor; SSA’s baseline change and maintenance policy and practice, and its IBR procedures also need improvement.

SSA Does Not Use Actual Labor Costs

SSA does not use actual labor costs or costs reconcilable to its accounting systems for EVM as required by ANSI standard. Instead, it uses an estimate based on an average hourly rate. This flat labor rate then is used with the actual labor hours to determine what SSA reports as the actual direct labor costs for IT projects. The results are estimated labor costs. These estimated costs are compared with the project baseline to measure performance. SSA has chosen this method after considering the additional implementation costs and efforts by using actual labor costs.

This practice does not fully comply with ANSI Standard (see Appendix C for additional discussion). Under SSA's current EVM practice, an hour of direct labor of a Grade 9 employee is not different from that of a Grade 15 employee. Comparison of budgets with actual costs is fundamental for EVM. We recommend that SSA conduct a cost-benefit analysis to determine whether to use actual costs or reconcilable costs in its EVM process.

Resource Accounting System Needs Improvement in Data Reliability, Accuracy, and Completeness

SSA uses the Resource Accounting System (RAS) to collect time reported by SSA employees within the Office of Systems (OS). Hours charged to projects, leave, and administrative activity are captured on a daily basis and used for reporting by OS management. A monthly report is provided for EVM processing. Due to control and management weaknesses, the RAS data used for EVM analysis and reporting needs to be improved to achieve a higher level of reliability, completeness, and accuracy. Some of the weaknesses we found are as follows (see Appendix C for a full discussion of RAS control weaknesses):

• Controls do not ensure the completion of data entry before RAS data extracts are generated for EVM processing.
• RAS data can be retroactively changed by both the employees and the supervisors without proper control. The ANSI Standard requires control of any retroactive changes to actual costs.
• RAS contains only OS hours.

SSA concurred with our findings and agreed to make improvements. To comply with the reconciliation requirement of the ANSI Standard, SSA is implementing a control on the RAS – Reconciliation Exceptions Report. This report is an automatic reconciliation between RAS and the Mainframe Time and Attendance System (MTAS). MTAS, updated by SSA time keepers, is used to update SSA’s payroll system. RAS data can be significantly improved, if proper control processes are implemented in concert with this report.

SSA has made significant progress and plans to further improve the data collection system for EVM, but still needs to implement effective controls to ensure all direct labor hours are correctly entered into RAS before monthly EVM processing starts. For components other than OS, SSA also needs to have a mechanism to collect direct labor hours devoted to its EVM projects.

Baseline Maintenance and Changes

Performance Measurement Baseline (PMB) is the time-phased budget that reflects the schedule and planned scope of all authorized work for the project. PMB provides the project manager a reference to assess project performance. The National Defense Industrial Association (NDIA) Intent Guide states that: “Any changes to the project must be approved and implemented following the baseline management control process.” The ANSI Standard prohibits unauthorized changes to baseline. “Changes made outside the authorized baseline control processes compromise the integrity of performance trend data and delay visibility into overall project variance from plan.”

SSA’s EVM policy allows detail level changes to its PMB without proper controls. SSA’s EVM System Description states, “Detail level schedule and budget changes - Permitted as long as master program schedules and control account (CA) schedules and budgets are not impacted.” SSA's CA can be a project's “Development” stage of the life cycle, which can last many months and contains significant project resources.

This policy provides opportunities for manipulating EVM performance results; therefore, the process needs to be properly controlled. SSA concurred with our finding and plans to update its EVM System Description and implement a standard EVM report that will track baseline changes. SSA expects to complete these changes by the end of Calendar Year (CY) 2006.
SSA Procedure Could Allow Changes to OMB Approved Baseline

The essence of EVM rests in the comparison of planned values (baseline) with actual values. However, SSA’s Overtime Procedure for EVM processing allows periodic (quarterly) adjustments to the project baseline.

Such practices could undermine what the EVM process is designed to achieve – timely alerts of project issues, such as budget overruns. Increasing budgets of existing project baselines would eliminate the EVM variances that indicate potential budget overruns.

In addition, OMB requires that actual project costs be compared with OMB’s approved baseline. SSA needs to inform and obtain approval from OMB and ensure that EV variances are calculated based on the OMB approved baseline.

SSA concurred with our finding, and as noted above, is updating its EVM System Description to include proper OMB notification and approval. SSA expects to complete these changes by the end of CY 2006.

SSA Needs to Improve Its IBR Process

The purpose of an IBR is to provide project/program managers with an understanding of the PMB and project risks and to obtain an agreement on a plan of corrective actions to remediate the identified risks. A project’s PMB is assessed for its completeness, accuracy and reasonableness during the IBR process.

Our review of SSA’s IBR documentation for its 10 IT major projects shows that SSA’s IBR process ensures that costs, schedules, and project scope are accurately and properly integrated into the PMB. However, we also noted that there are areas where SSA needs improvement for its future IBRs (See Appendix C for details).

• The independent IBR evaluation team needs the required technical expertise to conduct the review.
• SSA needs to improve its analysis and documentation of risks and mitigations.
• SSA's IBR process should assess the resources needed for addressing risks.
• IBR participants need to receive sufficient training specific to IBR which must be adequately documented.
• Project Managers need to be involved in all stages of the IBR process.

SSA concurred with our findings and agreed to make improvements to comply with OMB guidance.

CONCLUSION AND RECOMMENDATIONS

We concluded that SSA has generally implemented an EVM system to track costs, schedules, and the progress of its major IT projects as directed by OMB. SSA has devoted efforts, which resulted in significant progress to obtain compliance with EVM requirements. OMB has recognized SSA’s progress in EVM and rated SSA “Green” on the PMA E-Gov Scorecard for the first quarter of CY 2006.

Our review shows there are areas of SSA’s EVM system that need improvement. Implementation of the following recommendations will provide SSA with a more effective EVM system that allows the Agency to better manage its IT development projects. We recommend SSA:

1. Conduct a cost-benefit analysis to determine whether to use actual cost or reconcilable cost data in the EVM process;
2. Implement controls to ensure SSA employees accurately complete RAS inputs before RAS data is provided for EVM processing and RAS codes are properly closed after Post Implementation Review, and to control retroactive changes to RAS data;
3. Consider an agency-wide mechanism that would allow all SSA components to track EVM project-related efforts;
4. Continue to implement the automated reconciliation between RAS and MTAS and use reconciled data for EVM processing;
5. Implement controls to all baseline changes and obtain OMB’s approval when allocation of overtime budget to project occurs;
6. Ensure members of the IBR evaluation team and all IBR participants have programmatic or technical expertise and receive IBR specific training;
7. Ensure that project risks are identified and discussed between the project management team and the IBR evaluation team;
8. Categorize, analyze, and document the risks identified, including resource needs, during the IBR process in accordance with SSA’s IBR policy and OMB’s recommended guidance; and
9. Ensure project managers plan and perform the IBRs, and monitor the progress of the IBRs.

AGENCY COMMENTS

SSA agreed with our recommendations. The Agency’s comments are included in Appendix D.

S
Patrick P. O’Carroll, Jr.

Appendices
APPENDIX A – Acronyms
APPENDIX B – Scope and Methodology
APPENDIX C – Selected Earned Value Management Criteria and Social Security Administration Earned Value Management Practices
APPENDIX D – Agency Comments
APPENDIX E – OIG Contacts and Staff Acknowledgments

Appendix A
Acronyms
ANSI American National Standards Institute
ANSI Standard American National Standards Institute /Electronic Industries Alliance Standard 748
CA Control Account
CY Calendar Year
E-Gov Electronic Government
EIA Electronic Industries Alliance
EV Earned Value
EVM Earned Value Management
EVMS Earned Value Management System
IBR Integrated Baseline Review
IT Information Technology
MS Microsoft
MTAS Mainframe Time and Attendance System
NDIA National Defense Industrial Association
NDIA IBR Guide National Defense Industrial Association Program Management Systems Committee The Program Managers’ Guide to the Integrated Baseline Review Process
NDIA Intent Guide NDIA PMSC ANSI/EIA-748-A Standard for EVMS Intent Guide
OMB Office of Management and Budget
OS Office of Systems
PM Project Manger
PMA President’s Management Agenda
PMB Performance Measurement Baseline
PMO Program Management Office
PMSC Program Management Systems Committee
RAS Resource Accounting System
RIMS Risk Identification and Mitigation System
SSA Social Security Administration
WY Work Year

Appendix B
Scope and Methodology
Our objective was to determine whether the Social Security Administration (SSA) has implemented Earned Value Management Systems (EVMS) for Information Technology (IT) projects in accordance with the Office of Management and Budget (OMB) and other related guidance. The scope of this audit was limited to SSA’s Earned Value Management (EVM) general policy, procedure, practices, and systems design and controls. We did not examine SSA’s EVM at project level.

To achieve our objective, we:

1. Reviewed the following OMB and OMB recommended criteria:
• OMB Memorandum M-05-23, Improving Information Technology (IT) Project Planning and Execution;
• OMB Memorandum M-04-24, Expanded Electronic Government (E-Gov) President’s Management Agenda (PMA) Scorecard Cost, Schedule and Performance Standard for Success;
• OMB Circular No. A-11 Part 7, Planning, Budgeting, Acquisition, and Management of Capital Assets;
• National Defense Industrial Association (NDIA) Program Management Systems Committee (PMSC), ANSI/EIA-748-A-Standard for Earned Value Management Systems Intent Guide;
• NDIA PMSC, Surveillance Guide;
• NDIA PMSC, The Program Managers’ Guide to the Integrated Baseline Review Process; and
• Department of Defense, Earned Value Management Implementation Guide.

2. Interviewed representatives from SSA’s:
• Office of Systems, EVM Program Management Office;
• Office of Systems, Budget Staff, Administrative Budget Team, IT Systems Team and Resource Management Team;
• Office of Systems, Planning Staff;
• Office of Systems, Office of Enterprise Support, Architecture & Engineering, Division of Process Engineering, Project and Customer Service, Project Control and Customer Relations Branch; and
• Office of Chief Information Officer, Office of Information Technology Systems Review.
3. Reviewed and analyzed the following relevant EVM documents:
• SSA Policy for Earned Value Management for Major Information Technology Projects;
• SSA Earned Value Management System Description;
• SSA Earned Value Management System Study by Lockheed Martin Information Technology;
• OMB Assessment of the Earned Value Management System at the SSA (Gap Analysis);
• Other SSA EVM planning, analysis and reporting documents.

4. Obtained understanding of the following relevant SSA EVM planning, data collecting, and analysis systems, and SSA financial accounting systems:
• IT Systems QuickPlace;
• Electronic General Auditable Document Store;
• IT Proposal Application;
• IT Systems Plan Database;
• Resource Accounting System / Mainframe Time and Attendance System;
• Automated Purchase Requisition System;
• Social Security Streamlined Acquisition System;
• Risk Identification & Mitigation System;
• Vital Signs & Observations Report system;
• Microsoft Project; and
• wInsight.

We reviewed EVM for the entire Agency. We performed our field work at SSA Headquarters from January to May 2006 and focused on the Office of Systems. We determined that the data used in this report was sufficiently reliable to meet our audit objectives and intended use of the data. We determined that our use of this data should not lead to an incorrect or unintentional message. This audit was conducted in accordance with generally accepted government auditing standards.

Appendix C
Selected Earned Value Management Criteria and Social Security Administration Earned Value Management Practices

General Criteria

On August 4, 2005, Office of Management and Budget (OMB) issued Memorandum
M-05-23, Improving Information Technology (IT) Project Planning and Execution, to provide assistance to agencies in monitoring and improving project planning and fully implementing Earned Value Management Systems (EVMS) for IT projects. Agencies are now required to ensure improved execution and performance while promoting more effective oversight on all new major IT projects, ongoing major IT developmental projects, and high-risk projects. The requirements for full implementation of EVMS for IT projects include:

1. Develop comprehensive agency policies;
2. Incorporate EVMS requirements in contracts and agency in-house project charters;
3. Conduct compliance reviews of agency and contractor EVMS;
4. Perform periodic systems surveillance reviews to ensure the EVMS continues to meet the guidelines in American National Standards Institute (ANSI) / Electronic Industries Association Standard 748 (ANSI Standard); and
5. Use Integrated Baseline Reviews (IBR) to finalize the cost, schedule and performance goals.

EVM Standard and SSA practice related to project costs

According to Earned Value Management (EVM) standards and guidelines, actual direct costs need to be recorded in a manner consistent to formal accounting systems. If timing differences exist between data of the EVM systems and accounting systems, they need to be reconciled.

Although the Social Security Administration’s (SSA) estimated labor costs used for EVM analysis are recorded in a manner consistent with its budgeting method, they are not recorded in consistence with SSA's accounting system for labor - Payroll. Since the “actual” labor costs are estimated, they are not reconcilable to accounting data.

SSA decided to use a flat labor rate to estimate actual direct labor costs to its IT projects largely to keep implementation costs down. This flat rate method is already used for its IT planning and budgeting process for years. SSA's IT planning process only requires an estimate of total number of Work Years (WY) to complete a project. The average WY cost then is applied to derive the total direct labor budget for the project. This process does not distinguish employees with different pay grades. Another factor is SSA’s use of Microsoft (MS) Project software for project management and EVM purposes. MS Project requires the use of resource rates. For example, all budgets and actual costs for labor are populated in MS Project file by labor hours. Then dollar amount budgets and actuals are calculated using a flat labor rate.

Resource Accounting System Control Weaknesses

Our review of SSA’s Resource Accounting System (RAS) revealed the following control and management weaknesses:

• Controls do not ensure the completion of data entry before RAS data extracts are generated for EVM processing.

• RAS data can be retroactively changed by either the employees or the supervisors without proper control. Employees and their supervisors can use the RAS input screen to go back to any prior pay periods and make changes. In addition, SSA does not maintain an audit trail of RAS changes.

• We have examined a monthly RAS data extract that contained the total number of hours worked monthly for each IT project. This file shows numerous negative numbers of hours that represent the changes made to the past periods. These negative numbers indicate that changes were made, however, since there is no audit trail, SSA does not know when or who made what changes.

• RAS contains only Office of Systems (OS) hours. For some IT projects, SSA uses an Excel Template to collect actuals for components other than OS. However, non-development direct labor hours of other SSA components are not captured in RAS and not included in the EVM calculation. EVM guidance requires that all costs be included in the project and recognizes the importance of visibility into direct and indirect costs.

• RAS data is not reconciled with SSA's payroll system as required by the ANSI Standard.

• We have found two completed projects where time was still charged to the RAS Project codes. SSA's policy is to close a project's RAS code when Post Implementation Review or Lessons Learned is completed.

IBR Requirement and SSA Practice

OMB requires that agencies conduct independent validations to ensure the reasonableness of the costs, schedules, and performance goals of major IT projects. According to OMB, "Agencies currently using Integrated Baseline Reviews (IBRs), may substitute an IBR for an independent assessment.” SSA has chosen to conduct IBRs instead of independent validations for its major IT projects and has implemented IBR policy and procedures.

Our review of SSA IBR documentation for its 10 IT major projects shows that SSA’s IBR process ensure that costs, schedules, and project scope are accurately and properly integrated in the PMB. However, we also noted that there are areas where SSA needs improvement for its future IBRs.

Issue 1: The independent IBR evaluation team needs the required technical expertise to conduct the review.

According to the OMB recommended IBR guidance, the National Defense Industrial Association Program Management Systems Committee The Program Managers’ Guide to the Integrated Baseline Review Process (NDIA IBR Guide), IBR “…participants should be identified based on their programmatic or technical expertise, as required for the review.” SSA’s IBR evaluation team is comprised of EVM Program Management Office (PMO) staff, OS Planning staff, System Process Improvement staff, and PMO support contractors and does not include the project managers. As a result, the evaluation team does not have the required programmatic or technical expertise. The technical expertise required in the IBR evaluation team is essential during the technical risks identification and remediation processes and in determining the reasonableness of project costs and schedules.

According to OMB, for agencies that performed most of their own systems development, it is appropriate for one project management team to evaluate another project management team for IBR purposes.

Issue 2: SSA needs to improve its analysis and documentation of risks and mitigations.

SSA adopted the risk management method specified in NDIA IBR Guide that the IBR process should identify and categorize project risks in the following five categories: technical, schedule, cost, resource, and management process risks at control account level. SSA’s IBR documentation shows that project management teams referred to the Risk Identification and Mitigation System (RIMS) for documentation of risk management. However, SSA RIMS criteria do not match the criteria specified in the NDIA IBR guide and SSA’s own IBR policy. RIMS documents and categorizes risks into high, medium, and low, according to their severity and probability of occurrence.

In addition, according to the NDIA IBR guide, reviewing and reviewed parties need to obtain a mutual understanding of project risks and agree on the plan of corrective actions. The process should also include an assessment of impact on resources if the risks occurred. SSA's remediation approaches specified in the RIMS Quick Reference guide does not include an assessment of resources needed to address the risks.

SSA needs to ensure the project risks be identified and discussed between the project management team and the evaluation team during the IBR process. SSA also needs to document project risks and their remediation in accordance with its own IBR policy and OMB recommended guidance.

Issue 3: SSA's IBR process should assess the resources needed for addressing risks.

The NDIA IBR Guide requires that the IBR team should assess the resources needed with respect to project risk not accounted for in the PMB. The guide also requires documentation of schedule and cost rough-order-of-magnitude impact on PMB for each risk area. SSA’s IBR process does not require an assessment of resources needed for addressing identified risks.

SSA needs to discuss and assess the resources needed for addressing the risks identified during the IBR process.

Issue 4: IBR participants need to receive sufficient training specific to IBR which must be adequately documented.

According to the NDIA IBR Guide, "Training is essential to ensure that the IBR team can identify and adequately assess project risk." SSA’s PMO stated that, although not included in the IBR documentation, the IBR evaluation team had obtained IBR specific training by conducting multiple weekly meetings prior to the IBR to understand the IBR process and requirements. However, the IBR documentation does not show that other participants of the IBR process received IBR specific training.

SSA needs to improve the documentation of IBR specific training and ensure that all IBR participants receive sufficient training before the review starts to ensure a proper understanding of IBR purposes and procedures.

Issue 5: Project Managers need to be involved in all stages of the IBR process.

The documentation we reviewed did not show that project managers (PM) were involved in the planning process. Rather, IBRs were planned, led, and conducted by the IBR evaluation team that does not include the PMs. According to the NDIA IBR Guide, PMs play an essential role in the IBR process and should be involved in the IBR planning process and all other processes. PMs should bear the responsibility for the whole IBR Process.

For future IBRs, SSA should ensure that PMs:

• Plan and perform the IBR;
• Provide an adequate number of qualified personnel to serve as IBR team members;
• Specify evaluation criteria for risk areas;
• Document risk issues identified during an IBR; and
• Monitor progress on required actions until issues are resolved.

Appendix D
Agency Comments

MEMORANDUM

Date: September 7, 2006 Refer To: S1J-3

To: Patrick P. O'Carroll, Jr.
Inspector General

From: Larry W. Dye /s/
Chief of Staff

Subject: Office of the Inspector General (OIG) Draft Report, “The Social Security Administration’s Implementation of Earned Value Management Systems” (A-14-06-26085)--INFORMATION

We appreciate OIG’s efforts in conducting this review. Our comments on the draft report are attached.

Please let me know if you have any questions. Staff inquiries may be directed to
Ms. Candace Skurnik, Director, Audit Management and Liaison Staff, at extension 54636.

Attachment:
SSA Comments

COMMENTS ON THE OFFICE OF THE INSPECTOR GENERAL’S (OIG) DRAFT REPORT, “THE SOCIAL SECURITY ADMINISTRATION’S IMPLEMENTATION OF EARNED VALUE MANAGEMENT SYSTEMS” (A-14-06-26085)

Thank you for the opportunity to review and provide comments on this OIG draft report. The report indicates that the Social Security Administration (SSA) has taken several significant actions to implement an Earned Value Management (EVM) process for managing SSA information technology (IT) projects in accordance with Office of Management and Budget (OMB) guidance. In addition to the many SSA achievements in this area cited in this OIG report, we have also deployed EVM methodology in preparing budget submission documents in support of funding for major IT investments.

To further enhance our EVM process, our EVM Program Management Office (PMO) will dedicate three government employee full-time equivalents and seven contractor work years for Fiscal Year 2007 to improving and automating our EVM and related processes and procedures. The EVM PMO is also integrally involved with the Systems Planning And Reporting System initiative, which will automate and integrate our management, planning and accounting systems into a single database.

We have the following comments on the OIG draft report recommendations.

Recommendation 1

Conduct a cost-benefit analysis to determine whether to use actual cost or reconcilable cost data in the EVM process.

Comment

We agree. A cost-benefit analysis will be performed to determine the feasibility of using actual personnel dollars in the EVM process.

Recommendation 2

Implement controls to ensure SSA employees accurately complete Resource Accounting System (RAS) inputs before RAS data is provided for EVM processing and RAS codes are properly closed after Post Implementation Review, and to control retroactive changes to RAS data.

Comment

We agree. We have implemented two significant improvements that address this recommendation. First, RAS reporting (timeliness and accuracy) will be included in SSA employee performance evaluations. Second, we have established a RAS change control process that includes a form requiring approval of RAS inputs from an EVM PMO lead staff member. In addition, Office of Systems’ senior management has increased the amount of communication about the critical importance of accurate and timely RAS reporting.
Recommendation 3

Consider an Agency-wide mechanism that would allow all SSA components to track EVM project-related efforts.

Comment

We agree. As part of our present efforts to enhance our EVM process, we will determine the feasibility and cost-effectiveness of developing the recommended mechanism.

Recommendation 4

Continue to implement the automated reconciliation between RAS and the Mainframe Time and Attendance System (MTAS) and use reconciled data for EVM processing.

Comment

We agree. The RASMTAS Hyperion Reporting System now includes a Reconciliation Report that produces an exception report by SSA component, pay period, and employee hours reported to RASMTAS and hours in MTAS.

Recommendation 5

Implement controls to all baseline changes and obtain OMB’s approval when allocation of overtime budget to project occurs.

Comment

We agree. We have re-written the applicable portion of the System Description, established a Baseline Change Request form, and adopted approval and control processes in accordance with this OIG recommendation. Baseline changes are submitted to OMB
in accordance with OMB requirements. This process applies to all baseline changes,
including allocation of overtime hours to programs.

Recommendation 6

Ensure members of the Integrated Baseline Review (IBR) evaluation team and all IBR participants have programmatic or technical expertise and receive IBR specific training.

See comment for recommendation 9.

Recommendation 7

Ensure that project risks are identified and discussed between the project management team and the IBR evaluation team.
See comment for recommendation 9.

Recommendation 8

Categorize, analyze, and document the risks identified, including resource needs, during the IBR process in accordance with SSA's IBR policy and OMB's recommended guidance.

See comment for recommendation 9.

Recommendation 9

Ensure project managers plan and perform the IBRs, and monitor the progress of the IBRs.

Comment

We agree with recommendations 6 - 9. SSA staff has taken Defense Acquisition University IBR training and will follow these OIG recommendations and other guidance for improvement during our next IBR. We intend to ask OIG to participate on the IBR Team.

Appendix E
OIG Contacts and Staff Acknowledgments
OIG Contacts

Kitt Winter, Director, Data Analysis and Technology Audit Division, (410) 965-9702

Phil Rogofsky, Audit Manager, General Controls Team, (410) 965-9719

Acknowledgments

In addition to those named above:

Grace Chi, Auditor-in-Charge

Harold Hunter, Senior Auditor

Annette DeRito, Writer/Editor

For additional copies of this report, please visit our web site at www.socialsecurity.gov/oig or contact the Office of the Inspector General’s Public Affairs Specialist at (410) 965-3218. Refer to Common Identification Number
A-14-06-26085.

DISTRIBUTION SCHEDULE

Commissioner of Social Security
Office of Management and Budget, Income Maintenance Branch
Chairman and Ranking Member, Committee on Ways and Means
Chief of Staff, Committee on Ways and Means
Chairman and Ranking Minority Member, Subcommittee on Social Security
Majority and Minority Staff Director, Subcommittee on Social Security
Chairman and Ranking Minority Member, Subcommittee on Human Resources
Chairman and Ranking Minority Member, Committee on Budget, House of Representatives
Chairman and Ranking Minority Member, Committee on Government Reform and Oversight
Chairman and Ranking Minority Member, Committee on Governmental Affairs
Chairman and Ranking Minority Member, Committee on Appropriations, House of Representatives
Chairman and Ranking Minority, Subcommittee on Labor, Health and Human Services, Education and Related Agencies, Committee on Appropriations,
House of Representatives
Chairman and Ranking Minority Member, Committee on Appropriations, U.S. Senate
Chairman and Ranking Minority Member, Subcommittee on Labor, Health and Human Services, Education and Related Agencies, Committee on Appropriations, U.S. Senate
Chairman and Ranking Minority Member, Committee on Finance
Chairman and Ranking Minority Member, Subcommittee on Social Security and Family Policy
Chairman and Ranking Minority Member, Senate Special Committee on Aging
Social Security Advisory Board

Overview of the Office of the Inspector General
The Office of the Inspector General (OIG) is comprised of our Office of Investigations (OI), Office of Audit (OA), Office of the Chief Counsel to the Inspector General (OCCIG), and Office of Resource Management (ORM). To ensure compliance with policies and procedures, internal controls, and professional standards, we also have a comprehensive Professional Responsibility and Quality Assurance program.
Office of Audit
OA conducts and/or supervises financial and performance audits of the Social Security Administration’s (SSA) programs and operations and makes recommendations to ensure program objectives are achieved effectively and efficiently. Financial audits assess whether SSA’s financial statements fairly present SSA’s financial position, results of operations, and cash flow. Performance audits review the economy, efficiency, and effectiveness of SSA’s programs and operations. OA also conducts short-term management and program evaluations and projects on issues of concern to SSA, Congress, and the general public.

Office of Investigations
OI conducts and coordinates investigative activity related to fraud, waste, abuse, and mismanagement in SSA programs and operations. This includes wrongdoing by applicants, beneficiaries, contractors, third parties, or SSA employees performing their official duties. This office serves as OIG liaison to the Department of Justice on all matters relating to the investigations of SSA programs and personnel. OI also conducts joint investigations with other Federal, State, and local law enforcement agencies.

Office of the Chief Counsel to the Inspector General
OCCIG provides independent legal advice and counsel to the IG on various matters, including statutes, regulations, legislation, and policy directives. OCCIG also advises the IG on investigative procedures and techniques, as well as on legal implications and conclusions to be drawn from audit and investigative material. Finally, OCCIG administers the Civil Monetary Penalty program.
Office of Resource Management
ORM supports OIG by providing information resource management and systems security. ORM also coordinates OIG’s budget, procurement, telecommunications, facilities, and human resources. In addition, ORM is the focal point for OIG’s strategic planning function and the development and implementation of performance measures required by the Government Performance and Results Act of 1993.