A new report published on Monday by the Government Accountability Office (GAO) reveals that the Social Security Administration (SSA) is failing to properly oversee $2 billion – or 90 percent – of its annual IT budget, raising concerns about the agency’s ability to manage its IT portfolio effectively.
According to GAO, SSA spent about $2.2 billion on IT in fiscal year 2024. The agency’s IT investments are divided into two categories: “investments in operations,” which account for 90 percent of SSA’s annual IT budget, and “investments under development,” which make up the remaining 10 percent.
While SSA has defined processes for managing IT investments under development that align with Federal legislation and guidance, GAO said SSA does not have a process to oversee the investments already in operation.
These “investments in operations” that make up 90 percent of the IT budget include those in operations and maintenance (O&M), infrastructure, and cybersecurity.
“Without a process for the IT investment review board (IRB) to oversee these investments, SSA lacks the enterprise-wide perspective to make the most appropriate strategic IT investment decisions,” the report says. “In addition, the agency is hampered in its ability to effectively manage the entire IT portfolio and identify opportunities for cost savings and efficiencies.”
The other 10 percent of SSA’s IT budget, or the “investments under development,” also lack proper oversight from SSA. GAO said that SSA does have policies and procedures in place to oversee these investments, but “it has not fully implemented them.”
“SSA’s IT IRB meeting minutes for fiscal years 2022 to 2024 showed that the board primarily focused on funding allocations for the upcoming fiscal year and did not regularly discuss investment performance. SSA officials said that this was primarily due to the uncertain budget environment,” the report says.
“However, without regular oversight, the IT IRB will not know whether the investments are meeting performance targets. The IRB also risks identifying corrective actions late, when they are more difficult and costly to address,” it adds.
GAO also found that SSA did not have complete performance documentation for three selected investments under development. Additionally, it does not have a process to regularly review the performance of investments in O&M.
SSA officials told GAO that maintaining investments in O&M is necessary and the agency “cannot have debates on whether to continue to fund them.” However, Federal guidance from the Office of Management and Budget calls for agencies to provide appropriate oversight of investments in operations.
“Until SSA defines and implements processes to review investments in O&M, it risks not knowing whether its multibillion-dollar IT investments continue to support agency needs,” the report says.
To prevent the agency from flying blind on its multibillion-dollar IT projects, GAO is making seven recommendations.
These include that SSA implement a process to oversee and review the performance of investments in operations, and fully implement its process to evaluate the performance of investments under development. SSA agreed with all seven recommendations.