United States General Accounting Office Washington, DC 20548 March 4, 2003 The Honorable Jo Anne B. Barnhart Commissioner Social Security Administration Subject: Social Security Trust Funds Actuarial Estimates: Internal Control over Projection Process Needs Improvement Dear Ms. Barnhart: The combined Federal Old-Age, Survivors and Disability Insurance (OASDI) programs, commonly referred to as Social Security, provide protection against loss of earnings due to retirement, death, or disability. During calendar year 2001, the most recent year for which complete data were available at the time of our review, about 46 million people, including 91 percent of Americans age 65 or older, received $432 billion in benefits from the trust funds maintained for these programs. The Board of Trustees1 of the trust funds is required to report annually on the current and projected financial status of the Social Security programs to the Congress and the 2 American people. The Social Security Administration’s (SSA) Office of the Chief Actuary (OACT) provides estimates to the board to assist them in setting demographic, economic, and programmatic assumptions about OASDI’s future performance that are needed to prepare long-range and short-range projections of the financial status of the trust funds for the trustees’ reports. Based on the board’s assumptions, OACT then prepares the projections and the trustees’ report for the board. In its 2002 annual report, the Board of Trustees estimated that, under current rules, OASDI expenditures would begin to exceed revenue in calendar year 2017, causing the trust fund to be exhausted in 2041. A wide spectrum of users relies on these projections for a variety of purposes. These include the Congress, which needs reliable information about the Social Security trust funds to make informed decisions about the future funding and benefits of the OASDI programs. Providing decision makers with reasonable assurance about the 1 The Social Security Board of Trustees was established under the Social Security Act, as amended, to oversee the financial operation of the Old-Age and Survivors Insurance and Disability Insurance trust funds. The Board of Trustees is composed of the Commissioner of Social Security, the Secretary of the Treasury, the Secretary of Labor, the Secretary of Health and Human Services, and two members of the public, who are nominated by the President and confirmed by the Senate. 2 42 U.S.C. 401(c). GAO-03-246R SSA’s Controls over Projections reliability of financial reporting is one of the specific objectives of the Standards for Internal Control in the Federal Government3 issued by the Comptroller General. The Standards, which consider an entity’s internal control in terms of its control environment, risk assessment, control activities, information and communication, and monitoring, apply to all aspects of an agency’s operations: programmatic, financial, and compliance. Strong internal control is particularly important in the OACT, where making reliable projections is intensively people and process oriented. Control activities—the policies, procedures, techniques, and mechanisms that enforce management’s directives—are a key aspect of an effective system of internal control and include proper reviews, approvals, and documentation that help ensure work processes are carried out according to management’s directives. For example, control activities include checks and balances that provide reasonable assurance that data are entered correctly and calculated results are reported properly. Control activities also include effective management of an organization’s workforce—its human capital—which is essential to achieving results. Monitoring activities, another key aspect of internal control, help track the effectiveness of control activities, including those to ensure that findings of audits and other reviews are promptly resolved. We selected these activities for review because of their importance in the preparation of long-range financial projections for the OASDI trust funds. Our specific objectives were to identify and evaluate the adequacy of OACT’s (1) control activities over the projection process, (2) human capital practices related to workforce planning, and (3) tracking and resolution process to address recommendations from technical panels and other reviewers. To achieve these objectives, we reviewed our prior reports and reports by other reviewers, interviewed OACT management and staff and certain other SSA officials, and obtained and reviewed available documentation concerning the projection process. We used as a guide the Standards for Internal Control in the Federal Government4 with a focus on OACT control activities over the long-range projection process used for the 2002 Trustees’ report. We conducted our work in Washington, D.C., and Baltimore, Md., from October 2001 through November 2002 in accordance with generally accepted government auditing standards. We did not evaluate the actuarial assumptions and methodology because they are subject to periodic reviews by technical panels and others. We received written comments on a draft of our report from the Commissioner, SSA, and have reprinted their comments in enclosure II. Further details of our scope and methodology are provided in enclosure I. Results in Brief SSA’s OACT has implemented some control activities to help provide assurance over OASDI trust fund projections, including informal reviews of data, calculations of projection components, and final projections. However, we found that documentation of OACT’s long-range projection model, work processes, and work 3 U.S. General Accounting Office, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999). 31 U.S.C. 3512(c),(d) (The Federal Managers’ Financial Integrity Act of 1982 (FMFIA) requires GAO to issue standards for internal control in the federal government. 4 GAO/AIMD-00-21.3.1. Page 2 GAO-03-246R SSA’s Controls over Projections performed, including supervisory reviews, was insufficient. For example, there was no comprehensive description of the procedures necessary to prepare the long-range OASDI trust fund projections for the Trustees’ reports, and documentation of the work performed by OACT while preparing projections was limited. Without explicit documentation of OACT’s work processes and work performed, reviewers’ opportunity for oversight was reduced, and the risk that errors in the projection process would go undetected was increased. While no major errors were identified in reviews of OACT’s actuarial assumptions and methodologies, reviewers have pointed out the need for increased documentation.5 According to OACT officials, resource constraints were a key reason limiting the extent to which documentation was prepared. However, in light of potential near-term retirement of over 30 percent of OACT staff, documenting the projection process is becoming increasingly important to efficiently transition the work to new staff. We also found that OACT lacked a workforce plan to help ensure the availability of skills needed to achieve its mission. Such planning would typically include analyzing current and future workloads, identifying likely staff turnover and possible retention strategies, establishing skills sets for all key positions, and training staff to ensure that appropriate skill needs are met. Our recently issued tool for agency leaders, A Model of Strategic Human Capital Management,6 provides a framework for helping agency leaders plan and achieve effective use of their human capital. The lack of an adequate workforce plan, coupled with insufficient policies and documentation, could negatively affect OACT’s ability to achieve its mission in the future.7 OACT also lacks a monitoring policy and process for ensuring that recommendations from technical panels and other reviewers are tracked and addressed by OACT, leaving open the possibility that important initiatives and issues may not be completed in a timely manner. While OACT has taken steps to address some of the recommendations, it has not implemented a policy and associated procedures to (1) track recommendations it has received, (2) decide which recommendations should be implemented, (3) determine the order of priority, and (4) document the resolution of each recommendation. Without an established tracking and resolution process, OACT lacks a mechanism to help ensure that it addresses identified deficiencies and continues to improve its operations. We are making recommendations aimed at strengthening OACT’s internal control over documenting key procedures, establishing a workforce plan, and addressing recommendations from reviews. In commenting on a draft of this report, SSA generally agreed with most of our recommendations but raised concerns about several areas. Most significantly, SSA agreed with the need to continue to better document OACT’s internal controls, but believed that OACT has a strong internal 5 The Social Security Technical Panel Report to the 1991 Advisory Council on Social Security, (Washington, D.C.: August 1990) and The 1999 Technical Panel on Assumptions and Methods, Report to the Social Security Advisory Board (November 1999). 6 U.S. General Accounting Office, A Model of Strategic Human Capital Management, GAO-02-373SP (Washington, D.C.: Mar. 15, 2002). 7 OACT’s workforce plan should be performed in coordination with SSA’s agencywide human capital plan, which, as we reported in U.S. General Accounting Office, Performance and Accountability Series, Major Management Challenges and Program Risks: Social Security Administration, GAO-01-261 (Washington, D.C.: January 2001), needs further attention. Page 3 GAO-03-246R SSA’s Controls over Projections control process and culture. SSA specifically disagreed with our conclusion that the lack of documentation increased the risk of errors. While their practices might be sound, without explicit documentation of the work that is planned and performed, the opportunity for supervisors to identify errors or inconsistencies in the work is greatly impeded. This in turn increases the risk that errors in the projection process could go undetected. Background The Social Security program was developed to provide income security to citizens and permanent residents of the United States under specific circumstances as a responsibility of the government. SSA is responsible for administering the nation’s Old-Age and Survivors Insurance (OASI), Disability Insurance (DI), and other income security programs. OASI provides benefits to retired workers and their families and to survivors of deceased workers. DI pays benefits to disabled workers and their families. The OASDI programs are funded by payroll taxes, taxes on self-employment income, and income from the taxation of benefits. Income in excess of expenditures is held in the OASDI trust funds and invested in federal government securities. OACT’s mission involves reviewing the balance between future benefit payments and future income of the OASDI programs. Further, evaluating the cost of proposals to change the programs is an important task of OACT. One of the recurring reports prepared by OACT is the annual report of the Board of Trustees on the OASDI trust funds and the current and projected financial condition of the funds based on assumptions set by the Trustees. Although preparing the Trustees’ report is only one of OACT’s activities, of the 51 full-time equivalent (FTE) staff on board, approximately 20 participate directly in preparing the long-range projections of OASDI for the reports, which, for the most part, takes place between September and March. OACT has organized its staff into three teams that focus on specialized areas for the long-range estimates. The demographics team estimates the social security population. The economics team estimates the covered-worker population, as well as future income to the trust funds. The program team estimates future benefits, cost projections, and the long-range trust fund financial status. The Trustees’ reports present both short-range (10-year) and long-range (75-year) projections of the OASDI trust funds’ future financial condition. The estimates are made based on current law and board-approved assumptions about factors that affect the income and expenditures of the trust funds. The long-range projections are generated using a complex, computerized model consisting of many interrelated programs. Some of the data that are used in the long-range projections come from external sources such as the Census Bureau, National Center for Health Statistics, Bureau of Economic Analysis, and Bureau of Labor Statistics. The Board of Trustees’ projection assumptions and OACT’s actuarial projection methodology are subject to periodic review by independent experts to help ensure their validity and reasonableness. The Social Security Advisory Board periodically convenes technical panels consisting of expert actuaries, economists, and demographers to review the assumptions and methods underlying the projections Page 4 GAO-03-246R SSA’s Controls over Projections 8 included in the Trustees’ reports. The Technical Panel reports typically include 9 recommendations primarily relating to actuarial methodologies and assumptions. In addition, in January 2000, we reported on an evaluation of actuarial methods, techniques, and assumptions used in preparing the actuarial projections of the Social Security trust funds contained in the 1999 Trustees’ report.10 To make these determinations, we contracted with PricewaterhouseCoopers, an independent accounting and consulting firm, to evaluate the actuarial methodologies and assumptions. While OACT has been subjected to reviews by technical panels and others, internal control over its projection processes had not been independently reviewed previously. Although projections are inherently uncertain because they depend on assumptions about the occurrence of future events, an effective system of internal control can help provide reasonable assurance that projections included in financial reports are reliable. The Comptroller General issues standards for internal control in the federal government11 that provide the overall framework for management to establish and maintain internal control and to identify and address major performance and management challenges. According to these standards, internal control, also referred to as “management control,” comprises the plans, methods, and procedures used to meet the missions, goals, and objectives of an organization. One of its objectives is the reliability of financial reporting, including financial statements and other reports for internal and external use. 12 The Federal Accounting Standards Advisory Board (FASAB) promulgates federal accounting standards, which form the foundation for preparing consistent and meaningful financial statements both for individual agencies and the government as a whole. FASAB is currently reviewing the accounting and financial reporting requirements for social insurance trust funds. The provisions of Statement of Federal Financial Accounting Standards No. 17 currently require reporting certain social insurance information as Required Supplementary Stewardship Information,13 resulting in limited audit coverage. Reclassifying the required information as basic financial information, as currently discussed by FASAB, would subject the information to more extensive audit scrutiny. While specific procedures to audit social insurance projections have not been developed, typical audit procedures would 8 The Social Security Advisory Board was created by the Social Security Independence and Program Improvements Act of 1994. The Social Security Advisory Board appoints technical panels to advise on the assumptions and methods used in the Trustees’ reports. In 1999, the Social Security Advisory Board convened its first technical panel. Similar technical panels have been convened periodically since 1971 by other advisory authorities. 9 The most recent technical panel reports are available on SSA’s Web site: www.ssa.gov. 10 U.S. General Accounting Office, Social Security: Actuarial Projections of the Trust Funds, GAO/AIMD-00-53R (Washington, D.C.: Jan. 14, 2000). 11 GAO/AIMD-00-21.3.1. 12 In October 1990, the Secretary of the Treasury, the Director of the Office of Management and Budget, and the Comptroller General (Principals) established FASAB to develop a set of generally accepted accounting standards for the federal government. Effective July 1, 2002, FASAB is comprised of six nonfederal or public members and representatives of the three Principals. 13 Federal Accounting Standards Advisory Board (FASAB), Statement of Federal Financial Accounting Standards No. 17, Accounting for Social Insurance, August 1999. Page 5 GAO-03-246R SSA’s Controls over Projections likely include obtaining an understanding of policies and procedures, assessing the adequacy of internal control, and analyzing key projections. Limited Documentation Reduced Effectiveness of Control Activities Although the Standards for Internal Control in the Federal Government 14 call for clear documentation of policies, procedures, and actions, we found that OACT has not fully implemented these key control activities. While OACT has documented some portions of the complex model used to generate long-range projections for the OASDI trust funds, OACT has not fully documented the model. Also, the procedures needed to prepare the projections for the Trustees’ reports have not been fully documented, although descriptions of some portions have been drafted. Further, when preparing the projections, staff did not adequately document the work they performed, including adjustments and changes to data or results, nor did management or supervisors document their reviews of various phases of the process. OACT management cited resource constraints as a key reason for not performing these tasks. The lack of documented planned procedures, work performed, and reviews increases the risk that errors in the projection process could go undetected and impedes efforts by those who evaluate the projections. According to the Standards for Internal Control in the Federal Government, management is responsible for developing the detailed policies, procedures, and practices to fit their agency’s operations and ensuring that internal control is built into and is an integral part of operations. The Standards also provide that procedures need to be clearly documented, documentation should be readily available for examination, and documentation should be properly managed and maintained. Furthermore, actuarial standards of practice15 state that actuaries should identify the data, assumptions, and methods they use with sufficient clarity so that another actuary qualified in the same practice area could evaluate the reasonableness 16 of the work. These standards also stipulate that this documentation be retained for a reasonable period of time. OACT has not developed a comprehensive flow chart or description of the model used to produce the long-range projection. OACT has documented portions of their actuarial methodology in actuarial studies, such as the social security population projection used in preparing the 1997 Trustees' report,17 but an overall description of the long-range projection model has not been fully documented. Furthermore, although one supervisory actuary required his staff to document the procedures they 14 GAO/AIMD-00-21.3.1. 15 Actuarial standards of practice are promulgated by the Actuarial Standards Board. These standards are designed to provide practicing actuaries with a basis for assuring that their work will conform to generally accepted principles and practices and to assure the public that actuaries are professionally accountable. 16 Actuarial Standard of Practice Number 41, Actuarial Communications (Washington, D.C.: March 2002). 17 Actuarial Study Number 112, Social Security Area Population Projections: 1997 (Baltimore, Md.: August 1997). Page 6 GAO-03-246R SSA’s Controls over Projections used after they had prepared certain portions of the 2002 Trustees’ report projection, a complete procedural description of the process in standardized form and content has not been prepared. We also found that OACT had not documented acceptable ranges for fluctuation in ratios and trends between reporting periods to provide guidance for consistently judging reasonableness from year to year. Establishing and documenting acceptable ranges for reasonableness tests of ratios and trends is important because SSA actuaries use these tests to judge the reasonableness of results from the overall model as well as discrete portions of the model. In addition to limited documentation of the overall long-range projection model and planned procedures to follow in preparing the projection, OACT could provide little documented evidence of the procedures performed by staff during the projection process. According to OACT staff, some of the steps performed during preparation of the Trustees’ report include reasonableness reviews of source data, the entry of data into the model, reasonableness tests of component calculations of the projection, and adjustments made to preliminary results. OACT could not provide documented evidence of adjustments made to data or component calculations based on reasonableness reviews and tests performed by staff. For example, an OACT staff member told us that immigration source data were recognized as problematic, that adjustments to that data were required regularly, and that most of the time devoted to processing that portion of the population model was spent analyzing the data. However, no documentation of related adjustments was available. Proper documentation of these types of changes would allow effective review, showing why a problem occurred, what was done to address the problem, who addressed it, and who approved the action taken. We found that evidence documenting supervisory actuaries’ reviews of the work done by staff and of projection results was lacking, although demographics team actuaries told us that they meet weekly to discuss work performed and problems encountered during the preparation of the long-range projection. Also, there was limited documented evidence of product reviews and reasonableness checks performed at the management level. According to the actuaries in OACT, reasonableness checks of data and projection results are done at many levels, including those done by supervisory actuaries and OACT management. As an example, another OACT staff member told us that he reviewed the numbers and graphs presented in the 2002 Trustees’ report to determine that they agreed with the projection calculations prepared by OACT for that report. He presented a copy of the report containing markings that indicated work had been done but explanation of the markings, the procedures performed, and the conclusions were not documented. Supervisory actuaries told us that one type of reasonableness check is a reconciliation performed between the first 10 years of the long-range projection and the 10-year short-range projection to compare results and identify differences. The effect of this reconciliation is to smooth the differences between the two projection models. OACT could not provide documentation showing that the reconciliation had been performed. According to OACT staff, resource constraints have prevented completion of documentation of the projection model and the work plan, although numerous Page 7 GAO-03-246R SSA’s Controls over Projections attempts have been made. Staff also attributed the lack of documentation of work performed and supervisory reviews to resource constraints. According to OACT management, while demands placed on the office in recent years have stretched existing resources, the knowledge and experience of OACT staff provide assurance of projection reliability. Accordingly, OACT management has not developed policy guidance concerning documentation requirements. Similarly, the 1999 Technical Panel recognized the extraordinary demands placed on OACT for analysis of legislative proposals and the difficulty of adequately addressing the need for thorough documentation of all areas involved in making financial projections given OACT’s current resources.18 The 1999 Technical Panel also reported that OACT’s work was outstanding and the projection methodology reasonable as a whole, but recommended that adequate resources be provided to help document the current projection system. Further, the panel identified no major 19 errors. Also, our January 2000 report stated that comprehensive documentation would benefit those who evaluate or assist in the development of the financial projections. While we reported that the actuarial methods and techniques used in preparing the long-range projection were sound and the assumptions were reasonable, our report specifically noted that, “[a]lthough not explicitly within the specific scope of this project, we observed that there are a number of gaps in the documentation of current practice.” Collectively, the lack of complete and current documentation of the (1) entire model, (2) projection work plan, (3) work completed during the projection process including adjustment of data and component calculation results, and (4) reviews by supervisors and managers, increases the risk that errors could occur in future projections and not be detected. In addition, these documentation deficiencies limit • guidance available to staff regarding projection preparation; • evidence that proper practices are consistently followed from year to year, as planned; • assurance to OACT’s management regarding projection reliability; • opportunities to provide staff, especially new staff, with an overview of the entire projection process; and • the effectiveness and efficiency of reviews within and outside of OACT, such as OACT’s ability to effectively and efficiently communicate its projection procedures. In addition, increased audit scrutiny that could result from FASAB’s current consideration of changes to social insurance reporting requirements would magnify the need for documentation of the long-range projection work plan and steps performed. Furthermore, as discussed in the next section, retirement eligibility will seriously impact OACT in the next 5 years. When experienced actuaries retire and less experienced actuaries replace them, the documentation needed to bridge the knowledge gap becomes more critical. In consideration of potential near-term 18 The 1999 Technical Panel on Assumptions and Methods, Report to the Social Security Advisory Board (November 1999). 19 GAO/AIMD-00-53R. Page 8 GAO-03-246R SSA’s Controls over Projections retirements and associated staff changes, documenting the projection process is critical for an efficient transition of the workload. Inadequate Workforce Plan Could Negatively Affect OACT’s Ability to Achieve Its Mission While OACT currently has qualified, experienced staff, it is aware that the potential retirement of more than 30 percent of its staff, including key management and professional personnel, over the next 5 years will expose the office to a loss of institutional knowledge that is vital to its operations. In response to this potential loss of experience and knowledge, OACT has stepped up recruiting efforts and is encouraging staff to sit for actuarial exams. OACT has not, however, developed a workforce plan for hiring and training future staff and management based on an assessment of current skill levels and future skill needs. Lack of an adequate workforce plan could impede OACT’s ability to achieve its mission in the future. According to the Standards for Internal Control in the Federal Government, effective management of an organization’s workforce—its human capital—is essential to achieving results and an important part of internal control. Management should ensure that skill needs are continually assessed and that the organization is able to obtain a workforce that has the required skills that match those necessary to achieve organizational goals. According to our recently issued tool for agency leaders, A Model of Strategic Human Capital Management,20 high-performing organizations identify their current and future human capital needs, including the appropriate number of employees, the key competencies and skills mix for mission accomplishment, and the appropriate deployment of staff across the organization, and then create strategies for identifying and filling gaps. According to the 21 International Personnel Management Association’s workforce planning guide, a good workforce plan would include • analyzing present workload, workforce, and competencies; • identifying workload, workforce, and competencies needed for the future; • comparing the present workload, workforce, and competencies to future needs to identify gaps and surpluses; • preparing and implementing plans to build the workforce needed for the future; and • evaluating the success of the workforce planning model to ensure it remains valid and objectives are being met. 20 GAO-02-373SP. 21 International Personnel Management Association, Workforce Planning Resource Guide for Public Sector Human Resource Professionals (Alexandria, Va.: 2002). Page 9 GAO-03-246R SSA’s Controls over Projections OACT, however, has not performed an in-depth analysis to identify issues such as workloads, skill gaps, and succession plans as outlined in SSA’s Future Workforce 22 Transition Plan. As of November 15, 2002, OACT had a staff of 51 FTEs, 16 of whom have been part of OACT for fewer than 5 years. Moreover, OACT does not have a succession plan to address the potential retirement of its managers and staff. With over 30 percent of its staff eligible to retire in the next 5 years, including 7 management and 7 professional staff, OACT has accelerated its recruiting efforts, but the lack of a well-considered workforce analysis increases the potential for vital knowledge to be lost when experienced actuaries retire or otherwise leave the agency. Our January 2000 report noted that OACT has hired qualified staff. To develop staff, OACT provides some cross-training and conducts on-the-job training. OACT also provides training opportunities by allowing staff to use work time to study for exams 23 given by the Society of Actuaries and, if funds are available, by paying for the exam fees, books, and other study material to help staff successfully complete the exams. However, OACT does not have a formal plan for staff training and development and has no requirements for continuing professional education. 24 A Model of Strategic Human Capital Management recognizes that people are assets whose value can be enhanced through investment. In addition, our analysis of 25 training programs at federal agencies emphasized that to design and implement effective training programs, agencies must (1) identify the competencies needed to achieve their specific mission and goals and measure the extent to which their employees exhibit those competencies, (2) identify training and development needs to be addressed, and (3) evaluate the extent to which their training programs are actually increasing employees’ individual competencies and individual and overall organization performance levels. Our analyses found that effective training programs (1) include training curricula for developing employee skills in selected occupations, (2) require or recommend that employees complete training on specific topics or meet a minimum number of training hours, and (3) make training slots available each year on the basis of estimated needs, priorities, and available resources. Effective human capital strategies can enable an organization to have the right 26 people, with the right skills, doing the right jobs, in the right place, at the right time. 22 SSA issued its Future Workforce Transition Plan in June 2000, which encompasses strategies that address workforce planning/analysis (including retirement analysis), recruitment and retention, and training. Since 1993, we have reported a number of concerns with SSA’s overall human capital planning efforts that the agency is taking steps to address such as by developing the Future Workforce Transition Plan. However, to be more useful in making workforce and information technology decisions, we have stressed that a more detailed service delivery plan is needed that spells out who will provide what type of services in the future. 23 The Society of Actuaries (SOA) is an educational, research, and professional membership organization with the purpose of advancing actuarial knowledge and enhancing the ability of actuaries. To become a member of SOA, one must successfully complete a series of SOA examinations. 24 GAO-02-373SP. 25 U.S. General Accounting Office, Design, Implementation and Evaluation of Training at Selected Agencies, GAO/T-GGD-00-131 (Washington, D.C.: May 18, 2000). 26 GAO-02-373SP. Page 10 GAO-03-246R SSA’s Controls over Projections Without a workforce plan that is predicated on an analysis that integrates with SSA’s overall workforce analysis and planning efforts, OACT lacks a strategic focus on its human resource issues, which impedes its ability to align those resources with completion of critical tasks now and in the future. Lack of a Formal Policy and Process to Track and Address Recommendations Could Reduce Opportunity for Improvements Technical panels and other reviewers have provided recommendations to OACT management about technical issues and documentation concerning the projection system. While OACT management has taken action on some of those recommendations, it has not developed a monitoring policy and process to respond to individual recommendations and track steps taken to address those requiring action. Accordingly, OACT could not readily provide us with the status of actions taken to respond to recommendations from technical panels and our January 2000 report. Although there is no requirement to respond to recommendations made by technical panels, without a tracking process, important improvements to the projection process may be overlooked or may not be completed in a timely manner. According to the Standards for Internal Control in the Federal Government, monitoring of internal control should include policies and procedures for ensuring that the findings of audits and other reviews are promptly resolved. The standards further state that the resolution process begins when audit or other review results are reported to management, and is completed only after action has been taken that (1) corrects identified deficiencies, (2) produces improvements, or (3) demonstrates that the findings and recommendations do not warrant management action. The Office of Management and Budget (OMB) Circular A-50, Audit Followup, provides policies for executive branch agencies to use when following up on our reports and reports issued by the Inspectors General (IG) and others, and emphasizes the importance of establishing a system to provide a complete record of action taken on recommendations. In accordance with OMB Circular A-50, SSA has implemented an agencywide system to monitor our and IG engagements and facilitate follow-up by components, such as OACT, on recommendations resulting from these engagements.27 This system relies on periodic updates from components on the status of recommendations and does not include recommendations from technical panels. OACT has not developed a process to track steps taken to address recommendations made in technical panel reports and other reviews. Therefore, OACT cannot readily supply updates to the agencywide system on our report and similar reports, nor provide the status of updates on technical panel recommendations efficiently and effectively. Such a tracking process would typically include documenting management’s position on recommendations, establishing a timetable for resolving the recommendations, and designating a management official to oversee the 27 When we contacted agency officials who maintain this system, we found that recommendations contained in our January 2000 report were not in the system, because the recommendations were included in our consultants’ report, which was an enclosure to our report. Page 11 GAO-03-246R SSA’s Controls over Projections resolution of corrective action, issues which are discussed in OMB Circular A-50 as applying to audits. Three technical panels have been convened since 1991 by the Social Security Advisory Board or its predecessor, the Social Security Advisory Council, to review the assumptions and methodology used to project the future financial status of the OASDI trust funds. As previously discussed, both the 1991 and the 1999 technical panels urged further documentation of the current projection system and made several recommendations relating to technical issues surrounding it.28 In response to our request for an update on the status of recommendations from our January 2000 report,29 which included recommendations for improving documentation, developing assumptions, and performing additional sensitivity testing, it was necessary for OACT management to research each of the recommendations to determine if and how they had been resolved. In addition, OACT could not readily describe actions taken on recommendations of the 1999 Technical Panel. Management cannot remain informed of the status and resolution of recommendations nor can they respond to recommendation resolution status requests efficiently and effectively unless a tracking system that provides information on decisions and actions for each recommendation is implemented and maintained. OACT officials told us there is no requirement for OACT to respond, either formally or informally, to recommendations made by the technical panels and that limited resources restrict OACT’s ability to formally track recommendation resolution. However, management cannot be assured that all technical panel recommendations were considered and that those providing for improved or corrected results have been implemented unless actions to address recommendations, particularly those bearing on the projection methodology, are documented as provided for in OMB 30 Circular A-50 regarding audit follow-up. Also, without tracking and documenting action taken in response to recommendations, responding to follow-up inquiries concerning recommendations will remain a labor-intensive and inefficient exercise. Further, unless OACT management develops and implements a tracking and resolution process to address recommendations, it leaves open the possibility that important initiatives will not be completed in a timely manner or will go uncompleted, thus effectively wasting the resources expended by technical panels and other reviewers. 28 The Social Security Technical Panel Report to the 1991 Advisory Council on Social Security (Washington, D.C.: August 1990) and The 1999 Technical Panel on Assumptions and Methods, Report to the Social Security Advisory Board (November 1999). 29 GAO/AIMD-00-53R, 100-101. 30 While the policies outlined in OMB Circular A-50 are applicable to audit follow-up, and the review by the Technical Panel would not appear to be considered an audit for purposes of the Circular, we view these policies as critical in providing assurance to OACT management that the resolution process has been properly completed. Documentation under the Circular would include outlining a course of action for implementing recommendations that management agrees with and providing reasons for taking no course of action for those that management disagrees with. Page 12 GAO-03-246R SSA’s Controls over Projections Conclusion The Congress and other decision makers rely on SSA’s OACT to provide reliable estimates of future OASDI expenditures and income. While OACT has indicated that many informal control activities are taking place, internal control over OACT’s long- range projection processes regarding documentation, workforce planning, and its policies for resolving recommendations are inadequate. Incomplete documentation of the projection model and procedures, work completed during the projection process, and the reviews of projection work and products by supervisors and managers, increases the risk that errors could occur in future projections and not be detected. Documenting all tasks is important to the efficient transfer of knowledge concerning policies, procedures, and processes to new staff. While resource constraints might have impeded OACT’s efforts to properly document policies and projection procedures, the lack of a workforce plan has prevented systematic analysis of OACT’s workload, identification of the skill mix needed to accomplish that work, identification of the skill levels of current staff, and the identification of supporting resources needed to perform these and other critical OACT functions. Moreover, OACT management has not documented the priority and status of actions planned and taken to address recommendations from auditors, including GAO, technical panels, and other reviewers, increasing the risk that significant recommendations might not be addressed in a timely manner. Recommendations for Executive Action To address the internal control weaknesses we identified related to policy development, documentation, workforce management planning, and monitoring follow-up of external review recommendations, we recommend that the Commissioner of SSA direct the Chief Actuary to • develop and implement policies regarding documentation of the work performed by OACT; • document the • projection model, • procedures needed to generate the projections, including acceptable ranges for reasonableness tests, • work performed by staff to prepare projections, and • supervisory and management reviews; • develop and implement a workforce plan that integrates with SSA’s Future Workforce Transition Plan and includes the following elements: • analyzing present workload, workforce, and competencies, • identifying workload, workforce, and competencies needed for the future, • comparing the present workload, workforce, and competencies to future needs to identify gaps and surpluses, • preparing and implementing plans to build the workforce needed for the future, and Page 13 GAO-03-246R SSA’s Controls over Projections • evaluating the success of the workforce planning model to ensure it remains valid and objectives are being met; and • develop and implement a formal policy to track, follow up, and resolve findings and recommendations of external audits and reviews. In addition, to overcome the challenge of limited resources, we recommend that the Commissioner of SSA, in consultation with the Chief Actuary, consider using alternative approaches, such as contractor assistance, to address the above recommendations. Agency Comments and Our Evaluation In written comments (reprinted in enclosure II) on a draft of this report, SSA generally agreed with most of our recommendations but raised concerns about several areas. Concerning our conclusion and recommendations related to OACT’s limited documentation of procedures and processes, SSA commented that, while it agreed that more formal documentation of internal control could be of value, it disagreed with the conclusion that current OACT procedures increase the risk of errors. While OACT’s current procedures might be sound, without explicit documentation of the work that is planned and performed, the opportunity for supervisors to identify errors or inconsistencies in the work is greatly impeded. This in turn increases the risk that errors in the projection process could go undetected. SSA agreed that written documentation of reviews would assist in assuring auditors that the reviews were done and discussed the additional documentation of reviews that they have begun. However, SSA also stated that documentation of reviews, perhaps in the form of "check-off lists," would not necessarily reduce the risk of errors and that overdependence on sequential check-off lists could pose a risk by implying that work checked off was not subject to subsequent necessary revision. We disagree. Documentation, whether in a checklist or another form, provides a degree of assurance to management, as well as auditors, that planned procedures have been properly completed. It is not a substitute for technical expertise or professional judgment but complements those integral components of competent performance that are especially critical in OACT. In its comments, SSA stated that it does not believe the limited focus of our review allowed us to understand the extent of OACT’s present documentation of the projection model. Our review focused exclusively on OACT’s controls over the projection process and provided a sufficient basis to identify shortfalls in OACT’s documentation. Our report points out that, while portions of the model and their procedures have been partially documented, neither an overall summary of the model for OACT’s long-range projection nor a work plan to prepare the projection exists. These basic documents are needed to provide (1) an overview of the entire projection process and detailed guidance about projection preparation for new OACT staff, (2) additional assurance that proper practices are consistently followed from year to year, and (3) a means for OACT to effectively and efficiently communicate its Page 14 GAO-03-246R SSA’s Controls over Projections procedures to reviewers within and outside of OACT. Further, in its technical comments, SSA suggested that we revise our recommendations to essentially eliminate our recommendation to document the projection model. Because of its importance, we are retaining the recommendation to document the projection model and encourage SSA to complete this essential documentation. Regarding our recommendation that OACT document acceptable ranges for reasonableness tests, SSA stated that because outputs of the projection involve yearly changes in input data, assumptions, and methodology, absolute standards cannot be set for such reasonableness tests. We did not recommend establishing absolute standards but instead call for acceptable ranges to provide guidance for consistently making reasonableness judgments from year to year. We understand that elements of the model change each year. Because of these changes, it is especially important to provide guidance to ensure that differences that exceed a predetermined range or criteria are uniformly identified and questioned by staff, especially junior staff, and reviewers. The intent of our recommendation is to help ensure that appropriate attention is focused on changes in data and results that exceed the criteria. In response to our recommendations concerning development and implementation of a workforce plan and a policy to track, follow up, and resolve audit and review findings and recommendations, SSA described actions it has planned. In both areas, we believe additional steps are needed to obtain the greatest benefit. SSA described how its training and development process is focused on on-the-job training. However, as discussed in the report, our analysis of training programs at federal agencies emphasized the importance of formal training in addition to on-the-job training to help ensure staff skills are fully developed. Regarding follow-up of audit and review recommendations, SSA noted that there is a tracking system in place for audits. However, as we reported, SSA’s system depends on timely periodic updates from components such as OACT. Neither SSA nor OACT could readily provide us with the status of actions to respond to recommendations from our January 2000 report. SSA also outlined its plans for OACT to implement a tracking system for technical panels and other reviews. SSA’s stated plan is a good start as described, but is missing a key step to enhance accountability for completing corrective actions by assigning responsibility to individuals. This step would be consistent with the provisions of OMB Circular A-50 and provide a mechanism of accountability and assurance to management that corrective actions are completed. We believe it would benefit OACT to consolidate its process to follow up on recommendations from all reviews and audits so that they can be efficiently tracked and resolved. SSA did not comment on our recommendation to consider alternative approaches, such as contractor assistance, to address our other recommendations. However, during a subsequent conversation with an SSA official, we were advised that OACT management is discussing alternative approaches such as contractor assistance. ___________________________________ This report contains recommendations to you. The head of a federal agency is required by 31 U.S.C. 720 to submit a written statement on actions taken on these recommendations to the Senate Committee on Governmental Affairs and the House Committee on Government Reform and Oversight within 60 days of the date of this Page 15 GAO-03-246R SSA’s Controls over Projections report. You must also send a written statement to the House and Senate Committees on Appropriations with the agency’s first request for appropriations more than 60 days after the date of this report. We are sending copies of this report to the Chairman and Ranking Minority Member, Senate Committee on Governmental Affairs; the Chairman and Ranking Minority Member, Senate Committee on Finance; the Chairman and Ranking Minority Member, House Committee on Government Reform; the Chairman and Ranking Minority Member, House Committee on Ways and Means; the Chairman and Ranking Minority Member, Subcommittee on Social Security, House Committee on Ways and Means; and other interested congressional committees. In addition, this report is available at no charge on our Internet home page at http://www.gao.gov. If you have any questions about this report, please contact me at (202) 512-9508 or Kay L. Daly, Assistant Director, at (202) 512-9312. You may also reach us by e-mail at email@example.com or firstname.lastname@example.org. Key contributors to this assignment were Joseph Applebaum, Lisa Crye, Marie Novak, Taya Tasse, Jack Warner, and Brooke Whittaker. Sincerely yours, Linda Calbom Director, Financial Management and Assurance Enclosures Page 16 GAO-03-246R SSA’s Controls over Projections Enclosure I Enclosure I Scope and Methodology Because of the importance of long-range projections, their inclusion in agency and governmentwide financial reports, and the potential for their being subjected to increased audit scrutiny as basic financial information, we focused on internal control over the procedures used by OACT to prepare the 2002 long-range projection. Throughout our work, we used as a guide the Standards of Internal Control in the 31 Federal Government. Because of the technical nature of OACT’s work, we focused on assessing control activities, including human capital management, and monitoring activities, including recommendation follow-up. To achieve our overall objectives, we obtained and reviewed past Trustees’ reports, technical panel reports, and GAO work to gain an understanding of the assumptions and methods used by OACT. We also reviewed pertinent documentation provided by OACT and actuarial standards of practice promulgated by the Actuarial Standards Board. To identify and evaluate OACT’s control activities over documentation of the projection process, we interviewed OACT managers and staff to identify policies and procedures, including reviews made by supervisors and managers of interim and final results. We also reviewed available paper and electronic documentation from OACT, including descriptions of steps needed to complete the projections, computer spreadsheets, trend analyses, graphs, and other printouts used to conduct reasonableness reviews, and actuarial standards of practice relating to actuarial communications and documentation. To identify and evaluate OACT’s human capital control activities, we made inquiries of managers in OACT to assess their approach to human capital management, including skill needs assessments, training, supervision, and succession planning. We also discussed training and supervision practices with OACT staff. Further, we interviewed officials from SSA’s Office of Personnel to identify agency and OACT human capital practices and reviewed SSA’s Future Workforce Transition Plan to identify overall agency human capital initiatives. To assess OACT’s tracking and resolution process to address recommendations, we interviewed OACT management and officials from SSA’s Offices of the Inspector General and Management Analysis and Audit Program Support about policies and procedures for ensuring that the findings of audits and other reviews are promptly resolved. We also obtained documentation of OACT’s response to recommendations included in our January 2000 report on an evaluation of actuarial methods, techniques, and assumptions used in preparing the actuarial projections of the Social Security trust funds contained in the 1999 Trustees’ report. When controls were identified, we evaluated whether the controls as designed and implemented would provide management with reasonable assurance that the control objectives were achieved. We confirmed our understanding of the internal control 31 GAO/AIMD-00-21.3.1. Page 17 GAO-03-246R SSA’s Controls over Projections Enclosure I Enclosure I system currently in place through discussions with OACT officials. We did not evaluate the assumptions and methods used by OACT or the accuracy of the data and information they used. Our work was not designed to assess the effect of control weaknesses that we identified on the reliability of previous projections prepared by OACT. We conducted our work from October 2001 through November 2002, in Washington, D.C., and Baltimore, Md., in accordance with generally accepted government auditing standards. We requested and obtained written comments on a draft of this report from the Commissioner of SSA. Those comments are reprinted in enclosure II. Page 18 GAO-03-246R SSA’s Controls over Projections Enclosure II Enclosure II Comments from the Social Security Administration Page 19 GAO-03-246R SSA’s Controls over Projections Enclosure II Enclosure II Page 20 GAO-03-246R SSA’s Controls over Projections Enclosure II Enclosure II Page 21 GAO-03-246R SSA’s Controls over Projections Enclosure II Enclosure II Page 22 GAO-03-246R SSA’s Controls over Projections Enclosure II Enclosure II Page 23 GAO-03-246R SSA’s Controls over Projections Enclosure II Enclosure II (190025) Page 24 GAO-03-246R SSA’s Controls over Projections
Social Security Trust Funds Actuarial Estimates: Internal Control over Projection Process Needs Improvement
Published by the Government Accountability Office on 2003-03-04.
Below is a raw (and likely hideous) rendition of the original report. (PDF)