oversight

Railroad Retirement Board: Internal Controls for Unemployment Program Improving, but Gaps Remain

Published by the Government Accountability Office on 1990-05-03.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

Iv ;ry I !)!)(I
                  RAILROAD
                  RETIREMENT BOARD
                  Internal Controls for
                  Unemployment Program
                  Improving, but Gaps
                  Remain

                                          w




----
GAO/IIHI)-W-412
      ,United States
GAO   General Accounting  Office
      Washington, D.C. 20648

      Human Resources Division

      B-239100

      May 3,199O

      The Honorable Edward M. Kennedy
      Chairman, Committee on Labor and
        Human Resources
      United States Senate

      The Honorable Lloyd Ben&en
      Chairman, Committee on Finance
      IJnited States Senate

      The Honorable Thomas A. Luken
      Chairman, Subcommittee on Transportation
        and Hazardous Materials
      Committee on Energy and Commerce
      House of Representatives

      The Honorable Thomas J. Downey
      Chairman, Subcommittee on Human Resources
      Committee on Ways and Means
      House of Representatives

      The Railroad Unemployment Insurance and Retirement Improvement
      Act of 1988 required GAO to (1) study the frequency of fraud and pay-
      ment error in the railroad unemployment-sickness benefits program and
      (2) report to the Congress. We agreed with your staffs that the most
      effective way to achieve the act’s intent would be to review the pro-
      gram’s internal controls for safeguarding against fraud and payment
      error.

      The Accounting and Auditing Act of 1950 requires federal agencies to
      establish and maintain effective internal controls. The Federal Manag-
      ers’ Financial Integrity Act (FMFIA) of 1982 reinforced this requirement
      by focusing on what internal controls were intended to accomplish. The
      act states that internal controls must ensure that (1) the use of
      resources is consistent with laws, regulations, and policies; (2) these
      resources are safeguarded against waste, loss, and misuse; and (3) relia-
      ble data are obtained, maintained, and disclosed in reports.

      In addition to reviewing these controls, we obtained related program
      information that should be useful to the Congress. To do this, we




      Page I                           GAO/HRD-90-42 Railroad Retirement Board Controls
                       B-239100




                   . examined earlier GAO reviews, internal audits by the Railroad Retire-
                     ment Board, and Office of Inspector General (OIG) studies concerning the
                     unemployment-sickness benefits program (see app. I);
                   l reviewed current internal controls (see app. II);
                   . observed and traced actual transactions through the processing system
                     at headquarters and field offices (see app. II); and
                   l assessed the Board’s computer system, including its recent analysis of
                     computer security (see app. II).

                       Appendix I contains a more detailed description of the objectives, scope,
                       and methodology of our review (see p. 10). We carried out our review
                       from December 1988 through July 1989 in accordance with generally
                       accepted government auditing standards.

                                                                                               -
                       Railroad employees were originally covered by state unemployment pro-
Background             grams established under the 1935 Social Security Act. Unemployed rail-
                       road workers were often denied benefits, however, because they became
                       unemployed while working in one state whereas their employers had
                       paid unemployment taxes in another state. Consequently, in June 1938
                       the Congress created a separate railroad unemployment program to
                       cover railroad workers; in 1946, the Congress expanded the program to
                       include sickness benefits. The requirements for program eligibility are
                       discussed in appendix III (see p. 22).

                       The Railroad Retirement Board is an independent federal government
                       agency that administers retirement-survivor and unemployment-sick-
                       ness benefits programs for the nation’s railroad workers, The Board,
                       headquartered in Chicago, has 90 field offices and about 1,600 employ-
                       ees. During 50 years of operation, it has paid out over $102 billion in
                       retirement benefits and about $6 billion in unemployment and sickness
                       benefits: 925,000 retirement-survivor beneficiaries received about $6.7
                       billion and about 101,000 unemployment- sickness beneficiaries received
                       about $132 million in 1988. Unemployment-sickness benefits paid in
                       June 1989 averaged $150 a week for each beneficiary. This report
                       addresses the internal controls for the unemployment-sickness benefits
                       program. Appendix IV contains detailed information on the program’s
                       operations and describes the Board’s internal controls (see p. 24).


                       Through the program’s current internal controls, the Board identified
Results in B>ief       approximately $1 million in fraud and payment error during benefit



                       Page 2                          GAO/HRD-9042 Railroad Retirement Board Controls
       *
~---
               B-239100




               year 1988.’ In addition, from October 1987 through September 1989, the
               Board’s OIG obtained 95 criminal convictions for fraudulent unemploy-
               ment-sickness benefits amounting to $383,300. OIG also has under inves-
               tigation 842 cases for benefits of about $3 million.

               The Board has internal controls in place to deter fraud and payment
               error and, on the basis of a 1985 GAO review,” has strengthened its inter-
               nal controls by implementing new procedures. Even with these improve-
               ments, however, gaps exist in controls for processing benefits and in
               computer operations that may permit fraud and payment error to go
               undetected. Appendix II contains the details of our assessment of the
               unemployment-sickness benefits program, steps taken by the Board to
               improve controls, and the problems we identified (see p. 12). Specifically,
               we found the following:

           l There is no assurance that the people filling out the physician certifi-
             cates, required to obtain sickness benefits, are the applicants’ physi-
             cians. Applicants, rather than physicians, submit the certificates to the
             Board. This presents an opportunity for an applicant to falsify this cer-
             tificate and obtain fraudulent benefits. Three studies-a 1978 Board
             internal audit, an independent consulting firm study, and our 1985
             review-pointed     out the potential for submitting fraudulent certificates
             to obtain sickness benefits. The studies recommended establishing addi-
             tional controls, such as checking lists of physicians’ tax identification
             numbers against certificates, but these controls have not been imple-
             mented. The potential for falsifying physician certificates would be min-
             imized if the Board had direct contact with physicians (see p. 14).
           . Documents used to enter data into the computer are not adequately con-
             trolled. Computer personnel estimate the number of documents to be
             processed and do not reconcile discrepancies between the estimates and
             the actual number of documents processed. In addition, original docu-
             ments are sent to outside contractors for keypunching, but duplicates of
             these documents are not maintained to (1) prevent unauthorized
             changes or (2) permit reconstruction because of document loss or dam-
             age. Finally, GAO guidance for evaluating internal controls in computer
             operations states that input data should be combined by type (batch),:’
             with a count and predetermined control totals of input data to deter

               ‘A benefit year runs from My 1 through .June30.

               “Need to Improve Internal Controls to Curtail Possible Fraud and Abuse in the Railroad Retirement
               Hoard’s
               __.
               “ISvaluating Internal Controls in Computer Based Systems, Audit Guide (.June 1981).



               Page 3                                      GAO/HRD-90-42 Railroad Retirement Board Controls
    B-239100




  potential fraud4-caused by added, lost, or changed source documents
  (see p. 13).
l The Board’s computer documentation indicated that incorrect and unau-
  thorized software programs have been used to process benefits. GAO gui-
  dance for evaluating controls and the Board’s own procedures require
  (1) careful testing and safeguarding of computer software programs to
  prevent unauthorized and potentially incorrect computer programs from
  being used for actual processing and (2) that any software changes have
  proper authorization by a responsible official and a record be kept
  (see p, 15).
. The Board’s security for the computer center is inadequate. During our
  visit, the doors to both the central computer room and the tape library
  were standing open “due to air conditioning problems.” GAO guidance for
  evaluating internal controls states that computers, information, and
  data should be protected against theft, loss, unauthorized manipulation,
  fraudulent activities, and natural disasters. The Board’s security does
  not, however, assure this protection. In addition, the location of the com-
  puter facility above the cafeteria increases the risk from fire (see p. 16).
. The Board’s policy is to investigate the background of all computer
  employees, but we found employees who had not been investigated. For
  example, top-ranked computer officials who have worked at the Board
  for many years, including the chief of computer services, had not
  received background checks. Standards require screening all computer
  personnel before they are hired to (1) assure their integrity and (2)
  guard against fraud and sabotage in federal data processing.” In addi-
  tion, Board employees who certify computer tapes for payment, which
  averages about $500,000 a day, had not received background checks
  (see p. 16).
. Board personnel do not manually verify whether claimants are working
  (they are not eligible for benefits if so), and computer generation of
  potential wage-reporting violations takes months to resolve. The Board
  has established manual and computerized procedures to match wage
  data with records of railroad and state employment offices to see if
  claimants have earnings that were not reported to the Board. In benefit
  year 1988, approximately 70 percent ($700,000 from $1 million) of pay-
  ment error and over 90 percent of fraud were a result of these proce-
  dures (see p. 17).

    “A control total is the sum of all values of a variable that appears on documents in a group. It is
    calculated before the batch is read into the computer for later comparison with an analogous total
    calculated by the computer.
    “Federal Information Processing Standards Publication 73, Guidelines for Security of Computer
    Applications.



    Page 4                                       GAO/HRD-99-42 Railroad Retirement Board Controls
.                     B-299100




                  . Board claims examiners process transactions for benefit payments and
                    also enter them directly into computerized claims-processing, without
                    earlier approval or authorization of supervisory personnel. These activi-
                    ties are not separated, as called for by GAO standards for internal con-
                    trols in the federal government6 Those standards require separating key
                    duties and responsibilities in authorizing and processing transactions,
                    Such separation is an essential internal control in reducing the possibil-
                    ity of fraud and payment errors. Under the Board’s process, an
                    employee could authorize and receive fraudulent payments without
                    being discovered (see p. 19).


                      The Board has significant internal controls in place to deter fraud and
Conclusions and       payment error and has detected such occurrences in the past. Some gaps
Recommendations       exist, however, in separation of duties, control over computer docu-
                      ments, verification of physician certificates, wage matches, controls
                      over computer software, computer center security, and security checks
                      of computer personnel. The Board should improve its internal controls
                      in these areas to (1) deter those with knowledge of benefit processing
                      and computer operations from introducing fraudulent transactions, (2)
                      reduce payment error, and (3) reduce administrative costs in correcting
                      fraud and payment error.

                      We recommend that the Chairman of the Railroad Retirement Board do
                      the following:

                  . Alter procedures to ensure adequate separation of claims-processing and
                    payment authorization activities.
                  . Provide better control for documents used to enter data so the docu-
                    ments cannot be lost or manipulated.
                  l Strengthen controls to ensure that only properly authorized computer
                    programs are used, the computer center is secure, and all computer per-
                    sonnel receive background security checks.
                  l Improve control for validity of physician certificates of sickness by
                    implementing our earlier recommendation that physicians (1) provide
                    their tax identification numbers with the certificates and (2) deal
                    directly with the Board rather than through claimants.
                  . Increase (1) the priority for resolving discrepancies disclosed by com-
                    puter matches of benefit payments with state employment records and
                    (2) the number of manual matches in states in which computer match

                      “Accounting Series, Standards for Internal Controls in the Federal Government, United States General
                      Accounting Office (1983).



                      Page 6                                      GAO/HRD9O-42 Railroad Retirement Board Cbntrola
-
                  B-239100




                  agreements have not been negotiated. A cost-benefit analysis should be
                  carried out, however, to assure that the benefits derived exceed the
                  costs incurred.

                  Our review of fraud and payment error in the unemployment-sickness
                  benefits program did not reveal deficiencies that require changes in leg-
                  islation to reduce losses.


                  The Board, in its written comments, generally concurred with our rec-
Agency Comments   ommendations and described the actions planned or already taken to
                  implement them. Concerning our recommendation about the validity of
                  physician certificates, the Board does not plan to alter procedures to
                  require that physicians submit medical statements directly to it. The
                  Board plans to develop alternative procedures, however, that it believes
                  will achieve the result intended by our recommendation. The Board will
                  determine the best method to incorporate, in claims-processing routines,
                  an increased level of direct communication with physicians (see app. V).


                  We are sending copies of this report to the Chairman of the Railroad
                  Retirement Board and other interested congressional committees. Other
                  interested parties will be sent copies on request.

                  Please call me on (202) 275-1655 if you or your staffs have any ques-
                  tions about this report. Other major contributors are listed in
                  appendix VI.




                  Linda G. Morra
                  Director, Intergovernmental
                     and Management Issues




                  Page B                          GAO/HRD-9042 Railroad Retirement Board Controls
Page 7   GAO/HRD-9042 Railroad Retirement Board Controls
Contents


Letter                                                                                                          1

Appendix I                                                                                                     10
Ob,jectives, Scope, and
Methodology
Appendix II                                                                                                    12
GAO’S     Assessment        of   Defining Internal Controls                                                    12
                                 Internal Controls for Computer Input Data Inadequate                          13
the Internal Controls            Internal Controls for Physicians’ Certificates Inadequate                     14
for the                          Internal Controls for Computer Programs and Security                          15
Unemployment-                         Inadequate
                                 Postpayment Verifications Inadequate                                          17
Sickness Benefits                Benefit-Processing Duties Not Separated                                       19
Program                          Agency Comments                                                               20

Appendix III                                                                                                   22
Employee Eligibility
for Benefits
Appendix IV                                                                                                    24
                                 Earlier Evaluation of the Board’s Program                                     24
IProcessing    Procedures        Key Org&Ldtiondl Controls                                                     25
and Internal Controls               ’ ’ -’ Insurance
                                 Iincmployment      ’       Benefit Processing at District                     27
                                      Offices
                                 Sickness Insurance Benefit Processing at Board                                30
                                      IIeadquarters
                                 Computer Processing                                                          33
                                 Postpayment Checks                                                           36

Appendix V                                                                                                     38
Comments From the
Railroad Retirement
Board
           Y



                                 Page 8                           GAO/HRD-9042 Railroad Retirement Board Controls
                        Contents




Appendix VI                                                                                          45
Major Contributors to
This Report
Figures                 Figure IV. 1: Key Organizational Controls for Paying                         26
                             Benefits
                        Figure IV.2 Processing of Unemployment Insurance                             29
                             Benefits
                        Figure IV.3: Processing of Sickness Insurance Benefits                       32




                        Abbreviations

                                   Bureau of Compensation and Certification
                                   Bureau of Data Processing
                                   Bureau of Fiscal Operations
                                   Bureau of Field Services
                                   Bureau of Unemployment and Sickness Insurance
                                   estimated end of inability
                                   Federal Managers’ Financial Integrity Act
                                   General Accounting Office
                                   optical character reader
                                   Office of Inspector General
                                   Railroad Retirement Board
                                   Railroad Unemployment Insurance Act
                                   Railroad Unemployment Claims System
                                   Service & Compensation of Railroad Employees


                        Page 9                          GAO/HRD-9042 Railroad Retirement Hoard Controls
Appendix I

Objectives, Scope,and Methodology


_--_-----
                  Section 7107 of the Railroad Unemployment Insurance and Retirement
                  Improvement Act of 1988 states that our report is to include

              l estimates of rates and amounts of annual losses because of fraud and
                payment error,
              l comparisons of such rates with rates of loss in similar federal programs,
              . recommendations for legislation to reduce the losses resulting from
                fraud and payment error, and
              . such other matters relating to fraud and payment error as the Comptrol-
                ler General determines are appropriate.

                  Assessing the extent of fraud in any program is difficult. If fraud is dis-
                  covered, the program deficiencies permitting the fraud must be cor-
                  rected to prevent further losses. The amount of fraud uncovered,
                  however, is not necessarily indicative of how much may yet exist. The
                  federal government has passed several laws (see p. 2) to ensure that
                  programs are designed and administered in ways that minimize the
                  opportunity for, and thus the amount of, fraud.

                  Considering how difficult it is to determine how much fraud there is in a
                  program, GAO discussed the intent of the act with staffs of the congres-
                  sional committees responsible for the unemployment-sickness benefits
                  program. They agreed that the most effective way to achieve the act’s
                  intent would be to review the program’s internal controls for safeguard-
                  ing against fraud and payment error.

                  To assess the Board’s internal controls, we (1) reviewed the program’s
                  legislative history; (2) assessed benefit eligibility criteria in relation to
                  the law; (3) reviewed earlier studies made by the Board, its internal
                  audit organizations, and GAO; (4) studied the Board’s organizational
                  structure; (5) interviewed Board officials; (6) reviewed program policies,
                  procedures, and management reports; (7) reviewed changes in regula-
                  tions proposed by the Board; (8) identified internal controls in place; (9)
                  observed program operations at the Board’s headquarters and five dis-
                  trict offices; (10) reviewed claim files; (11) verified the correctness of a
                  random sample of transactions by tracing them through the unemploy-
                  ment-sickness claims-processing system; (12) analyzed computer reports
                  of processing problems, as well as fraud and payment error; and (13)
                  reviewed cases closed by the Board’s Office of Inspector General (OIG).

                  We also reviewed internal controls for the computer system and ana-
                  lyzed two new computer systems that were being implemented at the
                  time of our review. Our assessment of computer programs was limited to


                  Page 10                           GAO/HRD-SO-42 Railroad Retirement Board Controls
Appendix I
Objectives, Scope, and Methodology




reviewing the documentation for these programs; we did not develop or
run test transactions through the computer systems.

Our work was done at the Board’s headquarters in Chicago and at dis-
trict offices in Baltimore, Joliet (Ill.), Milwaukee, New Orleans, and West
Covina (Calif.)-one in each of the Board’s five regions.




Page 11                              GAO/HRD-9042 Railroad Retirement Board Controls
Appendix II

GAO’s Assessmentof the Internal Controls for
the Unemployment-Skkness Benefits Program

                    The Board has extensive internal controls that identified approximately
                    $1 million in fraud and payment error during benefit year 1988.1 In
                    addition, from October 1987 through September 1989, the Board’s OIG
                    obtained 95 criminal convictions for fraud covering $383,300 in unem-
                    ployment-sickness benefits. The Board strengthened its internal controls
                    on the basis of a 1985 GAO review, and the Board is implementing new
                    procedures that will further strengthen them. Gaps still exist, however,
                    in controls for computer operations and benefits processing, which may
                    permit fraud and payment error to go undetected.


                    The Board’s internal controls consist of review and approval steps.
Defining Internal   These take place in district and headquarters offices; the steps are
Controls            designed to ensure that personnel correctly handle manually processed
                    documents and identify discrepancies. In addition, there are computer
                    controls that verify information being processed electronically. A princi-
                    pal control to determine if claimants are working is the Board’s postpay-
                    ment checking of employment data at state employment offices.
                    Claimants cannot work and receive benefits. This control identified
                    about 70 percent of the approximately $1 million in fraud and payment
                    error for benefit year 1988. Appendix IV describes current internal con-
                    trols in detail (see p. 24)

                    Internal controls also consist of separation of processing duties. The
                    duties of the Board’s five bureaus reflect such a separation. These
                    bureaus include the Bureau of Field Services (BFS), the Bureau of Data
                    Processing (BDP), the Bureau of Compensation and Certification (BCC),
                    the Bureau of Unemployment and Sickness Insurance (BUSI), and the
                    Bureau of Fiscal Operations (BFO). (See fig. IV.1, p. 26, for key organiza-
                    tional controls for paying benefits.)

                    The Board has strengthened several of its internal controls. For exam-
                    ple, employers were notified only when former employees initially sub-
                    mitted applications for unemployment benefits. Beginning in 1990, the
                    Board must notify each railroad employer of every claim for benefits
                    that an unemployed worker submits. The reason for the new notification
                    system is that employers’ tax rates will be affected by the volume of
                    benefits paid. This will enable employers to challenge claims for benefits
                    by former employees who may not be entitled to them, The application
                    and claim process is discussed in appendix IV.


                    ‘A benefit year runs from July 1 through June 30.



                    Page 12                                    GAO/HRD-9042 Railroad Retirement Board Controla
    .


                        Appendix    II
                        GAO’s Assessment of the Internal Controls
                        for the UnemploymentSickness
                        Benefits Program




                        The Board’s internal controls for documents that are used to enter data
Internal Controls for   into the computer are inadequate. GAO guidance for evaluating internal
Computer Input Data     controls in computer operations requires combining (batching) data by
Inadequate              type,z with record counts and predetermined control totals, to assure
                        that documents are not added, lost, or manipulated.3 This was not being
                        done.

                        When we began our review, all unemployment benefit transactions from
                        the district offices and sickness insurance transactions processed in
                        headquarters were sent to a batch control unit. There personnel
                        counted, logged, and hand-carried the transactions to the computer
                        center. Personnel there did not make copies of the individual documents
                        in the batches; the only identifiers for the batches were the (1) Social
                        Security numbers on the first and last documents and (2) number of doc-
                        uments in each batch. There were no predetermined control totals.

                        We found that the number of documents actually processed by the com-
                        puter did not always agree with the original batch count. This occurred
                        frequently, according to the computer operators, but they did not recon-
                        cile discrepancies of plus or minus five documents.

                        When the computer rejects transactions, it notifies claims examiners to
                        take action. Claims examiners correct these rejected transactions, called
                        referrals, by preparing new documents that the examiners also batch
                        and introduce into the computer. In tracing referrals, however, we found
                        that the examiners did not have valid batch counts. They estimated,
                        rather than counted, the documents because counting equipment did not
                        operate accurately. In addition, during the rush to get documents to data
                        processing at scheduled times, we observed extra documents being
                        inserted into the estimated batches.

                        Accepting tolerance levels (for example, plus or minus five) and esti-
                        mates defeats the batching of data, which is to assure that transactions
                        have not been altered. No official policy, Board officials stated, permit-
                        ted tolerance levels or estimates; the officials agreed to correct this defi-
                        ciency. Personnel are now reviewing all batched documents, the Board
                        said in comments on our draft report, to ensure the accuracy of batch-
                        ing. The Board also agreed to reconcile discrepancies on a sample basis.


                        “Evaluating Internal Controls in Computer Based Systems Audit Guide (June 1981).

                        “A control total is the total value of a variable in a batch. It is calculated before the batch is read into
                        the computer for later comparison with a total calculated by the computer.



                        Page 13                                         GAO/HRD-90-42 Railroad Retirement Board Controls
       ----.-----                                                                                                           ,
                        Appendix II
                        GAO’s Assessment of the Internal Controls
                        for the Unemployment8ickness
                        Benefits Program




                        The Board cannot reconstruct a lost or damaged batch, a particularly
                        significant problem for batches sent to outside contractors for
                        keypunching. Board personnel do not prepare a record of the individual
                        items in the batch; only the count is known. No resources are available,
                        Board officials said, to copy every document sent out for keypunching;
                        to date, however, no batches have been lost. In addition, prompt
                        processing is the primary concern -that is, getting the money to unem-
                        ployed workers- and copying would delay processing. Two new data
                        entry systems, the Railroad Unemployment Claims System (IttJCS) and
                        Key/Master, officials also pointed out, will significantly reduce the num-
                        ber of documents that must be batched; information will be transmitted
                        through computer terminals from remote sites.

                        Although WCS and Key/Master will reduce the volume of paper docu-
                        ments to be batched and keypunched, they will not totally eliminate
                        batching. Various sickness benefit transactions will still be batched. The
                        Board said, in comments on our draft report, that staff will (1) photo-
                        copy a random selection of batched documents before release to the
                        outside contractor and (2) compare the copies with the keyed documents
                        when they are returned.


                        An applicant for sickness benefits must submit a physician’s certifi-
Internal Controls for   cate-a card with the physician’s name, address, signature, and diagno-
Physicians’             sis. The applicant generally sends the certificate to the Board. Earlier
Certificates            Board studies, as far back as 1978, and a 1985 GAO report pointed out
                        the potential for submitting fraudulent certificates-because    anyone
Inadequate              can fill out these certificates-and  recommended additional contro1s,4
                        such as requiring the physician to provide his or her tax identification
                        number. Claimants have attempted, Board claims examiners said, to
                        submit fraudulent certificates. Examiners identify such certificates by
                        (1) comparing the handwriting on the application and on the certificate
                        and (2) recognizing the use of lay, rather than medical, terminology in
                        the diagnosis.

                        The Board has acknowledged the problem and, Board officials said, it
                        will start using tax identification numbers for physicians late in 1990.
                        The Board intends to obtain physician identification numbers from the
                        Travelers Insurance Company, which administers Medicare payments
                        for railroad retirement beneficiaries. The Board will incorporate the

                        “Need to Improve Internal Controls to Curtail Possible Fraud and Abuse in the Railroad Retirement
                        Hoard’s IJnemployment and Sickness Insurance Program (GAO/HRD-853’/, Feb. 27, 1986).



                        Page 14                                     GAO/HRD-90-42 Railroad Retirement Board Controls
                            Appendix II
                            GAO’s Assessment of the Internal   Controls
                            for the UnemploymentSicknese
                            Benefits Program




                            numbers into a data base and compare those on the certificate with
                            those in the data base. Using tax identifier numbers offers an additional
                            opportunity for internal control. These identifiers would let the Board
                            analyze certificates to determine if any physicians are submitting large
                            numbers; the Board could then investigate those cases for potential
                            fraud,

                            We believe relying only on tax identifier numbers may be inadequate.
                            Since applicants obtain and submit certificates themselves, they could
                            learn the physician tax identifiers. Direct communication between the
                            Board and the physician would be preferable. Physicians could send the
                            certificates directly to the Board in Board-supplied envelopes, and the
                            Board could contact the physician for any subsequent certificates, for
                            example, if the applicant is still sick at the expiration of the original
                            period of sickness. The implementation of such a procedure is not specif-
                            ically addressed in the Board’s response to our draft report. The Board
                            has, however, initiated a special study of the unemployment-sickness
                            benefits program to evaluate current operations and procedures. This
                            special study is scheduled to be completed in July 1990.


                            To prevent unauthorized and potentially incorrect computer programs
Internal Controls for       from being used to produce payments, GAO guidance for evaluating
Computer Programs           internal controls and the Board’s procedures require these programs to
and Security                be tested and safeguarded. We reviewed 124 programs used daily by
                            Board computer personnel. The program documentation showed these
Inadequate                  problems: 1 program was not properly authorized for use; 3 had logic
                            statements missing; and 14 contained other logic problems. All of these
                            problems may have involved poor documentation rather than incorrect
                            programs. The missing logic statements, however, indicate that the cal-
                            culations used for benefit payments could be affected.

                            Hoard officials should have been able to give us documentation of com-
                            puter test runs showing that the errors were corrected. But they were
                            unable to do so.

                            The Board uses three computer program inventories, each maintained
                            by a different group, in the operation of its programs. We found differ-
                            ences in the data of these inventories, even though they should be the
                            same, for example:

                        l   Four programs in use were not indicated on two of the inventories.



                            Page 16                                       GAO/HRD-90-42 Railroad Retirement Board Controls
                               Appendix II                                                                                   I
                               GAO’s Assessment of the Internal Controls
                               for the Unemployment-Sickness
                               Benefits Program




.-- ___.-.
       - -...- _.._..--_
                      --
                           . Five programs with different dates reflected changes made to the pro-
                             grams, but the dates on the inventories did not agree with the dates for
                             the programs.
                           . Three programs labeled obsolete on one inventory should have been so
                             labeled on the other inventories.
                           l Eight programs on one inventory were not on the other inventories.

                               We also found that the security for the computer center is inadequate. It
                               is located above the cafeteria, thereby increasing fire risk. In addition,
                               the security officer for data processing was not directly included in
                               planning HIJCS, which permits direct input of applications and claims
                               from remote computer terminals. The security officer was not, there-
                               fore, protecting against unauthorized access to the computer so as to
                               prevent fraud or payment error.

                               Since virtually all the internal controls depend on properly functioning
                               computer programs, correct and properly authorized programs are cen-
                               tral to accurate payments. In addition, inadequate controls for access to
                               the computer tape library could result in unauthorized access to, or use
                               of, computer programs and data. This increases opportunities for fraud
                               and the likelihood of payment error.

                               Federal data-processing standards require screening computer personnel
                               before hiring them.” Although the Board has a policy of investigating its
                               computer personnel, top-ranked officials- including the chief of com-
                               puter services, who had been employed for many years-had not been
                               investigated. The lack of investigations, a Board official said, was
                               because of (1) the high cost of in-depth background checks by the Office
                               of Personnel Management and (2) the number of such checks required in
                               recent years for new hires and newly promoted employees. The Board
                               said, in response to our draft report, it will make a concerted effort in
                               fiscal year 1990 to complete investigations for senior computer
                               personnel.

                               In addition, we found that Board staff who certify benefit payments-
                               currently averaging about $500,000 a day-had never been investi-
                               gated. Although we saw no evidence of wrongdoing, the lack of investi-
                               gations is a serious omission because the staff are in a significant
                               position of trust,


                               “Fcdcral Information Processing Standards Publication 73, Guidance for Security of Computer
                               Applications.



                               Page 16                                    GAO/HRD-90-42 Railroad Retirement Board Controls
--
                Appendix II
                GAO’s Assessment of the Internal Controls
                for the Unemployment-Sickness
                JSeneflts Program




                Claimants for unemployment-sickness benefits are not eligible for bene-
Postpayment     fits if they are working. The Board, therefore, does computerized and
Verifications   manual postpayment verifications to discourage false claims and detect
Inadequate      employed claimants. Three major railroads supply the Board with com-
                puterized wage data to match against benefit records. Another major
                railroad has given district office employees authorization for access to
                wage records of train and engine crews. The Board does computer
                matches of their records with state employment records; currently, the
                Board has contracts for computer matching of records with nine states
                and is negotiating for matching with three additional ones.

                District offices periodically make manual matches of beneficiary records
                against wage data at railroad payroll offices. In those states that do not
                have computer-matching agreements with the Board, periodic manual
                matches of beneficiary records are also made with state employment
                records.

                Investigating potential violations by matching railroad and state wage
                records, however, is time-consuming. Wage data reported by nonrailroad
                employers to state employment offices is accumulated into 3-month
                periods. Railroad employees, however, can be entitled to benefits for 1
                day of unemployment. If railroad unemployment benefits are paid dur-
                ing the same period as wages or state employment benefits, the Board
                must ask each nonrailroad employer or state to determine the specific
                dates for which the beneficiary received nonrailroad compensation. The
                Board depends on the cooperation of the state employment agencies and
                the nonrailroad employers for this information and, often, encounters
                significant delays.

                Our visits to district offices revealed few manual matches of railroad
                wage data against beneficiary records. Aside from the problem of delays
                cited above, wage data may not be easily accessible to the district
                offices. In addition, district offices do not use direct computer access to
                the payroll data, even when that is possible. For example, in two of the
                district offices we visited, the access codes to the railroad computer sys-
                tem had expired because of not being used.

                We also found that the district offices made little attempt at nonrailroad
                postpayment verification: they did (1) few manual matches of wage
                data against the records of state employment offices and (2) no follow-
                up on the delayed responses to requests for both manual and computer-
                ized wage matches. For example, in 3 years, one district office had
                requested a state employment agency to make only three manual wage


                Page 17                                 GAO/HRD-9042 Railroad Retirement Board Controls
Appendlx II
GAO’s Assessment of the Internal Controls
for the UnemploymentSickness
Benefits Program




matches for 5 to 7 percent of beneficiaries. Board headquarters had
asked another district office to investigate 11 matches of computerized
state wage data in August 1988. Of these 11,6 were over 8 months old
and unresolved when we visited. The district offices attributed the lim-
ited wage match efforts to insufficient staff. The Board said in response
to our draft report, however, that for matches of state wage data, gui-
dance would be issued to all field service offices by March 31, 1990,
concerning the (1) number of wage match efforts and (2) prescribed
time periods for completing these matches.

There is also inadequate separation of duties in the postpayment verifi-
cation procedures. The same staff that process the original unemploy-
ment applications and claims do the manual matches. These staff could
simply ignore a case for wage matches if a fraudulent benefit had been
introduced into the system. Similarly, although computer matches elimi-
nate judgment in selecting wage match cases, potential overpayments
disclosed by computer matches are returned to the same staff that
processed the original claims. In contrast, overpayment cases for sick-
ness payments, discovered in computer matches, are turned over to a
quality-assurance unit for resolution. This unit, not the claims examin-
ers, is responsible for recovery actions. In this instance, duties are ade-
quately separated.

The detection of unreported wages is an important internal control and
a major deterrent to fraud. In benefit year 1988, about 70 percent of the
Board’s payment error, $700,000 of the $1 million, and over 90 percent
of the OIG fraud cases and convictions resulted from unreported
nonrailroad wages. These results were achieved even though our review
indicated that (1) field offices did few manual wage checks and (2) com-
puterized wage checks were not resolved promptly. Board officials told
us that they planned to conduct a cost-benefit analysis of computer
matching. They believe the benefits will exceed the costs, especially
when considering that the existence of computer matching is a deterrent
to those who claim unemployment benefits while working.

As a result of our 1985 review, the Board, in order to detect possible
fraud, tested cases in which multiple benefits were being sent to the
same address. The Board also matched its own employee wage data
against benefit records to determine if fraudulent benefits were sent to
Board employees. The Board only did these tests once, however, about
5 years ago. Although these tests did not disclose fraudulent benefits,
they should be done more often as a deterrent.



Page 18                                 GAO/HRD-9042 Railroad Retirement Board Controls
                           GAO’s Assessment of the Internal Controls
                           for the Unemployment-Sickness
                           Beneflts Program




                           GAO standards for internal controls in the federal government require
Benefit-Processing         separate authorization for transactions and processing. To do this for
Duties Not Separated       thousands of small payments is prohibitively expensive. Therefore, GAO
                           guidance permits sampling of payments amounting to less than $1,000.
                           When staff duties are not separated, internal controls must compensate
                           for the lack of separation, Unemployment transactions processed by the
                           Board’s district offices and sickness transactions processed by head-
                           quarters, however, are forwarded directly to computer processing.
                           Under RUCSand Key/Master, Board officials said, claims examiners at
                           remote computer terminals without supervisory review will enter docu-
                           ments directly into the computer-processing system.

                           We discussed this lack of separation of duties with Board operating offi-
                           cials. They acknowledged the problem, but believe that compensating
                           internal controls ensure the program’s integrity. A review of every
                           transaction, they asserted, is unwarranted; they cited such compensat-
                           ing controls as

                       . valid wage records on file for comparing with applications to determine
                         eligibility for benefits,
                       . the need for a valid application before claims can be processed,
                       l controls over changes of address, and
                       . postpayment wage matches.

                           Staff reviewing a transaction, the officials also pointed out, would have
                           no more information for making a judgment than the original claims
                           processor (see app. IV for further detail). Our review suggests, however,
                           that a staff member who understood the Board’s internal controls could
                           circumvent them. In doing claims processing, Board staff have access to
                           records that show whether (1) a valid wage record exists and (2) a rail-
                           road employee is working or collecting benefits. With this information, a
                           staff member could submit a fraudulent application that would match
                           against a valid wage record, thereby permitting receipt of fraudulent
                           benefits.

                           The Board notifies the applicant’s current and base-year employers for
                           each unemployment application received.” But a railroad employer’s
                           questioning of an application is returned to the district office and then
                           handled by the same staff member who originally processed the applica-
                           tion. This offers an opportunity for that person to ignore the employer’s

                           “The base year is the calendar year preceding the benefit year, which extends from July 1 through
                           June 30. Thus, calendar year 1987 was the base year for the benefit year beginning July 1,1988.



                           Page 19                                     GAO/HRD-9042 Railroad Retirement Board Controls
                  Appendix II                                                                           ,
                  GAO’s Assessment of the Internal Controls
                  for the Unemployment-Sickness
                  Benefits Program




                  challenge. A similar deficiency exists in postpayment verification, as
                  discussed on p. 18. The same field staff who make wage matches or fol-
                  low up on them also process unemployment transactions. Likewise, the
                  same staff who processed the original application handle any data from
                  nonrailroad employers. Again, this provides an opportunity for ignoring
                  the employer’s challenge.

                  Sickness benefits are handled differently. The Bureau of Unemployment
                  and Sickness Insurance’s (BLJSI) quality-assurance unit receives employer
                  challenges, investigates them, and takes corrective actions. Responsibili-
                  ties for sickness benefits are adequately separated.

                  Supervisory staff periodically review a judgmental sample of unemploy-
                  ment and sickness insurance transactions to evaluate how well the staff
                  are doing. In addition, daily, a BUS1 quality-assurance unit selects sick-
                  ness transactions for examination.

                  We sampled 10 percent of both unemployment and sickness benefits for
                   1 day-241 transactions -and traced them through the benefit-process-
                  ing system. We found no discrepancies in the sample transactions. The
                  Board, however, inadequately separates duties for processing benefit
                  payments, and the internal controls in place do not adequately protect
                  against fraud. In addition, although the Board does a quality-assurance
                  review of some sickness transactions, it does not review unemployment
                  transactions,

                  The Board should assure the validity of unemployment and sickness
                  benefits through adequate separation of duties. Authorization of every
                  unemployment and sickness application or claim would be a significant
                  burden on the Board’s resources, but few additional resources would be
                  required if the Board would do statistically sound, quality-assurance
                  sampling of unemployment benefits as well as sickness benefits; this
                  would also provide statistically sound data on performance errors for
                  management reporting. The staff member who originally processes the
                  application or claim should not also resolve employer challenges,


                  The Board, in its written comments, generally concurred with our rec-
Agency Comments   ommendations Its comments are included in appendix V.

                  To ensure adequate separation of claims processing and payment
                  authorization, the Board will develop procedures, following GAO gui-
                  dance. The Hoard will do quality assurance reviews, using a statistically


                  Page 20                                 GAO/HRD-90-42 Railroad Retirement Board Controls
Appendix II
GAO’s Assessment of the Internal Controls
for the Unemployment-Sicknees
Benefits Program




valid sampling technique, for samples of both unemployment and sick-
ness transactions. The Board will establish procedures requiring sepa-
rate authorization for all payments over $1,000 resulting from multiple
claims paid on the same day.

Concerning better control over documents used to enter data into the
computers, the Board will review all batched documents to ensure
(1) they are combined by type and (2) accurate record counts are
obtained. In addition, the Board will reconcile discrepancies on a sample
basis.

For control over computer programs, the computer center, and computer
personnel, the Board will install a computer software package that will
ensure that only authorized staff have access to programs. Contract per-
sonnel will tour the computer center daily to check on security, and
Board staff working in sensitive areas will have background checks.

We recommended that physicians submit their tax identification num-
bers with sickness certificates directly to the Board rather than through
claimants. The Board plans, it said, to develop alternative procedures
that it believes will achieve the result intended by our recommendation.
The Board expressed concern that direct communication with physi-
cians would remove the claimants from the process, perhaps resulting in
delayed benefit payments. The Board will determine, by December 31,
1990, how best to incorporate an increased level of direct communica-
tion between the Board and physicians into its claims-processing rou-
tines. Although delays in receiving benefits may occur, we believe that
direct communication between physicians and the Board is the best
method to prevent payment of fraudulent benefits.

The Board will issue guidance to all field offices concerning increasing
(1) the priority for resolving discrepancies disclosed by computer
matches and (2) the number of matches in states where computer
matches are not possible. The guidance will include the prescribed time
periods for investigating information obtained from state programs for
wage matching. In addition, Board regional directors will be requested to
review the status of manual wage matching and make arrangements to
conduct such matches when computer-matching programs do not exist.




Page 21                                 GAO/HRD-9042 Railroad Retirement Board Controls
Appendix III   _

Employee Eligibility for Benefits                                                                                       .


--.------
                   The Railroad Unemployment Insurance Act (RLJIA) provides benefits to
                   replace part of the railroad wages lost because of unemployment or sick-
                   ness (including illness resulting from maternity). To receive benefits, an
                   employee must be both “qualified” and “eligible.” A qualified employee
                   is one who earns sufficient creditable compensation in a base year (see
                   fn. 6, p, 19), at least $1,775 in calendar year 1989, including no more
                   than $710 in any month.’

                   To be eligible for unemployment benefits, a qualified claimant must be
                   unemployed and both able and available to work. A day of unemploy-
                   ment is one in which the claimant meets these conditions and does not
                   receive any pay, is not disqualified, and is registered at a Board unem-
                   ployment office.

                   To be eligible for sickness benefits, a qualified claimant must be unable
                   to work because of illness or injury. A sick day is one on which the
                   claimant meets these conditions, does not receive any pay, and has filed
                   a statement of sickness. A physician’s certificate is required to receive
                   sickness benefits.

                   The unemployment-sickness benefits program pays 60 percent of the
                   claimant’s last daily wage in benefits. The minimum daily benefit is
                   $12.70 and the maximum is $31.00.2 Under current railroad wage rates,
                   most claimants receive the maximum daily benefit.

                   Normal benefits are paid up to 130 days. After 130 days, claimants with
                   10 to 14 years of railroad service can receive extended benefits for 65
                   additional days; claimants with at least 15 years of railroad service can
                   receive extended benefits for up to 130 days.

                   Claimants may be disqualified for fraudulent statements, receiving
                   other social insurance benefits (such as state unemployment insurance),
                   receiving separation allowances, voluntarily quitting without good
                   cause, or engaging in an illegal strike. An unemployment claimant may
                   also be disqualified for refusing to accept suitable work, failing to apply
                   for work, or not reporting to a Board office for an interview. A sickness


                   ’ In addition, a new employee must have worked in the railroad industry at least Fimonths of the first
                   year to draw benefits in the following year.

                   2The Gramm-Iiudman-Hollings Act mandates spending reductions in certain federal programs. The
                   Board will have to reduce biweekly unemployment and sickness benefits for fiscal year 1990 because
                   of this act.



                   Page 22                                      GAO/HRD-9042 Railroad Retirement Board Controls
                          Appendix III
                          Employee EllglbUlty for Benefits




.-.-_._-.---..-----
                          claimant may also be disqualified for not taking a medical examination
                          when required by the Board.




                      Y




                          Page 23                            GAO/HRD-9042 Railroad Retirement Board Controls
Appendix   IV

ProcessingProcedures and Internal Controls                                                                                   *


                        The Railroad Retirement Board has internal controls in place for the
                        unemployment-sickness benefits program. At district and headquarters
                        offices, the controls for manually processed documents consist of review
                        and approval. There are also computer controls that verify information
                        being processed.

                        Manual processing of applications and claims for unemployment are dif-
                        ferent from those for sickness. Computer processing at the Board’s
                        headquarters is generally the same for both types of benefits. Some pro-
                        cedures and internal controls were changed during our field work as a
                        result of the 1988 Railroad Unemployment Insurance and Retirement
                        Act and the implementation of two computer systems-the Railroad
                        IJnemployment Claims System (RIJCS) and Key/Master. Our review of
                        these two systems was limited to learning what they were meant to
                        accomplish because they were still being tested and not fully
                        operational.


                        In 1985, we issued a report on the Board and recommendations for
Earlier Evaluation of   improvement.’ The Board implemented four of our five recommenda-
the Board’s Program     tions It began (1) doing more checks to detect claimants who fail to
                        report nonrailroad employment while they are receiving unemployment
                        benefits, (2) notifying railroad employers immediately after applications
                        for benefits were filed, (3) verifying the authenticity of changes of
                        address, and (4) reviewing the reason why multiple checks were sent to
                        the same address. The Board has not, however, improved its procedures
                        for verifying the validity of physicians’ certificates.

                        In 1988, as part of its responsibility under the Federal Managers’ Finan-
                        cial Integrity Act (FMFIA), the Board classified 24 of its 123 operating
                        systems as being “highly vulnerable” to being unable to carry out their
                        objectives. A system is a collection of associated activities, policies, and
                        procedures that produce an end product, such as a benefit payment.
                        Included in these 24 systems were unemployment and sickness applica-
                        tions and claims processing, payment tape processing (computer tapes
                        sent to the Department of the Treasury, which generates benefit
                        checks), data entry, and computer operations.

                        The Board acknowledged significant weaknesses in internal controls
                        because of

                        ’ Need to Improve Internal Controls to Curtail Possible Fraud and Abuse in the Railroad Retirement
                        Ibard’s IJnemployment and Sickness Insurance Program (GAO/fIEFD-85-37, Feb. 27, 1985).



                        Page 24                                     GAO/HRD-90-42 Railroad Retirement Board Controls
                     Appendix IV
                     Processing Procedures and Internal Controla




                     the lack of controls for the accuracy of information that applicants and
                     physicians furnish to the Board in connection with payment of sickness
                     benefits;
                     the lack of controls for preventing loss, destruction, or alteration of
                     computer documents used to enter data when these documents are sent
                     to an outside contractor for keypunching; and
                     inadequate physical security in the computer center.

                     The Board’s internal auditors had not comprehensively reviewed the
                     program in recent years. The Board’s OIG, established in 1986, had
                     included a review of the program in its 1989 audit plan, but postponed
                     the review because of our review.


                     Separation of duties is a key internal control. The Board’s organizational
Key Organizational   structure is, therefore, a form of internal control since five of the
Controls             Board’s bureaus are separately involved in processing benefits. The
                     Bureau of Unemployment and Sickness Insurance (BIJSI) at Board head-
                     quarters has primary responsibility for the program-policies       and pro-
                     cedures, quality control, and resolution of problem applications and
                     claims. It receives and processes sickness applications and claims. The
                     Bureau of Field Services (BFS) receives and processes unemployment
                     applications and claims at district offices, resolves questionable items,
                     interviews beneficiaries, and makes postpayment matches of benefits
                     paid against railroad and state employment records. The Bureau of
                     Compensation and Certification (BCC) receives wage data and maintains
                     the master wage record, which determines eligibility. The Bureau of Fis-
                     cal Operations (REV) independently reconciles wage data reported to HCC
                     with the employer tax payments made on these wages to DFO.The
                     Bureau of Data Processing (BDP) carries out computer operations.

                     The Board’s key organizational controls concerned with unemployment
                     and sickness benefits are shown in figure IV.1.




                     Page 26                                 GAO/HRD-90-42 Railroad Retirement Board Controls
                                                             Appendix IV
                                                             Processing Procedures and Internal        Controls




 Figure W-1: Key Organizational               Controls for Paying Benefits

                                                                               The Rallroad
                                                                             Retirement Board




                                                                                      I                                                      1
                                                                                                                  L                                              L

                                                                      Bureau of Unemployment            &
              Bureau of Field Services                                                                                         Bureau of Data Processing
                                                                      Sickness Insurance

         Provides assistance to railroad                          Formulates policies for                                   Provides data processing
         employees in completing                                  processing unemployment      and                          support to all the Board’s
         applications,   receives and                             sickness claims, receives and                             bureaus
         processes unemployment                                   processes sickness applications
         claims, forwards program                                 and claims, resolves computer
         material for final processing,                           processing discrepancies,   and
         and conducts investigations                              directs programs to ensure the
         to ensure benefits are paid                              accuracy and integrity of benefit
         correctly                                                payments
I . ._                                                       I.




                                                        L                                      I-                     I
                                                                                                      Bureau of Compensation      and
                                           Bureau of Fiscal Operations
                                                                                                      Certification

                                    Directors the financial                                         Receives and maintains
                                    management of the Board,                                        compensation    records of
                                    collects RUIA contributions       from                          railroad employees and certifies
                                    employers, and verifies                                         to the Board’s bureaus the
                                    correctness  of contributions                                   accuracy of employee service
                                                                                                    records




                              Y




                                                             Page 26                                         GAO/HRD-9042 Raiioad Retirement        Board Controls
                             Appendix IV
                             Proce~ing Procedures and Internal Controls




                             To apply for unemployment benefits, the applicant completes a UI-1
Unemployment                 form, Application for Unemployment Benefits and Employment Service.
Insurance Benefit            This form, available from employers, labor organizations, and Board
Processing at District       offices, requests the applicant’s name, address, Social Security number,
                             date of birth, railroad employment, and reason for unemployment. The
Offices                      form must be received by the Board within 30 days of the first day for
                             which the applicant wishes to claim benefits. After the form has been
                             processed, the Board sends a computer-generated UI-3 form, Claim for
                             Unemployment Benefits, to the applicant. This form requests the claim-
                             ant’s name, Social Security number, and days not worked, including holi-
                             days. A claim must be filed for each 14-day period, beginning with the
                             first day of unemployment. The applications and claims, which must be
                             signed, are mailed directly to Board district offices, The Board also
                             sends the claimant computer-generated UI-3 forms for filing subsequent
                             claims.

                             On receipt of an application, the district office reviews it for complete-
                             ness, resolves any problem, and establishes a file on the applicant.
                             Claims examiners notify employers that they have an obligation to reim-
                             burse the Board if there is any indication that the applicant might sub-
                             sequently receive some kind of settlement from the employer covering
                             the period of unemployment for which Board benefits are to be paid.

                             Claims examiners at district offices evaluate claims for completeness
                             and allowable benefit days. An examiner can deny any days claimed if
                             there is an indication that the claimant

                         . was not available for work;
                         . received remuneration on the days not worked (that is, vacation or sev-
                           erance pay);
                         . registered too late for the days claimed (the definition of acceptable
                           delay varies with the cause);
                         l was a “voluntary quit” without good cause; or
                         l was a passenger, road, or yard service employee who exceeded limits on
                           the number of miles traveled or hours worked.

                             Examiners resolve questions concerning claims by calling the claimant
                             or the claimant’s employer. Some district offices have the capability to
                             check by computer the wage records of a major railroad employer to
                             determine if a claimant is working. With some exceptions, regulations
                             require that all claimants must be called into the district office for an
                             interview at least once a year and before the fourth claim period.



                             Page 27                                GAO/HRD-90-42 Railroad Retirement Board Controls
Appendix IV
Processing procedures and Internal Controls




Examiners in district offices then send all applications and claims to
Board headquarters. At the start of our review, they were sent by mail
to I~USI.It then sent “clean claims” directly to keypunching for entry into
BDP'S computer system. During our review, the Board installed a new
system, RUCS, that permits district offices to electronically enter unem-
ployment applications and claims into the headquarters computer. A
few transactions from the district offices require special handling by
headquarters claims examiners because of problems. After resolution,
the headquarters claims examiners also enter these problem cases into
the computer-processing system. The processing of unemployment bene-
fits is shown in figure IV.2.




Page 28                                  GAO/HRD-90-42 Railroad Retirement Board Controls
                                                   Appendix IV
                                                   Roceesing Procdures and Internal Controls




Figure IV.2: Processing of Unemployment Insurance Benefits




                                                                                                           BDP              Computer
                                                                                                                            Storage

        BUSI                                                                                                    Coded                  Clean
                                                                                                                Examiners
                                                                                                                                       Claims
                                                                                                                Action
1              Clean
               Claims




    I           Cards
                        I
                               OCR
                               Forms




                                                                                                                                                L
        BDP                                                                                                                      BCC
                                        Computer    Processing                                              4                          SCORE

    I-----                                 .                                                                                   1..     File




      Treasury          Paylist                                  BFO
                        Checks Mailed                                    Control   Voucher
                        to Claimants




                                                   Page 29                                   GAO/HRD-9042 Railroad Retirement Board Controls
                            Appendix IV
                            Processing Procedures and Internal Controls




                            We visited one district office in each of the Board’s five regions and
                            observed the application and claims-processing operations at each
                            office. We found that claims examiners were generally following Board
                            policies and procedures. A review of a random sample of 3 to 5 percent
                            of claim files for benefit year 1988 disclosed

                        l properly signed applications and claims;
                        . the required claimant personal interviews;
                        . actions taken on questionable items, such as claimants actively seeking
                          work; and
                        . proper responses to application notifications from railroad employers.


                            To apply for sickness benefits, the applicant files an application, which
Sickness Insurance          is a two-part form, SI-la Application for Sickness Benefits and SI-lb
Benefit Processing at       Statement of Sickness. District offices, railroads, and union offices dis-
Board Headquarters          tribute the forms. The SI-la form requests the applicant’s name,
                            address, Social Security number, date of birth, the date the applicant
                            became sick or was injured, the date he/she last worked, and any dates
                            the applicant does not wish to claim. The applicant applies as soon as
                            possible after onset of his/her sickness or injury, regardless of whether
                            he/she returned to work.

                            The applicant’s physician completes the SI-lb form. The main informa-
                            tion requested includes the date the applicant became sick or was
                            injured, the date of examination, the diagnosis and findings, and the
                            date the physician expects the applicant to return to work. The physi-
                            cian signs the SI-lb form, fills in his/her address, and the applicant
                            mails both the SI-la and SI-lb forms to Board headquarters. A sickness
                            application cannot be processed without a completed SI-lb form. The
                            Board’s district offices are not involved in sickness claims processing.

                            Claims examiners in BUSI review the SI-la and lb for completeness,
                            including a diagnosis and physician’s signature, and code them for com-
                            puter processing. One important element of information on the applica-
                            tion is the date the physician submits as the “estimated end of inability”
                            (EN), the date the applicant is expected to return to work. The claims
                            examiner can enter EEI or it can be left blank and EEIwill be determined
                            by computer, using Board-developed criteria.

                            The Board contacts beneficiaries as the           EEI   date approaches. If a benefi-
                            ciary is unable to return to work on the          EEI   date, he/she must obtain a



                            Page 30                                  GAO/HRD-90-42 Railroad Retirement Board Controls
Appendix Iv
Processing Procedures and Internal Controls




supplemental physician’s certificate, form SI-7, and submit it to the
Board.

If the beneficiary did not report returning to work on his/her applica-
tion, the Board mails a computer-generated form SI-3, Claim for Sickness
Benefits, to the applicant. The SI-3 requests the claimant’s name,
address, Social Security number, and the beginning and ending dates of
the S-week claim period, starting with the first date the claimant was off
from work. The claimant indicates on the claim whether he/she (1) is
reporting sickness for the entire 2-week period or (2) worked any inter-
vening dates or received other income or benefits for any of the days.
The claimant then mails the claim back to the Board where claims exam-
iners review it, code it for any dates not reported sick, and route clean
claims to keypunching for entry into the computer system. The com-
puter system then processes SI-la, lb, 3, and 7. The processing of sick-
ness benefits is shown in figure IV.3.




Page 31                                  GAO/HRD-9042 Railroad Retirement Board Controls
                                                  Appendix IV
                                                  Processing Procedures and Internal Controls




Figure IV.3: Processing of Sickness Insurance Benefits




                                             .
                                                                                                                    1’
                                                                                       Examiners                         Computer
                                                                                                                         Referrals
                           Clean                 Claims
                           Claims                                                             Instruction
                                                 Requiring                                    Cards,
                                                 Examiner                                     OCR Forms
                                                 Action




                                                                           BDP

                                      KeyPunchand
                                      Data Preparation                                  OCR
                                                                                        Scanner




BCC                        BDP
                                                             Computer
     SCORE File




                           Treasury                                        BFO

                                      Paylist                                      Control   Voucher
                                      Checks Mailed
                                      to Claimants




                                                 Page 32                                     GAO/HRD-90-42 Railroad Retirement Board Controls
                          Appendix N
                          processing Procedures and Internal Controls




                          At Board headquarters for 1 day, we observed applications and claims
                          processing for sickness benefits. Claims examiners generally followed
                          Board procedures for processing these transactions, For example, we
                          found

                      l   properly signed applications with physician certificates and
                      l   that examiners contacted applicants to resolve problems when applica-
                          tions were received without certificates or vice versa.

                          In addition, on the date of our observations, unit supervisors were
                          reviewing all transactions before releasing them for computer process-
                          ing. Supervisors periodically review transactions to assess staff
                          performance.

                          At BIJSI, the Board has a separate quality assurance unit that reviews
                          sickness transactions. Each day, before documents are transported to
                          the computer center, the unit selects at least five applications, claims,
                          and physicians’ supplemental certificates for each of BIJSI’S four claims-
                          processing units, a total of 60 transactions a day. To pinpoint training
                          needs to improve performance, the quality assurance unit examines the
                          transactions for errors. The claims-processing units make needed correc-
                          tions. For 1988, the error rates were 18 percent for applications and 6
                          percent for claims, No Board unit does similar quality assurance reviews
                          of unemployment transactions submitted by the field offices.


                          The Board has a batch-controlled computer-processing system. With
Computer Processing       batch controls, transactions of a similar nature are grouped; record
                          counts are made; and predetermined totals are computed to assure that
                          no documents are added, lost, or changed, and that all transactions are
                          processed. If transactions from a batch are not processed because of
                          some error, they are rejected and reintroduced after corrections have
                          been made.

                          District offices and headquarters send all applications and claims to a
                          batch control unit where they are counted, logged, and hand-carried to
                          the computer center. Computer personnel log in the batches, send pre-
                          punched cards directly to computer processing, and send the rest to
                          keypunching. Since the Board contracts for outside keypunching ser-
                          vice, messengers pick up the batches of documents for keypunching
                          each evening and return them the next evening for processing.




                          Page 33                                 GAO/HRD-9042 Railroad Retirement Board Controls
--                                                                                                       -
         Appendix IV
         Processing Procedures and Internal Controls




         HCCmaintains the Board’s master wage record, the file for the service
         and compensation of railroad employees (SCORE). BCC updates this file
         annually and corrects it periodically using compensation data supplied
         by railroad employers covered by RUIA. Initial computer processing of
         applications includes comparing them with SCOREto determine that for
         the base year, there is a valid wage record and sufficient creditable com-
         pensation.” This is the primary criterion for benefit eligibility. A “suc-
         cessful certification” results in establishing the applicant’s
         unemployment or sickness insurance master record. In addition, the
         Board notifies railroad employers-for       both the current and base
         years-to give them the opportunity to challenge the claim for benefits.
         For example, in recent years railroad companies have paid large sever-
         ance allowances to current and former employees who relinquished
         their railroad employment rights (former employees are not entitled to
         unemployment benefits under such circumstances).

         Computer processing of claims subsequently submitted under the appli-
         cation determines the amount payable for each 2-week registration
         period. As part of computer processing, each claim is tested to ensure
         that

     l   a valid application has been processed;
     l   no duplicate claims exist; and
     l   from what is known about the claim, no disqualifying factors exist, such
         as, voluntary quit, unavailable for work, or exceeding work limitations.

         Under the 1988 amendments to KUIA, all employers must be notified of
         all claims received so that they have an opportunity to challenge benefit
         entitlement. This is necessary because, beginning in calendar year 199 1,
         employer tax rates to support the unemployment-sickness benefits pro-
         gram will be affected by the amount of benefits paid to company
         employees.

         Another important control built into claims processing is the control for
         a beneficiary’s changes of address. One way of obtaining fraudulent
         benefits is diverting payments from a valid address. To prevent this,
         when a beneficiary reports a move to another location, a change-of-
         address notice is sent to the old address, to be returned if undeliverable.
         Notices returned provide evidence that the beneficiary no longer resides
         at the old address. If the beneficiary still resides at the address, he/she

         “The base:year is the calendar year preceding the benefit year, which extends from .July 1 through
         .Junc 30. Thus, calendar year 1987 was the base year for the benefit year beginning .JuJy 1, 1988.



         Page 34                                      GAO/HRD-90-42 Railroad Retirement Board Controls
    Appendix IV
    Processing Procedures and Internal Controls




    alerts the Board to the error or possible fraud. Only address changes on
    claims, however, are verified. The original address on the application is
    not verified, possibly permitting a fraudulent address to be established
    when the application is first submitted.

    Many controls for computer operations have been implemented, includ-
    ing (1) edit checks of the reasonableness and completeness of informa-
    tion and (2) nonduplication and validity of Social Security numbers. The
    computer system stops payment when the beneficiary has exhausted
    normal benefits for the year, that is, on reaching the 130-day maximum
    or the amount of the beneficiary’s base-year earnings. The system also
    determines eligibility for extended benefits.

    Applications or claims rejected by the computer are sent (“referred”) to
    headquarters claims examiners. These examiners also receive notifica-
    tions to take other actions. For example, the examiners notify sickness
    beneficiaries (1) before the EEI date that benefits will cease or an addi-
    tional physician certificate must be submitted and (2) when benefits
    have been exhausted.

    During our review, examiners resolved referred transactions by using
    hard-copy documents that were entered into the computer process
    through an optical character reader (OCR), a device that reads handwrit-
    ten characters on a document. The batch control procedures also con-
    trolled the OCR transactions. About the time we completed our field
    work, the Board introduced a new computer system, called Keymaster,
    to resolve referrals by direct entry, using remote computer terminals, to
    computer processing.

    The final product of computer processing is a daily payment tape sent to
    the Department of the Treasury, which issues and mails benefit checks.

    We sampled 10 percent of the benefit payments made for 1 day-241
    transactions-to   trace them through the Board’s payment system. Of
    these 241 transactions, 8 concerned resolving a referral. We found this
    system correctly identified

l a wage record for each beneficiary,
. a signed application on file,
. a signed claim, and
l adjustments to benefit amounts.




    Page 35                                  GAO/HRD-9042 Raiioad Retirement Board Controls
                           Appendix IV
                           Pmceselng Procedures and Internal Controls




                           In several instances, the amount paid was the final amount due for
                           exhausted benefits, During our visits to the district offices, we found
                           instances in which employers had returned the notices sent at the time
                           the applications were initially processed. These returns indicated that
                           the control to assure the validity of applications is working. We also
                           noted that the system was sending out notifications of changes of
                           address for unemployment beneficiaries in accordance with Board
                           procedures.


Computer System Controls   In June 1988, BDP analyzed its computer security. A principal deficiency
                           noted in this analysis was a lack of physical security for the computer
                           centers; this has been corrected. BDP has a computer security officer and
                           established physical security procedures. Systems analysts, program-
                           mers, and operators fulfill separate computer duties. Computer posi-
                           tions are considered sensitive and most, but not all, computer personnel
                           have received in-depth background checks. New and revised computer
                           programs require authorization before they can be developed, tested,
                           and used. BDP documents the functions of the computer-based systems
                           and programs.


                           An unemployment or sickness insurance beneficiary cannot work and
Postpayment Checks         receive benefits at the same time. To discourage false claims and detect
                           beneficiaries who are employed, the Board has implemented postpay-
                           ment verification procedures with railroad and state employment
                           offices. Through agreements with three major railroad companies, the
                           Board receives computerized wage data to match against benefit
                           records. A fourth major railroad company has authorized district office
                           employees to directly access wage data for train and engine crews. For
                           computer matches of employment records, the Board has contracts with
                           nine states and is negotiating with three additional ones.

                           District office employees are also required to intermittently visit rail-
                           road payroll offices to (1) manually check beneficiary records against
                           wage data and (2) do selected manual matches with state agencies in
                           those states without computer matches.

                           As a result of our 1985 review, the Board, to determine potential fraud,
                           developed a test of benefit records for multiple beneficiaries located at
                           the same address. The Board also developed a method to match Board




                           Page 36                                 GAO/HRD-9942 Railroad Retirement Board Controls
.




    employee data against benefit records to determine if fraudulent bene-
    fits were being paid. The Board only ran these tests, however, once,
    about 6 years ago.




    Page 37                        GAO/HRD-9042 IMlroad Retirement Board Controls
Amendix   V

Comments From the Railroad Retirement Board




              Ms.    Linda G. Morra
              Director,    Intergovernmental
                 and Management       Issues
              U. S. General       Accounting            Office
              Washington,     D.C.      20548


              Dear    Ms.    Morra:

              This    is in reply    to your draft      of             a proposed    report      on the Railroad      Retirement
              Board’s     (RRB’s)  internal    controls                to safeguard     against      fraud    and payment
              errors    in the railroad     unemployment                 and sickness       insurance      program   (GAOJHRD-
              90-42).

              The RR9 recognizes           the importance            of strong       internal      controls       to prevent       fraud
              and payment       errors      in the benefit           programs      it administers.             We appreciate         that
              the U. S. General           Accounting       Office        (GAO) acknowledged            the effectiveness          of
              the controls        already       in place      in the unemployment               and sickness        insurance
              program,      and  our efforts         to strengthen          those      controls      based on recommendations
              contained       in the 1985 GAO report                (GAO/HRD-85-37,           February      27, 1985).        We
              believe     that    to a great       extent       these     measures       are responsible          for controlling
              the number of erroneous              benefit        payments     in the program.              In the benefit        year
              that    ended June 30, 1988,             benefits        found to be erroneously                paid amounted       to
              less    than 1 percent          of the total         benefits      paid to claimants             under     the Railroad
              Unemployment        Insurance       Act (RUIA).

              The RR9 recently               implemented      a system         to notify        each claimant’s             railroad
              employer        of each unemployment              application,         unemployment             claim     and sickness
              claim     filed      by the employee.             This prepayment             claims      notification            system
              provides        the employer          an opportunity           to submit        information          relevant        to the
              employee’s         eligibility         prior    to a decision           to pay or deny benefits.                       We expect
              this    system       to significantly           reduce      payment       errors      and fraud          associated       vith
              employment         in the railroad           industry.




                      Page 38                                                        GAO/HRD-9042 Railroad Retirement Board Controls
             Appendix V
             Comments From the Railroad
             Retirement Board




                                                                  -2-


We generally      agree   with    each of the recommendations         contained      in the draft
report.      Our comments      and a description       of the actions      planned     or already
taken   to implement      the recommendations        are enclosed.       In addition,       we also
intend    to look    into   a number of other      issues/ideas     mentioned      in the draft
report,     but not specifically       covered   by the recommendations.             These include
the following.

             --       Ye will    review   the    sensitivity        of   those    positions     that       certify    benefit
                      payments     to ensure     that     background       checks    are required          as appropriate.

             --       We will    reviev     those   areas   where ve have opportunities         to establish                     or
                      maintain     computer     access    to railroad   payroll   records    to ensure     that                  we
                      make the most effective           use of that   information      in doing   post-payment
                      employment      checks.

             --       We   vi11    consider    ways to create     further      separation   of duties               in the
                      area of post-payment           wage checks    or to make a sample        review             of these
                      transactions         to safeguard   against     possible     fraud  or abuse.

             --       We intend    to schedule     an annual    computer      match between     the
                      unemployment     and sickness    insurance      benefit     payment  records                and   our
                      own payroll    data  as an additional        security     measure.

We appreciate                GAO bringing         these areas      of    possible   improvement    to          our
attention.                 Thank you for        the opportunity          to provide    our comments            on the    draft
report            I

                                                                          Sincerely,




                                                                          FOR THE BOARD                ’
                                                                          Beatrice  Ezerski
                                                                          Secretary  to the       Board

Enclosure




             Page 39                                                     GAO/HRD-9042 Railroad Retirement Board Controls
       Appendix V
       Comments From the Railroad
       Retirement Board




                                                                                                    Enclosure


4\             “C    ure        t
payment        authorization.

Although       additional        control     could    be realized         vith      the implementation              of
procedures        for reviev        and authorization           of claims         processing        transactions,
such procedures           have not been implemented                 because       of the significant              burden
that     would be placed          on the agency’s         limited        personnel        resources       by the
authorization          of every       unemployment      and sickness            insurance       transaction           --
approximately          1 million       each year.       Such procedures               would require         a
significant         amount of staff          time to be diverted              from workloads           which      already
have large        backlogs.         In the field       service,        the reviev         process      would be
further       exacerbated        because     most field       offices       have only        four     or five
employees.

In view of GAO’s guidance                   that    permits      reviev       of processing          transactions           on a
sampling       basis     when payment           amounts     are less        than $1.000,          we will       develop
procedures        to conduct        quality        assurance       reviews       of a sample of both
unemployment          and sickness          insurance       transactions          using      a statistically            valid
sampling       technique.         The director           of unemployment            and sickness           insurance        has
been requested           to provide,          by March 30. 1990,              a target       date and milestones               for
development         of the methodology              necessary        for such revievs.               In the interim,
supervisors         in the bureaus            of unemployment           and sickness          insurance         and field
service      will     be instructed           to periodically           review      claims      processing
transactions          to test     for fraud         and payment         errors.         We vi11      also     develop       by
March 30. 1990,            procedure        requiring       separate        authorization          for all       payments        of
over     $1.000     resulting       from the payment             of multiple          claims      on the same day.



Provide        better    control        over    documents        of    oriuinal       entry.      so they       cannot      be
lost      or   manioulated.

Effective          January       31. 1990,        most documents,         including         sickness        insurance
claims,       will       be entered       by claims        examiners      through       either      the Railroad
Unemployment            Claims      System      (RUCS) or Keymaster.               Original       documents,           including
unemployment             insurance       applications         and claims        and sickness          insurance          claims,
are alvays          vithin       the control         of agency      personnel,        and secure          from loss          and
manipulation.              The only unemployment              and sickness         insurance        documents          that    will
be batched           for processing           are      (1)    sickness        insurance          applications,             Form
SI-la;      (2) statements             of sickness,         Form SI-lb;         (3) supplemental              doctor’s
statements,            Form SI-7;        (4)      change      of    name     transactions,            Form CU-13;            and
(5) various            compensation          and pay rate        details,       Forms UI-le.          UI-lf       and UI-41a.

At the time of the audit,                     RRB personnel        vere observed            estimating        rather      than
counting      documents          to be batched.             Also,    discrepancies            in batch      counts      were
not reconciled           after      the documents           were processed            in our computer           system.        As
pointed     out   in the draft              report,     when this        situation         was brought        to the
attention       of RRB officials,               the GAO auditors             were advised         that     no procedure
existed     to permit          tolerance         levels     or estimates          of batched        items.       Agreement
was reached       to correct            this    deficiency.          All batched           documents       are now being
reviewed      to ensure          that     documents       are combined          by type and accurate               record
counts    are obtained.               Also,     ve will      perform       reconciliations            of discrepancies
on a sample       basis.




       Page 40                                                        GAO/HRD-90-42 Railroad Retirement Board Controls
            Appendix V
            Comments From the Railroad
            Retirement Board




                                                                       -2.


    In addition,      procedures        are being         developed     to periodically          select    a random
    batch   of documents        sent to outside            contractors        for keying.        These documents
    will  be photocopied         prior      to release        to the contractor             and will    be compared   to
    the keyed    documents       returned        by the contractor.              This approach        was recommended
    by GAO and addresses           internal        control      weaknesses       involving      documents     sent to
    an outside     contractor        for keying.           Quarterly      revievs       vi11   be conducted     with
    the first    reviev      scheduled        before     March 30, 1990.

    The    RRB initiated           a special       study      of the railroad         sickness      insurance       program
    on   January     2,     1990,      to evaluate        current     operations        and procedures.            The study
    team consists           of representatives              from the bureaus          of unemployment           and sickness
    insurance,        field       service     and data processing.               We expect      the team to make
    recommendations             to revise       the application,          medical       and claim       documents       used in
    the program.            The form changes,             combined     with    our intention          to eliminate
    processing       delays        associated       with      vendor   keying      of data and improve             control     of
    original     documents,            will   lead to changes          in the method of data input                   for the
    automated      processing            of sickness        insurance     applications         and medical
    statements.           The program         study     team will      be directed         to consider        this
    recommendation            in formulating          alternatives         to the current         procedures.           Within
    120 days after            completion        of the study,         we will      determine      the method of data
    entry    to be used and establish                   a target      date for implementation               of the new
    procedures.           The special         study     is scheduled         to be completed          in July      1990.

    We will   develop     procedures     to better     control                      change of name and              compensation/
    pay rate   transactions        by December      31, 1990.                       The new procedures              will  utilize
    Keymaster    for entry      of these   details.


    sSt   n the                                                                              autho   ized     commuter         roerams
     are used.       the computer     facility               is    secure.      and    all      comnuter      oersonnel        receive
    Dacknround         security   checks.

    By September          30. 1990.        a software       package     (LCS/CMF)     is scheduled       to be
    installed        that    vi11     automatically         keep source      and load modules         in proper
    synchronization.               In addition        to solving      problems     associated    vith      source
    documentation,           the software          process     will   ensure    that    only personnel        in the
    quality      assurance         section     of our bureau        of data processing        are authorized         to
    catalog      programs        for production          use.

    At the time of the audit,                     the     doors     to the central              computer       processing            room
    were open to provide                sufficient            air   conditioned           ventilation           to this        room
    because       of compressor           failure         on one of the air               conditioning            units      inside      the
    room.       As soon as the compressor                       was replaced,           the doors          were closed           and are
    kept     closed.         The door to the              tape library           which      was malfunctioning                 on the day
    of the audit,           has been repaired                 and is also kept              closed.         We have established
    a procedure          whereby      our building              maintenance         contract         personnel          tour     the
    computer        center      daily     checking          various       pieces      of equipment,             including          the
    doors,      for proper         operation.             During      this     past     summer,        supplemental            air
    conditioning           vas installed            for     the mainframe           in the central             processing            room to
    help eliminate            future      problems          with    insufficient            air     conditioning.

    A complete      fire sprinkler    system    was installed                          in the cafeteria          and in the
    mezzanine   area above the cafeteria             in December                       1989.     so the risk       to the
    computer   center    from a cafeteria       fire    has been                       significantly         reduced.     The
    cafeteria    is a limited-service        operation,      vhich                       further     reduces     the risk    of          a
    cafeteria    fire.
Y




            Page 4 1                                                           GAO/HRD-90-42 Railroad Retirement Board Controls
         Appendix V
         Comments From the Railroad
         Retirement Board




                                                                  -3-


The security         access    system      for the computer        facility        is now fully    operational.
The system       allows     entry    to authorized        personnel         who have access     cards,     and
provides     immediate       alarm     notification       for any unauthorized           entry.      This
corrects     the material         weakness         in the physical        security    of the computer
center,    as previously          reported        by the RRB under          the Federal    Managers’
Financial      Integrity       Act.

The process        of designating              sensitivity            levels         for all      RRB positions           was begun
in late     1984.        In early        1985,       the designation                 process      was completed           and
background       investigations              were initiated               only       for employees           being     reassigned
or promoted        into      sensitive         positions.             It was not until               fiscal       year    1987 that
we started       to initiate           background           investigations                on personnel          already       in
positions       designated          as sensitive.              Because           of the substantial               costs     involved,
we did not initiate              background            investigations                on the 220 employees                who were
already     assigned         to sensitive           positions,            but rather           developed        a plan      for
conducting       such investigations                   in the future,                  The plan,       which      was approved         by
the RRB’s Office            of Inspector            General,          called         for initiating           investigations           on
these     employees        over a 3-year            period        (fiscal          years     1987.     1988,      and 1989).
dividing      the number of investigations                          equally          among the 3 years.                These
security      investigations             are being          conducted            in seniority          date order         with     the
most junior        employees         being      investigated              first.          We have      completed         156 of the
original      220 investigations,                 and continue               to initiate          investigations            on all
new employees         hired       into     the agency          and on all              present      employees        who are
promoted      or reassigned            into     a sensitive             position.            Because      priority        was given
to investigations              of newly hired             and newly            promoted        or reassigned           employees,
we have not yet completed                    the investigations                    of the most senior              computer
employees.

Our ability        to conduct        security        investigations          has recently        been complicated
by a lawsuit         filed     against      the agency         and the Office           of Personnel    Management
 (OPM) by the American              Federation         of Government         Employees      on behalf    of some
agency      employees       in the United          States      District      Court      for the Northern     District
of Illinois.            The lawsuit       challenges         the use of Standard            Form (SF) 86,
Questionnaire           for Sensitive         Positions,         which OPM requires           to be completed        in
order     to conduct        the full     background          investigation.             As a result   of the
lawsuit,      the RRB is not requiring                   the completion          of the SF-86 by any
bargaining       unit      employee     pending        the outcome         of litigation.

We are still          able to obtain             security     investigations      of non-bargaining        unit
(supervisory          and managerial)             employees,       and we will     schedule    13 senior     non-
bargaining         unit   employees,           including      the chief      of computer    services,    for
investigations           during   fiscal          year    1990.


Improve     control    over the validity       of uhvsician                       certifications             of applicants’
sickness     by implementine      prior    GAO recommendation                           that     physicians        YUDP~Y their
tax identification         number with     the certificate                        and Drovide           this   directly     to
the Board       rather  than throueh     claimants.

Development        of a system          that   will    check    the validity      of tax identification
numbers     furnished      by physicians            on medical       statements    has been delayed        by the
implementation         of amendments           to the Railroad          Unemployment    Insurance       Act and
other   high priority          activities.           Analysis      for the automated       system     is now
scheduled      to begin      later        this   month.      Approximately       9 months will      be required
to complete        t.he project.




         Page 42                                                           GAO/HRD-9042 Railroad Retirement Board Controls
        Appendix V
        Comments From the Railroad
        Retirement Board




                                                             -4-


For the      following     reasons,     ve do not plan to alter           procedures        to require
physicians        to submit     medical   statements      directly     to the RRB.          We vill,
however,       develop   alternative      procedures      to increase       direct      communications
betveen      the RRB and claimants’          physicians.         Our reasons       for continuing                  to
require      claimants     to obtain     and submit      medical    statements        include    the
follovingr


--   The current         system     recognizes         and reinforces         the responsibility             of the
     claimant       to submit       all   documentation,            including      medical     evidence,        in
     support      of his or her claims.                 Direct      communications         between      physicians        and
     the RRB would          remove the claimant              from the process,          and could        result      in
     delays     in benefit        payments.         Claimants         have been an effective             means of
     checking       with    physicians       and ensuring           the timely      submission        of medical
     statements.          The absence        of claimant          involvement       in this     process        could
     result     in sickness         insurance        forms     requiring      a physician’s         signature        being
     “buried”       among the other           “insurance”         forms which       the physician          must
     complete.

--   Responsibility         for the       payment     for services          rendered      by a claimant’s
     physician        is less clear        if the RRB directly              solicits      the physician          for
     completion         of a medical       statement.

--   Claimants    are often        referred       to medical        specialists       during      the course      of an
     illness    or injury.         As a result,          attempting       to identify        the physician        vith
     the most current         and/or      pertinent        medical    knowledge       of a claimant        could      be
     a problem    for the agency            if the RRB were responsible                 for obtaining
     additional     medical      information         to support       payment     of benefits        beyond     the
     estimated    end of inability.               Failure      to properly      identify        the treating
     physician    could     result      in benefit         payment     delays.

--   Forms SI-lb         and SI-7 are often          completed     in conjunction           with    a personal
     visit     by the claimant            to his or her treating          physician,        resulting       in the
     submission        of the most up-to-date            medical     information         possible      for the
     claimant.         Direct     solicitation       of medical      information         by the RRB would
     either     require       the physician       to schedule      an appointment           for the claimant,
     thereby      resulting       in a delay       in receipt    of medical         information,         or
     completion        of the statement          based on out-of-date            medical      records.


We will    determine      by December           31. 1990.    hov to best incorporate                     an increased
level    of direct      communication           betveen   the RRB and physicians                  into     our   claims
processing      routines.




                                                                    GAO/HRD-90-42 Railroad Retirement Board Controls
     Appendix V
     Comments Prom the Railroad
     Retirement Board




                                               -5-


lwrease the tirifv         for res0lvi.m     diwman.Us        disclosed   bv ce
aetches of bane fit
           of lpkllypl matches in states vhere cm
nastiated.         Hovever.    a cost/be*efit analvsisd           be ~ecformed
r&w the banefits         derived exceed the costs ~*wrk
By March 31, 1990, the RRB will            issue  guidance to All field       service offices
concerning    the prescribed        time periods   for investigating      Assignments   from
StAte vAge computer matching progroma.               In Addition,    ve vi11 request   ~11
regionA    directors       to reviev    the status of manual wage checking in the AreAs
under their     jurisdiction,       And make Arrangements      to conduct checks in StAtes in
vhich computer matching programs do not exist,                And mAnuA1   checks Are not
currently   conducted.

Also, ve vi11 develop Automated programs to select                cases to be mAnuAlly
checked AgAinst State wage records.             In Addition   to providing      some separation
of duties   in this Area, such AUtOmAted          progrAms will     ollov checking of CASQS
involving   sickness     insurence   benefit    payments.    The director     of unemployment
And sickness    insurclnce,     in association    with the director      of dAtA processing,
hAs been requested       to provide    A target   dAtA.   by April    6. 1990, for development
And implementation       of such programs.




      Page 44                                        GAO/HRD-9042 ltaibad         lbtirement   Board C~ntrola
           *
  Ppe

k:a            Contributors to This &port


                        Larry Horinko, PLssistant Director, (202) 523-9131
Human Resources         Robert F. Gerkin, Assignment Manager
Division,               C. Robert DeRoy, Evaluator (Computer Science)
Washington, DC.

                        Steven Merritt, Assistant Director
Information
Management and
Technology Division,
Washington, DC.

                        Patrick C. Dolan, Evaluator-in-Charge
Chicago Regional        Louis W. Windisch, Site Senior
Office                  David J. Diersen, Site Senior




(118262)                Page 45                          GAO/HRD-90-42 lbilroad   Retirement Board Controls