OFFICE OF
THE INSPECTOR GENERAL

SOCIAL SECURITY ADMINISTRATION

ADMINISTRATIVE
COSTS CLAIMED BY THE
NEVADA DISABILITY
DETERMINATION SERVICES

August 2004

A-09-04-14009

AUDIT REPORT

Mission

We improve SSA programs and operations and protect them against fraud, waste, and abuse by conducting independent and objective audits, evaluations, and investigations. We provide timely, useful, and reliable information and advice to Administration officials, the Congress, and the public.

Authority

The Inspector General Act created independent audit and investigative units, called the Office of Inspector General (OIG). The mission of the OIG, as spelled out in the Act, is to:

Conduct and supervise independent and objective audits and investigations relating to agency programs and operations.
Promote economy, effectiveness, and efficiency within the agency.
Prevent and detect fraud, waste, and abuse in agency programs and operations.
Review and make recommendations regarding existing and proposed legislation and regulations relating to agency programs and operations.
Keep the agency head and the Congress fully and currently informed of problems in agency programs and operations.

To ensure objectivity, the IG Act empowers the IG with:

Independence to determine what reviews to perform.
Access to all information necessary for the reviews.
Authority to publish findings and recommendations based on the reviews.

Vision

By conducting independent and objective audits, investigations, and evaluations, we are agents of positive change striving for continuous improvement in the Social Security Administration's programs, operations, and management and in our own office.

MEMORANDUM

Date: August 10, 2004

To: Peter D. Spencer
Regional Commissioner San Francisco

From: Assistant Inspector General for Audit

Subject: Administrative Costs Claimed by the Nevada Disability Determination Services (A-09-04-14009)

OBJECTIVE

The objectives of our audit were to evaluate internal controls over the accounting and reporting of administrative costs and drawdowns, determine whether costs claimed on the State Agency Report of Obligations for SSA Disability Programs (Form SSA 4513) for the period October 1, 2000 through September 30, 2002, were allowable and properly allocated, and assess limited areas of the general security controls environment.

BACKGROUND

The Disability Insurance program was established in 1954 under Title II of the Social Security Act (Act). The Disability Insurance program provides benefits to wage earners and their families in the event the wage earner becomes disabled. In 1972, Congress enacted the Supplemental Security Income program under Title XVI of the Act. The Supplemental Security Income program provides benefits to financially needy individuals who are aged, blind, or disabled.

The Social Security Administration (SSA) is responsible for implementing policies for the development of disability claims under the Disability Insurance and Supplemental Security Income programs. Disability determinations under both Disability Insurance and Supplemental Security Income are performed by Disability Determination Services (DDS) in each State or other responsible jurisdiction in accordance with Federal regulations. In carrying out its obligation, each DDS is responsible for determining claimants' disabilities and ensuring adequate evidence is available to support its determinations. To assist in making proper disability determinations, each DDS is authorized to purchase medical examinations, x rays and laboratory tests on a consultative basis to supplement evidence obtained from the claimants' physicians or other treating sources.

SSA reimburses the DDS for 100 percent of allowable expenditures up to its approved funding authorization. The DDS withdraws Federal funds through the Department of the Treasury's (Treasury) Automated Standard Application for Payments system for program expenditures. Funds drawn down must comply with Federal regulations and intergovernmental agreements entered into by Treasury and States under the Cash Management Improvement Act of 1990. At the end of each quarter of the fiscal year (FY), each DDS submits a Form SSA 4513 to account for program disbursements and unliquidated obligations.

Nevada Disability Determination Services (NV DDS) is a component of the Bureau of Disability Adjudication. The Bureau of Disability Adjudication is a division within the Nevada Department of Employment, Training and Rehabilitation (NV DETR). Parent agencies, such as the NV-DETR, often provide such administrative services as accounting, purchasing and personnel to the State-designated DDS.

For FYs 2001 and 2002, NV-DDS had about 64 employees, and NV-DETR reported total disbursements of $14.49 million with no unliquidated obligations.

RESULTS OF REVIEW

NV-DETR and NV-DDS generally had adequate controls over the $14.49 million claimed for reimbursement during the 2-year audit period ended September 30, 2002. However, NV-DETR used FY 2002 funds to pay for some FY 2003 expenditures. In addition, NV-DDS had no intrusion detection system to ensure protection of equipment and information and did not set adequate workstation security controls for three of its employees.

Incorrect Fiscal Year Payments

NV DETR withdrew some Federal funds for expenditures for the incorrect FY. In October 2002, NV DETR withdrew $23,098 from the FY 2002 authorization to cover FY 2003 rental expenditures. NV-DETR returned these funds to the FY 2002 authorization on November 4, 2002. The supporting documentation for the return of the FY 2002 funds stated the expenditures had been "coded to the wrong FY - due to no funds for the new year."

This occurred, in part, because NV-DETR did not request additional funding authority from SSA. Although these funds were subsequently returned to the applicable authorization, NV DETR should not have used the funds of one FY to pay for the expenditures of another FY. NV-DETR needs to improve its accountability over Federal funds to ensure such funds are drawn for authorized purposes only.

Federal law states:

…the balance of an appropriation or fund limited for obligation to a definite period is available only for payment of expenses properly incurred during the period of availability…the appropriation or fund is not available for expenditure for a period beyond the period otherwise authorized by law.

Improperly shifting costs between FYs potentially impacts total expenditures authorized for reimbursement. The procedure also prevents SSA from accurately monitoring the status of DDS expenditures and unexpended appropriations. The effect is to reduce the Agency's ability to manage the allocation and use of budgeted funds among DDSs.

Perimeter and Interior Office Security

While reviewing the general security controls, we determined NV DDS did not have an intrusion detection system to protect equipment and prevent unauthorized access to sensitive SSA data. Further, the building did not have a 24 hour guard and was not located in a Federal building.

The Disability Determination Services Security Document states an intrusion detection system is required in all facilities unless determined unnecessary. For example, if a DDS is located in a Federal building with 24-hour guard service.

As a result, equipment and sensitive SSA data were not protected against unauthorized access and use. We believe SSA should instruct NV DDS to acquire an intrusion detection system or provide justification supporting why one is unnecessary.

Workstation Security Controls

NV DDS did not have an automatic lock to secure 3 of the 14 employee computer workstations we tested. The three employees had access to most NV DDS systems. NV DDS needs to strengthen its systems controls to protect against the unauthorized disclosure, manipulation, or destruction of sensitive data.

SSA's procedures require that the DDS install an automatic lock on all Intelligent Workstation/Local Area Network workstations. In August 2002, the SSA regional office issued a memorandum requiring that NV DDS implement SSA's systems policy, including an automatic lock and uniform configuration settings for each workstation. Specifically, the DDS should use a standardized screensaver to automatically lock the workstation when it is not in use for 20 minutes. Employees must enter a personal identification number or password to reactivate their access to the workstation. In addition, all employees are required to lock or log off their workstations before leaving them unattended.

During our audit, we tested 14 workstations and found that 3 did not ensure an automatic lock would occur if the workstation was left unattended for 20 minutes. The three workstations had the broadest authority to access NV-DDS' systems. In addition, we observed that a number of NV DDS employees did not lock or log off their workstations before they left their desks. Since employee workstations were unsecured and unattended, there was an increased risk that sensitive SSA data may have been altered, deleted, or replaced.

CONCLUSION AND RECOMMENDATIONS

The NV-DETR and NV-DDS had adequate internal controls over the accounting and reporting of administrative costs. However, NV-DETR used FY 2002 funds to pay for FY 2003 expenditures, and NV-DDS needed to establish an intrusion detection system to ensure protection of equipment and information and set access controls for three of its employees.

We recommend that SSA:

1. Remind NV-DETR that drawing funds from one FY to pay for the expenditures of another FY is not allowable under Federal law.

2. Instruct NV-DDS to acquire an intrusion detection system or provide justification supporting why one is unnecessary to protect equipment and prevent unauthorized access to sensitive SSA data.

3. Verify that NV-DDS has implemented an automatic lock to safeguard all employee workstations.

AGENCY COMMENTS

SSA and NV-DDS agreed with all of our recommendations. See Appendix B for the text of SSA's and NV-DDS' comments.

Steven L. Schaeffer

Appendices
APPENDIX A - Acronyms
APPENDIX B - Agency Comments
APPENDIX C - Scope and Methodology
APPENDIX D - Obligations Reported/Allowable for Nevada Disability Determination Services for Fiscal Years 2001 and 2002, as of June 5, 2003.
APPENDIX E - OIG Contacts and Staff Acknowledgments

Appendix A
Acronyms
Act Social Security Act
C.F.R Code of Federal Regulations
DDS Disability Determination Services
Form SSA 4513 State Agency Report of Obligations for SSA Disability Programs
FY Fiscal Year
NV-DDS Nevada Disability Determination Services
NV-DETR Nevada Department of Education, Training and Rehabilitation
Pub. L. No. Public Law Number
SSA Social Security Administration
Treasury Department of the Treasury
U.S.C. United States Code

Appendix B
Agency Comments

SOCIAL SECURITY

MEMORANDUM

Date: July 21, 2004

To: Assistant Inspector General for Audit

From: Assistant Regional Commissioner
Management and Operations Support San Francisco

Subject: Audit of Administrative Costs Claimed by the Nevada Disability Determination Services (A-09-04-14009)--REPLY

Thank you for the opportunity to review the draft report of your audit of the Nevada Disability Determination Services. As you requested, we are providing our specific written comments for each of the three recommendations contained in the draft report. Please see Attachment 1 below. We have also attached the comments the State submitted.

If you have any questions regarding our comments, please call me, at (510) 970-8390. If staff have any questions, they may call Diane Trewin in the Center for Disability, at (510) 970-8295.

Ron Sribnik for Patrick E. Sheehan

Attachment 1

Regional Office Comments on the Nevada DDS Draft Audit Report

Recommendation 1: Remind the Nevada Department of Employment, Training and Rehabilitation (DETR) that drawing funds from one Fiscal Year to pay for the expenditures of another Fiscal Year is not allowable under Federal law.

Comment: We find this recommendation reasonable. The long standing regional policy is that the States notify the Regional Office if they require additional funding for a Fiscal Year.

Recommendation 2: Instruct the Nevada Disability Determination Services (DDS) to acquire an intrusion detection system or provide justification supporting why one is unnecessary to protect equipment and prevent unauthorized access to sensitive SSA data.

Comment: We find this recommendation reasonable.

Recommendation 3: Verify that the DDS has implemented an automatic lock to safeguard all employee workstations.

Comment: We agree with this recommendation. Regional Office staff will verify that the automatic lock has been implemented.

Attachment 2

Appendix C
Scope and Methodology

SCOPE

We reviewed the administrative costs reported by Nevada Department of Education, Training and Rehabilitation (NV-DETR) and its component Nevada Disability Determination Services (NV-DDS) on its State Agency Report of Obligations for SSA Disability Programs (Form SSA-4513) for Fiscal Years (FY) 2001 and 2002. For the items tested, we reviewed NV-DETR's and NV-DDS' compliance with applicable laws and regulations over the allowability of administrative costs and draw down of Federal funds.

To accomplish our objectives, we:

Reviewed Office of Management and Budget Circular A 87, Cost Principles for State, Local, and Indian Tribal Governments; the Code of Federal Regulations; United States Code; the Social Security Administration's (SSA) Program Operations Manual System; and NV-DETR's Cost Allocation Plan.

Reviewed NV-DDS' policies and procedures related to personnel, medical, indirect, and non-personnel costs.

Interviewed employees from SSA; the Department of Labor; NV DETR; NV DDS; and Kafoury, Armstrong and Company, Certified Public Accountants.

Reconciled the amount of Federal funds drawn for support of program operations to the allowable expenditures.

Examined the administrative costs incurred and claimed by NV-DETR for personnel, medical, indirect, and non-personnel costs during FYs 2001 and 2002.

Selected a random sample of personnel, medical, and non-personnel costs.

Reconciled the accounting records to the costs reported by NV-DETR on its Form SSA 4513 for FYs 2001 and 2002.

Conducted limited general control testing related to physical access security and security plan within the DDS.

We determined NV DETR's computer-processed data to be sufficiently reliable for their intended use. Further, any data limitations are minor in the context of this assignment, and the use of the data should not lead to an incorrect or unintentional message. We tested cash draw receipts and disbursements recorded in the NV DETR's automated accounting system made on behalf of NV DDS. We completed tests to determine the completeness, accuracy and validity of the data. These tests allowed us to assess the reliability of the data and achieve our audit objectives.

We performed audit work at NV-DETR and NV-DDS in Carson City, Nevada. In addition, we reviewed Nevada single audit work performed by Kafoury, Armstrong and Company, Certified Public Accountants, in Reno, Nevada. We also performed audit work at the SSA regional office in Richmond, California. We conducted field work from August 2003 through April 2004. We conducted our audit in accordance with generally accepted government auditing standards.

METHODOLOGY

We reviewed the $14,492,984 administrative costs NV-DETR reported on its SSA 4513 for FYs 2001 and 2002. The sampling methodology encompassed the four general areas of costs reported on the SSA-4513: (1) personnel, (2) medical, (3) indirect, and (4) all other non-personnel costs. We obtained a data extract of all costs and the associated invoices for FYs 2001 and 2002 for use in statistical sampling. This was obtained from the accounting systems used in preparing the SSA 4513.

Personnel Costs

We reviewed 68 employees from 1 randomly selected pay period in FY 2002. We tested the payroll records to ensure individuals were paid correctly and payroll was adequately documented.

Medical Costs

We sampled 100 items (50 items from each FY) using a stratified random sample of medical costs based on the proportion of Medical Evidence of Record and consultative examination costs to the total medical costs claimed.

Indirect Costs

NV-DDS departmental indirect costs are determined by applying a Federally approved cost allocation plan. The State-wide indirect costs are computed using a fixed cost plan. These methodologies were approved by the Department of Labor, which is the Federal agency designated the responsibility of approving indirect costs for the NV DETR. NV DETR claimed indirect cost of $522,404 for FY 2001 and $522,622 for FY 2002. We reviewed the FY 2001 and 2002 indirect cost computations to ensure that SSA reimbursed NV-DETR in compliance with the cost allocation plans.

All Other Non-personnel Costs

We sampled 100 items (50 expenditures from each FY) using a stratified random sample based on the proportion of costs in each of the 10 SSA-4513 all other non personnel cost categories to the total all other non-personnel cost. In addition, we reviewed all occupancy costs for each FY.

Appendix D
OBLIGATIONS REPORTED/ALLOWABLE FOR NEVADA DISABILITY DETERMINATION SERVICES FOR FISCAL YEARS 2001 THROUGH 2002, AS OF JUNE 5, 2003

TOTAL OBLIGATIONS
DISBURSEMENTS
UNLIQUIDATED OBLIGATIONS
COSTS
REPORTED
BY NV-DETR
ALLOWABLE
PER AUDIT
REPORTED
BY NV-DETR
ALLOWABLE
PER AUDIT
REPORTED
BY NV-DETR
ALLOWABLE
PER AUDIT
PERSONNEL
MEDICAL
INDIRECT
ALL OTHER
TOTAL $ 8,384,200
3,644,771
1,045,026
1,418,987
$ 14,492,984 $ 8,384,200
3,644,771
1,045,026
1,418,987
$ 14,492,984 $ 8,384,200
3,644,771
1,045,026
1,418,987
$ 14,492,984 $ 8,384,200
3,644,771
1,045,026
1,418,987
$ 14,492,984
$ 0
0
0
0
$ 0
$ 0
0
0
0
$ 0

Appendix E
OIG Contacts and Staff Acknowledgments
OIG Contacts
James Klein, Director, San Francisco Audit Division, (510) 970-1739
Joseph Robleto, Audit Manager, (510) 970-1737
Jack Trudel, Audit Manager, (510) 970-1733
Acknowledgments
In addition to those named above:
Timothy E. Meinholz, Senior Auditor
Brennan Kraje, Statistician
Kim Beauchamp, Writer-Editor

For additional copies of this report, please visit our web site at http://www.ssa.gov/oig or contact the Office of the Inspector General's Public Affairs Specialist at (410) 966-1375. Refer to Common Identification Number A-09-04-14009.

Overview of the Office of the Inspector General

The Office of the Inspector General (OIG) is comprised of our Office of Investigations (OI), Office of Audit (OA), Office of the Chief Counsel to the Inspector General (OCCIG), and Office of Executive Operations (OEO). To ensure compliance with policies and procedures, internal controls, and professional standards, we also have a comprehensive Professional Responsibility and Quality Assurance program.

Office of Audit

OA conducts and/or supervises financial and performance audits of the Social Security Administration's (SSA) programs and operations and makes recommendations to ensure program objectives are achieved effectively and efficiently. Financial audits assess whether SSA's financial statements fairly present SSA's financial position, results of operations, and cash flow. Performance audits review the economy, efficiency, and effectiveness of SSA's programs and operations. OA also conducts short-term management and program evaluations and projects on issues of concern to SSA, Congress, and the general public.

Office of Investigations

OI conducts and coordinates investigative activity related to fraud, waste, abuse, and mismanagement in SSA programs and operations. This includes wrongdoing by applicants, beneficiaries, contractors, third parties, or SSA employees performing their official duties. This office serves as OIG liaison to the Department of Justice on all matters relating to the investigations of SSA programs and personnel. OI also conducts joint investigations with other Federal, State, and local law enforcement agencies.

Office of the Chief Counsel to the Inspector General

OCCIG provides independent legal advice and counsel to the IG on various matters, including statutes, regulations, legislation, and policy directives. OCCIG also advises the IG on investigative procedures and techniques, as well as on legal implications and conclusions to be drawn from audit and investigative material. Finally, OCCIG administers the Civil Monetary Penalty program.

Office of Executive Operations

OEO supports OIG by providing information resource management and systems security. OEO also coordinates OIG's budget, procurement, telecommunications, facilities, and human resources. In addition, OEO is the focal point for OIG's strategic planning function and the development and implementation of performance measures required by the Government Performance and Results Act of 1993.