SOCIAL SECURITY
MEMORANDUM
Date: September 20, 2002
To: The Commissioner
From: Inspector General
Subject: Summary of Single Audit Oversight Activities (A-07-02-32035)
The attached final Management Advisory Report presents a summary of internal control weaknesses at State Disability Determination Services reported in State single audits and identified during our October 2000 through April 2002 single audit oversight activities.
Please comment within 60 days from the date of this memorandum on corrective action taken or planned on each recommendation. If you wish to discuss the final report, please call me or have your staff contact Steven L. Schaeffer, Assistant Inspector General for Audit, at (410) 965-9700.
James G. Huse, Jr.
OFFICE OF
THE INSPECTOR GENERAL
SOCIAL SECURITY ADMINISTRATION
SUMMARY OF SINGLE AUDIT
OVERSIGHT ACTIVITIES
OCTOBER 2000
THROUGH
APRIL 2002
September
2002
A-07-02-32035
MANAGEMENT ADVISORY REPORT
Mission
We improve SSA programs and operations and protect them against fraud, waste, and abuse by conducting independent and objective audits, evaluations, and investigations. We provide timely, useful, and reliable information and advice to Administration officials, the Congress, and the public.
Authority
The Inspector General Act created independent audit and investigative units, called the Office of Inspector General (OIG). The mission of the OIG, as spelled out in the Act, is to:
Conduct and supervise independent and objective audits and investigations relating to agency programs and operations.
Promote economy, effectiveness, and efficiency within the agency.
Prevent and detect fraud, waste, and abuse in agency programs and operations.
Review and make recommendations regarding existing and proposed legislation and regulations relating to agency programs and operations.
Keep the agency head and the Congress fully and currently informed of problems in agency programs and operations.
To ensure objectivity, the IG Act empowers the IG with:
Independence to determine what reviews to perform.
Access to all information necessary for the reviews.
Authority to publish findings and recommendations based on the reviews.
Vision
By conducting independent and objective audits, investigations, and evaluations, we are agents of positive change striving for continuous improvement in the Social Security Administration's programs, operations, and management and in our own office.
Executive Summary
Our objective was to summarize categories of internal control weaknesses at State Disability Determination Services (DDS) reported in State single audits and identified during our October 2000 through April 2002 single audit oversight activities.
On July 5, 1996, the President signed the Single Audit Act Amendments of 1996, Public Law No. 104-156. The Amendments extended the statutory audit requirement to nonprofit organizations and revised various provisions of the 1984 Single Audit Act, including raising the Federal financial assistance dollar threshold for requiring an audit from $100,000 to $300,000. On June 30, 1997, the Office of Management and Budget issued revised Circular A-133, Audits of States, Local Governments, and Non-Profit Organizations to implement the 1996 amendments. The revised Circular A-133 was effective July 1, 1996 and applies to audits of fiscal years (FY) beginning after June 30, 1996. This Circular requires non-Federal entities that expend $300,000 or more per year in Federal awards to have a single or program-specific audit conducted for that year.
The Social Security Administration (SSA) is responsible for the policies on developing disability claims under the Disability Insurance (DI) and Supplemental Security Income (SSI) programs. In accordance with Federal regulations, the DDS in each State generally performs disability determinations under the DI and SSI programs. In carrying out this function, the DDS is responsible for determining claimants’ disabilities and ensuring that adequate evidence is available to support its determinations. SSA reimburses the DDS for 100 percent of allowable expenditures. There are a total of 54 DDSs in the 50 States, the District of Columbia, Puerto Rico, Guam, and the Virgin Islands. All DDSs are subject to single audit coverage except the federally administered Virgin Islands DDS.
RESULTS OF REVIEW
We reviewed 103 single audits covering State fiscal year (SFY) operations at 53 DDSs (1 SFY 1997 single audit, 1 SFY 1998 single audit, 51 SFY 1999 single audits, and 50 SFY 2000 single audits). We compiled and categorized the audit findings as direct or crosscutting. Direct findings are those specifically identified to the DDS. Crosscutting findings impact more than one Federal program; however, they may not be identified to any one Federal program or may not be identified to all Federal programs. Our review disclosed common direct and crosscutting findings in the categories of cash management, equipment and real property management, and allowable costs. We also identified crosscutting findings in procurement and reporting categories. All the findings relate to DDS’ noncompliance with Federal requirements because of internal control weaknesses. Of the 103 single audits, 25 reported direct findings, and 89 reported crosscutting findings (see Appendix A).
Our review of the 25 single audits with direct findings disclosed:
We conduct audits of DDS administrative costs. Our recent audits of the Oregon, Connecticut and Arizona DDSs disclosed findings in the cash management, procurement, equipment and real property management, reporting, and allowable costs categories. These findings relate to DDS’ noncompliance with Federal requirements because of internal control weaknesses. Appendix D summarizes our findings.
A comparison of the Oregon, Connecticut, and Arizona DDS single audit findings and audits for the same reporting period disclosed significant differences. We reported our findings on incorrect FY payments, excess cash draws, inconsistent accounting obligations, inadequate computer access and security controls, missing inventory records, inaccurate and inconsistent reporting, and unreasonable medical fees. The single audits for Oregon, Connecticut, and Arizona did not report these findings. We present this comparison for informational purposes only. We will report our comparison to the cognizant Federal agency, the Department of Health and Human Services, in a separate management letter for any action it deems appropriate.
CONCLUSIONS AND RECOMMENDATIONS
The first five recommendations listed below were presented to SSA in our prior single audit summary report. Therefore, SSA should not consider these new recommendations for its audit recommendation tracking system. We do, however, reaffirm our position that SSA should take corrective action by being proactive in providing internal control guidance to DDSs. To do so, SSA should provide the following instructions to DDSs.
AGENCY COMMENTS
In response
to our draft report, SSA agreed with all of our recommendations and outlined
the corrective action taken on each recommendation. See Appendix E for the full
text of SSA's comments to our draft report.
Table
of Contents
Page
INTRODUCTION 1
RESULTS OF REVIEW 5
Cash Management 5
Equipment and Real Property Management 7
Computer Controls 7
Property Controls 8
Allowable Costs 9
Comparison of Single Audit and OIG Findings 12
Oregon DDS 12
Connecticut DDS 13
Arizona DDS 13
CONCLUSIONS AND RECOMMENDATIONS 14
APPENDICES
APPENDIX A – Summary of Single Audit Findings
APPENDIX B – Direct Findings Reported in 25 Single Audits
APPENDIX C – Crosscutting Findings Reported in 89 Single Audits
APPENDIX D – Findings We Identified During the Same Time Frame as the
Single Audits Reviewed
APPENDIX E – Agency Comments
APPENDIX F – OIG Contacts and Staff Acknowledgments
AIF Automated
Investment Funds
AIS Automated
Information Systems
CMIA Cash
Management Improvement Act
DDS Disability
Determination Services
DES Department
of Economic Security
DHS Department
of Human Services
DI Disability
Insurance
DLES Department
of Labor and Employment Security
DPHHS Department
of Public Health and Human Services
DoE Department
of Education
DoF Department
of the Family
DRS Department
of Rehabilitation Services
DSS Department
of Social Services
DVR Division
of Vocational Rehabilitation
EDP Electronic
Data Processing
EIS Equipment
Inventory System
FY Fiscal
Year
LAE Limitation
on Administrative Expenses
OIG Office
of the Inspector General
OMB Office
of Management and Budget
POMS Program
Operations Manual System
SEFA Schedule
of Expenditures of Federal Awards
SFY State
Fiscal Year
SSA Social
Security Administration
SSI Supplemental
Security Income
Our objective was to summarize categories of internal control weaknesses at State Disability Determination Services (DDS) reported in State single audits and identified during our single audit oversight activities. To accomplish our objective, we reviewed 103 single audits covering 53 DDSs and categorized findings that were identified as directly affecting DDS operations and crosscutting findings that potentially affect DDS operations. Of the 103 single audits, 25 reported direct findings and 89 reported crosscutting findings. Appendix A lists the 103 single audits reviewed and identifies those with direct and/or crosscutting findings.
BACKGROUND
On July 5, 1996, the President signed the Single Audit Act Amendments of 1996, Public Law No. 104-156. The Amendments extended the statutory audit requirement to nonprofit organizations and revised various provisions of the 1984 Single Audit Act, including raising the Federal financial assistance dollar threshold for requiring an audit from $100,000 to $300,000. On June 30, 1997, the Office of Management and Budget (OMB) issued revised Circular A-133, Audits of States, Local Governments, and Non-Profit Organizations, to implement the 1996 amendments. The revised Circular A-133 was effective July 1,1996 and applies to audits of fiscal years (FY) beginning after June 30, 1996. This Circular requires non-Federal entities that expend $300,000 or more per year in Federal awards to have a single or program-specific audit conducted for that year.
State DDSs
The Disability Insurance (DI) program was established in 1954 under title II of the Social Security Act to provide benefits to disabled wage earners and their families. In 1972, Congress enacted the Supplemental Security Income (SSI) program, to provide income and disability coverage to financially needy individuals who are aged, blind and/or disabled.
The Social Security Administration (SSA) is responsible for the policies on developing disability claims under the DI and SSI programs. According to Federal regulations, the DDS in each State generally performs disability determinations under the DI and SSI programs. In carrying out this function, the DDS is responsible for determining claimants’ disabilities and ensuring that adequate evidence is available to support its determinations. In those limited instances where SSA makes disability determinations, regulations provide that each State agency will obtain and furnish medical or other evidence and provide assistance as may be necessary for SSA to carry out its responsibility for making such determinations. SSA reimburses the DDS for 100 percent of allowable expenditures. There are a total of 54 DDSs in the 50 States, the District of Columbia, Puerto Rico, Guam, and the Virgin Islands.
Each DDS is managed by a State parent agency, which administers other State and Federal programs. There are also other agencies within the State that administer various aspects of Federal programs, such as cash draws and electronic data processing.
Direct and Crosscutting Findings
In conducting single audits, the auditor uses a risk-based approach to determine which Federal programs will receive audit coverage. The single audit also includes an audit of the State’s financial statements. The two parts of the single audit identify direct or crosscutting findings.
Direct findings are specifically identified to the Federal programs they affect. The direct SSA findings are identified in single audits by Catalog of Federal Domestic Assistance number 96. The single audits also report findings that impact more than one Federal program, referred to as crosscutting. However, crosscutting findings may not be identified to any one Federal program or may not be identified to all Federal programs. Thus, the auditor may not be in a position to identify findings for SSA-funded programs because of the limited scope of the single audit. While crosscutting findings are not specifically identified to SSA, they could impact DDS operations.
We reviewed 103 single audits as well as their related recommendations and auditee responses. Of the 103 single audits, 25 reported direct findings related to DDSs. These findings, questioned costs, and related recommendations were previously reported on a State-by-State basis to SSA’s Management Analysis and Audit Program Support Staff for resolution. In addition, 89 of the 103 single audits reported crosscutting findings that could possibly affect DDS operations. To identify crosscutting findings, we reviewed all findings reported for the State agency that managed the DDS and State agencies that performed functions for the DDS.
We also reviewed relevant provisions of the:
The Compliance Supplement identifies seven types of compliance requirements auditors should consider for the SSA programs in performing single audits. Our review of the 103 single audits identified common direct findings in 3 of the categories: cash management, equipment and real property management, and allowable costs. In addition to these categories, we identified crosscutting findings in the procurement and reporting categories. This report presents the findings by the related Compliance Supplement category.
Our analysis of the findings in 103 single audit reports disclosed direct and crosscutting findings in the cash management, equipment and real property management, and allowable cost categories. We also identified crosscutting findings in the procurement and reporting categories. All the findings relate to DDS’ noncompliance with Federal requirements because of a lack of adequate internal controls. Appendix B summarizes the 25 single audits with direct findings by DDS. Appendix C summarizes the 89 single audits with crosscutting findings by DDS.
Our audits at the Oregon, Connecticut, and Arizona DDSs disclosed findings in the cash management, procurement, equipment and real property management, reporting, and allowable cost categories. These findings also relate to DDS’ noncompliance with Federal requirements because of internal control weaknesses. Appendix D summarizes our audit findings.
In our opinion, a comparison of the Oregon, Connecticut, and Arizona DDS findings in the single audits and the OIG audits for the same reporting period disclosed significant differences. We reported findings on incorrect FY payments, excess cash draws, inconsistent accounting obligations, inadequate computer access and security controls, missing inventory records, inaccurate and inconsistent reporting, and unreasonable medical fees. The single audits for Oregon, Connecticut, and Arizona did not report these findings. We present this comparison for informational purposes only. We will report our comparison to the cognizant Federal agency, the Department of Health and Human Services, in a separate management letter for any action it deems appropriate.
The Congress enacted the CMIA of 1990 to ensure efficiency, effectiveness, and equity in transferring funds between the States and the Government. This Law requires the Government to enter into an agreement with States covering applicable Federal programs and to establish procedures and requirements for transferring Federal funds.
The CMIA requires the States to minimize the time between the receipt and disbursement of Federal funds and generally allows the Government to charge interest when a State receives Federal funds in advance of disbursements. The CMIA also generally allows the States to charge interest when State funds are paid out for Federal programs before Federal funds are made available. The States are supposed to calculate Federal and State interest liabilities for each applicable program and report liabilities to the Federal Government on the Annual Report to the U.S. Department of the Treasury.
Without cash management controls, States cannot identify and assess allowable cash needs. Without proper internal controls, DDSs may draw cash in excess of allowable expenditures.
Seven single audits reported direct findings related to States not adhering to CMIA agreements.
The State audits identified similar crosscutting cash management findings in 29 single audits (see Appendix C).
EQUIPMENT AND REAL PROPERTY MANAGEMENT
DDSs operate computer systems critical to the administration of SSA’s disability programs. These systems issue payments for administrative expenses and contain confidential claimant information, including Social Security numbers. SSA requires DDSs to develop, distribute, and implement a formal computer security policy addressing the confidentiality of sensitive information, data integrity, and authorized access to information.
A DDS’ computer security policy should identify computer access controls to ensure only authorized users access the system. Access controls include the use of personal identification numbers to identify users, passwords to authenticate the user’s identity, and profiles to specify the functions users can perform. Without proper access controls, the DDS is vulnerable to such security risks as the unauthorized use or sale of personal information and identity theft. Accidental or intentional modifications to confidential and sensitive information can adversely affect the quality of services and lead to unauthorized and inaccurate disbursements.
SSA’s Systems Security Handbook instructs DDSs to make every reasonable effort to avoid disruption of critical applications processed by automated data files and automated information systems (AIS) facilities. Furthermore, a DDS must also minimize, and be prepared to recover from, any disruption that occurs. Contingency plans should be documented as part of a DDS’ overall AIS security program. The lack of a contingency plan could cause a disruption of DDS claims processing and result in poor service to disability claimants.
Seven single audits disclosed direct findings related to weaknesses in computer controls, as follows.
In addition, policies and procedures for systems (1) development and maintenance were informal and did not provide appropriate segregation of duties among data processing personnel and (2) access by users and data processing personnel were inadequate (SFY 2000).
Similar crosscutting computer systems and applications findings were identified in 30 single audits (see Appendix C).
The DDSs are responsible for maintaining, labeling, and inventorying all property they acquire or that SSA furnishes it to perform the disability determination function. Inventory records of equipment must include (1) an item description, (2) source of funds used in the purchase, (3) unit cost, (4) inventory or serial number, (5) date purchased, and (6) physical location, including building address and room or floor location. The lack of proper controls over inventory could result in misappropriation or improper disposition of property acquired with Federal funds.
Five single audits identified direct findings related to weaknesses in equipment inventory.
Similar crosscutting property control findings were identified in 18 single audits (see Appendix C).
Allowable costs must be reasonable and necessary for proper and efficient performance and administration of Federal awards. A cost is allocable to a program or department if the goods or services involved are charged or assigned in accordance with benefits received. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose was allocated to the Federal award as an indirect cost. To recover indirect costs, the organization must prepare cost allocation plans or indirect cost rate proposals in accordance with guidelines provided in OMB Circulars. Costs must be net of all applicable credits that result from transactions reducing or offsetting direct or indirect costs.
Internal control directives require that non-Federal entities receiving Federal awards maintain effective control and accountability for funds and assets purchased with such funds. Transactions should be properly recorded, accounted for, and executed in compliance with applicable laws, regulations and the provisions of contracts or grant agreements that could have a direct and material effect on a Federal program. Also, funds, property, and other assets should be safeguarded against loss from unauthorized use or disposition.
The absence of controls over goods and services charged to Federal awards results in the risk of misappropriation or misuse of funds. In addition, unallowable activities or costs could be charged to a Federal program and not be detected in a timely manner if proper internal controls are not in place to ensure that costs benefit the program and are properly authorized and documented.
Nineteen single audits reported direct findings related to inadequate internal controls over allowable costs.
Crosscutting weaknesses related to allowable costs were disclosed in 62 single audits. The findings were in the following areas.
COMPARISON OF SINGLE AUDIT AND OIG FINDINGS
SSA OIG conducts audits of claims by DDSs for administrative costs based on the frequency of prior audits as well as annual referrals by SSA’s Office of Disability. Starting in FY 2002, we increased our audit coverage to provide for a more timely and effective review of administrative costs. We based this schedule on the following factors: (1) past administrative audits, (2) amount of costs, and (3) suggestions made by SSA. The audit frequency, based on total administrative costs incurred, is as follows.
Annual Administrative Cost Incurred by DDS |
Audit Frequency |
Over $50 million |
Every 3 years |
$20 to $50 million |
5 to 7 years |
Under $20 million |
7 to 10 years |
The objectives of the audits are to determine whether (1) expenditures and obligations are properly authorized and disbursed, (2) Federal funds drawn agree with total expenditures, and (3) internal controls over the accounting and reporting of administrative costs are adequate.
We performed administrative cost audits at the Oregon, Connecticut, and Arizona DDSs covering the same SFYs as the single audits discussed in this report. Our comparison of the direct single audit findings and OIG findings disclosed notable differences. Our findings were not identified in the single audits and therefore are discussed below.
Oregon DDS
Our audit of the Oregon DDS covered the period October 1995 through September 1998 and included any subsequent financial activities that affected those FYs as of December 31, 1999. The audit identified expenditures for rental payments reported in the wrong FY and excess cash draws (see Appendix D). The single audit did not report any direct findings for the Oregon DDS.
Connecticut DDS
Our audit of the Connecticut DDS covered the period October 1996 through September 1999, as reported to SSA as of December 31, 1999. The audit identified (1) expenditures reported in the wrong FY, (2) an unapproved office lease, and (3) weak computer security and access controls (see Appendix D). The single audit did not report any direct findings for the Connecticut DDS.
Arizona DDS
Our audit of the Arizona DDS covered the period October 1995 through September 1998 and included any subsequent financial activities that affected those FYs as of June 30, 1999. The audit identified (1) inconsistent accounting and reporting of obligations, (2) missing inventory records, and (3) unreasonable medical fees (see Appendix D). The single audit identified problems related to allowable costs (see Appendix B).
Conclusions and Recommendations
The first five recommendations listed below were presented to SSA in our prior single audit summary report. Therefore, SSA should not consider these new recommendations for its audit recommendation tracking system. We do, however, reaffirm our position that SSA should take corrective action by being proactive in providing internal control guidance to DDSs. To do so, SSA should provide the following instructions to DDSs.
AGENCY COMMENTS
In response to our draft report, SSA agreed with all of our recommendations and outlined the corrective action taken on each recommendation. See Appendix E for the full text of SSA's comments to our draft report.
Summary of Single Audit Findings
State |
State Fiscal Year |
Direct Findings |
Crosscutting Findings |
||||||||
Cash Management |
Procurement |
Equipment/Real Property Management |
Reporting |
Allowable Costs |
Cash Management |
Procurement3 |
Equipment/Real Property Management4 |
Reporting5 |
Allowable Costs |
||
Alabama |
1999/2000 |
X |
X |
X |
X |
||||||
Alaska |
1999/2000 |
X |
X |
||||||||
Arizona |
1999/2000 |
X |
X |
X |
X |
||||||
Arkansas |
1999/2000 |
||||||||||
California |
1999/2000 |
X |
X |
||||||||
Colorado |
1999/2000 |
X |
X |
X |
X |
||||||
Connecticut |
1999/2000 |
X |
X |
X |
X |
||||||
Delaware |
1999/2000 |
X |
X |
||||||||
District of Columbia |
1999 |
X |
|||||||||
Florida |
1999/2000 |
X |
X |
X |
|||||||
Georgia |
1999/2000 |
X |
X |
||||||||
Guam |
1999/2000 |
X |
X |
X |
X |
X |
|||||
Hawaii |
1999/2000 |
X |
X |
X |
|||||||
Idaho |
1999/2000 |
X |
X |
||||||||
Illinois |
1999/2000 |
X |
X |
X |
X |
X |
|||||
Indiana |
1999/2000 |
||||||||||
Iowa |
1999/2000 |
X |
|||||||||
Kansas |
1999/2000 |
X |
X |
||||||||
Kentucky |
1999/2000 |
X |
X |
X |
X |
X |
|||||
Louisiana |
1999/2000 |
X |
X |
X |
X |
||||||
Maine |
1999/2000 |
X |
X |
X |
|||||||
Maryland |
1999/2000 |
X |
X |
X |
|||||||
Massachusetts |
1999/2000 |
X |
X |
X |
X |
||||||
Michigan |
1999/2000 |
X |
X |
X |
|||||||
Minnesota |
1999/2000 |
X |
X |
X |
|||||||
Mississippi |
1999/2000 |
X |
X |
X |
X |
||||||
Missouri |
1999/2000 |
X |
|||||||||
Montana |
1998/1999 |
X |
X |
X |
X |
X |
|||||
Nebraska |
1999/2000 |
X |
|||||||||
Nevada7 |
1999/2000 |
||||||||||
New Hampshire |
1999/2000 |
X |
X |
X |
|||||||
New Jersey |
1999/2000 |
X |
|||||||||
New Mexico |
1999/2000 |
X |
X |
X |
|||||||
New York |
1999/2000 |
X |
X |
X |
X |
||||||
North Carolina |
1999/2000 |
X |
X |
X |
X |
X |
|||||
North Dakota |
1999/2000 |
X |
X |
||||||||
Ohio |
1999/2000 |
X |
X |
X |
X |
X |
|||||
Oklahoma |
1999/2000 |
X |
X |
X |
|||||||
Oregon |
1999/2000 |
X |
|||||||||
Pennsylvania |
1999/2000 |
X |
X |
X |
|||||||
Puerto Rico |
1997/1998/1999 |
X |
X |
X |
X |
X |
X |
X |
X |
||
Rhode Island |
1999/2000 |
X |
X |
X |
X |
X |
X |
X |
|||
South Carolina |
1999/2000 |
X |
X |
||||||||
South Dakota |
1999/2000 |
X |
X |
||||||||
Tennessee |
1999/2000 |
X |
X |
||||||||
Texas |
1999/2000 |
X |
|||||||||
Utah |
1999/2000 |
X |
X |
X |
|||||||
Vermont |
1999/2000 |
X |
X |
X |
|||||||
Virginia |
1999/2000 |
X |
X |
||||||||
Washington |
1999/2000 |
X |
X |
||||||||
West Virginia |
1999/2000 |
X |
X |
||||||||
Wisconsin |
1999/2000 |
X |
X |
X |
|||||||
Wyoming7 |
1999/2000 |
Note: See page A-1 for explanation of footnotes 1 through 7.
Direct Findings Reported in 25 Single Audits
STATE |
DIRECT FINDINGS |
QUESTIONED COSTS |
Alabama |
The parent agency for the Alabama Disability Determination Services (DDS), the Department of Education (DoE), had not developed a formal contingency plan to be followed in the event of a disaster that adversely affects the operations of its in-house data processing center. |
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
Alabama |
The DoE had informal policies and procedures for systems development and maintenance and did not provide appropriate segregation of duties among data processing personnel. |
$0 |
|
$0 |
|
|
$0 |
|
Arizona 1999 |
The cost allocation plan for the parent agency of the Arizona DDS, the Department of Economic Security (DES), did not include all equipment purchases in the allocation base. As a result, costs were not properly allocated to Federal programs. |
$0 |
Colorado 2000 |
The parent agency for the Colorado DDS, the Department of Human Services (DHS), did not make timely payments to providers who perform medical examinations of disability claimants. Fifty-three percent of payments tested were made 45 or more days after DDS staff received the invoice. |
$0 |
|
$0 |
|
|
$0 |
|
Florida 2000 |
Salary costs for a DDS employee who performed non-SSA work were inappropriately charged to SSA. |
$22,607 |
|
$151,005 |
|
Georgia 2000 |
The parent agency for the Georgia DDS, the DHS, did not follow established guidelines for maintaining equipment inventory. |
$0 |
Illinois 1999 |
The Illinois DDS did not have an approved Memorandum of Understanding with SSA outlining the specifics of its non-SSA work. Furthermore, the DDS did not have a methodology for allocating costs of the non-SSA work between the State and Federal program. |
$90,000 |
|
$0 |
|
|
$12,994 |
|
Illinois 2000 |
DHS did not have a certification process in place to verify that DDS employees worked solely on SSA’s disability programs as required by OMB Circular A-87. |
$0 |
Kentucky 1999 |
The Kentucky DDS did not have formalized policies and procedures in place to control its Wang system program modifications. Specifically, a lack of segregation of duties existed between the DDS’ systems support and program control personnel. |
$0 |
Michigan 2000 |
On the Schedule of Expenditures of Federal Awards, the Michigan DDS’ parent agency, the Family Independence Agency, did not list the Disability Insurance (DI) program, Catalog of Federal Domestic Assistance number 96.001, as an individual grant of the DI/Supplemental Security Income cluster and did not report the correct Federal assistance program title for the DI program. |
$0 |
|
$9,186 |
|
Minnesota 2000 |
Some employees at the DES, the parent agency for the Minnesota DDS, had inappropriate access to mainframe data. |
$0 |
|
$0 |
|
Mississippi 1999 |
Personnel costs of DDS employees who performed non-SSA work were inappropriately charged to SSA. |
$0 |
|
$0 |
|
Montana 1999 |
The parent agency for the Montana DDS, the Department of Public Health and Human Services’ (DPHHS), did not have a financial management control structure adequate to prevent or detect all errors. Therefore, DPHHS could not ensure payments were made for allowable purposes. Specifically, DPHHS’ inefficient transaction processing did not accurately support Federal reporting, demonstrate accurate allocation of costs between State and Federal programs, and prevent discrepancies from existing between the State’s primary accounting system and DPHHS’ subsystems. |
$0 |
New Mexico 1999 |
The new accounting system for the New Mexico DDS was not properly designed to allow reconciliation of DDS encumbrances and related expenditures. |
$0 |
|
$0 |
|
New Mexico 2000 |
The accounting system for the New Mexico DDS did not allow reconciliation of DDS encumbrances and related expenditures with the States’ accounting system. |
$0 |
|
$0 |
|
New York 1999 |
The parent agency for the New York DDS, the Department of Social Services (DSS), did not follow cost allocation methodology procedures set forth in OMB Circular A-87. |
$0 |
|
$475,785 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
New York 2000 |
DSS incorrectly recorded salaries in the State’s payroll system because of errors in employee timesheets. |
$4,263 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
Oklahoma 2000 |
The parent agency for the Oklahoma DDS, the DRS, did not have a disaster recovery plan to be followed in the event of a disaster that adversely affects the Department's operations. |
$0 |
|
$0 |
|
|
$0 |
|
Puerto Rico 1997 |
The parent agency for the Puerto Rico DDS, the Department of the Family (DoF), paid an employee above the authorized salary. The auditors estimated that questioned costs for improper salary payments could be in excess of $10,000. |
$725 |
|
$939,771 |
|
|
$0 |
|
|
$753,217 |
|
Puerto Rico 1998 |
DoF did not reconcile physical inventory results with the accounting records, or maintain accurate records for acquisitions and dispositions of property acquired with SSA funds. |
$0 |
|
$0 |
|
|
$170,768 |
|
Puerto Rico 1999 |
DoF claimed expenditures on the Financial Status Report that were greater than amounts recorded in the general ledger. |
$899,764
|
|
$4,214,001 |
|
|
$172,354 |
|
|
$0 |
|
Rhode Island 1999 |
The parent agency for the Rhode Island DDS, the DHS, did not have a statewide inventory system and related controls for its fixed assets. |
$0 |
|
$0 |
|
Rhode Island 2000 |
DHS allocated central service costs to various Federal programs, including SSA’s disability programs, based on an estimated amount. Once actual amounts were available, DHS adjusted current year charges to account for the overcharge in previous fiscal years. |
$0 |
|
$0 |
|
|
$0 |
|
West Virginia 2000 |
The parent agency for the West Virginia DDS, the DRS, did not properly apply or code indirect costs to the disability program. |
$1,552,922 |
Wisconsin 2000 |
SSA might have reimbursed the parent agency for the Wisconsin DDS, the Division of Vocational Rehabilitation (DVR), for client rehabilitation services based on incorrect administrative costs. The auditors could not determine how SSA’s reimbursement amount was calculated because DVR did not retain the supporting documentation. |
$0 |
Total Questioned Costs |
$9,469,362 |
Appendix
C
Crosscutting Findings Reported in 89 Single Audits
STATE |
CROSSCUTTING FINDINGS |
QUESTIONED COSTS |
Alabama 1999/2000 |
|
$0 |
|
$0 |
|
Alaska 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
Arizona 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
California 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
Colorado 1999/2000 |
|
$0 |
|
$0 |
|
|
|
$0 |
|
$0 |
|
|
$0 |
|
Connecticut 1999/2000 |
|
$0 |
Note: See page C-1 for footnote explanation. |
||
Connecticut 1999/2000 (Continued) |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
Delaware 1999/2000 |
|
$0 |
|
$0 |
|
District of Columbia 1999
|
|
$0 |
Florida 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
Note: See page C-1 for footnote explanation. |
||
Georgia 1999/2000 |
|
$0 |
|
$0 |
|
Guam 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$125,516 |
|
|
$0 |
|
|
$6,397,029 |
|
|
$38,380 |
|
|
$88,287 |
|
|
$0 |
|
|
$7,146,869 |
|
Note: See page C-1 for footnote explanation. |
||
Hawaii 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
Idaho 1999/2000 |
|
$13,000 |
|
$0 |
|
Illinois 1999 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
Note: See page C-1 for footnote explanation. |
||
Illinois 1999 (Continued) |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
Iowa 1999/2000
|
|
$0 |
Kansas 1999/2000 |
|
$0 |
|
$0 |
|
Kentucky 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
Note: See page C-1 for footnote explanation. |
||
Kentucky 1999/2000 (Continued) |
|
$74,185 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
Louisiana 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$48,226 |
|
Note: See page C-1 for footnote explanation. |
||
Maine 1999/2000 |
|
$0 |
|
$963,687 |
|
|
$415,757 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
Maryland 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
Note: See page C-1 for footnote explanation. |
||
Massachusetts 1999/2000 |
|
$$ |
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
Michigan 2000 |
|
$0 |
|
$0 |
|
Minnesota 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
Note: See page C-1 for footnote explanation. |
||
Mississippi 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
Missouri 2000 |
|
$0
|
Montana 1999 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
Nebraska 1999/2000 |
|
$6,566 |
|
$0 |
|
New Hampshire 1999/2000 |
|
$0 |
|
$0 |
|
|
$8,427 |
|
|
$5,932 |
|
Note: See page C-1 for footnote explanation. |
||
New Jersey 2000 |
|
$0 |
New Mexico 1999/2000 |
|
$0 |
New York 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
North Carolina 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$60,000 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
Note: See page C-1 for footnote explanation. |
||
North Carolina 1999/2000 (Continued) |
|
$922,000 |
|
$0 |
|
|
$8,451 |
|
|
$0 |
|
|
$0 |
|
North Dakota 2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
Ohio 1999/2000 |
|
$0 |
|
$0 |
|
|
$747,972 |
|
|
$106,189 |
|
|
$0 |
|
|
$0 |
|
|
$151,164 |
|
Note: See page C-1 for footnote explanation. |
||
Oklahoma 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
Oregon 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
Pennsylvania 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
Puerto Rico 1997/1998/ |
|
$0 |
1999 |
|
$42,578 |
|
$0 |
|
|
$7,552,548 |
|
Note: See page C-1 for footnote explanation. |
||
Puerto Rico 1997/1998/ 1999 (Continued) |
|
$0 |
|
$2,700,019 |
|
|
$793,439 |
|
|
$0 |
|
|
$4,362,699 |
|
|
$90,637 |
|
|
$0 |
|
|
$3,334,758 |
|
|
$39,651 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$12,500 |
|
|
$81,318 |
|
Note: See page C-1 for footnote explanation. |
||
Puerto Rico 1997/1998/ 1999 (Continued) |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
Rhode Island 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$32,801 |
|
|
$0 |
|
|
$20,369 |
|
|
$0 |
|
Note: See page C-1 for footnote explanation. |
||
South Carolina 1999/2000 |
|
$0 |
|
$0 |
|
|
$63,990 |
|
|
$0 |
|
South Dakota 1999/2000 |
|
$0 |
|
$0 |
|
Tennessee 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
Texas 1999 |
|
$0 |
Note: See page C-1 for footnote explanation. |
||
Utah 1999/2000 |
|
$0 |
|
$147,158 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
Vermont 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
Virginia 1999/2000 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
Washington 2000 |
|
$0 |
Note: See page C-1 for footnote explanation. |
||
West Virginia 1999/2000 |
|
$0 |
Wisconsin 1999 |
|
$0 |
|
$0 |
|
|
$0 |
|
|
$0 |
|
|
$0 |
|
Total Questioned Costs |
$36,602,102 |
|
Note: See page C-1 for footnote explanation. |
Findings We Identified During the Same Time Frame as the Single Audits Reviewed
OIG AUDIT |
OFFICE OF THE INSPECTOR GENERAL (OIG) FINDINGS |
QUESTIONED COSTS |
Audit of the Administrative Costs Claimed by the Oregon Disability Determination Services (A-15-99-52021) |
|
$0
$27,544
|
Audit of the Administrative Costs Claimed by the Connecticut Disability Determination Services (A-15-00-30016) |
|
$0
$0 $0
$0 |
Audit of the Administrative Costs Claimed by the Arizona Department of Economic Security for its Disability Determination Services Administration (A-15-99-51009) |
|
$413,292
$249,560
$0 $0
|
Total Questioned Costs |
$690,396 |
Appendix E
Agency Comments
MEMORANDUM |
Date: |
September 16, 2002 |
|
To: |
James
G. Huse, Jr. |
From: |
Larry
W. Dye |
Subject: |
Office of the Inspector General (OIG) Draft Management Advisory Report "Summary of Single Audit Oversight Activities," A-07-02-32035—INFORMATION |
We appreciate the OIG’s efforts in analyzing single audits for this review. Our comments on the draft management advisory report recommendations are attached.
Staff questions may be referred to Janet Carbonara on extension 53568.
COMMENTS ON THE OFFICE OF THE INSPECTOR GENERAL’S (OIG) DRAFT MANAGEMENT ADVISORY REPORT, "SUMMARY OF SINGLE AUDIT OVERSIGHT ACTIVITIES" (A-07-02-32035)
Thank you for the opportunity to review this OIG draft Management Advisory Report. The first five recommendations are from a prior single audit summary report (A-07-00-10032) and were implemented in August 2001 (recommendation 3) and October 2001 (recommendations 1, 2, 4 and 5). Information about the actions taken is provided below, along with our response to recommendation six.
Recommendation 1
SSA should provide instructions to the Disability Determination Services (DDS) to adhere to the terms of the Cash Management Improvement Act (CMIA) agreement.
Comment
SSA issued a DDS Administrators Letter on October 4, 2001 reminding the States to adhere to the terms of their CMIA agreements. Since the CMIA agreements are between the States and the Department of the Treasury (DT), SSA has a limited role with respect to these agreements. Therefore, we suggest that the OIG bring the results of its review on this matter to the attention of the DT Inspector General for follow-up action by that agency.
Recommendation 2
SSA should provide instructions to the DDSs to implement controls to prevent unauthorized computer access.
Comment
SSA issued a Regional Commissioners memorandum and a DDS Administrators Letter regarding DDS security on October 4, 2001. This document provided comprehensive guidance to the DDSs and regional offices regarding a number of security areas. Compliance with that document is being monitored through annual DDS self-reviews, regional security audits and PricewaterhouseCoopers security audits. In addition, the Agency has been working closely with the DDSs to develop systems risk models for the AS/400 and WANG systems, as well as installing monitoring software to check for compliance to critical systems setting. SSA will continue its efforts to prevent unauthorized computer access.
Recommendation 3
SSA should provide instructions to the DDSs to develop a formal contingency plan to be followed in the event of a disaster that adversely affects operations.
Comment
SSA issued a DDS Administrators Letter on August 6, 2001, transmitting the "Final DDS Security Document" which covers developing a formal contingency plan to prevent disruption of services in the event of a disaster. SSA will continue to work with the DDSs to ensure adherence.
Recommendation 4
SSA should provide instructions to the DDSs to maintain complete and accurate equipment inventory records and perform periodic physical inventories.
Comment
SSA issued a DDS Administrators Letter on October 4, 2001 reminding the States to maintain complete and accurate equipment inventory records and to perform periodic physical inventories.
Recommendation 5
SSA should provide instructions to the DDSs to ensure that costs charged to SSA benefit its programs and are properly authorized and documented.
Comment
SSA issued a DDS Administrators Letter on October 4, 2001 reminding the States to ensure that costs charged to SSA benefit its programs and are properly authorized and documented.
Recommendation 6
SSA should provide instructions to the DDSs to implement controls to ensure that non-SSA work costs are properly accounted for and reported.
Comment
SSA has revised and updated the Program Operations Manual System (POMS) DI 39563.210f and circulated it to all the regions for comments, which are currently being reviewed. The POMS emphasizes that a Memorandum of Understanding (MOU) between SSA and the State is necessary when the DDS will be processing non-SSA work. At a minimum the MOU must include:
Appendix F
OIG Contacts and Staff Acknowledgments
OIG Contacts
Francis
W. Fernandez, Director, Western Audit Division (510) 970-1739
Mark
Bailey, Deputy Director, Western Audit Division (816) 936-5591
Acknowledgments
In addition to those named above:
Shannon
Agee, Lead Auditor
Wanda
Craig, Auditor
Kim
Beauchamp, Writer-Editor
For additional copies of this report, please visit our web site at www.socialsecurity.gov/oig or contact the Office of the Inspector General’s Public Affairs Specialist at (410) 966-1375. Refer to Common Identification Number A-07-02-32035.
Overview of the Office of the Inspector General
Office of Audit
The Office of Audit (OA) conducts comprehensive financial and performance audits of the Social Security Administration’s (SSA) programs and makes recommendations to ensure that program objectives are achieved effectively and efficiently. Financial audits, required by the Chief Financial Officers' Act of 1990, assess whether SSA’s financial statements fairly present the Agency’s financial position, results of operations and cash flow. Performance audits review the economy, efficiency and effectiveness of SSA’s programs. OA also conducts short-term management and program evaluations focused on issues of concern to SSA, Congress and the general public. Evaluations often focus on identifying and recommending ways to prevent and minimize program fraud and inefficiency, rather than detecting problems after they occur.
Office of Executive Operations
The Office of Executive Operations (OEO) provides four functions for the Office of the Inspector General (OIG) – administrative support, strategic planning, quality assurance, and public affairs. OEO supports the OIG components by providing information resources management; systems security; and the coordination of budget, procurement, telecommunications, facilities and equipment, and human resources. In addition, this Office coordinates and is responsible for the OIG’s strategic planning function and the development and implementation of performance measures required by the Government Performance and Results Act. The quality assurance division performs internal reviews to ensure that OIG offices nationwide hold themselves to the same rigorous standards that we expect from the Agency. This division also conducts employee investigations within OIG. The public affairs team communicates OIG’s planned and current activities and the results to the Commissioner and Congress, as well as other entities.
Office of Investigations
The Office of Investigations (OI) conducts and coordinates investigative activity related to fraud, waste, abuse, and mismanagement of SSA programs and operations. This includes wrongdoing by applicants, beneficiaries, contractors, physicians, interpreters, representative payees, third parties, and by SSA employees in the performance of their duties. OI also conducts joint investigations with other Federal, State, and local law enforcement agencies.
Counsel to the Inspector General
The Counsel to the Inspector General provides legal advice and counsel to the Inspector General on various matters, including: 1) statutes, regulations, legislation, and policy directives governing the administration of SSA’s programs; 2) investigative procedures and techniques; and 3) legal implications and conclusions to be drawn from audit and investigative material produced by the OIG. The Counsel’s office also administers the civil monetary penalty program.