OFFICE OF THE INSPECTOR GENERAL

SOCIAL SECURITY ADMINISTRATION

ADMINISTRATIVE COSTS CLAIMED

BY THE MARYLAND DISABILITY
DETERMINATION SERVICES

February 2007 A-13-06-16029

AUDIT REPORT

Mission

By conducting independent and objective audits, evaluations and investigations, we inspire public confidence in the integrity and security of SSA’s programs and operations and protect them against fraud, waste and abuse. We provide timely, useful and reliable information and advice to Administration officials, Congress and the public.

Authority

The Inspector General Act created independent audit and investigative units, called the Office of Inspector General (OIG). The mission of the OIG, as spelled out in the Act, is to:

Conduct and supervise independent and objective audits and investigations relating to agency programs and operations.

Promote economy, effectiveness, and efficiency within the agency.

Prevent and detect fraud, waste, and abuse in agency programs and operations.

Review and make recommendations regarding existing and proposed legislation and regulations relating to agency programs and operations.

Keep the agency head and the Congress fully and currently informed of problems in agency programs and operations.

To ensure objectivity, the IG Act empowers the IG with:

Independence to determine what reviews to perform.

Access to all information necessary for the reviews.

Authority to publish findings and recommendations based on the reviews.

Vision

We strive for continual improvement in SSA’s programs, operations and management by proactively seeking new ways to prevent and deter fraud, waste and abuse. We commit to integrity and excellence by supporting an environment that provides a valuable public service while encouraging employee development and retention and fostering diversity and innovation.

MEMORANDUM

Date: February 5, 2007 Refer To:

To: Laurie Watkins

Regional Commissioner

Philadelphia

From: Inspector General

Subject: Administrative Costs Claimed by the Maryland Disability Determination Services
(A-13-06-16029)

OBJECTIVE

The objectives of our audit were to (1) evaluate the Maryland Disability Determination Services' (MD-DDS) internal controls over the accounting and reporting of administrative costs, (2) determine whether costs claimed for Federal Fiscal Years (FFY) 2003 and 2004 were allowable and properly allocated and funds were properly drawn, and (3) assess limited areas of the general security controls environment.

BACKGROUND

Disability Determination Services (DDS) in each State or other responsible jurisdiction perform disability determinations under the Disability Insurance and Supplemental Security Income programs. Such determinations are performed in accordance with Federal law and underlying regulations.[1] In carrying out its obligation, each DDS is responsible for determining claimants' disabilities and ensuring adequate evidence is available to support its determinations.[2]

The Social Security Administration (SSA) reimburses the DDS for 100 percent of allowable and allocable program expenditures up to the limit of its funding authority. The DDS obtains Federal funds through the U.S. Department of the Treasury's (Treasury) Automated Standard Application for Payments system. These funds are obtained in

accordance with Federal regulations[3] and an intergovernmental agreement entered into by Treasury and the State of Maryland under the Cash Management Improvement Act of 1990 (CMIA).[4] CMIA provides the general rules and procedures for the efficient transfer of Federal financial assistance between the Federal Government and the States. This process is often referred to as the draw down of Federal funds.

MD-DDS is located in Timonium, Maryland, and is a component of the Maryland State Department of Education (MSDE), Division of Rehabilitation Services (DORS). MSDE and DORS provide administrative and accounting services for MD-DDS. MSDE also draws down Federal funds to reimburse the State of Maryland for the expenses incurred by MD-DDS. Treasury transfers funds to the State Treasurer. The State's indirect costs for MD-DDS are determined based on rates negotiated and approved by the U.S. Department of Education. See Appendix B for our scope and methodology.

The State Agency Report of Obligations for SSA Disability Programs (Form SSA-4513) reports obligations for personnel service, medical, indirect, and all other nonpersonnel costs. For these costs, MD-DDS reported program disbursements and unliquidated obligations to SSA on Forms SSA 4513, as shown in Table 1.

Table 1: MD-DDS Report of Disbursements and Unliquidated Obligations

FFYs 2003 and 2004

Reporting Item	FFY 2003 as of September 30, 2004	FFY 2004 as of September 30, 2005
Disbursements
Personnel	$13,093,437	$13,350,837
Medical	$6,420,884	$6,649,175
Indirect Costs	$2,428,102	$2,252,851
Other	$1,971,725	$2,015,305
Total Disbursements	$23,914,148	$24,268,168
Unliquidated Obligations	$0	$0

RESULTS OF REVIEW

Generally, MD-DDS had effective internal controls over the accounting and reporting of administrative costs. Costs it claimed during our audit period were allowable and properly allocated. However, MD-DDS can improve cash management. Specifically, we found MD-DDS obtained Federal funds in excess of its expenditures. In addition, we found MD-DDS’ general security controls were generally effective. However, MD-DDS can improve its general security controls. For example, MD-DDS did not comply with policies on intrusion detection and access restrictions for employees and contractors. In addition, MD-DDS did not comply with policies concerning the Disaster Recovery Plan (DRP) and security awareness training.

cash management

Draw Down of Federal Funds

We found the draw down of Federal funds sometimes exceeded MD-DDS’ expenditures. Federal regulations state, “A State and Federal Program Agency must limit the amount of funds transferred to the minimum required to meet a State's actual and immediate cash needs.”[5] MD-DDS started drawing excess Federal funds in November 2004. In December 2004, the excess drawdowns totaled $303,600. In June 2005, after the close of FFY 2004, the MD-DDS was still overdrawn by $99,621.

Since we identified excess drawdowns for FFY 2004 expenditures and excess drawdowns in a prior audit,[6] we also reviewed FFY 2002 drawdowns. MD-DDS started drawing excess Federal funds in October 2002. In December 2002, the excess drawdowns totaled $330,520. In March 2004, after the close of FFY 2002, the MD-DDS was still overdrawn by $52,020. The total amount of drawdowns of Federal funds exceeding MD-DDS’ expenditures for FFYs 2002 and 2004 totaled $151,641
(see Table 2).

Table 2: Analysis of Excess Federal Funds

FFYs 2002 - 2004

	FFY 2002	FFY 2003	FFY 2004	TOTAL
Federal Funds Obtained	$21,430,821	$23,914,148	$24,368,098	$69,713,067
DDS Expenditures	$21,378,801	$23,914,148	$24,268,477	$69,561,426
Excess Federal Funds	$52,020	$0	$99,621	$151,641

The excess drawdown of FFY 2004 Federal funds occurred because internal controls between MSDE and DORS were not effective. Communications between MSDE, the component that draws down funds, and DORS, the component that records the expenditures, was inadequate.

SSA’s portion of the single audit of the State of Maryland for the FY ended

June 30, 2005 reported an issue related to the drawdown of funds.[7] It was reported that the MSDE did not properly reconcile the financial statements with the general ledger balances, which resulted in incorrect receivable balances being carried forward each year. As a result, the accuracy of the Federal cash draws may have been impacted. The auditors recommended, “…that MSDE perform quarterly reconciliations of amounts drawn and expended to properly determine the balance due from or payable to the Federal Government on a federal program basis.”

We discussed the excess drawdown of Federal funds with SSA and State officials. State officials returned the excess FFY 2002 and 2004 funds in April 2006. We verified MSDE returned the funds.

General security CONTROLS

Access Controls

Access controls are an essential element of a general security controls environment to ensure that only authorized individuals have access to specified facilities and/or sensitive information. SSA's policies and procedures identify several protocols that DDSs implement for intrusion detection and access restrictions for employees and contractors. MD-DDS did not comply with certain SSA policies and procedures for intrusion detection and restricting employee and contractor access. Lack of access controls increases the risk of unauthorized access and loss of sensitive information and equipment. We discussed the details of these conditions with MD‑DDS, MSDE, and DORS management.

For example, we found contractor employees provided cleaning services at the

MD-DDS office during nonwork hours, and sensitive documents were not secured overnight. SSA policy requires that the office be cleaned during work hours. If daytime cleaning is not possible, the DDS should take extra care to ensure sensitive documents (for example, medical reports and folders) are secured overnight.[8] Unsecured sensitive documents increase the risk of loss of sensitive information.

We discussed this issue with MD-DDS officials, who stated offices were cleaned during nonwork hours to prevent cleaning staff from interrupting MD-DDS employees during work hours. Officials explained this was done as described in the lease agreement. Further, officials informed us MD-DDS did not practice the clean desk policy, as required by SSA policy.[9] Although officials indicated the contractor employees were bonded, we do not believe this is an adequate management control. We believe MD‑DDS officials should comply with SSA policy for cleaning services.

Disaster Recovery Plan

MD-DDS did not comply with SSA’s policies for the DRP. The DRP did not identify, as required, the local resources needed to operate in the event of a disaster. For example, the MD-DDS plan did not identify people, equipment, computers, lines, telephones, chairs, desks, office supplies, and facilities needed. SSA policy requires that the DRP document local DDS data and personnel information vital to disaster recovery. An incomplete DRP increases the risk MD-DDS may not perform critical DDS operations after a disaster. MD-DDS officials said they would update the DRP to identify local resources needed to operate in the event of a disaster.

Security Awareness Training

MD-DDS security awareness training did not comply with SSA’s policies. Employees and contractors did not receive annual security awareness training, and MD-DDS did not document training information in its Systems Security Awareness and Training Plan (Training Plan). SSA policy requires that the Training Plan include a schedule for annual security awareness training. Lack of security awareness training increases the risk of unauthorized access to and loss of sensitive information and equipment. MD‑DDS officials stated the training would occur and be documented in the Training Plan.

CONCLUSION AND RECOMMENDATIONS

Generally, MD-DDS had effective internal controls over the accounting and reporting of administrative costs. Costs it claimed during our audit period were allowable and properly allocated. In addition, we found the MD-DDS general security controls environment was generally effective. However, MD-DDS could improve its cash management and some general security controls.

We recommend SSA instruct MD-DDS to:

1. Work with MSDE and DORS to improve cash management controls.

2. Comply with SSA’s policies related to intrusion detection, access restrictions for employees and contractor cleaning services, disaster recovery planning, and security awareness training.

SSA AND STATE AGENCY COMMENTS

SSA and the State agency agreed with our recommendations. The full texts of the comments are included in Appendices C and D.

Patrick P. O’Carroll, Jr.

Appendix B

Scope and Methodology

SCOPE

To achieve our objectives, we:

· Reviewed applicable Federal laws and regulations, pertinent parts of the Social Security Administration’s (SSA) Program Operations Manual System and other criteria relevant to administrative costs claimed by Maryland Disability Determination Services (MD-DDS) and drawdowns of SSA program funds.

· Interviewed staff and officials from MD-DDS; Maryland State Department of Education (MSDE), Division of Rehabilitation Services (DORS); and SSA’s Philadelphia Regional Office.

· Reviewed the State of Maryland Statewide Single Audit reports for the years ending June 30, 2003 and June 30, 2005.

· Reviewed State of Maryland policies and procedures related to personnel, medical services, and all other nonpersonnel costs.

· Obtained an understanding of the internal control structure to plan the audit and to determine the nature, timing, and extent of the tests to be performed.

· Reconciled State of Maryland accounting records to the administrative costs reported by MD-DDS on the State Agency Report of Obligations for SSA Disability Programs (Form SSA-4513) for Federal Fiscal Years (FFY) 2003 and 2004. · Reviewed the administrative costs MD-DDS reported on its Forms SSA 4513 for FFYs 2003 and 2004. · Examined certain administrative expenditures (personnel, medical services, and all other nonpersonnel costs) incurred and claimed by MD-DDS for FFYs 2003 and 2004 on the Forms SSA-4513. · Selected statistical samples of personnel, medical services, and all other nonpersonnel costs as described in the sampling methodology section on page B-2. · Examined the indirect costs claimed by MD-DDS for FFYs 2003 and 2004. · Discussed indirect costs with an official from the U.S. Department of Education, which is the cognizant agency for the State of Maryland. · Compared the amount of SSA funds drawn for support of program operations to the expenditures reported on the Forms SSA-4513 for FFYs 2002, 2003, and 2004. · Reviewed MD-DDS’ general physical security controls at their office in Timonium, Maryland.

We concluded the electronic data used in our audit were sufficiently reliable to achieve our audit objectives. We assessed the reliability of the electronic data by reconciling them with the costs claimed on the Form SSA-4513. We also conducted detailed audit testing on selected data elements from the electronic files.

We performed work at the MD-DDS in Timonium, Maryland, as well as DORS and MSDE in Baltimore, Maryland. We conducted fieldwork from February through October 2006. Our audit was conducted in accordance with generally accepted government auditing standards.

SAMPLING METHODOLOGYOur sampling methodology encompassed the four general areas of costs as reported on Form SSA-4513: (1) personnel, (2) medical, (3) indirect, and (4) all other nonpersonnel costs. We obtained data extracts from MD-DDS for FFYs 2003 and 2004 to use in statistical sampling. Additionally, we randomly selected a month from the 2‑year audit period and reviewed supporting documents for all Medical Consultants under contract to MD-DDS. Personnel CostsWe randomly selected 1 pay period in FFY 2004 and reviewed 50 personnel transactions for the pay period. We tested MD-DDS payroll records to ensure MD-DDS correctly paid employees and adequately documented these payments.For medical consultant costs, we randomly selected one pay period in FFY 2004. We selected all medical consultants during that period and verified the medical consultants were paid in accordance with the approved contract. Medical Costs

We tested medical service costs by selecting 60 records from FFYs 2003 and 2004, and reviewed the processed Medical Evidence of Record (MER) and Consultative Examination (CE) vouchers. MER/CE records are included in one object code; therefore, we based our selection on a $50 cut-off per transaction as outlined below. Typically, MERs are less than $51.

		FFY 2003		FFY 2004
	Transaction Amount	Sample Size	Number of Transactions	Sample Size	Number of Transactions
	$0 - $50	30	59,096	30	62,817
	Over $50	30	29,377	30	30,708
Total		60	88,473	60	93,525

Indirect Costs

We determined the State Wide Indirect Cost Allocation to the parent agency was performed using a Fixed Basis Cost Allocation Agreement approved by the cognizant Federal agency (U.S. Department of Education). The amount allocated to each State department and agency was based on estimated central service costs. In a subsequent State Fiscal Year, the cognizant agency compared the actual costs for that year with the estimated costs and adjusted the future year rate to compensate for the difference. The Cost Allocation Agreement states that costs allocated to the State departments and agencies under the agreement are approved for further allocation to Federal grants, contracts, and other agreements performed at those departments and agencies. We reviewed the State-Wide Allocation for FFYs 2003 and 2004, to verify that the State used the approved fixed amount to allocate central service costs to the DDS. All Other Nonpersonnel Costs

We selected a stratified random sample of 100 items (50 items from each FFY) from the All Other Non-personnel Costs category. Before selecting the sample items, we stratified the transactions into the following categories: (1) Occupancy, (2) Contracted Costs, (3) Electronic Data Processing (EDP) Maintenance, (4) New EDP Equipment/Upgrades, (5) Equipment Purchases, (6) Equipment Rental, (7) Communications, (8) Applicant Travel, (9) Disability Determination Service Travel, (10) Supplies, and (11) Miscellaneous. We then distributed the 50 sample items for each year between categories based on the proportional distribution of the costs.

Appendix C

Social Security Administration Comments

January 12, 2007 Administrative Costs Claimed by the Maryland Disability Determination Services (A-13-06-16029) - Response Thank you for the opportunity to provide comments on the recommendations contained in the audit of the Administrative Cost Claimed by the Maryland Disability Determination Services (MD DDS) (A-13-06-1-6029) for Fiscal Years ending 2003 and 2004. The response shown below incorporates the MD DDS response to the draft report. Recommendation #1: Work with the Maryland State Department of Education (MSDE) and the Division of Rehabilitation Services (DORS) to improve cash management controls. Response: The DDS, DORS, and MSDE accounting personnel reviewed and revised existing cash management controls to ensure the proper draw down of Federal funds. The revised procedures require that accounting staff from the three entities meet on a quarterly basis to reconcile federal reports to the State's financial system. This finding is resolved. Recommendation #2:Comply with SSA’s policies related to intrusion detection, access restrictions for employees and contractor cleaning services, disaster recovery planning, and security awareness training. Response:

· Intrusion Detection

Modifications are required to several perimeter doors to comply with SSA’s policy requiring non-rising hinge pins. MD DDS has contacted the landlord with a proposal to correct the required door hinges and to redesign the entrance into the office. An estimate of $15,000 was received for these modifications. The funding request is pending SSA's budget approval.

· Access Restriction for Employees

Modifications are required to reset access to all secure areas when authorized personnel resign. The MD DDS has implemented new procedures to reset the Intrusion Detection System (IDS) key code with any future resignations of staff who have authorized access. This finding is resolved.

· Contractor Cleaning Services

The DDS is implementing a clean desk policy effective January 12, 2007, that will require all staff to place claimant records and folders in locked drawers, cabinets, or rooms before leaving for the day. In addition, the DDS will investigate the possibility of amending their existing lease to provide daytime cleaning. This finding is resolved.

· Disaster Recovery Planning

The MD DDS has updated their Disaster Recover Plan (DRP) to identify the local resources required for continued operations in the event of a disaster. The revised DRP was submitted to and reviewed by the Center for Disability Programs. This finding is resolved.

· Security Awareness Training

Annual Security Awareness Training was developed for all employees and contractors of the MD DDS, and added to the Systems Security Awareness and Training Plan section of the DDS Security Plan. A copy of the program was reviewed by the SSA Regional Office and found to comply with SSA policies. Security Awareness Training was conducted for all staff during the week of November 27, 2006 and will be repeated annually.

Should you have any questions regarding this response, please contact Betty Martin (215-597-2047) in the Philadelphia Region Center for Disability Programs.

[1] 42 United States Code (U.S.C.) § 421; 20 Code of Federal Regulations (C.F.R.) §§ 404.1601 et seq. and 416.1001 et seq.

[2] 20 C.F.R. §§ 404.1613(a), 404.1614(b), 416.1013(a) and 416.1014(a).

[6] Our June 1997 Audit of Administrative Costs Claimed by the Maryland Department of Education for its Disability Determination Services (A-13-96-25000), reported the DDS’ drawdowns exceeded FFY 1993 through 1995 expenses by $773,003.

[7] See SSA, OIG Management Advisory Report: Single Audit of the State of Maryland for the Fiscal Year Ended June 30, 2005 (A-77-07-00002), October 27, 2006.

[8] Program Operations Manual System (POMS), DI 39566.010 B.6.e. and DI 39566.110

[9] POMS, DI 39566.010B.2. and DI 39566.110 A.2.

AUDIT REPORT

MEMORANDUM

Appendix A

Appendix B

Appendix C

Appendix D

Appendix E

OIG Contacts

C.F.R.	Code of Federal Regulations
CMIA	Cash Management Improvement Act of 1990
DDS	Disability Determination Services
DORS	Division of Rehabilitation Services
DRP	Disaster Recovery Plan
FFY	Federal Fiscal Year
IDS	Intrusion Detection System
MD-DDS	Maryland Disability Determination Services
MSDE	Maryland State Department of Education
POMS	Program Operations Manual System
SSA	Social Security Administration
SSA-4513	State Agency Report of Obligations for SSA Disability Programs
U.S.C.	United States Code