Computer Matching Act: OMB and Selected Agencies Need to Ensure Consistent Implementation
GAO-14-44
Published: Jan 13, 2014. Publicly Released: Feb 12, 2014.
Skip to Highlights
Highlights
What GAO Found
The Office of Management and Budget (OMB) is responsible for developing guidelines and providing assistance to agencies on implementing the Computer Matching Act, while agencies have a variety of implementation responsibilities. Agency responsibilities include (1) developing computer matching agreements (CMA) containing specific elements for each proposed matching program and notifying Congress, OMB, and the public of such activities; (2) conducting cost-benefit analyses for proposed matching programs; and (3) establishing data integrity boards to oversee matching programs.
The seven agencies GAO reviewed (the Departments of Agriculture, Education, Health and Human Services, Homeland Security, Labor, Veterans Affairs, and the Social Security Administration) have taken a number of steps to implement the act's requirements. They have all established processes for creating CMAs, and the agreements generally included the elements required by the act. However, implementation among these agencies was inconsistent in several ways. First, the selected agencies differed in their understanding of whether CMAs were required for data queries. OMB's guidance is not clear on whether such queries are covered by the act. Second, while the selected agencies generally developed cost-benefit analyses for their CMAs, they did not consistently address key elements needed to assess the value of computer matching programs. OMB stated in 1989 that it would issue specific guidance for cost-benefit analyses of computer matching programs, but it has not done so. Finally, agency data integrity boards have not consistently reported to OMB on agencies' computer matching activities as required by the act. OMB guidance requires biennial reporting, which varies from the act's requirement for annual reports. The lack of clear guidance from OMB has contributed to the inconsistent implementation of the act at the agencies GAO reviewed.
Several agency and office of inspector general officials stated that the act's rigorous requirements and short time frames discouraged them from pursuing CMAs. Officials at six agencies stated that CMA review processes were lengthy and resource-intensive and that statutory durations for conducting matching activities were too short. Similarly, officials from offices of the inspector general at four agencies stated that the length of the approval process and the requirement that proposed agreements be approved by data integrity boards discouraged them from computer matching.
Why GAO Did This Study
Computerized matching of data from two or more information systems is one method of data analysis that can assist in detecting and preventing fraud, waste, and abuse in government programs, and it is commonly used to help identify improper payments in federal benefit programs and activities. However, computer matching may also pose privacy risks to individuals. To ensure that federal agency computer matching programs protect individuals' privacy rights, from 1988 through 1990 Congress enacted amendments to the Privacy Act of 1974 (collectively referred to in this report as the Computer Matching Act).
GAO was asked to review issues relating to computer matching. This report examines (1) agencies' responsibilities under the Computer Matching Act, (2) how selected agencies are implementing the act with regard to federal benefits programs, and (3) the views of officials at selected agencies on the process of developing and implementing computer matching agreements. GAO reviewed the act's provisions and OMB guidance. It also interviewed officials and examined documents at seven agencies with high expenditures in benefits and assistance programs.
Recommendations
GAO is recommending that OMB revise its guidance and that selected agencies develop and implement policies and procedures for cost-benefit analyses and ensure annual reviews and reporting. In their comments, agencies concurred with GAO's recommendations, with the exception of Education. OMB did not state whether the agency agreed or disagreed. GAO continues to believe that the recommendations are valid, as discussed in the report.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Office of Management and Budget | To make government-wide computer matching program planning efforts more consistent, the Director of OMB should revise guidance on computer matching to clarify whether front-end verification queries are covered by the Computer Matching Act. |
In August 2017, the Office of Management and Budget (OMB) stated that it does not intend to address the recommendation because it believes that the guidance is clear and it is up to the agencies to adhere to the act and official guidance. However, as mentioned in the report, OMB's guidance documents did not clarify whether front-end verification queries qualify as subsets of systems of records or are otherwise covered, thus continuing to leave the subject unclear. Without incorporating these key elements, agencies are likely to continue to interpret what the act covers in varying ways, and its privacy protections are likely to continue to be inconsistently applied.
|
| Office of Management and Budget | To make government-wide computer matching program planning efforts more consistent, the Director of OMB should direct agencies to address all key elements when preparing cost-benefit analyses. |
In August 2017, the Office of Management and Budget (OMB) stated that it does not intend to address the recommendation because it believes that the current guidance is sufficient. However, as mentioned in the report, OMB has general guidance for conducting cost-benefit analyses but not specific guidance for conducting cost-benefit analyses on computer matching programs. In the absence of specific OMB guidance, several agencies developed their own interim guides for cost-benefit analyses, while the others had no established methodology. Without incorporating GAO's key elements (identifying personnel costs, computer costs, the avoidance of future improper payments, and an estimate of the recovery of improper payments and debts), agencies are likely to continue to inconsistently assess the costs and benefits of their proposed matches and may be unable to demonstrate that such matches are a cost-effective use of resources.
|
| Office of Management and Budget | To make government-wide computer matching program planning efforts more consistent, the Director of OMB should ensure that Data Integrity Boards (DIBs) prepare and submit annual reports of agency-wide computer matching activities. |
In December 2016, in response to our recommendation, OMB updated Circular A-108, to require the Data Integrity Board of each agency that has participated in a matching program during the year to conduct a review of that year's matching programs and submit a report to the head of the agency and to OMB at the end of each calendar year. As a result, OMB can now ensure that agencies' computer matching programs are being regularly evaluated for effectiveness and are more transparent to OMB, Congress, and the public.
|
| Office of Management and Budget | To make government-wide computer matching program planning efforts more consistent, the Director of OMB should ensure that agencies receive assistance in implementing computer matching programs as envisioned by the act. |
In August 2017, the Office of Management and Budget (OMB) stated that it does not intend to address the recommendation because it believes that it is up to agencies to adhere to the act and OMB guidance. However, as mentioned in the report, the act gave OMB responsibility for providing continuing assistance to agencies in their implementation of the act and the other provisions of the Privacy Act. Without taking steps to follow up on reporting requirements or to provide assistance to agencies, OMB may be allowing agencies to implement the act inconsistently.
|
| Department of Agriculture | To improve the implementation of the act, the Secretary of Agriculture should develop and implement policies and procedures for cost-benefit analyses related to computer matching agreements to include key elements such as personnel and computer costs, as well as avoidance of future improper payments and recovery of improper payments and debts. |
In November 2021, in response to our recommendation, USDA provided its updated guidelines for preparing computer matching program within their Departmental Regulation 3450-001 and Cost Benefit Analysis (CBA) Procedures which included an outline of key elements that must be included in order to receive approval from the Data Integrity Board. Those key elements included personnel cost, computer cost, and avoidance or recovery of improper payments. As a result, USDA can now ensure that it is consistently assessing the cost and benefits of its proposed matches and is able to demonstrate that such matches are a cost-effective use of resources.
|
| Department of Agriculture | To improve the implementation of the act, the Secretary of Agriculture should ensure the DIB reviews cost-benefit analyses to make certain cost savings information for the computer matching program is included before approving CMAs. |
In 2018, we verified that the department's data integrity board, in response to our recommendation, reviewed a cost-benefit analysis for its current matching program and the cost/benefit analysis performed resulted in a favorable ratio. As a result, the department can now ensure that the cost of its matching agreements do not outweigh the benefits of conducting those matches.
|
| Department of Agriculture | To improve the implementation of the act, the Secretary of Agriculture should ensure the DIB performs annual reviews and submits annual reports on the agency's computer matching activities, as required by the act. |
In 2018, we verified that The Department of Agriculture established a process for issuing Annual Computer Matching Activity Reports. In 2017, they did not submit a report as they did not have any matching agreements and submitted a report in 2018, which outlined the board's members, an inventory of the matching programs, and summary of activities for the calendar year. As a result, the Administration and OMB have increased assurance that matches are being conducted in accordance with the terms of matching agreements and that the programs are justified and viable in terms of cost and benefits.
|
| Department of Education | To improve the implementation of the act, the Secretary of Education should develop and implement policies and procedures for cost-benefit analyses related to computer matching agreements to include key elements such as personnel and computer costs, as well as avoidance of future improper payments and recovery of improper payments and debts. |
In September 2017, the Department of Education stated that it does not intend to address the recommendation because its current policies and procedures for preparing cost-benefit analyses related to computer matching agreements already incorporate the appropriate key elements. However, as mentioned in the report, the policies do not consistently address personnel costs, computer costs related to the processing of computer matching programs, avoidance of future improper payments, and the recovery of improper payments and debts. Without incorporating these key elements, the department may inconsistently assess the costs and benefits of their proposed matches and may be unable to demonstrate that such matches are a cost-effective use of resources.
|
| Department of Education | To improve the implementation of the act, the Secretary of Education should ensure the DIB reviews cost-benefit analyses to make certain cost savings information for the computer matching program is included before approving CMAs. |
In 2014, we verified that the department's data integrity board, in response to our recommendation, reviewed cost-benefit analyses and stated that for each of the seven current matching programs, the cost/benefit analysis performed resulted in a favorable ratio. As a result, the department can now ensure that the cost of its matching agreements do not outweigh the benefits of conducting those matches.
|
| Department of Education | To improve the implementation of the act, the Secretary of Education should ensure the DIB performs annual reviews and submits annual reports on agency computer matching activities, as required by the act. |
The Department of Education issued a Biennial Computer Matching Activity Report in June 2014, which includes a review of activities for calendar years 2012 and 2013. The report outlines the board's members, an inventory of the matching programs, and summary of activities for the two calendar years. As a result, the department and OMB have increased assurance that matches are being conducted in accordance with the terms of matching agreements and that the programs are justified and viable in terms of cost and benefits.
|
| Department of Health and Human Services | To improve the implementation of the act, the Secretary of Health and Human Services should develop and implement policies and procedures for cost-benefit analyses related to computer matching agreements to include key elements such as personnel and computer costs, as well as avoidance of future improper payments and recovery of improper payments and debts. |
In August 2016, in response to our recommendation, HHS updated its guidelines for preparing Computer Matching Agreements to include an outline of key elements that must be included in cost-benefit analysis (CBA) in order to receive approval from the Data Integrity Board. The guidelines include personnel and computer costs for all stages and all major activities and information on avoidance and recovery of future improper payments to agencies, clients, and the general public. As a result, HHS can now ensure that it is consistently assessing the costs and benefits of its proposed matches and is able to demonstrate that such matches are a cost-effective use of resources.
|
| Department of Health and Human Services | To improve the implementation of the act, the Secretary of Health and Human Services should ensure the DIB reviews cost-benefit analyses to make certain cost savings information for the computer matching program is included before approving CMAs. |
In February 2018, we verified that the department's data integrity board, in response to our recommendation, reviewed cost-benefit analyses and ensured they had a favorable cost ratio and that the analyses covered the four key elements required by GAO in report 14-44: personnel costs, computer costs, avoidance of future improper payments, and recovery of improper payments and debts. As a result, the department can now ensure that the cost of its matching agreements do not outweigh the benefits of conducting those matches.
|
| Department of Health and Human Services | To improve the implementation of the act, the Secretary of Health and Human Services should ensure the DIB performs annual reviews and submits annual reports on agency computer matching activities, as required by the act. |
The Department of Health and Human Services issued Annual Computer Matching Activity Reports in 2017 and 2018. The report outlines the board's members, an inventory of the matching programs, and summary of activities for the calendar year. As a result, the department and OMB have increased assurance that matches are being conducted in accordance with the terms of matching agreements and that the programs are justified and viable in terms of cost and benefits.
|
| Department of Homeland Security | To improve the implementation of the act, the Secretary of Homeland Security should develop and implement policies and procedures for cost-benefit analyses related to computer matching agreements to include key elements such as personnel and computer costs, as well as avoidance of future improper payments and recovery of improper payments and debts. |
In November 2017, in response to our recommendation, DHS updated its Computer Matching Agreement (CMA) procedures entitled DHS Data Integrity Board Methodology for Developing a Cost Benefit Analysis, to include an outline of key elements that must be included in cost-benefit analysis. The framework includes departmental personnel and computer costs and all major activities and information on avoidance and recovery of future improper payments. As a result, DHS can now ensure that it is consistently assessing the costs and benefits of its proposed matches and is able to demonstrate that such matches are a cost-effective use of resources.
|
| Department of Homeland Security | To improve the implementation of the act, the Secretary of Homeland Security should ensure the DIB reviews cost-benefit analyses to make certain cost savings information for the computer matching program is included before approving CMAs. |
In January 2018, we verified that DHS's data integrity board, in response to our recommendation, reviewed cost-benefit analyses as part of its computer matching agreement approval process. As a result, DHS can now ensure that the cost of its matching agreements do not outweigh the benefits of conducting those matches.
|
| Department of Homeland Security | To improve the implementation of the act, the Secretary of Homeland Security should ensure the DIB performs annual reviews and submits annual reports on agency computer matching activities, as required by the act. |
The Department of Homeland Security issued Annual Computer Matching Activity Reports in 2017 and 2018. The report outlines the board's members, an inventory of the matching programs, and summary of activities for the calendar year. As a result, the Administration and OMB have increased assurance that matches are being conducted in accordance with the terms of matching agreements and that the programs are justified and viable in terms of cost and benefits.
|
| Department of Labor | To improve the implementation of the act, the Secretary of Labor should develop and implement policies and procedures for cost-benefit analyses related to computer matching agreements to include key elements such as personnel and computer costs, as well as avoidance of future improper payments and recovery of improper payments and debts. |
Although department officials have stated that they are taking actions to address this recommendation, as of March 2024, we have not yet received information to validate agency actions. Subsequent to the agency sending documentation, we plan to verify whether implementation has occurred.
|
| Department of Labor | To improve the implementation of the act, the Secretary of Labor should ensure the DIB reviews cost-benefit analyses to make certain cost savings information for the computer matching program is included before approving CMAs. |
Although department officials have stated that they are taking actions to address this recommendation, as of March 2024, we have not yet received information to validate agency actions. Subsequent to the agency sending documentation, we plan to verify whether implementation has occurred.
|
| Department of Labor | To improve the implementation of the act, the Secretary of Labor should ensure the DIB performs annual reviews and submits annual reports on agency computer matching activities, as required by the act. |
Although department officials have stated that they are taking actions to address this recommendation, as of March 2024, we have not yet received information to validate agency actions. Subsequent to the agency sending documentation, we plan to verify whether implementation has occurred.
|
| Department of Veterans Affairs | To improve the implementation of the act, the Secretary of Veterans Affairs should develop and implement policies and procedures for cost-benefit analyses related to computer matching agreements to include key elements such as personnel and computer costs, as well as avoidance of future improper payments and recovery of improper payments and debts. |
In November 2014, in response to our recommendation, VA developed a policy requiring a Cost/Benefit Analysis (CBA) to be submitted as part of all Computer Matching Agreements and requires that the Data Integrity Board review the analysis to ensure that costs saving measures are implemented. To supplement that policy, it also developed outlining eight steps that should be included in the CBA, which included the identification of all future improper payments and debts expected to be avoided in the future by performing the computer matching process and all potential personnel and computer costs that will be incurred by implementing a computer matching. As a result, VA can now ensure that it is consistently assessing the costs and benefits of its proposed matches and is able to demonstrate that such matches are a cost-effective use of resources.
|
| Department of Veterans Affairs | To improve the implementation of the act, the Secretary of Veterans Affairs should ensure the DIB reviews cost-benefit analyses to make certain cost savings information for the computer matching program is included before approving CMAs. |
In January 2018, we verified that VA's data integrity board, in response to our recommendation, reviewed cost-benefit analyses as part of its computer matching agreement approval process. As a result, VA can now ensure that the cost of its matching agreements do not outweigh the benefits of conducting those matches.
|
| Social Security Administration | To improve the implementation of the act, the Administrator of Social Security should develop and implement policies and procedures for cost-benefit analyses related to computer matching agreements to include key elements such as personnel and computer costs, as well as avoidance of future improper payments and recovery of improper payments and debts. |
In August 2015, in response to our recommendation, SSA developed a policy stating that the Data Integrity Board should not approve any written agreement for a computer-matching program unless the agency has completed and submitted a cost-benefit analysis of the proposed program, which demonstrates that the program is likely to be cost effective. It outlined what should be included in the analysis, such as recovered and reduced overpayments, detected underpayments, saved work years, systems costs, interagency costs, operational costs, and a benefit-to-cost ratio. As a result, SSA can now ensure that it is consistently assessing the costs and benefits of its proposed matches and is able to demonstrate that such matches are a cost-effective use of resources.
|
| Social Security Administration | To improve the implementation of the act, the Administrator of Social Security should ensure the DIB reviews cost-benefit analyses to make certain cost savings information for the computer matching program is included before approving CMAs. |
In August 2017, we verified that SSA's data integrity board, in response to our recommendation, reviewed cost-benefit analyses as part of its computer matching agreement approval process. As a result, SSA can now ensure that the cost of its matching agreements do not outweigh the benefits of conducting those matches.
|
| Social Security Administration | To improve the implementation of the act, the Administrator of Social Security should ensure the DIB performs annual reviews and submits annual reports on agency computer matching activities, as required by the act. |
The Social Security Administration issued Annual Computer Matching Activity Reports in 2017 and 2018. The report outlines the board's members, an inventory of the matching programs, and summary of activities for the two calendar years. As a result, the Administration and OMB have increased assurance that matches are being conducted in accordance with the terms of matching agreements and that the programs are justified and viable in terms of cost and benefits.
|
Full Report
GAO Contacts
Public Inquiries
Topics
Agricultural programsComputer matchingComputer securityCost effectiveness analysisErroneous paymentsFederal agenciesFederal social security programsHousing programsInformation technologyOverpaymentsRegulatory agenciesReporting requirementsRight of privacy