The Government Accountability Office told Social Security’s commissioner in May 2025 that three of its findings needed urgent, personal attention. More than a year later, the agency has closed none of them, and GAO has since added a fourth item to the same list. The four recommendations run through how the agency screens for overpayments, how claimants apply for benefits online, and how it tracks its own computer purchases — decisions that shape both how quickly a beneficiary gets paid correctly and how much money the government later tries to take back.
A June 2026 letter finds nothing closed since May 2025
GAO’s findings sit in a letter dated June 23, 2026, addressed directly to SSA Commissioner Frank Bisignano and signed by Orice Williams Brown, Acting Comptroller General of the United States. The letter states that, as of June 2026, SSA has 48 open GAO recommendations, including four priority recommendations, and that “since our May 2025 letter, SSA has not implemented any priority recommendations.” That earlier letter, GAO-25-108005, is the one that first flagged three priority items in May 2025; a footnote in the June 2026 version confirms GAO “added one new priority recommendation” since then, bringing the count to four. Brown copied Michael L. Russo, SSA’s Chief Information Officer, on the letter and listed Cindy Brown Barnes, GAO’s Managing Director for Education, Workforce, and Income Security, as the office’s point of contact for following up.
Free download: Where the deadline hides in an overpayment notice, the four response paths, and what to ask before calling SSA. Download the free first-day checklist.
Four recommendations, three named problem areas
The letter groups its four open priority recommendations under three headings: preventing potential overpayments, making service delivery more efficient, and managing information technology investments cost-effectively. The first two areas each carry one recommendation apiece, unchanged since May 2025. The IT-investment area carries two: the original recommendation that SSA compare its software license inventory against what it has actually purchased, plus the new one GAO added in June 2026 requiring SSA to write and follow documented policies for reviewing and approving its investments in operations, maintenance, infrastructure and cybersecurity. That combination — three named areas, one of them doubled — is how the letter arrives at four total priority recommendations while still describing only three problem areas by name. Two of the three areas, service delivery and IT investment management, are also carried on GAO’s broader High-Risk List, meaning GAO already tracks them as chronic, government-wide vulnerabilities rather than one-off findings specific to a single audit.
The overpayment fix and the clawback notice it could prevent
The overpayment recommendation targets a specific gap in Disability Insurance: SSA currently relies on beneficiaries to self-report if they are also collecting Federal Employees’ Compensation Act benefits, which are supposed to reduce or offset a DI payment when both are received at once. GAO wants SSA to pull that data directly from the Department of Labor instead of waiting for a beneficiary to disclose it. The gap between the two systems is what eventually produces a repayment notice. GAO’s own earlier testimony on DI overpayments, delivered by Director Elizabeth Curda in October 2023, put a scale on the broader problem: a 2019 study by Mathematica and SSA found that 71 percent of DI beneficiaries with earnings above the program’s limits ended up overpaid, with a median overpayment of $9,282 building up over a median of nine months before it was caught. Separately, SSA’s own Office of the Inspector General found that overpayments tied to beneficiaries working above program limits put $755 million in taxpayer funds at risk in a single year, 2021. Those figures describe the general size of the DI overpayment problem GAO has documented over several years, not a 2026 total — but they show what is at stake when SSA cannot verify a beneficiary’s outside income until after the money has already gone out and a bill follows.
An online SSI application that still doesn’t reach every applicant
The service-delivery recommendation concerns Supplemental Security Income, the program for older and disabled Americans with limited income and resources. SSA rolled out an online SSI application in December 2024 for some adults who meet specific criteria, a step GAO credits as progress. But the letter says SSA still has no plan “with clear steps, goals, metrics, and timelines” to extend that online option to all claimants, meaning a meaningful share of SSI applicants still cannot file without in-person or phone help from agency staff. GAO frames the fix as a way to reduce the load on SSA’s own staff while giving more claimants a way to apply independently, rather than as a service the agency is choosing to withhold.
Software licenses nobody has reconciled, on a $100 billion IT bill
The federal government spends more than $100 billion a year across agencies on information technology and cyber-related investments, according to the letter, and SSA buys thousands of software licenses annually as part of that spending. GAO’s recommendation asks SSA to check its license inventory against its purchase records, something the agency has not yet done, and to adopt documented procedures for approving IT spending on operations, maintenance, infrastructure and cybersecurity — categories that made up about 90 percent of SSA’s fiscal year 2024 IT budget. Brown’s letter closes by inviting Bisignano to discuss the open items directly, noting that a full list of SSA’s recommendations, including the four marked as priorities, is maintained on GAO’s public Recommendations Database for anyone tracking whether they get closed.
An Overpayment Notice and the Forms That Answer It
GAO’s recommendation addresses how an overpayment starts, on the SSA side of the ledger. It says nothing about the separate clock that starts running once a notice already lists a balance and a repayment date, which moves on its own schedule regardless of whether the data exchange GAO wants ever gets built. That gap between an audit finding and a mailbox is where most beneficiaries are currently left to sort out the response on their own.
The Social Security Check Protection Kit is an 18-page kit with the three SSA forms that stop or pause collection — SSA-561, SSA-632 and SSA-634 — plus a first-24-hours plan for a late or missing payment.
See the three collection-pause forms and the overpayment response worksheet in The Social Security Check Protection Kit.
This article was researched and drafted with the assistance of AI and reviewed by an editor.
David M. Keller is a finance writer based in Columbus, Ohio, covering personal finance and consumer-focused economic topics. He earned his degree in journalism from Ohio University and began his career reporting on local business and economic trends for a regional media outlet. Since then, he has contributed to a variety of online publications, focusing on clear, practical coverage of topics such as cost of living, debt, and everyday financial decision-making.
