Objective

To determine the extent of implementation of the six recommendations included in our initial audit report, Controls and Management of the Unemployment Insurance System (Report 2021-S-3).

About the Program

One of the Department of Labor’s (DOL) key tasks in assisting the unemployed is administering the State’s Unemployment Insurance (UI) program. The UI program is a joint federal–State initiative that provides benefits to eligible workers who become unemployed through no fault of their own. In March 2020, Executive Order 202.8 directed the temporary closure of all non-essential businesses statewide to mitigate the spread of COVID-19. In addition, the federal Coronavirus Aid, Relief, and Economic Security Act, also enacted in March 2020, created temporary unemployment programs such as Pandemic Unemployment Assistance (PUA), which allowed for enhanced UI benefits for those affected by COVID-19. The COVID-19 pandemic and the addition of temporary federal benefit programs, like PUA, that had less stringent requirements than traditional UI contributed to a dramatic increase in UI claims and also increased the risk of improper payments and fraud, largely the result of identity theft. In February 2021, DOL began using ID.me, Inc. to provide identity verification services to assist with identifying fraudulent claims, particularly those attributed to identity theft. Information reported by the U.S. Department of Labor for April 1, 2022 to March 31, 2023 shows that the estimated fraud and improper payment rates for New York’s UI program have fallen since the height of the pandemic, but continue to remain higher than pre-pandemic levels. 

In addition to managing UI benefits, DOL officials are responsible for maintaining the UI system in accordance with appropriate standards, including those issued by the Office of Information Technology Services. As the owner of UI system data, DOL is responsible for classifying the data in its systems, determining the commensurate controls, and ensuring the controls are in place as needed. From April 1, 2023 through March 31, 2024, DOL made UI payments totaling over $3.1 billion.

The objective of our initial audit, issued on November 15, 2022, was to determine whether DOL took appropriate steps to oversee and manage the UI system and comply with selected portions of the New York State Information Security Policy and Standards. The audit covered the period from January 2020 to March 2022. Overall, the audit found deficiencies with DOL’s oversight and management of its UI system. During the pandemic, faced with the high demand for UI benefits and the need to process claims quickly, DOL resorted to stop-gap measures to compensate for system limitations, which resulted in misclassification of claims as State instead of federal liabilities, overpayment of claims, and supplemental spending to maintain the outdated UI system infrastructure while the new system was in development. The audit also found DOL:

• Could have better captured information on the details of its implementation of ID.me
• Was prevented from capturing sufficient and useful information about languages used by Limited English Proficient claimants because of its outdated UI system
• Did not take some fundamental, critical steps to secure its UI system and data
• Responded slowly to certain requests, which delayed our findings and recommendations and, in turn, DOL’s ability to promptly address serious problems

Key Findings

DOL officials made some progress in addressing the issues we identified in the initial audit report. Of the initial report’s six recommendations, two were implemented, three were partially implemented, and one was not implemented.

Key Recommendation

DOL officials are requested, but not required, to provide information about any actions planned to address the unresolved issues discussed in this follow-up within 30 days of the report’s issuance.