GAO 

United States Government Accountability Office

Report to the Subcommittee on 

Oversight and Investigations, 

Committee on Veterans’ Affairs, House 

of Representatives 

DEPARTMENT OF 

VETERANS AFFAIRS 

Improvements Needed 

in Corrective Action 

Plans to Remediate 

Financial Reporting 

Material Weaknesses 

November 2009 

GAO-10-65 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

November 2009

DEPARTMENT OF VETERANS AFFAIRS

Improvements Needed in Corrective Action Plans to 

Remediate Financial Reporting Material Weaknesses

Highlights of GAO-10-65, a report to the 

Subcommittee on Oversight and 

Investigations, Committee on Veterans' 

Affairs, House of Representatives 

In fiscal year 2008, the Department 

of Veterans Affairs (VA) identified 

three material internal control 

weaknesses over financial 

reporting—financial management 

system functionality, IT security 

controls, and financial management 

oversight. VA is developing a new 

financial system—FLITE—but full 

implementation is not expected 

until 2014. Therefore, the 

Subcommittee asked us to 

determine whether VA corrective 

action plans and oversight are 

appropriately focused on near-term 

actions to provide improved 

financial information. 

This report addresses (1) the 

nature of the internal control 

weaknesses identified in the VA 

fiscal year 2008 financial audit 

report and how long they have 

been outstanding, (2) whether VA 

had plans appropriately focused on 

near-term corrective actions, and 

(3) whether VA had appropriate 

oversight mechanisms in place to 

help assure that near-term 

corrective action plans are 

implemented on schedule. 

GAO reviewed corrective action 

plans for significant deficiencies 

underlying 2 of the 3 material 

weaknesses and performed 

additional analysis for two 

underlying significant deficiencies. 

What GAO Recommends

GAO makes recommendations to 

the Secretary of Veterans Affairs to 

improve the design and oversight 

of corrective action plans. VA 

generally concurred with GAO’s 

recommendations and identified 

related actions taken and planned. 

VA’s fiscal year 2008 material weaknesses in financial management system 

functionality and financial management oversight have been reported since 

fiscal years 2000 and 2005, respectively. These two material weaknesses are 

comprised of 16 underlying significant financial reporting control deficiencies. 

Although VA had eliminated some significant deficiencies in prior years, other 

deficiencies have emerged. As a result, continuing serious deficiencies in 

financial reporting leave VA at risk of processing errors and misstatements in 

its financial statements. 

Although VA had corrective action plans in place intended to result in nearterm remediation of the 16 fiscal year 2008 significant control deficiencies, 

many of these plans did not contain the detail needed to provide VA officials 

with assurance that the plans could be effectively implemented on schedule. 

VA lacked documented policies and procedures needed to assure the 

consistent and comprehensive design of these corrective action plans, and 8 

of 13 of VA’s plans for correcting its financial reporting deficiencies lacked 

key information regarding milestones for action steps and validation activities.

Key Elements Missing from VA Financial Reporting Corrective Action Plans 

Corrective action plan 

Lack of related 

milestones

Lack of validation 

activities

1 Fixed Asset Package 

2 Mail Order Pharmacy X X 

3 Obligations and Purchases X X 

4 Accrued services payable X 

5 Property, Plant, and Equipment X 

6 Environmental liabilities X 

7 Unbilled receivables X 

8 Benefit payment reconciliation 

9 Portfolio loan servicing X 

10 Actuarial liability model X 

11 VBA default model 

12 Software capitalization 

13 Year-end Closing Procedures 

Source: GAO analysis of VA corrective action plans as of August 2009. 

As of August 2009, VA had missed milestones in 5 of the 13 corrective action 

plans. For example, our analysis of plans for remediating deficiencies 

regarding the capitalization of property, plant, and equipment and inadequate 

benefit payment reconciliations showed that slipping milestones could 

jeopardize VA’s timely completion of these plans, and consequently may 

impair VA’s ability to obtain improved data reliability within the time frames 

originally envisioned. VA lacked documented policies and procedures for 

overseeing implementation of the corrective action plans, but recently took 

steps intended to better coordinate its oversight activities. View GAO-10-65 or key components.

For more information, contact Susan Ragland 

at (202) 512-9095 or raglands@gao.gov. 
Page i GAO-10-65 

Contents 

Letter 1

Background 4 

VA Faces Continuing Financial Reporting Deficiencies as a Result 

of Uncorrected Long-Standing Material Weaknesses 7 

Most VA Corrective Action Plans Lacked Key Information 9 

Deficient Corrective Action Plans and Ineffective Oversight of 

Remediation Efforts Result in Ongoing Risks to VA’s Financial 

Information 12 

Conclusion 19 

Recommendations 19 

Agency Comments and Our Evaluation 20 

Appendix I Scope and Methodology 22 

Appendix II Comments from the Department of Veterans Affairs 25 

Appendix III GAO Contact and Staff Acknowledgments 29 

Tables 

Table 1: Planned Completion of Corrective Action Plans 10 

Table 2: Summary of Key Elements Missing from VA Financial 

Reporting Corrective Action Plans 11 

Table 3: Status of VA Fiscal Year 2008 Financial Reporting 

Corrective Action Plans 14 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately. 

 VA Corrective Action Plans 
United States Government Accountability Office

Washington, DC 20548 

 

November 16, 2009 

The Honorable Harry E. Mitchell 

Chairman 

The Honorable David P. Roe 

Ranking Member 

Subcommittee on Oversight and Investigations 

Committee on Veterans’ Affairs 

House of Representatives 

Each year, the Department of Veterans Affairs (VA) produces financial 

statements intended to reflect its results of operations, status of budgetary 

resources, and assets and liabilities. Accurate and timely financial 

reporting helps provide accountability for billions of dollars of services 

and benefits to veterans and their families, including medical services, 

disability compensation, vocational rehabilitation, and burial benefits. 

However, in VA’s fiscal year 2008 financial statement audit report, the 

independent auditor reported serious weaknesses in internal control over 

financial reporting. While VA has been developing a new financial 

management system—Financial and Logistics Integrated Technology 

Enterprise (FLITE)—intended to help address these control weaknesses, 

the system is not expected to be fully implemented until fiscal year 2014. 

Further, GAO has reviewed the FLITE program and reported, among other 

things, that VA lacked assurance that the FLITE program would be 

completed as planned.1

 In light of the seriousness of VA’s internal control 

weaknesses, and the need to improve the reliability of financial 

information on VA programs and activities before FLITE implementation, 

the Subcommittee asked us to determine whether VA corrective action 

plans and oversight are appropriately focused on near-term actions to 

address these internal control weaknesses. 

Our objectives for this report were to determine (1) the nature of the 

internal control weaknesses identified in the VA fiscal year 2008 financial 

audit report and how long they have been outstanding, (2) whether VA had 

plans appropriately focused on near-term actions to address financial 

reporting deficiencies prior to the implementation of FLITE in fiscal year 

VA Corrective Action Plans

 

1

 GAO, Veterans Affairs: Additional Details Are Needed in Key Planning Documents to 

Guide the New Financial and Logistics Initiative, GAO-08-1097 (Washington, D.C.: Sept. 

22, 2008). 

Page 1 GAO-10-65 
 

2014, and (3) whether VA had appropriate oversight mechanisms in place 

to help assure that near-term corrective action plans to address financial 

reporting deficiencies are implemented on schedule. 

To determine the nature of the internal control weaknesses identified in 

the VA fiscal year 2008 financial audit report and how long they have been 

outstanding, we analyzed the financial statement audit reports for fiscal 

years 2000 to 2008. We summarized available information on the extent 

and nature of the internal control weaknesses characterized as material 

weaknesses,2

 as well as the underlying significant deficiencies3 and 

identified their evolution over time. We also interviewed VA and Office of 

Inspector General (OIG) officials and VA’s independent auditor, and 

reviewed VA documents, prior GAO and OIG reports, and independent 

auditor workpapers to better understand the nature of the control 

deficiencies underlying the material weaknesses. We did not perform 

independent audit work to test and validate whether the material 

weaknesses and related significant deficiencies reported by the 

independent auditor were appropriate and comprehensive. 

To determine whether VA had plans appropriately focused on near-term 

actions to address financial reporting deficiencies prior to the full 

implementation of FLITE in fiscal year 2014, we analyzed VA’s corrective 

action plans for remediating significant deficiencies underlying two of the 

three material weaknesses4

 impacting the reliability of financial 

information integral for helping inform management decision making—

weaknesses in VA’s financial management systems and in its financial 

management oversight. We interviewed VA officials, VA’s Office of 

Inspector General (OIG), and independent auditor officials who completed 

VA’s fiscal year 2008 financial statement audit about near-term actions in 

 

2

 A material weakness is a significant deficiency, or combination of significant deficiencies, 

that results in more than a remote likelihood that a material misstatement of the financial 

statements will not be prevented or detected by the entity’s internal control. 

3

 A significant deficiency is a control deficiency, or combination of control deficiencies, 

that adversely affects the entity’s ability to initiate, authorize, record, process, or report 

financial data reliably in accordance with generally accepted accounting principles such 

that there is more than a remote likelihood that a misstatement of the entity’s financial 

statements that is more than inconsequential will not be prevented or detected by the 

entity’s internal control. 

4

 VA’s third material weakness concerned IT security controls. VA planned to remediate 

this material weakness using plans of actions and milestones as specified by OMB’s 

Guidance for Preparing and Submitting Security Plans of Action and Milestones. 

Page 2 GAO-10-65 VA Corrective Action Plans
 

VA plans to correct these underlying significant deficiencies. We also 

analyzed related corrective action plans to determine whether they 

included key information specified in the Chief Financial Officers 

Council’s Implementation Guide for OMB Circular A-123, Management’s 

Responsibility for Internal Control – Appendix A, Internal Control over 

Financial Reporting (CFOC A-123 Guidance): action steps with related 

milestones to provide a “road map” for remediation activities, validation 

activities, a description of the deficiency to be corrected in sufficient detail 

to provide clarity and facilitate a common understanding of what needs to 

be done, and clear delineation of responsible officials for completing the 

planned actions. 

To determine whether VA had appropriate oversight mechanisms in place 

to help assure that near-term corrective action plans to address financial 

reporting deficiencies are implemented on schedule, we assessed the 

status of plan implementation by identifying whether VA met specific 

milestones and any slippages that had occurred. We also evaluated the 

timeliness of implementation of corrective action plans for two significant 

deficiencies—one to address the inadequate capitalization and accounting 

for property, plant, and equipment (PP&E) and another to improve 

reconciliations of benefit payments. We selected these plans for further 

review because the related deficiencies were not currently being audited 

or reviewed by other oversight organizations, their associated account 

balances exceeded a material dollar threshold ($12.7 billion),5

 and the 

deficiencies contributed to the two material weaknesses that we, VA 

officials, and the independent auditor considered most integral for 

developing useful and reliable information for decision making. We 

reviewed these plans’ implementation to determine the extent to which 

delays jeopardized VA’s ability to remediate these control deficiencies 

prior to FLITE implementation. In this regard, we reviewed documentation 

and transactions concerning 25 projects that had been placed in service 

since the start of fiscal year 2008—21 projects at the Albuquerque, New 

Mexico Medical Center and 4 projects at the Lyons, New Jersey Medical 

Center—to determine how long it took VA to capitalize these projects after 

they had been placed in service. We also reviewed VA’s progress in 

implementing benefit payment reconciliation procedures in a timely 

manner. We interviewed VA, OIG, and independent auditor officials about 

 

5

 VA had a net operating cost of about $423 billion in fiscal year 2008. For purposes of 

conducting this work, we calculated a materiality threshold of $12.7 billion (or 3 percent of 

the net operating cost), and identified those deficiencies related to line items with balances 

exceeding that amount. 

Page 3 GAO-10-65 VA Corrective Action Plans
 

mechanisms in place to oversee the design and implementation of nearterm corrective action plans to remediate material financial reporting 

weaknesses identified through financial statement audits. We reviewed 

minutes of oversight meetings involving senior VA management to 

determine how VA monitored the status of remediation efforts related to 

internal control deficiencies identified through financial statement audits. 

We also interviewed agency officials about VA’s overall accountability for 

timely remediation of internal control deficiencies in the near term, and 

reviewed the status of ongoing VA efforts to staff a new office responsible 

for coordination and oversight of the development of corrective action 

plans. Appendix I provides a more detailed description of the scope and 

methodology for our engagement. 

We conducted our audit work from November 2008 to November 2009 in 

accordance with generally accepted government auditing standards. Those 

standards require that we plan and perform the audit to obtain sufficient, 

appropriate evidence to provide a reasonable basis for our findings and 

conclusions based on our audit objectives. We believe that the evidence 

obtained provides a reasonable basis for our findings and conclusions 

based on our audit objectives. We received written comments on a draft of 

this report from the Department of Veterans Affairs Chief of Staff which 

are reprinted in appendix II. 

VA is responsible for providing federal benefits to veterans. Headed by the 

Secretary of Veterans Affairs, VA operates nationwide programs for health 

care, financial assistance, and burial benefits. According to VA, in fiscal 

year 2009 the department received appropriations of almost $97 billion, 

including over $50 billion in discretionary funding, primarily for health 

care and approximately $47 billion in mandatory funding, primarily for 

disability compensation, pensions, and education benefit programs. 

Background 

VA is organized into three administrations to provide health care, 

financial, and burial benefits to veterans and their families: 

• The Veterans Health Administration (VHA) provides a broad range of 

primary health care, specialized care, and related medical and social 

support services through its network of more than 1,200 medical 

facilities. 

• The Veterans Benefit Administration (VBA) distributes financial 

benefits to veterans and their families related to compensation and 

pension, vocational rehabilitation and employment, home loans, life 

insurance, and education. 

Page 4 GAO-10-65 VA Corrective Action Plans
 

• The National Cemetery Administration (NCA) maintains national 

cemeteries and provides burial and memorial services to veterans. 

Legislative and Regulatory 

Framework for Financial 

Management, Reporting, 

and Internal Control 

The Chief Financial Officers (CFO) of the 24 major departments and 

agencies identified in 31 U.S.C. § 901(b) are required to, among other 

things, develop and maintain integrated accounting and financial 

management systems, including financial reporting and internal controls, 

and to direct, manage, and provide policy guidance and oversight of all 

agency financial management activities. These CFOs are also required to 

assist the heads of their agencies with annually preparing and submitting 

to Congress and the Office of Management and Budget audited financial 

statements and statements of assurance on the effectiveness of their 

agencies’ systems of internal control.6

The Comptroller General’s Standards for Internal Control in the Federal 

Government7

 (the Green Book) provides that federal agencies should 

establish policies and procedures to ensure that the findings of audits and 

other reviews are promptly resolved. In addition, Office of Management 

and Budget (OMB) Circular No. A-123, Management’s Responsibility for 

Internal Control, requires management to develop corrective action plans 

for material weaknesses8

—identified through management reviews, OIG 

and GAO reports, program evaluations, and financial statement audits—

and periodically assess and report on the progress of those plans. Further, 

the CFOC A-123 Guidance provides that agencies construct a corrective 

action planning framework to facilitate plan preparation, accountability, 

monitoring, and communication. The guidance provides that agency 

managers are responsible for developing and implementing action plans 

for taking timely and effective action to correct deficiencies. The CFOC A123 Guidance is widely viewed as a “best practices” methodology for 

executing the requirements of Appendix A of OMB Circular No. A-123. 

 

6

 31 U.S.C. § 902; see 31 U.S.C. §§ 3512 (d), 3515. 

7

 GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 

(Washington, D.C.: November 1999). 

8

 The circular’s use of the term “material weakness” is similar to the same term used by 

auditors to identify internal control weaknesses found during a financial statement audit. 

This circular’s use of the same term encompasses not only financial reporting, but also 

encompasses weaknesses found in program operations and compliance with applicable 

laws and regulations. Material weaknesses for the purposes of this circular are determined 

by management, whereas material weaknesses reported as part of a financial statement 

audit are determined by independent auditors. 

Page 5 GAO-10-65 VA Corrective Action Plans
 

In the independent auditor’s report on VA’s fiscal year 2008 financial 

statements, the auditor identified the following three material weaknesses: 

• Financial management system functionality—reported since fiscal year 

2000, is linked to VA’s outdated legacy financial systems impacting VA’s 

ability to prepare, process, and analyze financial information that is 

reliable, timely, and consistent. Legacy system deficiencies 

necessitated significant manual processing of financial data and a large 

number of adjustments to the balances in the system, thereby 

increasing the risk of processing errors and misstatements in the 

financial statements. 

Material Weaknesses 

Identified in VA’s Internal 

Control over Financial 

Reporting in Fiscal Year 

2008 

• IT security controls—also reported as a material weakness since fiscal 

year 2000, resulted from the lack of effective implementation and 

enforcement of an agencywide information security program. Security 

weaknesses in the areas of access control, segregation of duties, 

change control, and service continuity continued to place VA’s program 

and financial data at risk. For example, weaknesses in information 

security controls placed sensitive financial and veterans’ medical and 

benefit information at risk of inadvertent or deliberate misuse, 

improper disclosure, theft, or destruction, possibly occurring without 

detection. 

• Financial management oversight—reported as a material weakness 

beginning in fiscal year 2005 and as a significant deficiency in fiscal 

years 2000 through 2004. This weakness stemmed from a number of 

control deficiencies whose operational causes varied. Common issues 

included the recording of financial data without sufficient review and 

monitoring, a lack of human resources with the appropriate skills, and 

a lack of capacity to effectively process a significant volume of 

transactions. When aggregated, the independent auditor found that 

these deficiencies suggested a recurring theme of inadequate or 

ineffective financial management oversight. 

VA Has Established FLITE 

Program 

To help resolve the financial management system functionality material 

weakness, modernize the IT environment, and implement an integrated 

financial management system, VA established the Financial and Logistics 

Integrated Technology Enterprise (FLITE) program, managed by the 

FLITE Program Office,9

 to replace its current legacy systems. The FLITE 

 

9

 The Director of the FLITE Program Office reports to the VA Assistant Secretary for 

Management. The Assistant Secretary for Management acts as the VA CFO overseeing all 

resource requirements, development and implementation of agency performance 

measures, and financial management activities relating to VA programs and operations. 

Page 6 GAO-10-65 VA Corrective Action Plans
 

Program involves a multiple-year phased approach comprised of three 

major components: the Strategic Asset Management (SAM) project, a 

logistics and asset management system; the Integrated Financial 

Accounting System (IFAS), which focuses on financial management; and a 

data warehouse that is intended to assist in financial reporting. As of 

January 2009, VA planned to complete FLITE implementation in fiscal year 

2014. 

Although VA had eliminated some significant deficiencies in prior years, 

other deficiencies have emerged that require attention. As a result of its 

recurring internal control weaknesses in financial reporting, VA continues 

to be at risk of processing errors and misstatements in VA’s financial 

reports. 

The financial management system functionality material weakness, which 

is linked to VA’s outdated financial systems, consists of seven underlying 

significant deficiencies. The following four significant deficiencies were 

newly reported in fiscal year 2008. 

VA Faces Continuing 

Financial Reporting 

Deficiencies as a 

Result of Uncorrected 

Long-Standing 

Material Weaknesses 

• VBA Benefit Delivery Network (BDN) and Veterans Services Network 

(VETSNET) had insufficient audit trail documentation for the transfer 

of data to a data warehouse and the storage of such data, increasing the 

risk of misstatements in the financial statements and other financial 

reports.10

• VETSNET lacked data mining11 capabilities, thereby preventing VA 

financial managers from analyzing transactions at a level needed to 

prepare routine reconciliations on billions of dollars in transactions.12

• Automated inventory systems at the Consolidated Mail Order 

Pharmacy facilities could not provide the data needed to properly 

record the cost of inventory, resulting in potential misstatements in the 

financial statements and other financial reports. 

 

10 In agency comments to the draft report provided on November 2, 2009, VA officials stated 

that the corporate database used by VETSNET contains an internal audit trail in the 

business transaction table, whereby every activity, whether a payment, proceed, or 

receivable, is traceable to its originating business transaction record(s). 

11 Data mining is the automatic extraction of useful, often previously unknown information 

from large data sets. 

12 According to VA officials, the VBA CFO has identified changes to VETSNET needed to 

improve operations and address deficiencies noted in the annual financial statement audits. 

These items are scheduled to be installed in an update to VETSNET in February 2010. 

Page 7 GAO-10-65 VA Corrective Action Plans
 

• VA lacked a system to track obligations and purchases by vendors 

resulting in VA relying on vendors to supply operational sales data on 

medical center purchases. 

Three of the seven significant deficiencies were repeat conditions: 

• Inadequate year-end closing procedures for the financial system and 

related records, reported since fiscal year 2000, created a significant 

risk of error in the annual financial statements. 

• Business line system integration problems, reported since fiscal year 

2004, resulted in inadequate support for amounts recorded in the 

general ledger, such as VETSNET accounts receivables, and the 

potential for misstatements in the financial statements and other 

financial reports. 

• Fixed asset reporting limitations, reported since fiscal year 2007, 

prohibited VA from readily identifying all current year PP&E additions 

and reclassifications of work in process. 

The financial management oversight material weakness, reflecting a 

recurring theme of inadequate or ineffective financial management 

oversight, consisted of nine underlying significant deficiencies. The 

following three were newly reported in fiscal year 2008: 

• Missing records in the mortgage loan portfolio maintained by an 

outside contractor resulted in unsupported amounts and potential 

errors in the general ledger. 

• Incorrect formulas for estimating the projected default rate for 

guaranteed and direct loans in VA’s housing model could lead to 

material misstatements of estimated costs of guaranteed and direct 

loans in the financial statements and other financial reports. 

• Incorrect expensing and capitalization of software development costs 

could result in an understatement of PP&E and an overstatement of 

operating program costs. 

Six of the nine significant deficiencies were repeat conditions: 

• A lack of adequate review and follow-up procedures for accrued 

services payable and undelivered orders, reported since fiscal year 

2007, resulted in invalid balances for obligations and accrued services 

payable and potential misstatements in the financial statements and 

other financial reports. VA reported a total of $8 billion in undelivered 

orders in fiscal year 2008. 

• Untimely depreciation, improper recording of disposed assets, 

discrepancies in estimated useful life of equipment, and other 

inadequate capitalization and accounting for PP&E, reported since 

Page 8 GAO-10-65 VA Corrective Action Plans
 

fiscal year 2000, could result in misstated PP&E and related expense 

accounts. VA reported a $13 billion PP&E balance in fiscal year 2008. 

• Inconsistent methodologies and unsupported estimates for 

environmental and disposal liabilities, reported since fiscal year 2004, 

could lead to misstatements in the financial statements. VA reported a 

$928 million balance in environmental and disposal liabilities in fiscal 

year 2008. 

• Inadequate review of unbilled receivables and contractual adjustments, 

reported since fiscal year 2007, could lead to misstatements of account 

receivable balances. VA reported over $1.7 billion in accounts 

receivable for fiscal year 2008. 

• Inadequate BDN and VETSNET reconciliations, reported since fiscal 

year 2007, increased the likelihood that an error in the financial 

statements will occur and go undetected. BDN and VETSNET 

processed over $40 billion in compensation, pension, education, and 

vocational rehabilitation and employment benefits in fiscal year 2008. 

• Inadequate reconciliations of the data input to the compensation and 

pension actuarial liability model, reported since fiscal year 2007, could 

result in misstatements in the financial statements. VA reported a $1.4 

trillion actuarial liability in fiscal year 2008. 

In fiscal year 2008, VA reported successfully eliminating two prior 

significant deficiencies concerning insufficient follow-up of accounts 

receivable collections and errors in payroll data submissions to the Office 

of Personnel Management underlying the financial management oversight 

material weakness, as well as a prior material weakness regarding the 

retention of computer-generated detail records for benefit payments. 

VA has established corrective action plans intended to remediate many of 

its 16 significant deficiencies in the near term independent of FLITE 

implementation.13 However, although VA had corrective action plans in 

place, many of these corrective action plans did not contain the detail 

needed to provide VA or congressional oversight officials with assurance 

that the plans had near-term actions that could be effectively implemented 

on schedule. As shown in the table 1, VA planned to remediate 9 

deficiencies in fiscal year 2009, 3 in fiscal year 2010, 3 in fiscal year 2012, 

and 1 in fiscal year 2014.14 However, VA lacked documented policies and 

Most VA Corrective 

Action Plans Lacked 

Key Information 

 

13 The scope of our review did not include analysis of plans of action and milestones to 

remediate the significant deficiencies underlying the IT Security material weakness. 

14 The independent auditor will evaluate VA progress in remediating the deficiencies as part 

of the fiscal year 2009 financial statement audit. 

Page 9 GAO-10-65 VA Corrective Action Plans
 

procedures to ensure the consistent and comprehensive design of these 

plans, and most of VA’s plans for correcting financial reporting 

deficiencies in the near term lacked key information suggested in CFOC A123 Guidance. 

Table 1: Planned Completion of Corrective Action Plans 

Corrective action plan title No. of deficiencies 

Fiscal year targeted 

for completion

1 Fixed Asset Package system limitations 1 2010a

2 Consolidated Mail Order Pharmacy inventory pricing 1 2010

3 Inadequate Obligations and Purchases Tracking System 1 2014b

4 Accrued services payable/ Undelivered orders not properly monitored 1 2009

5 Inadequate monitoring and accounting for Property, Plant, and Equipment 1 2009

6 Environmental and disposal liabilities not properly monitored 1 2009

7 Unbilled receivables and contractual adjustments not adequately reviewed 1 2009

8 BDN/VETSNET are not being properly reconciled to the general ledger c1d

3 

2009

2012

9 Incomplete outsourced portfolio loan servicing records 1 2009

10 Inadequate consideration of variables input in the compensation and pension 

actuarial liability model 

1 2009

11 VBA Variable Default Housing Model 1 2009

12 Software expenses not properly tracked/capitalized 1 2009

13 Year-end Closing Procedures 1 2010

Total deficiencies 16 

Source: GAO analysis of VA corrective action plans. 

a

According to VA officials, VA provided documentation of new reconciliation processes to the 

independent auditor in an effort to remediate this deficiency ahead of schedule. At the time of our 

review, the auditor had not provided VA with feedback regarding the sufficiency of VA’s new 

procedures. 

b

According to VA officials, VA provided a demonstration to the independent auditor in July 2009 to 

illustrate the ability of its financial system to track obligations and purchases at a vendor level. At the 

time of our review, the auditor had not provided VA with feedback regarding the sufficiency of VA’s 

new procedures. 

c

This plan addresses the four significant deficiencies related to the lack of BDN and VETSNET data 

mining capabilities, audit trail documentation, system integration, and reconciliation procedures. 

d

Te deficiency concerning VBA audit trail documentation was remediated through a contractorprepared task work plan which, according to VA officials, was issued under this corrective action plan 

and was to be implemented in fiscal year 2009. 

Eight of the 13 plans we reviewed lacked key information as 

recommended by the CFOC A-123 Guidance. As shown in table 2, 5 plans 

lacked milestone dates for action steps, 1 plan lacked validation activities, 

and 2 plans lacked both milestone dates and validation activities. 

Page 10 GAO-10-65 VA Corrective Action Plans
 

Table 2: Summary of Key Elements Missing from VA Financial Reporting Corrective Action Plans 

Corrective action plan title 

Lack of related 

milestones 

Lack of validation 

activities 

1 Fixed Asset Package system limitations 

2 Consolidated Mail Order Pharmacy inventory pricing X X 

3 Inadequate Obligations and Purchases Tracking System X X 

4 Accrued services payable and Undelivered orders not properly 

monitored X 

5 Inadequate monitoring and accounting for Property, Plant, and 

Equipment X 

6 Environmental and disposal liabilities not properly monitored X 

7 Unbilled receivables and contractual adjustments not adequately 

reviewed X 

8 BDN/VETSNET are not being properly reconciled to the general 

ledger 

9 Incomplete outsourced portfolio loan servicing records X 

10 Inadequate consideration of variables input in the actuarial liability 

model X 

11 VBA variable default model formula errors 

12 Software expenses not properly tracked and capitalized 

13 Year-end Closing Procedures 

Source: GAO analysis of VA corrective action plans as of August 2009. 

In accordance with CFOC A-123 Guidance, agencies should prepare 

comprehensive corrective action plans that list action steps with related 

monthly milestone dates to help ensure senior VA officials can monitor 

progress. Seven of VA’s corrective action plans did not include 

intermediate milestone dates necessary to gauge whether planned 

corrective actions are proceeding according to schedule, thus increasing 

the risk that corrective action plans will not be implemented on schedule. 

For example, 

• In one plan, VA combined several action steps, needed to rewrite the 

Consolidated Mail Order Pharmacy inventory management software, 

into one 2-year milestone period. For example, VA combined 

developing a statement of work, rewriting the software, and developing 

an inventory module for each CMOP into one 2-year milestone period. 

In addition, two other action steps lacked completion dates. Without 

interim milestones and completion dates, it is more difficult for VA 

officials to identify whether the necessary activities for remediating 

weaknesses are occurring and whether they are on schedule. Without 

Page 11 GAO-10-65 VA Corrective Action Plans
 

such information, VA could miss opportunities to address issues that 

might hamper timely completion of the remediation. 

• VHA’s plan for addressing the inadequate monitoring and accounting 

for PP&E only specified the fiscal year in which the tasks were to be 

completed. The lack of intermediate milestones makes it difficult for 

senior management to adequately monitor the progress of 

implementation efforts. Because most action steps only had a fiscal 

year target date, it was unclear when during the year the steps were to 

be taken and whether or not they were sequential. In addition, the plan 

did not include any descriptions or related milestones for two action 

steps. 

In accordance with CFOC A-123 Guidance, senior management is 

responsible for determining when sufficient action has been taken to 

declare that a significant deficiency or a material weakness has been 

corrected, and corrective action plans should include activities to validate 

the resolution of the deficiency. Without such validation measures, it is 

difficult for VA management to provide assurance that the corrective 

actions have effectively remediated the deficiency. Three of VA’s 

corrective action plans did not include activities to validate that the 

planned actions would resolve the deficiency. For example, the corrective 

action plan to address deficiencies in VA’s automated inventory systems at 

its Consolidated Mail Order Pharmacy facilities did not include activities 

to validate whether action steps were implemented and the desired results 

achieved. 

Deficient corrective action plans (discussed previously) and ineffective 

oversight of corrective action plan implementation have resulted in missed 

remediation milestones, placing VA at risk of continued errors and 

misstatements in financial information. As of August 2009, VA had missed 

milestones in 5 of the 13 corrective action plans to remediate fiscal year 

2008 significant deficiencies underlying the financial management system 

functionality and financial management oversight material weaknesses. 

Our analysis of corrective action plans for two significant deficiencies—

the untimely capitalization of construction projects and inadequate 

reconciliations related to benefit payments—showed that slipping 

milestones could jeopardize VA’s completion of these plans by fiscal years 

2009 and 2012 respectively, and therefore may impair VA’s ability to obtain 

the improved data reliability originally envisioned within those time 

frames. For the plans lacking interim milestones, it is difficult for VA 

management to monitor progress, identify whether there is any slippage, 

and take timely steps to keep actions on track. The lack of milestones and 

the related accountability for meeting targets could also limit incentives 

Deficient Corrective 

Action Plans and 

Ineffective Oversight 

of Remediation 

Efforts Result in 

Ongoing Risks to VA’s 

Financial Information 

Page 12 GAO-10-65 VA Corrective Action Plans
 

for staff to ensure actions are implemented on schedule. In addition, VA 

lacked documented policies and procedures for overseeing the 

implementation of corrective action plans to remediate material 

weaknesses identified in financial statement audits. In January 2009, VA 

recognized the need to better coordinate these oversight activities and 

created an office of Financial Process Improvement and Audit Readiness 

(FPIAR). 

VA Missed Milestones for 

Five Plans and Status of 

Other Plans Was Unknown 

As shown in table 3, VA missed milestones in 5 of the 13 corrective action 

plans that we reviewed, and the status of progress in implementing 3 other 

plans was unknown because they lacked sufficient interim milestones.15

VA missed milestones related to preparation of detailed procedures for the 

Fixed Asset Package, PP&E policies and procedures, benefit payment 

reconciliations, the development of reports to support reconciliations of 

expense accounts in the actuarial liability model, and year-end closing 

procedures. 

 

15 VA had not begun implementing one plan that was due to be completed in 2014 at the 

time of our review. 

Page 13 GAO-10-65 VA Corrective Action Plans
 

Table 3: Status of VA Fiscal Year 2008 Financial Reporting Corrective Action Plans 

Plan title On schedule 

Slipping 

milestones 

Unknown 

status Status shown on corrective action plans 

1 Fixed Asset Package system 

limitations 

X Development of work in process component 

has been delayed pending the results of further 

testing by the independent auditor. 

2 Consolidated Mail Order 

Pharmacy inventory pricing 

X First milestone completion date is scheduled 

for September 2010. Without interim 

milestones it is not feasible to determine project 

status. 

3 Inadequate Obligations and 

Purchases Tracking System 

N/A Implementation is scheduled to begin in 

October 2009. 

4 Accrued services payable 

and Undelivered orders not 

properly monitored 

X All actions have been completed as of May 

2009. 

5 Inadequate monitoring and 

accounting for Property, 

Plant, and Equipment 

X VA planned to develop policies and procedures 

by March 2009. As of August 2009, VA had not 

completed this action step (see case study 

below). 

6 Environmental and disposal 

liabilities not properly 

monitored 

X Milestones listed by fiscal year, so it is not 

feasible to determine project status. 

7 Unbilled receivables and 

contractual adjustments not 

adequately reviewed 

X Milestones listed by fiscal year, so it is not 

feasible to determine project status. 

8 BDN/VETSNET are not 

being properly reconciled to 

the general ledger 

X Slippage has occurred on several milestones, 

and milestones have been shifted back up to 

14 months (see case study below). 

9 Incomplete outsourced 

portfolio loan servicing 

records 

X All actions have been completed as of 

December 2008. 

10 Inadequate consideration of 

variables input in the 

actuarial liability model 

X Slippage has occurred in the development of 

reports to support manual reconciliations of 

expense accounts. 

11 VBA variable default model 

formula errors 

X All actions have been completed as of April 

2009. 

12 Software expenses not 

properly tracked and 

capitalized 

X On schedule. 

13 Year-end Closing 

Procedures 

X Missed milestone for developing a year-end 

closing operating plan for each administration. 

Source: GAO analysis of VA fiscal year 2008 corrective action plans as of August 2009. 

Page 14 GAO-10-65 VA Corrective Action Plans
 

An analysis of the status of corrective action plans for two significant 

deficiencies—the inadequate monitoring and accounting for PP&E and 

inadequate reconciliations related to benefit payments—provided 

examples of how missed milestones result in continuing risks of errors in 

related VA financial reporting. Specifically, VA missed its milestones for 

the creation of detailed procedures for capitalizing PP&E and automated 

reconciliations to support veteran benefit payments. 

Missed Milestones for Two 

Significant Deficiencies 

Illustrate Continuing 

Adverse Impacts on VA’s 

Financial Management 

Although the PP&E corrective action plan called for procedures related to 

timely capitalization of PP&E to be developed by March 2009, they had not 

been issued by August 2009. Failing to capitalize construction projects in a 

timely manner may lead to misstated financial information if projects are 

not capitalized in the same fiscal year they are placed in service. In 

addition, related depreciation expenses may also be misstated as a result 

of time lags in capitalizing projects. Finally, if projects are not closed out 

in a timely fashion, VA is unable to determine whether funds are available 

for use on other construction projects. Our analysis at two VHA medical 

facilities identified continuing problems in the timely capitalization of 

PP&E. 

According to federal accounting standards16 and VA policy issued by VA’s 

Assistant Secretary for Management (the VA CFO),17 construction projects 

are to be recorded as work in process (WIP) until they are placed in 

service, at which time the WIP balances are to be transferred to general 

PP&E. We reviewed the 21 projects at the Albuquerque, New Mexico 

Medical Center and the 4 projects at the Lyons, New Jersey Medical Center 

that had been placed into service since the start of fiscal year 2008 and 

found continuing significant delays in the amount of time it took to close 

out and capitalize projects after they were placed in service. In 

Albuquerque, VA fiscal staff told us their undocumented practice was to 

capitalize projects within 30 days of being placed in service. However, 

while they had capitalized 11 of 21 projects within 30 days, 6 projects were 

not capitalized for 30 to 60 days, and 4 projects were not capitalized for 

more than 120 days after they had been placed into service. At Lyons, VA 

staff capitalized 3 of 4 projects more than 180 days after they were placed 

in service. 

 

16 Statement of Federal Financial Accounting Standards No. 6 (SFFAS 6), Accounting for 

Property, Plant, And Equipment, paragraph 26. 

17 Department of Veterans Affairs Handbook 4511, Paragraph 2. 

Page 15 GAO-10-65 VA Corrective Action Plans
 

VBA also experienced slipping milestones in remediating the benefit 

payment reconciliation deficiency. VBA did not perform necessary 

reconciliations between the BDN and VETSNET systems and VA’s general 

ledger on a monthly basis prior to March 2008. Lacking such reconciliation 

VA is at continuing risk of improper reporting of benefit payments. That 

year, these systems processed over $41.6 billion in benefits payments 

related to compensation and pension, as well as a portion of education 

benefit programs as authorized by law. This information is critical to the 

correct determination of VA’s overall cost of operations. 

VBA developed a corrective action plan to correct this deficiency that 

contained 43 separate activities with related milestones, including 

developing automated reconciliations, documenting processes, and 

training end users. According to VBA documents and officials, VBA missed 

and pushed back milestones related to the development of reports 

supporting veteran education payments and automated reconciliations. 

For example, as of August 2009, work on the development of detailed 

reports supporting the Vocational Rehabilitation and Employment 

education payments was pushed back 5 months from November 2009 to 

April 2010 and VBA reported slippage ranging from 3 to14 months in the 

development of various reconciliations supporting Dependent’s Education 

Benefits. 

VA Lacked Effective 

Agencywide Oversight for 

the Correction of Material 

Weaknesses 

VA lacked policies and procedures for overseeing the design and 

implementation of corrective action plans to correct financial reporting 

material weaknesses identified in financial statement audits. Further, VA 

did not have an agencywide accountability mechanism in place to oversee 

and coordinate the remediation of the material weaknesses in financial 

reporting. Rather, VA delegated responsibility for the design, 

implementation, and oversight of the corrective action plans to the various 

administrations and offices responsible for the areas in which the 

deficiencies were identified (e.g., VHA and VBA). Lacking centralized VAwide guidance, the administrations inconsistently defined the parameters 

for milestone dates in corrective action plans. For example, VHA 

corrective action plans provided milestones by fiscal year, while VBA 

plans often had monthly milestone dates. As a result, VA’s ability to 

determine the status of corrective action plan implementation and identify 

and address any slippages was impaired. 

In contrast to its financial reporting weaknesses, VA had documented 

policies and procedures to identify and correct its programmatic material 

weaknesses, specifically those in the areas of accountability and 

Page 16 GAO-10-65 VA Corrective Action Plans
 

effectiveness over VA programs and operations. These policies and 

procedures, which could also be applied to the remediation of financial 

reporting material weaknesses identified through financial statement 

audits, are outlined in a manual which includes a detailed template for 

developing corrective action plans that specified parameters for milestone 

dates and other key information.18 Further, VA had a Senior Assessment 

Team (SAT) in place (chaired by the Assistant Secretary for Management 

and comprised of other senior management representatives from VA and 

its three administrations) to oversee remediation of programmatic control 

weaknesses detected through VA’s internal control reviews completed 

under OMB Circular No. A-123.19

In January 2009, VA recognized the need to better oversee and coordinate 

agencywide oversight activities for financial reporting material 

weaknesses identified through financial statement audits. Specifically, VA 

recruited a director to head a new office of Financial Process 

Improvement and Audit Readiness (FPIAR) reporting to the VA Deputy 

CFO in the Office of Finance under the VA Assistant Secretary for 

Management. FPIAR was established with responsibility for: 

• coordinating and overseeing comprehensive corrective action plans for 

VA’s audit-related material weaknesses, in consultation and 

coordination with VA’s three administrations and applicable staff 

offices; 

• assisting VA and the three administrations and staff offices in executing 

and monitoring the corrective action plans; 

• ensuring compliance of VA offices and field stations with VA policies, 

plans, procedures, and internal controls; and 

• assisting in updating corrective action plans as needed and developing 

recommendations and actions for ensuring completion of stated 

objectives and milestones in the event of slippage. 

 

18 Internal Control Stakeholder Procedures Manual, Internal Controls Service, Office of 

Business Oversight, Department of Veterans Affairs, July 2008. 

19 For example, the November 12, 2008, meeting was chaired by the Assistant Secretary for 

Management and attended by 31 other officials including the Principal Deputy Assistant 

Secretary for Management, the Deputy Assistant Secretary for Acquisition and Logistics, 

the Director of the Office of Business Oversight, the Director of the Office of Financial 

Policy, the Deputy Director of the Financial and Logistics Integrated Technology 

Enterprise (FLITE) Program Office, and the Chief Financial Officers from the VHA, VBA, 

and NCA. 

Page 17 GAO-10-65 VA Corrective Action Plans
 

In addition, the FPIAR Director’s position description calls for FPIAR to 

perform analysis and remediation efforts for any comparable internal 

control deficiencies being resolved as part of VA’s ongoing OMB Circular 

No. A-123 reviews in concert with work to remediate VA’s audit-related 

material weaknesses. Integrating VA’s A-123 review process and 

remediation activities for financial reporting material weaknesses 

identified in financial statement audits could enhance the efficiency of 

VA’s corrective actions and the elimination of material weaknesses. 

As of September 2009, according to FPIAR’s Director, VA had filled three 

permanent staff positions and hired six full-time contractors to assist VA 

in addressing a variety of financial reporting issues (e.g., helping address 

the IT Security Controls material weakness and outstanding issues 

surrounding the capitalization of software development costs, updating 

and reformatting corrective action plans, and developing requirements for 

an interface between VETSNET and VA’s general ledger). The VA Deputy 

CFO said that as office operations have evolved, VA has decided to hire 

one or two more permanent staff for the FPIAR and use contractors to fill 

other positions. He said that contractors can provide VA with the 

flexibility to address short-term staffing needs as well as the necessary 

technical expertise to remediate individual significant deficiencies. 

However, the FPIAR did not have a workforce plan defining the number of 

staff and expertise needed in the office.20

In fiscal year 2009, while not included in documented policies and 

procedures, the FPIAR began practices intended to establish agencywide 

procedures for oversight of corrective action plans to remediate material 

weaknesses identified in financial statement audits. For example, the 

FPIAR Director began participating in monthly SAT meetings chaired by 

the Assistant Secretary for Management and attended by other senior VA 

officials including the VHA CFO and VBA CFO. These meetings provide an 

opportunity for the FPIAR Director to highlight the status of specific 

corrective actions underway to address financial reporting significant 

deficiencies requiring the attention of key stakeholders across the agency. 

Further, the director told us that by the end of calendar year 2009, the 

FPIAR intends to begin using a corrective action plan template consistent 

 

20 Strategic workforce planning allows organizations to determine the critical skills and 

competencies that will be needed to achieve current and future programmatic results and 

develop strategies that are tailored to address gaps in the number, skills, competencies, 

and alignment of staff. See Human Capital: Key Principles for Effective Strategic 

Workforce Planning, GAO-04-39 (Washington, D.C.: Dec. 11, 2003). 

Page 18 GAO-10-65 VA Corrective Action Plans
 

with the CFOC A-123 Guidance to remediate significant deficiencies 

identified in the fiscal year 2009 financial statement audit. Because VA has 

developed a corrective action template for addressing A-123 control 

deficiencies, the FPIAR Director told us she is considering whether to 

adopt this template for corrective action plans to remediate financial 

reporting control weaknesses, which could provide efficiencies and help 

integrate resolution of some deficiencies. VA’s Deputy CFO also told us 

that oversight by the SAT, combined with the use of the corrective action 

plan template, will allow for more rigorous oversight of remediation 

efforts of weaknesses detected in the financial statement audits. 

VA has had serious, long-standing material weaknesses in financial 

reporting that could result in significant misstatements in financial 

information reported to Congress and used by VA to manage its 

operations. One of the significant deficiencies is not planned for resolution 

until FLITE is fully implemented, which will not be until 2014. Other 

deficiencies can be addressed in the near term. While VA has corrective 

action plans for near-term actions intended to provide more accurate and 

complete financial data, they often lacked key information. Consequently, 

VA managers could not readily identify and address slippage in 

remediation activities, exposing VA to continued risk of errors in financial 

information and reporting. Immediate actions to provide a rigorous 

framework for the design and oversight of corrective action plans will be 

essential to ensuring the timely remediation of internal control 

weaknesses before FLITE implementation. Well-defined corrective action 

plans provide a “road map” for remediation activities and facilitate 

effective oversight by senior VA officials. Continued support from senior 

VA officials and administration CFOs will also be critical to ensure that 

key corrective actions are developed and implemented on schedule. 

Conclusion 

To help focus VA’s corrective action plans on more effectively establishing 

and completing consistent and comprehensive near-term actions, we 

recommend that the Secretary of VA direct the Assistant Secretary for 

Management to issue policies and procedures for identifying and reporting 

on financial audit weaknesses to include: 

Recommendations 

• Detailed guidance (such as a set of tools and templates in place to 

identify and report on programmatic weaknesses) on required 

corrective action plan elements (including milestones for completion of 

interim action steps and validation steps). 

Page 19 GAO-10-65 VA Corrective Action Plans
 

• Establishing a VA Secretariat-level agency-wide governance structure 

for overseeing all OMB Circular No. A-123 and financial statement audit 

material weakness remediation activities that provides for (1) involving 

key stakeholders in the remediation process (such as the FPIAR, 

administration CFO’s, and other senior VA officials); (2) clearly 

defining stakeholder roles and responsibilities; (3) establishing and 

implementing strategic workforce planning for FPIAR; and (4) 

regularly assessing and reporting on the status of corrective action 

plans and identification of any actions needed to address any slippages 

of remediation activities. 

To help ensure the timely and complete capitalization of property, plant, 

and equipment, we recommend that the Secretary of VA direct the 

Assistant Secretary for Management to issue procedures on specific 

actions and identify specific reasonable time frames, such as within 30 

days, to implement VA policy to capitalize PP&E projects when they are 

placed in service. 

In its written comments, VA generally agreed with our findings and 

recommendations and identified specific actions it has taken and plans to 

take to implement these recommendations. In response to our 

recommendation to provide detailed guidance (such as a set of tools and 

templates in place to identify and report on programmatic weaknesses) on 

required corrective action plan elements (including milestones for 

completion of interim action steps and validation steps), VA stated that the 

FPIAR has begun integrating its corrective actions for financial audit 

weaknesses with VA’s OMB Circular No. A-123 processes. VA also said 

that FPIAR will migrate to a set of corrective action plan tools, templates, 

and documented procedures in fiscal year 2010. 

Agency Comments 

and Our Evaluation 

VA partially concurred with our recommendation that VA establish a 

Secretariat-level agencywide governance structure for OMB Circular No. 

A-123 and financial statement audit remediation activities. In its 

comments, VA stated it already established a Senior Assessment Team as 

the coordinating body for corrective action planning to address control 

deficiencies identified as a result of OMB Circular No. A-123 reviews and 

financial statement audits. As discussed in our draft report, we recognized 

VA has taken action to establish agencywide accountability for oversight 

of its corrective action plans and has begun to establish related practices. 

However, these practices had not yet evolved into the rigorous framework 

needed to effectively ensure timely control weakness remediation. VA 

stated that its Internal Controls Service is developing a handbook for all 

stakeholders that will provide detailed guidance for corrective action 

Page 20 GAO-10-65 VA Corrective Action Plans
 

planning, monitoring, reporting, and validation procedures for all financial 

statement audit and OMB Circular No. A-123 significant deficiencies and 

material weaknesses. Also, VA noted that as FPIAR matures, it will 

continue to define and meet staffing requirements. 

VA also concurred with our recommendation that VA issue procedures for 

specific actions and identify reasonable time frames, such as within 30 

days, to implement VA policy to capitalize PP&E projects when they are 

placed in service. VA provided a copy of recently issued procedures which 

identified specific actions and time frames for the capitalization of PP&E. 

These procedures provide guidance for monthly communications between 

engineering staffs, program directors, and the appropriate fiscal activity 

regarding construction project status, costs, and useful life. The 

procedures also provide that property should be capitalized no later than 

the end of the fiscal month following the month that the property is put 

into use or accepted by VA. If fully and effectively implemented, the 

guidance should help address the problems we found related to timely 

capitalization of VA’s PP&E. 

In its written comments, VA also provided technical comments which we 

considered and incorporated as appropriate. 

We are sending copies of this report to other interested congressional 

committees and to affected federal agencies. In addition, this report is 

available at no charge on the GAO Web site at http://www.gao.gov. 

If you or your staff have any questions regarding this report, please 

contact me at (202) 512-9095 or at raglands@gao.gov. Contact points for 

our Offices of Congressional Relations and Public Affairs may be found on 

the last page of this report. GAO staff who made major contributions to 

this report are listed in appendix III. 

usan Ragland 

Director, Financial Management and Assurance 

S

Page 21 GAO-10-65 VA Corrective Action Plans
Appendix I: Scope and Methodology Appendix I: Scope and Methodology 

To determine the nature of the internal control weaknesses identified in 

the Department of Veterans Affairs (VA) fiscal year 2008 financial audit 

report and how long they have been outstanding, we obtained and 

analyzed the financial statement audit reports for fiscal years 2000 to 2008. 

We summarized available information on the extent and nature of the 

internal control weaknesses characterized as material weaknesses,1

 as 

well as the underlying significant deficiencies2

 and identified their 

evolution over time. We also interviewed VA and Office of Inspector 

General (OIG) officials and VA’s independent auditor, and reviewed VA 

documents, prior GAO and OIG reports, and independent auditor 

workpapers to better understand control deficiencies underlying the 

material weaknesses. We did not perform independent audit work to test 

and validate whether the material weaknesses and related significant 

deficiencies reported by the independent auditor were accurate and 

complete. 

To determine whether VA had plans appropriately focused on near-term 

actions to address financial reporting deficiencies prior to the 

implementation of its Financial and Logistics Integrated Technology 

Enterprise (FLITE) system in fiscal year 2014, we analyzed VA’s corrective 

action plans for remediating significant deficiencies underlying two of the 

three material weaknesses impacting the reliability of financial 

information integral for helping inform management decision making—

weaknesses in VA’s financial management systems and in its financial 

management oversight.3

 We interviewed VA officials, VA OIG officials, and 

independent auditor officials who completed VA’s fiscal year 2008 

financial statement audit about near-term actions in VA plans to correct 

these underlying significant deficiencies. We also analyzed related 

corrective action plans to remediate 15 of the 16 significant deficiencies 

 

1

 A material weakness is a significant deficiency, or combination of significant deficiencies, 

that results in more than a remote likelihood that a material misstatement of the financial 

statements will not be prevented or detected by the entity’s internal control. 

2

 A significant deficiency is a control deficiency, or combination of control deficiencies, 

that adversely affects the entity’s ability to initiate, authorize, record, process, or report 

financial data reliably in accordance with generally accepted accounting principles such 

that there is more than a remote likelihood that a misstatement of the entity’s financial 

statements that is more than inconsequential will not be prevented or detected by the 

entity’s internal control. 

3

 VA’s third material weakness concerned IT security controls. VA planned to remediate 

this material weakness using plans of actions and milestones as specified by OMB’ s 

Guidance for Preparing and Submitting Security Plans of Action and Milestones. 

Page 22 GAO-10-65 VA Corrective Action Plans 
Appendix I: Scope and Methodology 

underlying two material weaknesses to determine whether they included 

key information specified in the Chief Financial Officers Council’s (CFOC) 

Implementation Guide for OMB Circular A-123, Management’s 

Responsibility for Internal Control – Appendix A, Internal Control over 

Financial Reporting: action steps with related milestones to provide a 

“road map” for remediation activities, validation activities to help ensure 

the proposed actions worked as envisioned, a description of the deficiency 

to be corrected in sufficient detail to provide clarity and facilitate a 

common understanding of what needs to be done, and clear delineation of 

responsible officials for completing the planned actions. We also reviewed 

VA’s task work plan to remediate the final significant deficiency—the 

documentation of data transfer from VBA benefit payment systems to a 

data warehouse—in fiscal year 2009. 

To determine whether VA had appropriate oversight mechanisms in place 

to help ensure that near-term corrective action plans to address financial 

reporting deficiencies are implemented on schedule, we assessed the 

status of plan implementation in July and August 2009 by identifying 

whether VA met specific milestones and any slippages that had occurred. 

We also evaluated the timeliness of implementation of corrective action 

plans for two significant deficiencies—one to address the inadequate 

capitalization and accounting for property, plant, and equipment (PP&E) 

and another to improve reconciliations of benefit payments. One plan was 

designed and implemented by the Veterans Health Administration, and one 

by the Veterans Benefit Administration—the two principal VA 

administrations. We selected these plans for further review because the 

related deficiencies were not currently being audited or reviewed by other 

oversight organizations, their associated account balances exceeded a 

material dollar threshold ($12.7 billion)4

, and the deficiencies contributed 

to the two material weaknesses that we, VA officials, and VA’s 

independent auditor considered most integral for developing useful and 

reliable information for decision making. We reviewed these plans’ 

implementation in detail to determine the extent to which delays 

jeopardized VA’s ability to remediate these control deficiencies and 

provide reliable financial management information to senior VA officials 

prior to FLITE implementation. In this regard, we reviewed documentation 

and transactions concerning 25 projects that had been placed in service 

 

4

 VA had a net operating cost of about $423 billion in fiscal year 2008. For purposes of 

conducting this work, we calculated a materiality threshold of $12.7 billion (or 3 percent of 

the net operating cost), and identified those deficiencies related to line items with balances 

exceeding that amount. 

Page 23 GAO-10-65 VA Corrective Action Plans
Appendix I: Scope and Methodology 

since the start of fiscal year 2008: 21 projects at the Albuquerque, New 

Mexico Medical Center and 4 projects at the Lyons, New Jersey Medical 

Center to determine how long it took VA to capitalize these projects after 

they had been placed in service. We also reviewed VA’s progress in 

implementing benefit payment reconciliation procedures in a timely 

manner. We interviewed VA, OIG, and independent auditor officials about 

mechanisms in place to oversee the design and implementation of nearterm corrective action plans to remediate material financial reporting 

weaknesses identified through financial statement audits. We reviewed 

minutes of oversight meetings involving senior VA management to 

determine how VA monitored the status of remediation efforts related to 

internal control deficiencies identified through financial statement audits. 

We also interviewed agency officials about VA’s overall accountability for 

timely remediation of internal control deficiencies in the near term, and 

reviewed the status of ongoing VA efforts to staff a new office responsible 

for coordination and oversight of the development of corrective action 

plans. 

We conducted our audit work from November 2008 to November 2009 in 

accordance with generally accepted government auditing standards. Those 

standards require that we plan and perform the audit to obtain sufficient, 

appropriate evidence to provide a reasonable basis for our findings and 

conclusions based on our audit objectives. We believe that the evidence 

obtained provides a reasonable basis for our findings and conclusions 

based on our audit objectives. 

Page 24 GAO-10-65 VA Corrective Action Plans
Appendix II: Coments from the Department of Appendix II: Coments from the Department Veterans Affairs 

of Veterans Affairs 

Page 25 GAO-10-65 VA Corrective Action Plans 
Appendix II: Coments from the Department of 

Veterans Affairs 

Page 26 GAO-10-65 VA Corrective Action Plans
Appendix II: Coments from the Department of 

Veterans Affairs 

Page 27 GAO-10-65 VA Corrective Action Plans
Appendix II: Coments from the Department of 

Veterans Affairs 

Page 28 GAO-10-65 VA Corrective Action Plans
Appendix III: GAO Contact and Staff Appendix III: GAO Contact and Staff Acknowledgments 

Acknowledgments 

GAO Contact – Susan Ragland, (202) 512-9095 or raglands@gao.gov. Staff 

Acknowledgments – In addition to the contact named above, Glenn 

Slocum (Assistant Director), Richard Cambosos, Patrick Frey, W. Stephen 

Lowrey, David Ramirez, and George Warnock made key contributions to 

this report. 

(197201) Page 29 GAO-10-65 VA Corrective Action Plans 
GAO’s Mission The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday afternoon, GAO 

posts on its Web site newly released reports, testimony, and 

correspondence. To have GAO e-mail you a list of newly posted products, 

go to www.gao.gov and select “E-mail Updates.” 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s Web site, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information. 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, DC 20548 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548 

Public Affairs 

Please Print on Recycled Paper