Department of Veterans Affairs: Long-standing Weaknesses in Miscellaneous Obligation and Financial Reporting Controls
Published: 2010-07-28T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In September 2008, GAO reported internal control weaknesses over the Veteran Health Administration's (VHA) use of $6.9 billion in miscellaneous obligations in fiscal year 2007. In November 2009, GAO reported on deficiencies in corrective action plans to remediate financial reporting control deficiencies. This testimony is based on these previous reports that focused on (1) VHA miscellaneous obligation control deficiencies and (2) Department of Veterans Affairs (VA) financial reporting control deficiencies and VA plans to correct them. For its review of VHA miscellaneous obligations, GAO evaluated VA's policies and procedures and documentation, interviewed cognizant agency officials, and conducted case studies at three VHA medical centers. For its review of financial reporting control deficiencies, GAO evaluated VA financial audit reports from fiscal years 2000 to 2008 and analyzed related corrective action plans.
section_title: What GAO Found
paragraphs: In September 2008, we reported that VHA recorded over $6.9 billion of miscellaneous obligations for the procurement of mission-related goods and services in fiscal year 2007. We also reported that VA policies and procedures were not designed to provide adequate controls over the authorization and use of miscellaneous obligations, placing VA at significant risk of fraud, waste, and abuse. We made four recommendations with respect to (1) oversight by contracting officials, (2) segregation of duties, (3) supporting documentation for the obligation of funds, and (4) oversight mechanisms. In January 2009, VA issued new policies and procedures aimed at addressing the deficiencies identified in GAO's September 2008 report. In November of 2009, we reported that VA's independent public auditor had identified two of VA's three fiscal year 2008 material weaknesses--in financial management system functionality and IT security controls--every year since fiscal year 2000 and the third--financial management oversight--each year since fiscal year 2005. While VA had corrective action plans in place that intended to result in near-term remediation of its internal control deficiencies, many of these plans did not contain the detail needed to provide VA officials with assurance that the plans could be effectively implemented on schedule. For example, 8 of 13 plans lacked key information about milestones for steps to achieve the corrective action and how VA would validate that the steps taken had actually corrected the deficiency. While VA began to staff a new office responsible for, in part, assisting VA and the three administrations in executing and monitoring corrective action plans, we made three recommendations to improve corrective action plan development and oversight. VA concurred with our recommendations and took some steps to address them. In fiscal year 2009, VA's own internal VA inspections and financial statement audit determined that the internal control deficiencies identified in our prior reports on miscellaneous obligations and material weaknesses identified in prior financial audits continued to exist. VA conducted 39 inspections, which identified problems with how VHA facilities had implemented VA's new miscellaneous obligation policies and procedures. Similarly, VA's independent auditor reported that VA continued to have material weaknesses in financial management system functionality, IT security controls, and financial management oversight in fiscal year 2009. To the extent that the deficiencies we identified continue, it will be critical that VA have an effective "tone at the top" and mechanisms to monitor corrective actions related to deficient internal controls. In its September 2008 report, GAO made four recommendations to improve VA's internal controls over miscellaneous obligations. In its November 2009 report, GAO made three recommendations to improve VA corrective action plans to remediate financial reporting control deficiencies. VA generally concurred with these recommendations and has since reported taking actions to address the recommendations.

section_title: Letter
paragraphs: I am pleased to be here today to discuss the findings from our prior work  that are relevant to the subject of this hearing on VA internal controls.  Specifically, I will highlight findings from our reports on (1) Veterans  Health Administration’s (VHA) use of miscellaneous obligations, and (2)  the Department of Veterans Affairs (VA) plans to correct financial  reporting control deficiencies. In September 2008, we reported on VHA’s  use of miscellaneous obligations and identified related control  deficiencies. Although the VA developed new policies and procedures in  response to our recommendations, recent internal VA inspections indicate  that the deficiencies we identified have not yet been corrected. In  November 2009, we reported that VA had long-standing financial reporting  control deficiencies. These deficiencies continue to be reported by VA’s  independent public auditor.
My testimony today summarizes findings of these prior two engagements. I  will also provide an update regarding the information we have obtained  from VA concerning recent internal inspections on the use of  miscellaneous obligations and pertinent sections of VA’s fiscal year 2009  financial audit report.
For our prior work regarding VHA’s use of miscellaneous obligations, we  obtained and analyzed a copy of VHA’s Integrated Funds Distribution,  Control Point Activity, Accounting and Procurement (IFCAP) database of  miscellaneous obligations. We also reviewed VA policies and procedures,  interviewed financial management and procurement officials, and  conducted case studies at three VHA medical centers. For our review of  VA corrective actions to remediate financial reporting control deficiencies,  we analyzed financial statement audit reports from fiscal years 2000 to  2008, interviewed VA and Office of Inspector General (OIG) officials and  VA’s independent auditor, and reviewed VA documents and independent  auditor work papers. We also analyzed VA corrective action plans to  remediate significant deficiencies underlying two of the three financial  reporting material weaknesses. Appendixes to our prior reports provide  additional details on our scope and methodologies.
We conducted the work for the report on VHA miscellaneous obligations  from November 2007 through July 2008, and the work for the report on  VHA corrective action plans to remediate financial reporting control  deficiencies from November 2008 to November 2009, in accordance with  generally accepted government auditing standards. Those standards  require that we plan and perform the audits to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives. We also summarize information VA  provided us on its actions to address our recommendations in these two  reports, as well as pertinent sections from VA’s independent public  auditor’s report on the VA fiscal year 2009 financial statements. Because of  the relatively short time between the request to testify and the hearing  date, we did not have sufficient time to validate VA’s information on the  status of actions taken to address our prior recommendations.
subsections: section_title: Background
paragraphs: VHA provides a broad range of primary and specialized health care, as well  as related medical and social support services through a network of more  than 1,200 medical facilities. In carrying out its responsibilities, VHA uses  “miscellaneous obligations” to obligate (or administratively reserve)  estimated funds against appropriations for the procurement of a variety of  goods and services when specific quantities and time frames are  uncertain. According to VA policy, miscellaneous obligations can be used  to record estimated obligations to facilitate the procurement of goods and  services, such as fee-based medical and nursing services and beneficiary  travel.
In fiscal year 2007, VHA recorded over $6.9 billion of miscellaneous  obligations for the procurement of mission-related goods and services.  According to VHA fiscal year 2007 data, almost $3.8 billion (55.1 percent)  of VHA’s miscellaneous obligations was for fee-based medical services and  another $1.4 billion (20.4 percent) was for drugs and medicines. The  remainder funded, among other things, state homes for the care of  disabled veterans, transportation of veterans to and from medical centers  for treatment, and logistical support and facility maintenance for VHA  medical centers nationwide.
section_title: Miscellaneous Obligation Control Deficiencies
paragraphs: In September 2008, we reported that VA policies and procedures were not  designed to provide adequate controls over the authorization and use of  miscellaneous obligations with respect to (1) oversight by contracting  officials, (2) segregation of duties, and (3) supporting documentation for  the obligation of funds. Collectively, these flaws increased the risk of  fraud, waste, and abuse. Our case studies at three medical centers showed,  for example, that VA did not have procedures in place to document any  review by contracting officials, and none of the 42 obligations we reviewed  had such documented approval. Effective oversight and review by trained,  qualified officials is a key factor in helping to ensure that funds are used  for their intended purposes. Without control procedures to help ensure  that contracting personnel review and approve miscellaneous obligations  prior to their creation, VHA is at risk that procurements do not have the  necessary safeguards. In addition, our analysis of VA data identified 145  miscellaneous obligations, amounting to over $30.2 million, that appeared  to have been used in the procurement of such items as passenger vehicles;  furniture and fixtures; office equipment; and medical, dental and scientific  equipment. VA officials told us, however, that the acquisition of such  assets should be done by contracting rather than through miscellaneous  obligations.
Our 2008 report also cited inadequate segregation of duties. Federal  internal control standards provide that for an effectively designed control  system, key duties and responsibilities need to be divided or segregated  among different people to reduce the risk of error or fraud. These  controls should include separating the responsibilities for authorizing  transactions, processing and recording them, reviewing the transactions,  and accepting any acquired assets. In 30 of the 42 obligations reviewed,  one official performed two or more of the following functions: requesting,  approving, or recording the miscellaneous obligation of funds, or  certifying delivery of goods and services and approving payment. In two  instances involving employee grievance settlements, one official  performed all four of these functions. In 2007, the VA OIG noted a similar  problem in its review of alleged mismanagement of funds at the VA Boston  Healthcare System. For example, according to OIG officials, they obtained  documents showing that a miscellaneous obligation was used to obligate  $200,000. This miscellaneous obligation was requested, approved, and  obligated by one fiscal official. The OIG concluded that Chief of the  Purchasing and Contracting Section and four other contracting officers  executed contract modifications outside the scope of original contracts  and the Chief of the Fiscal Service allowed the obligation of $5.4 million in  expired funds. In response to the OIG recommendations, VA officials  notified contracting officers that the practice of placing money on a  miscellaneous obligation for use in a subsequent fiscal year to fund new  work was a violation of appropriations law, and that money could no  longer be “banked” on a miscellaneous obligation absent a contract to  back it up. Similarly, an independent public accountant’s July 2007 report  found, among other things, that the segregation of duties for VA’s  miscellaneous obligation process was inadequate. Without the proper  segregation of duties, risk of errors, improper transactions, and fraud  increases.
Our 2008 case studies also identified a lack of adequate supporting  documentation at the three medical centers we visited. Specifically, VA  policies and procedures were not sufficiently detailed to require the type  of information needed such as purpose, vendor, and contract number that  would provide crucial supporting documentation for the obligation. In 8 of  42 instances, we could not determine the nature, timing, or the extent of  the goods or services being procured from the description in the purpose  field. As a result, we could not confirm that the miscellaneous obligations  were for bona fide needs or that the invoices reflected a legitimate use of  federal funds.
Our report concluded that without basic controls in place over billions of  dollars in miscellaneous obligations, VA is at significant risk of fraud,  waste, and abuse. In the absence of effectively designed key funds and  acquisition controls, VA has limited assurance that its use of  miscellaneous obligations is kept to a minimum, for bona fide needs, and  in the correct amounts. We made four recommendations, concerning  review by contracting officials, segregation of duties, supporting  documentation, and oversight mechanisms. These recommendations  aimed at reducing the risks associated with the use of miscellaneous  obligations.
In response to our recommendations, in January of 2009, VA issued  Volume II, Chapter 6, of VA Financial Policies and Procedures— Miscellaneous Obligations, which outlines detailed policies and  procedures aimed at addressing control deficiencies identified in our  September 2008 report. Key aspects of the policies and procedures VA  developed in response to our four recommendations included:    Review of miscellaneous obligations by contracting officials—The  request and approval of miscellaneous obligations are to be reviewed  by contracting officials, and the contracting reviews are to be  documented.
Segregation of duties—No one official is to perform more than one of  the following key functions: requesting the miscellaneous obligation;  approving the miscellaneous obligation; recording the obligation of  funds; or certifying the delivery of goods and services or approving  payment.
Supporting documentation for miscellaneous obligations—New  procedures require providing the purpose, vendor, and contract  number fields before processing obligation transactions, including  specific references, the period of performance, and the vendor name  and address.
Oversight mechanism to ensure control policies and procedures are  fully and effectively implemented—Each facility is now responsible for  performing independent quarterly oversight reviews of the  authorization and use of miscellaneous obligations. Further, the results  of the independent reviews are to be documented and  recommendations tracked by facility officials. The policies and  procedures also note that the Office of Financial Policy is to conduct  quarterly reviews of VA miscellaneous obligation usage to ensure  compliance with the new requirements.
subsections: section_title: Recent VA Inspections Identify Continuing Control Problems
paragraphs: As part of its fiscal year 2009 review activities, VA’s Office of Business  Oversight (OBO) Management Quality Assurance Service (MQAS)  evaluated VA compliance with new VA policies and procedures concerning  the use of miscellaneous obligations—Financial Policies and Procedures,  Volume II, Chapter 6, Miscellaneous Obligations. According to its  executive summary report, the MQAS reviewed 476 miscellaneous  obligations at 39 different medical centers, health care systems, and  regional offices in fiscal year 2009. The MQAS found 379 instances of  noncompliance with the new policies and procedures. Examples include:  Inadequate oversight of miscellaneous obligations by contracting  officials—Many miscellaneous obligations were not submitted for the  required approval by the Head of Contracting Activity. Further, some  miscellaneous obligation were used for invalid purposes, including  employee tuition, utilities, general post, lab tests, and blood products.
Segregation of duties— Many miscellaneous obligations had  inadequate segregation of duties concerning the requesting, approving,  and recording of miscellaneous obligations, and the certifying receipt  of goods and services and approving payment. For example, the MQAS  identified 48 instances where two individuals performed all four of  these functions.
Supporting documentation for miscellaneous obligations—Some  miscellaneous obligations also lacked adequate supporting  documentation concerning the vendor name, performance period, and  the contract number.
These noncompliance issues were similar to those we identified in our  September 2008 report on VHA miscellaneous obligations.
Overall, MQAS found that there was a lack of timely dissemination of the  new miscellaneous obligation policy, and issued 34 recommendations to  VA facility officials. Fiscal year 2010 facility-level recommendations  included the need to develop standard operating procedures for  implementing the policy, to provide training for new accounting personnel,  to require documentation establishing segregation of duties, and to  institute facility-level quarterly reviews. According to the MQAS Associate  Director, VHA facilities are in the process of taking corrective actions to  address the MQAS recommendations.
section_title: VA Has Had Long- standing Material Weaknesses in Financial Reporting
paragraphs: In November of 2009, we reported that VA had three long-outstanding  material weaknesses in internal control over financial reporting identified  during VA’s annual financial audits.
Financial management oversight—reported as a material weaknesses  since fiscal year 2005. This issue was also identified as a significant  deficiency in fiscal years 2000 through 2004. This weakness stemmed  from a variety of control deficiencies, including the recording of  financial data without sufficient review and monitoring, a lack of  sufficient human resources with the appropriate skills, and a lack of  capacity to effectively process a significant volume of transactions.
Financial management system functionality—reported since fiscal year  2000—is linked to VA’s outdated legacy financial systems affecting  VA’s ability to prepare, process, and analyze financial information that  is timely, reliable, and consistent. Legacy system deficiencies  necessitated significant manual processing of financial data and a large  number of adjustments to the balances in the system.
IT security controls—also reported since fiscal year 2000—resulted  from the lack of effective implementation and enforcement of an  agencywide information security program. Security weaknesses were  identified in the areas of access control, segregation of duties, change  control, and service continuity.
We also found that while VA had corrective action plans in place intended  to result in near-term remediation of its significant deficiencies, many  corrective action plans did not contain the detail needed to provide VA  officials with assurance that the plans could be effectively implemented on  schedule. Eight of the 13 plans we reviewed lacked key information  regarding milestones for completion of specific action steps and/or  validation activities. Consequently, VA managers could not readily identify  and address slippage in remediation activities, exposing VA to continued  risk of errors in financial information and reporting. VA recognized the  need to better oversee and coordinate agencywide oversight activities for  financial reporting material weaknesses, and began to staff a new office  responsible for, in part, assisting VA and the three administrations and  staff offices in executing and monitoring corrective actions plans. Our  report concluded that actions to provide a rigorous framework for the  design and oversight of corrective action plans will be essential to  ensuring the timely remediation of VA’s internal control weaknesses, and  that continued support from senior VA officials and administration CFOs  would be critical to ensure that key corrective actions are developed and  implemented on schedule. We made three recommendations to help  improve corrective action plan development and oversight. VA concurred  with the recommendations and said that it took some actions to address  the recommendations, including developing a manual with guidance on  corrective action planning and monitoring, creating a corrective action  plan repository, and establishing a Senior Assessment Team of senior VA  officials as the coordinating body for corrective action planning,  monitoring, reporting, and validation of deficiencies identified during  financial audits.
subsections: section_title: Recent VA Financial Reporting Indicates Continuing Material Weaknesses
paragraphs: VA’s independent auditor fiscal year 2009 financial audit report included  the three material weaknesses that have been reported as deficiencies  since 2000. In addition, it also included a new material weakness  concerning compensation, pension, and burial liabilities. Furthermore,  VA’s reporting indicated remediation timetables for the previously  reported material weaknesses appear to be slipping. In the fiscal year  2009 Performance and Accountability Report, VA officials noted that in  fiscal year 2009 they had closed 10 of the underlying significant  deficiencies reported in fiscal year 2008, but that their timetables had  slipped for remediating the IT security controls and financial management  oversight material weaknesses to 2010 and 2012, respectively. In addition,  milestones for remediating the new material weakness—compensation,  pension, and burial liabilities—had yet to be determined.
According to the independent auditor, the causes for the fiscal year 2009  material weaknesses related to   challenges to implement security policies and procedures,   a lack of sufficient personnel with the appropriate knowledge and  skills,   a significant volume of transactions, and     decentralization.
These findings are consistent with those we identified in our 2009 report  and are all long-standing issues at the VA. The auditor noted that VA did  not consistently monitor, identify, and detect control deficiencies. The  auditor recommended that VA assess the resource and control challenges  associated with operating in a highly decentralized accounting function,  and develop an immediate interim review and monitoring plan to detect  and resolve deficiencies.
In summary, while we have not independently validated the status of VA’s  actions to address our 2008 and 2009 reports’ findings concerning VA’s  controls over miscellaneous obligations and financial reporting, VA’s  recent inspections and financial audit report indicate that the serious,  long-standing deficiencies we identified are continuing. Effective  remediation will require well-designed plans and diligent and focused  oversight by senior VA officials. Further, the extent to which such serious  weaknesses continue raises questions concerning whether VA  management has established an appropriate “tone at the top” necessary to  ensure that these matters receive the full, sustained attention needed to  bring about their full and effective resolution. Until VA’s management fully  addresses our previous recommendations, VA will continue to be at risk of  improper payments, waste, and mismanagement.
Mr. Chairman, this concludes my prepared statement. I would be happy to  respond to any questions you or other members of the committee may  have at this time.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: For further information about this testimony, please contact Susan  Ragland, Director, Financial Management and Assurance at (202) 512-9095,  or raglands@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this  testimony. Major contributors to this testimony included Glenn Slocum,  Assistant Director; Richard Cambosos; Debra Cottrell; Daniel Egan;  Patrick Frey; W. Stephen Lowrey; David Ramirez; Robert Sharpe; and  George Warnock.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.