VA Medical Centers: Internal Control over Selected Operating Functions Needs Improvement
Published: 2004-07-21T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Department of Veterans Affairs (VA) provides health care to veterans through the $27 billion Veterans Health Administration (VHA) medical programs. VHA administers and operates VA's medical system, providing care to nearly 5 million patients in 2003. As of September 2003, VHA operated 160 hospitals, 847 outpatient clinics, 134 nursing homes, 42 domiciliaries, and 73 comprehensive home care programs, including facilities in every state, Puerto Rico, the Philippines, and Guam. VHA is responsible for effective stewardship of the resources provided to it by Congress, which asked GAO to review internal controls in three areas of operation at selected VHA medical centers. GAO conducted a review to assess the effectiveness of control activities over (1) personal property, (2) drugs returned for credit, and (3) part-time physician time and attendance.
section_title: What GAO Found
paragraphs: GAO's review found that six selected VA medical centers lacked a reliable property control database. The property databases for the six medical centers contained incomplete information. As a result, GAO could not select a statistical sample of test items so that results could be projected to each location's entire property universe. Key policies and procedures established by VA to control personal property provided facilities with substantial latitude in conducting physical inventories and maintaining their property management systems, which resulted in reduced property accountability. For example, VA's Materiel Management Procedures handbook allowed the person responsible for custody of VA property to attest to the existence of that property rather than requiring independent verification. Also, personnel at some locations interpreted a policy that established a $5,000 threshold for property that must be inventoried as a license to ignore VA requirements to account for lower cost items that are susceptible to theft or loss, such as personal computers and peripheral equipment. These weak practices, combined with lax implementation, resulted in low levels of accountability and heightened risk of loss. VHA personnel located fewer than half of the 100 items GAO selected at each of five medical centers and 62 of 100 items at the sixth medical center. The process for obtaining credit for recalled, expired, or deteriorated drugs was, in essence, an honor system. Each of the six pharmacies GAO visited used a contractor to return drugs to the manufacturer for credit, but only one of the pharmacies inventoried non-narcotic drugs before they were turned over to the contractor. None of the pharmacies had enough information about which drugs qualified for credit to be able to reconcile the credits they received with the drugs they had turned over to the contractor. There was no agency-level oversight of returned drug information to help identify improvements that might increase the credits that VA receives. At four of the six facilities, non-narcotic drugs held for return were stored in unsecured open bins accessible to anyone in the pharmacy. The combined lack of record keeping and physical controls over non-narcotic drugs held for return exposed them to potential loss, theft, or unauthorized use. Scheduled and actual hours worked by part-time physicians at the six locations GAO visited were not always documented in accordance with a January 2003 VHA directive. Five of the six locations had not prepared written work schedules for all part-time physicians as required. GAO found that latitude provided in the directive resulted in wide variation in procedures used by the six medical centers to verify physician compliance with work schedules. While some timekeepers used informal notes to record daily attendance, one facility required physicians to sign in. However, on the day of GAO's review, only two of 15 scheduled physicians had signed in. Attendance monitoring procedures at the six locations varied in frequency and included monitoring all part-time physicians once per quarter at one location and 5 percent of part-time physicians each month at another.

section_title: Letter
paragraphs: In fiscal year 2003, the Department of Veterans Affairs (VA) provided health  care to veterans through the Veterans Health Administration (VHA)  medical programs at a cost of $27 billion.  VHA’s medical programs include  medical care, research, and medical administration and miscellaneous  operating expenses.  VHA administers and operates VA’s medical care  system, the nation’s largest integrated health care system, providing care to  nearly 5 million patients with over 741,000 inpatient episodes treated and  over 50 million outpatient visits in 2003.  To carry out its medical care  mission, VHA operated (as of September 2003) 160 hospitals, 847  outpatient clinics, 134 nursing homes, 42 domiciliaries, and 73  comprehensive home care programs, including facilities in every state,  Puerto Rico, the Philippines, and Guam.
VHA is responsible for effective stewardship of the resources provided to it  by Congress.  In conjunction with that responsibility, you asked us to  review internal control activities in three areas of operation at selected  VHA medical centers to assess whether those controls were designed and  implemented effectively.  Specifically, you asked that we assess the  effectiveness of control activities regarding (1) accountability over  personal property, (2) drugs returned for credit, and (3) part-time physician  time and attendance.  We evaluated whether procedures used in these three  areas of operation at the selected VHA medical centers incorporated  effective controls regarding accountability for agency resources.
To gain an understanding of VHA’s policies and procedures and the related  internal controls for the three areas of operation, we obtained and  reviewed VA and VHA policy guidance and interviewed cognizant VHA  personnel on topics related to the scope of this report. We reviewed our  previous reports and reports issued by VA’s Office of the Inspector General (OIG) .   Using a case study approach to assess the effectiveness of the key  control activities that we identified, we reviewed transaction  documentation at six VA medical centers. We conducted our review from  February 2003 through March 2004 in accordance with U.S. generally  accepted government auditing standards.
subsections: section_title: Background
paragraphs: To meet property management requirements and provide data for personal  property reporting needs, VA field facilities use an inventory accounting  system, the Automated Engineering Management System/Medical  Equipment Reporting System.  The system was originally designed to  schedule preventive maintenance.  In 1996, the system was expanded to  incorporate the agency’s previously separate property management  function, becoming the agency’s official record of inventory for capitalized  and noncapitalized equipment.  VHA’s Acquisition and Materiel  Management (A&MM) service maintains the property management portion  of the system while Engineering Services operates the property  maintenance portion.  The property management system includes a  detailed listing of the agency’s personal property, providing information  that among other things, is (1) a control for the accuracy of property cost  information presented in the agency’s financial report, (2) the basis for  physical inventories of agency personal property, and (3) the primary  control record for accountability over the agency’s personal property.  The  system is used to prepare bar code labels that are affixed to nonexpendable  property acquired by VHA to identify items as VHA property and to provide  for efficient physical inventories using portable bar code readers.  The  property management software has been updated occasionally to  incorporate, for example, the addition of a disposal date capability and  changes in the agency’s cost thresholds for property accountability and  capitalization.  A VHA official told us that once a property item is entered in  the system’s database, a system application control retains the record, even  after disposal of the item.
Pharmaceutical manufacturers allow VA a credit for certain drugs that are  returned.  Each manufacturer establishes its own criteria for issuing credit,  which can change at any time and differ among a single manufacturer’s  products.  The differing criteria can include such attributes as units of  packaging and length of time between the return date and the expiration  date.  Some drugs are not returnable and must be destroyed if not used  before the expiration date.  To obtain available credits with minimal agency  resources, VA has arranged contracts with pharmaceutical returns vendors  that individual VHA medical facilities may utilize.  One hundred forty of  VHA’s 160 medical centers use the services of Devos, Ltd., doing business  as Guaranteed Returns, to assist them in returning drugs for credit or  disposing of nonreturnable drugs in accordance with environmental  standards and preparing required paperwork to monitor the movement of  narcotic drugs.  Guaranteed Returns receives a percentage of credits issued  for returnable drugs and a fee based on weight for destruction of  nonreturnable drugs.
VHA also uses the services of part-time physicians where necessary to  alleviate recruitment difficulties or when practicality would not indicate  full-time employees.  While VA policy states a part-time appointment  requires a tour of duty scheduled in advance that normally does not  significantly change from one pay period to another, it also provides that a  part-time physician whose other responsibilities make adherence to the  same schedule every pay period impractical may have an adjustable work  schedule. Part-time physicians with adjustable tours of duty have a  biweekly work requirement consisting of non-core hours that may be  adjusted at the request of the employee and core hours that are the days  and times when the employee must be present unless granted an  appropriate form of leave or excused absence.  VA policy requires core  hours to be at least 25 percent of total scheduled hours.  In April 2003, the  OIG reported that part-time physicians were not working the hours  established in their VA appointments.  A February 2004 follow-up report by  the OIG stated that while most part-time physicians were on duty as  required, 8 percent of the part-time physicians tested were not on duty or  on approved leave or authorized absence as scheduled.
section_title: Scope and Methodology
paragraphs: To gain an understanding of VHA’s policies and procedures and the related  internal controls for the three areas of operation we assessed, to identify  key control activities, and to assess the design effectiveness of those  controls, we obtained and reviewed VA and VHA directives, handbooks,  and other policy guidance and reports issued by VA’s OIG.  We also  conducted interviews and system walk-throughs with VHA personnel and  reviewed our previous reports.  To assess the implementation effectiveness  of the key control activities for the three areas of operation, we used a case  study approach, reviewing transaction documentation at six VA medical  centers selected based on size and medical specialization diversity of the  location’s part-time physicians and other factors.
For personal property management, we discussed requirements and  procedures with VHA headquarters and medical center personnel.  We  performed tests of each medical center’s property records to assess their  accuracy.  Because our initial review disclosed incomplete and inaccurate  information in property database records from each location we visited, we  could not design our work to make a statistically based projection on the  results of our work.  Instead, we tested a nonstatistical selection of 100  items from each location’s property records to verify property existence by  locating the item and comparing bar code, serial number, and item  description information in the records to the item that we observed.
For drugs returned for credit, we discussed requirements and procedures  for managing turned-in drugs with personnel at VHA headquarters, the  selected medical centers, and a pharmaceutical return contractor.  Also, for  each of the six medical centers we visited, we obtained and reviewed  inventory lists of returned drugs for one contractor pickup of drugs held for  return and vendor credit documents.
For part-time physician time and attendance, we discussed policy  requirements with VHA headquarters personnel and asked medical center  staff about the processes for collecting, approving, and recording time and  attendance data for part-time physicians.  We reviewed time and  attendance and corresponding payroll documentation for a judgmental  selection of 10 part-time physicians for two biweekly pay periods ending in  September 2003 at each of the six medical centers that we visited.  We also  reviewed medical center procedures for monitoring part-time physician  attendance.
We reviewed and used as guides, our Standards for Internal Control in the  Federal Government and the Internal Control Management and  Evaluation Tool. The Comptroller General issued these standards to  provide the overall framework for establishing and maintaining internal  control. According to these standards, internal control, also referred to as  “management control,” comprises the plans, methods, and procedures used  to meet the missions, goals, and objectives of an organization. Internal  control also serves as the first line of defense in safeguarding assets and  preventing and detecting errors and fraud.  Our Management and  Evaluation Tool provides a systematic, organized, and structured approach  to assessing internal control.
We performed our work at VA medical centers in Atlanta, Houston, Los  Angeles, San Francisco, Tampa, and Washington, D.C.; at VA headquarters;  and for drugs returned for credit, at a return contractor’s facility in East  Setauket, New York.  Our work was performed using a case study  approach, and therefore, results of our study cannot be projected beyond  the locations and transactions we reviewed.
We conducted our review from February 2003 through March 2004 in  accordance with U.S. generally accepted government auditing standards.
We requested comments on a draft report from the Secretary of Veterans  Affairs or his designee.  Written comments were received from the  Secretary of Veterans Affairs and are reprinted in appendix II.
section_title: Property Management Policies and Procedures Provided Inadequate Control over Medical Center Personal Property
paragraphs: We found that VHA’s property control databases did not provide a complete  and accurate record of personal property on hand, compromising effective  management and security of agency assets at the six locations we visited.   Our tests to determine whether the six medical centers had adequate  control over items that were recorded in the property control databases  showed that property officials could locate only about one-third of the 600  items we selected.  We found that in addition to noncompliance with VA  property management requirements, current VA physical inventory and  property accountability policies were a major cause of unreliable property  records and reduced the opportunity to adequately control personal  property at five of the six medical centers we visited.
subsections: section_title: Medical Centers Lacked a Reliable Property Control Database
paragraphs: Standards for Internal Control in the Federal Government requires that  agencies establish physical control to secure and safeguard vulnerable  assets such as equipment, periodically count those assets, and compare the  counts to control records.  However, through our initial reviews, we found  that the property control records for the six locations we visited contained  incomplete or incorrect information, such as missing property location or  acquisition cost information.  The property control records were such that  we could not select a statistical sample of test items that would allow our  results to be projected to the location’s entire property universe.  We  proceeded instead with a case study approach, reviewing 100 property  items selected from each of the six medical centers’ databases using a  nonstatistical selection method.  Medical center property officials told us  that some of the incorrect or incomplete information in the databases  resulted from the incorrect transfer of some information from the previous  property control system to the current system in 1996.  The lack of accurate  property control records hampered medical center property managers’  efforts to effectively safeguard and manage VHA personal property.
section_title: Property Managers Found about One-Third of the Property Items Selected for Testing
paragraphs: Property officials located only 201 of 600 items (or about one-third) that we  selected from the six medical centers’ property control records to observe  and verify.  At five locations, VHA officials found from 13 to 39 of the 100  items we tested at each location to determine if they were on hand, while at  the sixth medical center, Atlanta, 62 of 100 items were found. The 600  assets we selected to observe were recorded at a total value of $104,220,868  in the property control system.  However, because 125 of the 600 test items  selected had no acquisition cost entered in the databases, the total cost of  our selection could not be determined.  Table 1 summarizes the results of  our property observation tests at all locations we visited.  Each category of  items not observed is discussed below.
Database errors or omissions represented 156 items that were not observed  ostensibly because of insufficient database information.  These errors  included assets for which the property database did not (1) indicate a  disposal date, though property officials told us the item had been disposed  of, or (2) did not indicate a location for the property item.  One property  official said the predecessor property control system had not included a  field for a disposal date, and when the program was modified to add that  capability, then-existing records were not updated.  Other database errors  included records that did not accurately identify the asset as building  service equipment, which represent items that are essentially part of  facility buildings rather than personal property, or entries with one  equipment identification number that represented several component  items constituting one system.
At the Washington medical center, we could not locate three property  items, each valued at over $1 million, because of other data entry errors.   The explanation for two of the three items was that the assets were on  order but had not yet been received.  Center officials attributed these  errors to property personnel entering these assets into the property control  system prior to receipt.  For the third item, center officials informed us that  one bar code number had been issued for a system of several pill  dispensing machines, the components of which were at various locations  throughout the medical center and had a combined value over $1 million,  rather than bar coding each component and entering it in the property  record to provide a means of controlling each item.
Inadequate labeling of property items prevented us from verifying the  identity of 17 items with a total acquisition cost of $29,463,952 selected  from the property records at four medical centers.  According to VA  officials, nonexpendable property costing $5,000 or more must be bar  coded and recorded in the property system.  However, none of these 17  items had bar code labels attached, and either serial number labeling was  also not attached to the asset or the serial number was not entered in the  property records.  For example, at the Tampa medical center, five property  items totaling $9,996,491, including a telephone operating system, two X- ray systems, and two components of an X-ray system, were inadequately  labeled.  Although items that we observed matched the general description  and location indicated by the property records for these items, we were  unable to specifically verify their identity because bar codes had not been  placed on the items and serial number information could not be compared  between the property records and the physical items.  When both bar code  and serial number information cannot be compared between the property  records and the property item, the physical inventory process is impaired  and property accountability is compromised.  Under these circumstances,  even the most effective physical inventory procedure cannot provide the  requisite assurance that assets are controlled adequately.
Forty-two mobile or portable items, such as a wheelchair, adjustable bed,  and Intensive Care Unit module, also could not be located. Officials stated  that these items are moved from one location to another within the medical  centers to meet patients’ needs.  At the Houston medical center, from our  selection of 100 items, property officials were unable to locate 13 portable  assets, totaling $19,997, before the end of our visit.  Some of these items  included patient beds, patient feeding pumps, and a portable defibrillator.
Regarding the remaining 184 items, property officials at the six medical  centers could neither locate them at the time of our visits nor provide  documentation supporting the disposal, loan, or loss of the items, or  otherwise explain why they were not found.
A 1997 addition to VA’s Handbook 7127, “Materiel Management  Procedures,” established a $5,000 threshold for property that must be  inventoried.  The handbook stated that it is a local decision to maintain  inventory on "other" nonexpendable equipment not capitalized or  accounted for and also required accountability for sensitive property  regardless of cost.  Referring to the inventory provisions, A&MM staff at  four of the six locations we visited told us they were only accountable for  property items costing $5,000 or more and items in the four categories of  sensitive assets specifically identified by VA policy: handguns, ammunition,  canines, and automobiles.  By ignoring VA’s general requirement to account  for sensitive property regardless of cost, property managers at those  locations did not keep the property control database current for most items  costing less than $5,000 and lost control of the items not tracked.  Medical  center property officials at two centers said we should not expect to locate  items with a cost lower than $5,000 because they do not inventory these  assets.  This practice means that some items, such as computers, monitors,  and other sensitive equipment, which by their nature are subject to theft,  loss, or conversion to personal use, are not inventoried or tracked.  Of the  184 items that were neither found nor had plausible explanations for not  being found, over half (95) were sensitive assets.  Table 2 shows the nature  of these 95 sensitive items categorized as personal computers, laptop  computers, scanners, printers, monitors, facsimile or copier machines, and  videocassette recorders.
The Information Resources Management department (IRM) at the six  medical centers we visited had developed alternative procedures to  maintain accountability for computer equipment that cost less than $5,000.   However, we found many instances in which these procedures were not  used effectively.  For example, a separate listing prepared by the Los  Angeles center’s IRM was not used to update the property location  information in the property control record, which showed the initial IRM  storage room instead of the final location to which computer equipment  was assigned.  Further, the IRM record was not kept up to date, a factor in  IRM personnel being unable to locate 22 of the 30 IRM items we selected  for observation.
Our standards for internal control require that key duties be divided or  segregated among different people to reduce the risk of error or fraud.   However, one of the methods for taking physical inventory of property  established in VA’s handbook provides that each party responsible for  property items will (1) receive a listing of accountable property items  charged to him or her according to the property management system;   (2) conduct a physical count; and (3) sign and date the listing, certifying the  existence of and continuing need for the property for which he or she was  responsible.  Allowing the party responsible for the custody of property  assets to attest to the existence of those same assets is contrary to the  segregation of duties standard and compromises the control provided by  taking an independent physical inventory.  To illustrate the minimal value  of such procedures, property officials at two medical centers told us that  some service line managers just sign the inventory list without verifying the  existence of the equipment.  These practices would result in creating or  perpetuating property control record errors if listed items had been lost,  stolen, loaned, transferred, or otherwise disposed of.  VA’s handbook also  requires the involvement of A&MM officials in quarterly spot checks to  verify inventory accuracy, but A&MM officials at only two of the locations  we visited indicated they perform regular spot checks.
A&MM staff at the Atlanta medical center told us they conducted periodic  inventories of personal property rather than delegating that control  function to parties responsible for the property.  They also told us that the  Atlanta facility considers computer equipment to be sensitive and,  therefore, accountable.  At this location, we observed 62 of 100 test items  compared to from 13 to 39 of the 100 items at each of the other five  locations we visited, all of which performed physical inventories primarily  by using equipment lists certified by property custodians.
Subsequent to our visit, property officials from the San Francisco medical  center told us that they had located all equipment items with an acquisition  cost of $5,000 or more that we had selected for testing, and officials from  the Washington medical center told us they had located 10 additional items  that we selected for observation, one of which was over $5,000.  However,  because we were no longer on site and could not verify the existence of  these items, the additional found items are not incorporated in the  statistics we present.
Agency officials provided us with a copy of proposed revisions to VA’s  property policy guidance that address some of the weaknesses we  identified.  While the draft policy adds 27 specific categories of equipment  that would require accountability regardless of cost, including computer  equipment, it reduces the frequency of spot checks from quarterly to  semiannually and addresses the physical inventory segregation of duties  issue only minimally by requiring that 5 percent of inventory be verified by  disinterested parties.
section_title: VHA Controls over Process for Returning Drugs for Credit Was Weak
paragraphs: Internal control over drugs held for return credit, which according to VHA  officials is left to the discretion of medical center management, provided  no assurance that the six pharmacies we visited were receiving the proper  amount of credits for returned drugs. All six of the pharmacies used  contractors to return the drugs, and agency officials said that using  contractors had increased the amount of credits VA received for returned  drugs.  However, all six locations lacked information about which drugs  qualified for credit, and only one pharmacy inventoried non-narcotic drugs  before they were turned over to the contractor. Accordingly, none of the  pharmacies had the basic information needed to verify that credits received  were correct and complete.  We also found that no analytical review of  credits for returned drugs, focused on maximizing the amount of credits  received, was performed at the location, network, or agency level.  In  addition, we identified security weaknesses.  Non-narcotic drugs held for  return without a control listing were stored in unsecured open bins readily  accessible to anyone within the pharmacy at each facility except the San  Francisco and Tampa medical centers.
subsections: section_title: VHA Relies on Others to Determine the Amount of Credits for Returned Drugs
paragraphs: Standards for Internal Control in the Federal Government states that  internal control should provide reasonable assurance that effective and  efficient use of the entity’s resources is achieved.  VHA officials told us that  controls over returned drugs and related credits were left up to pharmacy  managers at individual medical centers.  However, we found that each of  the six medical centers we visited essentially used an honor system for  returning drugs to manufacturers for credit, relying on contractors that  collected and processed recalled, expired, or deteriorated drugs. The  contractors packaged the drugs at the medical centers and shipped them  either to the contractors’ processing facilities or, if required by the  manufacturers, to the manufacturers’ processing facilities.  For drugs  shipped to the contractors’ facilities, the contractors (1) determined which  drugs were returnable; (2) returned drugs qualified for credit to the  manufacturers and destroyed the nonreturnable drugs; and (3) provided  the pharmacy an itemized list of drugs collected, and their disposition, and  an itemized estimate of credits to be received.  The drug manufacturers  determined the final amount of credits issued.  While reviewing  documentation for drugs that were returned by the six medical centers in  September 2002, we found none of the pharmacies had determined if they  received appropriate credit for the drugs they turned over to the  contractor.  Further, none of the pharmacies could determine if the credits  received were complete or correct because all lacked detailed information  about which drugs the manufacturers accepted for credit.   In addition,  none of the medical centers except Tampa maintained lists of non-narcotic  drugs turned over to the return drug contractor.
Medical center pharmacy staff told us there are over 1,000 drug  manufacturers, each with its own policies for returning drugs for credit.   For example, one drug manufacturer might require that a drug be returned  30 days prior to its expiration to qualify for credit, another drug  manufacturer might allow a credit for a drug 30 days past its expiration,  and another might not allow credits at all.  Furthermore, a VA  pharmaceutical return contractor informed us that the manufacturers  frequently change their policies.  Consequently, medical center pharmacy  managers lacked information that would enable them to determine  whether the credits they received for returned drugs were correct.  As a  result, the pharmacies relied on the contractors’ determination of the type  and quantity of drugs that were returnable and relied solely on the drug  manufacturers’ determination of the final amount of credits issued for  returned drugs.
In addition to establishing a return policy for drugs, each drug  manufacturer set its own requirements for the process of returning the  drugs and issuing credits.  Some drug manufacturers allowed the  pharmacy’s contractor to process returned drugs and issued a credit  through the pharmacy’s prime vendor.  Other manufacturers would only  accept returned drugs directly from VHA.  Our review of the estimated  credits for non-narcotic drugs returned in September 2002 showed most  were processed through each pharmacy’s prime vendor.  Table 3 shows the  contractors’ estimated value of credits to be received by the six medical  center pharmacies we visited for non-narcotic drugs returned during  September 2002.
The return contractor informed us that if pharmacies requested, it could  provide a report on the actual credits issued through the prime vendor for  specific returned drugs.  None of the pharmacies we visited indicated they  were aware of this capability.  Using these reports might facilitate the  pharmacies’ reconciliation of credits received with drugs returned.  As  shown in table 3, analyzing the credits processed through the prime vendor  could account for 80 percent or more of estimated credits.
section_title: Pharmacies and VHA Managers Performed No Analysis of Drugs Returned for Credit
paragraphs: Standards for Internal Control in the Federal Government calls for  establishing performance measures that facilitate analysis so appropriate  actions are taken.  None of the six medical centers had established  performance measures or any kind of mechanism to oversee credits  received for returned drugs.  For example, medical center pharmacy  managers we interviewed did not review the lists of drugs processed for  credit provided by the pharmaceutical return contractor to determine if  unusual trends occurred that might indicate an opportunity to increase  credits received.  Periodic analysis of drugs turned in throughout the year  could reveal whether specific drugs were not accepted for credit on a  recurring basis.  For instance, drugs being consistently turned in too late to  receive credit would indicate a need to process the drugs differently.  If  pharmacy managers reviewed actual returned drugs and credit data and  took necessary corrective action to optimize returns, the net cost of  pharmaceutical operations might be reduced.  For example, at the Los  Angeles pharmacy we found that 23 percent, or more than $60,000, of the  $274,000 estimated value of drugs returned in September 2002 did not  receive a credit because the drug expiration dates exceeded the  manufacturers’ requirements.
Medical center pharmacy officials stated that it was not cost effective to  perform any of these control activities for returned drugs.  However, the  pharmacies had done no studies or analyses to document this conclusion.   In fact, at one pharmacy, we noted that the chief pharmacist was not aware  of the value of his pharmacy’s yearly credits from returned drugs.  Having  initially told us that his pharmacy’s yearly credits from returned drugs were  only about $10,000, he subsequently reviewed the return documentation  and told us his pharmacy received over $124,000 in returned drug credits  for fiscal year 2003.
We inquired of VA’s Pharmacy Benefit Management staff whether any  agencywide analysis or study had been done to determine the reasons why  more returned drugs had not qualified for credit.  They stated that they had  not undertaken such an analysis but believed credits had greatly increased  through the use of a contractor to return drugs to manufacturers.  They  also told us that under their previous system, the material management  staff of each medical center returned the drugs to the manufacturers and  credits received for returned drugs had been minimal.  Guaranteed  Returns, contractor for five of the six medical centers we visited, reported  that of the $21.5 million estimated return value of drugs it processed for  VHA in fiscal year 2003, VHA received $5.7 million in credits for returned  drugs.
Without review and analysis of return drug documentation, the pharmacies  cannot determine what control procedures would be cost effective.   Further, despite the improved results obtained from using pharmaceutical  return contractors, without agency oversight of returned drugs and related  credits based on established performance measures as called for in our  standards for internal control, VHA cannot be reasonably assured that  stewardship of agency resources is effective.
section_title: Lack of Security Made Non- Narcotic Drugs Held for Return Vulnerable to Fraud
paragraphs: Standards for Internal Control in the Federal Government states that  access to resources should be limited to authorized individuals.  We found  that at four of the six pharmacies visited, physical control over non- narcotic drugs held for return was lacking.  The San Francisco pharmacy  stored such drugs in a locked bin and the Tampa facility limited access to a  secured area, but the other four locations used open, unsecured bins.   Anyone with access to the pharmacy also had access to the drugs. Thefts  would be very difficult, if not impossible, to detect because the pharmacies  did not maintain lists of the non-narcotic drugs held for return.  The drugs  were simply deposited in the bin.  The lack of physical control over non- narcotic drugs held for return represents a potential lost opportunity to  maximize return credits and to reduce the risk of theft or misuse of these  drugs.  During our review, lapses in security at two of the pharmacies we  visited were reported.  The VA OIG reported that three employees of the  Houston medical center were convicted of conspiring to steal large  amounts of non-narcotic pharmaceutical drugs from the pharmacy.  These  employees had stolen over $1.3 million of drugs over 3 years.  At the  Washington, D.C., medical center, as discussed in our recent report on VHA  personnel screening procedures, we found that one employee of the  pharmacy had been convicted for possession of illegal drugs prior to VHA  employment.  While these incidents may not relate directly to drugs held  for return to manufacturers, they indicate the risks involved and  underscore the clear need for effective control over these drugs.  The  combination of weaknesses in record keeping and physical controls over  non-narcotic drugs held for return exposed them to potential loss, theft, or  unauthorized use.
section_title: Controls over Part-time Physician Time and Attendance Could Be Strengthened Further
paragraphs: Our review of part-time physician time and attendance documentation for  the two pay periods ending in September 2003 showed that scheduled and  actual hours worked were not always documented according to policy at  the six medical centers we visited.  Also, specific hours worked recorded  by physicians on their time and attendance reports sometimes differed  from information entered in the payroll system.  We also found that latitude  provided in VHA’s Directive 2003-001, issued in January 2003, on time  and attendance of part-time physicians was a factor in the various ways the  six locations carried out part-time physician attendance monitoring  responsibilities.  While newly emphasized policies stressed the importance  of this matter, compliance in some cases had been slow to develop and  oversight processes varied and were not fully effective.
subsections: section_title: Scheduled and Actual Hours Worked Were Not Always Documented in Accordance with Policy
paragraphs: Our standards for internal control state that control activities, such as  approvals and authorizations, are integral to an entity’s accountability for  stewardship of resources.  Consistent with that management control  objective, VHA’s January 2003 directive called for specifying work  schedules in writing in advance of the biweekly pay period, showing the  specific days and hours that part-time physicians were to work, including  core hours when employees working adjustable shifts must be present.   Our review showed that schedules were not always established in advance  of the pay period as required by VHA.  For the two pay periods ending in  September 2003, our review of records for 10 part-time physicians at each  of the six locations we visited revealed that only the Houston medical  center had documented preapproved schedules for all physicians whose  records we tested.  A contributing factor for this weakness was that an  official at one location told us part-time physicians with fixed schedules did  not require a documented preapproved schedule.  Almost one-third of the  part-time physician records that we reviewed did not include the required  documented schedule.  However, all those who had documented schedules  also had core hours established as required.  Table 4 summarizes the  results of our work regarding part-time physician policies and their  schedules at the centers we visited.
Failure to document schedules can lead to confusion about when a  physician should be at work.  The VA OIG’s February 2004 report on VA  medical center part-time physician time and attendance stated that 15 of 58  part-time physicians who were not present when scheduled during a 1-day  test said they had changed their hours without getting written approval.
Our internal control standard regarding accurate recording of transactions  and events applies to the entire process or life cycle of a transaction or  event from initiation and authorization through its final classification in  summary records.  Our comparison of manually prepared time and  attendance records with computerized payroll system timecards indicated  no differences between total hours worked and total hours entered in the  payroll system for the cases we tested.  However, we found that when part- time physicians temporarily modified their approved work schedules, the  changes they noted on their forms 4-5631a, used to document, review, and  approve actual hours worked, were sometimes not entered in the  computerized payroll system.  At five of the six medical centers, we  compared information shown on the payroll system timecards to the forms  4-5631a that were signed by the part-time physicians, timekeepers, and the  physicians’ supervisors.  At four of those five medical centers, we noted at  least one instance of a difference between the specific days and hours  worked shown on a part-time physician’s form 4-5631a and that information  shown on the corresponding payroll system timecard.
Timekeepers and other medical center officials told us that recording  temporary changes for actual time worked in VHA’s computerized payroll  system is difficult because the system is inflexible.  As a result, if total  hours that a part-time physician actually worked during a pay period  equaled the total hours scheduled, timekeepers often entered the  physician’s scheduled hours into the computerized payroll system rather  than the actual hours worked.  However, accurate payroll system  information about specific hours worked is important to satisfy VHA’s need  to document whether part-time physicians fulfill their core hour  requirements.
section_title: Monitoring Part-time Physician Attendance Varied by Location and Service
paragraphs: Our standards for internal control state that an entity’s documentation of  transactions and other significant events must be complete and accurate.   At the six medical centers we visited, we found variation in the design and  effectiveness of medical center procedures concerning the way supervisors  and timekeepers checked and documented daily employee attendance and  how facility management periodically monitored employee compliance  with time and attendance requirements.
VHA’s January 2003 directive on part-time physician time and attendance  referred to VA’s underlying policy manual that established requirements for  supervisors or timekeepers to have personal knowledge that part-time  physicians worked the hours or days shown on their time and attendance  forms.  Timekeeping procedures that included keeping a record of each  physician’s daily attendance throughout a pay period provided greater  reliability than those that relied on the physicians’, their timekeepers’, or  their supervisors’ memories.  With working arrangements of part-time  physicians, their supervisors, and timekeepers that vary among the service  centers within a medical center, we found that the timekeepers at the  medical centers we visited accounted for daily attendance of physicians  using a wide variety of procedures.  While the Houston medical center  established a sign-in procedure for all part-time physicians, the other five  medical centers relied primarily on the timekeepers’ observation of  physicians’ daily attendance.  At those facilities, the procedures often  differed among service centers and included activities such as timekeepers  making informal notes on their personal calendars or preparing calendar- like worksheets to check off the names of each part-time physician when  he or she was observed at the center during a scheduled workday.  While  each process offered a level of control over time and attendance, they all  had limitations and none provided assurance that part-time physicians  were on duty during their core hours.
For example, on the surface, a sign-in procedure would seem to offer more  definitive assurance; however, effectiveness depends on how well the  procedure is implemented.  On the day we reviewed part-time physician  sign-in sheets at the Houston medical center, we noted that only 2 of 15  physicians scheduled to work had signed in.  Timekeepers told us they  observed 5 other physicians in the facility and 1 had advance approval to  attend a lecture. However, the timekeepers also told us 2 other part-time  physicians scheduled to work had called in and stated that they were  “accounted for,” and the remaining 5 had not reported in or otherwise  confirmed their attendance.  Houston’s failure to enforce its sign-in  procedures for its part-time physicians is an example of compromised  control effectiveness that impaired medical center management’s ability to  know if part-time physicians worked when scheduled.
While VHA’s January 2003 directive identified medical center management’s  responsibility for monitoring compliance with part-time physician time and  attendance policy, the methodology for implementing that responsibility  was left to the discretion of facility management.  Some of the  methodologies adopted were less effective than others.  For example, while  the Atlanta medical center service areas checked attendance for 5 percent  of part-time physicians one day each month, at the San Francisco center  service areas checked attendance of all part-time physicians at least one  day per quarter, and its Office of Human Resource Management made  random spot checks.  In addition to physical observation, other methods  used for making these periodic surveys of attendance at the six locations  included monitoring doctors logging into the facility’s computer network,  monitoring doctors’ notes entered into VHA’s patient records system, and  paging doctors to determine if physicians used medical center telephones  to respond.
The wide variety of part-time physician time and attendance procedures  that have been developed by the medical centers we visited reduces VHA  management’s level of assurance that controls are effective and agency  objectives are being achieved.  We believe an opportunity exists for the  agency to study the various medical center and service area procedures so  that VHA can provide more specific direction about the most effective ways  to improve control over part-time physician time and attendance  agencywide.
section_title: Conclusions
paragraphs: The weaknesses in internal control that we identified at the six VA medical  centers we visited leave the agency vulnerable to waste, fraud, and abuse.   Improving the design and implementation of policies regarding personal  property will help improve accountability for agency assets, especially  sensitive property.  VHA managers performed no analytical oversight of  credits for returned drugs, and the six medical centers had no effective  control over the amount of credits for drugs returned to manufacturers.   Some analysis of drug return transactions would provide management with  a basis to determine what control activities would provide an appropriate  cost/benefit ratio.  Current policies and procedures for monitoring part- time physician time and attendance, if implemented more effectively, may  provide reasonable assurance that management’s objectives will be met.  In  addition, the wide range of physician attendance monitoring procedures  developed by the various medical centers and service areas provides an  opportunity to improve controls agencywide if their relative effectiveness  is studied.  While some medical centers have already taken positive steps to  improve controls over these areas, appropriate direction from management  will spur action agencywide and help reduce vulnerability to waste, fraud,  and abuse.
section_title: Recommendations for Executive Action
paragraphs: We are making the following 17 recommendations to improve the internal  controls over the operating areas that were the subject of our work.  Some  of these recommendations require attention of VA management at the  department level, others VHA, and still others VA medical center  management.  We recommend that the Secretary of Veterans Affairs direct  the Assistant Secretary for Management to  clarify existing guidance and establish consistent parameters for  personal property that is required to be accounted for in the property  control records and that is subject to physical inventory to include  sensitive property,  provide a more comprehensive list of the type of personal property  assets that are  considered sensitive for accountability purposes,  direct that physical inventories of personal property be performed by  the A&MM staff or other parties who are independent of those with  property custodian responsibilities, and  reinforce VA’s requirement to attach bar code labels to agency personal  property.
To improve accuracy of VA’s time and attendance records for part-time  physicians, we recommend that the Secretary of Veterans Affairs direct the  Assistant Secretary for Management to coordinate all time and attendance  system changes with VHA, in order to ensure that the time and attendance  system facilitates entry of actual hours and days worked by part-time  physicians into VA’s permanent electronic time and attendance record.
To improve oversight of medical center operations, we recommend that the  Acting Under Secretary for Health  designate a headquarters-level staff office to monitor medical facilities’  credits for returned drugs;  review returned drug credits and related pertinent information for VA  medical facilities and determine, especially for those with unusual  performance patterns, whether there might be additional opportunities  for credits;   develop procedures to periodically test whether the amount of credits  received for returned drugs is correct;  implement procedures to periodically test whether the amount of  credits that medical centers received for returned drugs is correct;  conduct a best practices review of procedures implemented by VA  medical centers and service areas to identify those most effective in  documenting daily attendance of part-time physicians and periodically  monitoring employee compliance with time and attendance  requirements; and  use the results of the best practices review to provide more definitive  policy guidance to improve control effectiveness over part-time  physician attendance monitoring.
To address the weaknesses noted during our visits to six VA medical  centers, we recommend that the Acting Under Secretary for Health require  the directors of those medical centers to  determine the location or disposition of personal property items not  found during our site visits;   review property records to identify and correct erroneous or incomplete   prepare a running list of all non-narcotic drugs held for return in facility  pharmacies as they are removed from current supplies to compare with  contractor-prepared lists of returned drugs;  improve physical security over non-narcotic drugs held for return in  facility pharmacies as they are removed from current supplies; and  analyze information regarding drugs returned to manufacturers to  identify potential improvements that might increase the amount of  credits received, such as improving the timeliness of returning drugs  consistently turned in too late to qualify for credit.
We also recommend that the Acting Under Secretary for Health determine  whether the above recommendations pertaining to the facilities we visited  are applicable to all VA medical facilities.
section_title: Agency Comments
paragraphs: VA provided written comments on a draft of this report.  In its response, VA  agreed with our conclusions and recommendations and reported that it is  developing an action plan to implement them.  Additionally, VA’s response  stated that it is pursuing a number of strategies to improve the processing  of expired medications held for credit, the monitoring of part-time  physician time and attendance, and the inventory records of all equipment.   VA also provided technical clarifications, which we incorporated where  appropriate.  VA’s written comments are reprinted in appendix II.
We are sending copies of this report to the Ranking Minority Member,  Subcommittee on Oversight and Investigations, House Committee on  Veterans’ Affairs; the Chairman and Ranking Minority Member, House  Committee on Veterans’ Affairs; the Chairman and Ranking Minority  Member, Senate Committee on Veterans’ Affairs; the Secretary of Veterans  Affairs; the Acting Under Secretary for Health, Veterans Health  Administration; and other interested parties.  We will also make copies  available to others upon request.  In addition, the report will be available at  no charge on the GAO Web site at http://www.gao.gov.
Should you or your staff have any questions on matters discussed in this  report, please contact me at (202) 512-6906 or by e-mail at  williamsm1@gao.gov or Jack Warner, Assistant Director, at (202) 512-4679  or by e-mail at warnerj@gao.gov.  Major contributors to this report are  acknowledged in appendix III.
section_title: General Background Information for Selected VA Medical Centers, Fiscal Year Ended September 30, 2003 (Unaudited)
section_title: Comments from the Department of Veterans Affairs
section_title: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Acknowledgments
paragraphs: In addition to those named above, the following individuals made  important contributions to this report: Kwabena Ansong, Sharon Byrd,  Cary Chappell, Lisa Crye, Fred Evans, Lou Fernheimer, Jeff Isaacs, Julia  Matta, Bonnie McEwan, Christina Quattrociocchi, Donell Ries, Alana  Stanfield, and Jason Strange.
section_title: GAO’s Mission
paragraphs: The Government Accountability Office, the audit, evaluation and  investigative arm of Congress, exists to support Congress in meeting its  constitutional responsibilities and to help improve the performance and  accountability of the federal government for the American people. GAO  examines the use of public funds; evaluates federal programs and policies;  and provides analyses, recommendations, and other assistance to help  Congress make informed oversight, policy, and funding decisions. GAO’s  commitment to good government is reflected in its core values of  accountability, integrity, and reliability.
section_title: Obtaining Copies of GAO Reports and Testimony
paragraphs: The fastest and easiest way to obtain copies of GAO documents at no cost  is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts  newly released reports, testimony, and correspondence on its Web site. To  have GAO e-mail you a list of newly posted products every afternoon, go to  www.gao.gov and select “Subscribe to Updates.”
subsections: section_title: Order by Mail or Phone
section_title: To Report Fraud, Waste, and Abuse in Federal Programs
section_title: Congressional Relations
section_title: Public Affairs