Veterans Health Administration: Inadequate Controls over Miscellaneous Obligations Increase Risk over Procurement Transactions
Published: 2009-12-16T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In September 2008, GAO reported internal control weaknesses over the Veterans Health Administration's (VHA) use of miscellaneous obligations to record estimates of obligations to be incurred at a future date. GAO was asked to testify on its previously reported findings that focused on (1) how VHA used miscellaneous obligations, and (2) the extent to which the Department of Veterans Affairs' (VA) related policies and procedures were adequately designed. GAO also obtained an update on the status of VA's activities to improve controls over its use of miscellaneous obligations. GAO's testimony is primarily a summary of its prior report (GAO-08-976), and also includes follow-up work to obtain information on the status of VA's efforts to implement our prior recommendations.
section_title: What GAO Found
paragraphs: In September 2008, GAO reported that VHA recorded over $6.9 billion of miscellaneous obligations for the procurement of mission-related goods and services in fiscal year 2007. VHA officials stated that miscellaneous obligations were used to facilitate payment for goods and services when the quantities and delivery dates are not known. According to VHA data, almost $3.8 billion (55.1 percent) of VHA's miscellaneous obligations was for fee-based medical services for veterans and another $1.4 billion (20.4 percent) was for drugs and medicines. The remainder funded, among other things, state homes for the care of disabled veterans, transportation of veterans to and from medical centers for treatment, and logistical support and facility maintenance for VHA medical centers nationwide. In 2008, GAO found that VA policies and procedures were not designed to provide adequate controls over the authorization and use of miscellaneous obligations with respect to oversight by contracting officials, segregation of duties, and supporting documentation for the obligation of funds. Collectively, these control design flaws increased the risk of fraud, waste, and abuse. These control design flaws were confirmed in GAO's case studies at VHA medical centers in Pittsburgh, Pennsylvania; Cheyenne, Wyoming; and Kansas City, Missouri. For example, in all of the 42 obligations reviewed, GAO found no documented approval by contracting officials. The systems used did not have a mechanism for contracting officials to electronically document their review of miscellaneous obligations and no manual documentation procedures had been developed. Furthermore, in 30 of the 42 obligations reviewed, one official performed two or more of the following functions: requesting, creating, approving or obligating funds for the miscellaneous obligation, or certifying delivery of goods and services and approving payment. Without proper segregation of duties, risk of errors, improper transactions, and fraud increases. Lastly, GAO found a lack of adequate supporting documentation at the three medical centers we visited. In 8 of 42 instances, GAO could not determine the nature, timing, or the extent of the goods or services being procured from the description in the purpose field. As a result, GAO could not confirm that these miscellaneous obligations were for bona fide needs or that the invoices reflected a legitimate use of federal funds. In January 2009, VA issued volume II, chapter 6 of VA Financial Policies and Procedures--Miscellaneous Obligations which outlines detailed policies and procedures aimed at addressing the deficiencies GAO identified in the September 2008 report. Full and effective implementation of this new guidance will be critical to reducing the government's risks associated with VA's use of miscellaneous obligations. GAO has not yet evaluated the extent to which these new policies have been fully and effectively implemented.

section_title: Letter
paragraphs: I am pleased to be here today to discuss the findings from our prior work  on the Veterans Health Administration’s (VHA)—a component of the  Department of Veterans Affairs’ (VA)—use of miscellaneous obligations,  and steps VA is taking to address our prior recommendations. VHA  provides a broad range of primary health care, specialized health care, and  related medical and social support services through a network of more  than 1,200 medical facilities. In carrying out its responsibilities, VHA uses  “miscellaneous obligations” to obligate, or administratively reserve  estimated funds against appropriations for the procurement of a variety of  goods and services for which specific quantities and time frames are  uncertain. VHA officials said that they have been using miscellaneous  obligations for over 60 years to record estimates of obligations to be  incurred at a later time. According to VA policy, miscellaneous  obligations can be used to record estimated obligations to facilitate the  procurement of a variety of goods and services, including fee-based  medical and nursing services and beneficiary travel.
The large dollar amount of procurements recorded as miscellaneous  obligations in fiscal year 2007—$6.9 billion—raised questions about  whether proper controls were in place over the authorization and use of  those funds. In September 2008 we reported that improvements were  needed in VHA’s design of controls over miscellaneous obligations.
My testimony today summarizes the findings of our September 2008 report  that are most relevant to the subject of today’s hearing. Specifically, I will  focus on our findings concerning (1) how VHA used miscellaneous  obligations during fiscal year 2007, and (2) the extent to which VA’s  policies and procedures were designed to provide adequate controls over  their authorization and use. I will also discuss the results of our limited  review of the status of VA’s actions to implement our recommendations.
To achieve the first objective, we obtained and analyzed a copy of VHA’s  Integrated Funds Distribution, Control Point Activity, Accounting and  Procurement (IFCAP) database of miscellaneous obligations. According  to VA, the IFCAP database provided the best available data on VHA  miscellaneous obligations created in fiscal year 2007. We determined that  the IFCAP data were sufficiently reliable for the purposes of our report  based on (1) testing various required data elements, (2) performing  walkthroughs of the system, and (3) tracing selected transactions from  source documents to the database. To achieve the second objective, we  compared VA policies and procedures governing the use of miscellaneous  obligations with federal appropriations law and internal control  standards, interviewed VHA officials in Denver, Colorado, and  Washington, D.C., and conducted three case studies at VHA medical  centers in Cheyenne, Wyoming; Kansas City, Missouri; and Pittsburgh,  Pennsylvania. As part of the case studies, we interviewed VHA financial  management and procurement officials, and reviewed a nongeneralizable  sample of miscellaneous obligations to provide more detailed data on the  extent and nature of any control design deficiencies. We did not review  VHA’s procurement or service authorization processes. Additional details  on our scope, methodology, and findings are included in our September  2008 report. To assess the status of our prior recommendations, we  reviewed volume II, chapter 6 of VA Financial Policies and Procedures— Miscellaneous Obligations (dated January 2009) which outlines detailed  policies and procedures aimed at addressing the deficiencies we identified  in our September 2008 report. We have not tested whether or to what  extent VA has effectively implemented these policies and procedures.
We conducted the work for the September 2008 report on which this  testimony was based from November 2007 through July 2008 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives. We also conducted a limited review of VA’s  actions to address our recommendations intended to improve its use of  miscellaneous obligations.
subsections: section_title: Miscellaneous Obligations Used Extensively for Mission-Related Activities in Fiscal Year 2007
paragraphs: In fiscal year 2007, VHA used miscellaneous obligations to record over $6.9  billion against its appropriations for the procurement of mission-related  goods and services at 129 VHA stations throughout the country. As shown  in figure 1, $3.8 billion of this total (55.1 percent) was for fee-based  medical and dental services for veterans, and another $1.4 billion (20.4  percent) was for drugs, medicines, and hospital supplies. The remainder  covered, among other things, state homes for the care of disabled  veterans, transportation of veterans to and from medical centers for  treatment, and logistical support and facility maintenance for VHA medical  centers nationwide.
Other, such as dietetic provisions, operating supplies, cleaning services, and data processing.
Transportation of persons/things.
State homes and homeless veteran support.
Rent, communications, and utilities including gas, electricity, water, sewer, and phone.
Supplies including drugs, medicines, hospital supplies, blood products, and prosthetic supplies.
Services including fee-basis physician, nursing, dental, hospitalization stays, research, and prosthetic repair.
VHA officials said they used miscellaneous obligations to administratively  reserve estimated funds required to facilitate the payments for goods and  services for which specific quantities and time frames were uncertain.  Specifically, a miscellaneous obligation can be created for an estimated  amount and then modified as specific quantities are needed or specific  delivery dates are set. In contrast, when a purchase order is used to  obligate funds, the obligated amount cannot be changed without a  modification of the purchase order. According to VHA officials, the need  to prepare numerous modifications to purchase orders could place an  undue burden on the limited contracting personnel available at individual  centers and could also require additional work on the part of fiscal  services personnel. Therefore, VHA officials view the use of miscellaneous  obligations as having the benefit of reduced workload.
Another cited benefit was that miscellaneous obligations simplify the  procurement process when no underlying contract or purchase order  exists. For example, providing medical care on a fee-basis to veterans  outside of VHA medical centers may involve the services of thousands of  private physicians nationwide. Attempting to negotiate a separate  agreement or contract with each of these individuals would be a difficult  task for VHA’s contracting staff. Under the policies and procedures in  place during fiscal year 2007, VHA centers could use miscellaneous  obligations as umbrella authorizations for fee-based medical services  performed by a number of different physicians. In effect, in cases for  which there is no preexisting contract, the miscellaneous obligation form  becomes the record of an obligation.
section_title: Deficiencies in Design of Controls over Miscellaneous Obligations Increase the Risk of Fraud, Waste, and Abuse
paragraphs: In September 2008, we reported that VA policies and procedures were not  designed to provide adequate controls over the use of miscellaneous  obligations. The use of miscellaneous obligations carries inherent risk due  to a lack of a negotiated contract. Without effectively designed mitigating  controls, the use of miscellaneous obligations may also expose VHA to  increased risk of fraud, waste, and abuse. VHA did not have effective basic  internal controls nor mitigating controls with respect to oversight by  contracting officials, segregation of duties, and supporting documentation  for recording the obligation of funds. Our Standards for Internal Control  in the Federal Government state that agency management is responsible  for developing detailed policies and procedures for internal control  suitable for its agency’s operations and ensuring that they provide for  adequate monitoring by management, segregation of duties, and  supporting documentation for the need to acquire specific goods in the  quantities purchased. We identified control design flaws in each of these  areas, and we confirmed that these weaknesses existed in our case studies  of VA fiscal year 2007 transactions at Pittsburgh, Cheyenne, and Kansas  City, as shown below in table 1. Collectively, these control design flaws  increase the risk of unauthorized procurements, overpayments for  services rendered, and the conversion of VHA assets for personal use  without detection.
subsections: section_title: Inadequate Oversight of Miscellaneous Obligations
paragraphs: The 42 miscellaneous obligations we reviewed at three VHA stations had  no evidence of approval by contracting officials. The systems used did not  have a mechanism for contracting officials to electronically document  their review of miscellaneous obligations, and no manual documentation  procedures had been developed. Furthermore, none of the three sites we  visited had procedures in place to document review of the miscellaneous  obligations by the appropriate contracting authorities. As a result, VHA  lacks assurance that miscellaneous obligations are being reviewed and  that related policies are being followed. Effective oversight and review by  trained, qualified officials is a key factor in helping to assure that funds are  used for their intended purposes, in accordance with laws, while  minimizing the risk for fraud, waste, or abuse. Without control procedures  to help ensure that contracting personnel review and approve  miscellaneous obligations prior to their creation, VHA is at risk that  procurements do not have the necessary safeguards.
For example, in our case study at the VA Pittsburgh Medical Center, we  found 12 miscellaneous obligations, totaling about $673,000, used to pay  for laboratory services provided by the University of Pittsburgh Medical  Center (UPMC). The Chief of Acquisition and Materiel Management for the  VA Pittsburgh Medical Center stated that she was not aware of the UPMC’s  laboratory testing service procurements and would review these testing  services to determine whether a contract should have been established for  these procurements. Subsequently, she stated that VISN 4—the Veterans  Integrated Service Network (VISN) that oversees the operations of the VA  Pittsburgh Medical Center—would revise procedures to procure  laboratory testing services through purchase orders backed by reviewed  and competitively awarded contracts, instead of funding them through  miscellaneous obligations.
In the absence of review by contracting officials, controls were not  designed to prevent miscellaneous obligations from being used for  unauthorized purposes, or for assets that could be readily converted to  personal use. Our analysis of the IFCAP database for fiscal year 2007  identified 145 miscellaneous obligations for over $30.2 million that were  used for procurement of such items as passenger vehicles; furniture and  fixtures; office equipment; and medical, dental, and scientific equipment.  Although VA’s miscellaneous obligation policy did not address this issue,  VA officials stated that acquisition of such assets should be done by  contracting rather than through miscellaneous obligations. Without  adequate controls to review miscellaneous obligations and prevent them  from being used for the acquisition of such assets, it is possible that VHA  may be exposing the agency to unnecessary risks by using miscellaneous  obligations to fund the acquisitions of goods or services that should have  been obtained under contract with conventional controls built in.
section_title: Inadequate Segregation of Duties
paragraphs: VA policies and procedures and IFCAP’s control design allowed a single  official to perform multiple key roles in the process of creating and  executing miscellaneous obligations. Control point officials were  authorized to create, edit, and approve requests for miscellaneous  obligations. In addition, these same individuals could certify the delivery  of goods and services and approve payment. Similar weaknesses have  been reported by agency auditors as well. Federal internal control  standards provide that for an effectively designed control system, key  duties and responsibilities need to be divided or segregated among  different people to reduce the risk of error or fraud. These controls  should include separating the responsibilities for authorizing transactions,  processing and recording them, reviewing the transactions, and accepting  any acquired assets. Without proper segregation of duties, risk of errors,  improper transactions, and fraud increases. The lack of segregation could  allow for improper expenditures to occur without detection.
Our case studies showed inadequate segregation of key duties in 30 of the  42 obligations we reviewed. In these instances, controls were not designed  to prevent one official from performing two or more of the following key  functions:  requesting the miscellaneous obligation,  approving the miscellaneous obligation,  recording the obligation of funds, or  certifying delivery of goods and services and approving payment.
For example, in one case in Pittsburgh, one official requested and  approved a miscellaneous obligation of over $140,000 for medical services  and then certified receipt and approved payment for at least $43,000 of  those services. In another case in Cheyenne, we found one miscellaneous  obligation for utilities where one official requested, approved, and  certified receipt and approved payment of over $103,000 in services. Such  weak control design could enable a VHA employee to convert VHA assets  to his or her personal use, without detection.
section_title: Lack of Adequate Supporting Documentation
paragraphs: Control design flaws in VA’s policies and procedures resulted in several  instances of insufficient documentation to determine whether the  miscellaneous obligations we reviewed as part of our case-study analysis  represented a bona fide need. Specifically, VA policies and procedures  were not sufficiently detailed to require the type of information needed  such as purpose, vendor, and contract number that would provide crucial  supporting documentation for the obligation. Internal control standards  provide that transactions should be clearly documented and all  documentation and records should be properly managed and maintained.  Adequate documentation is essential to support an effective funds control  system; is crucial in helping to ensure that a procurement represents a  bona fide need; and reduces the risk of fraud, waste, and abuse. When a  legal obligation is recorded, it must be supported by adequate  documentary evidence of the liability. An agency should use its best  estimate to reserve an amount for future obligation when the amount of  the government’s final liability is undefined. Further, the basis for the  estimated liability and the computation must be documented.
We found that 8 of the 42 miscellaneous obligations had insufficient data  to determine whether the miscellaneous obligation represented a bona  fide need. This level of documentation was not sufficient for an  independent reviewer to determine what items were procured and  whether the appropriate budget object code was charged. As a result of  these deficiencies, in several cases we had to rely on invoices to determine  the probable purpose of the miscellaneous obligation and whether it  represented a bona fide need.
For example, in Kansas City, we found one miscellaneous obligation for  over $1.3 million whose purpose was listed as “To obligate funds for the  Oct 06 payment,” while the associated invoices showed that the  miscellaneous obligation was used to cover the services of medical  resident staff. In Pittsburgh, we found a miscellaneous obligation for over  $45,000 whose purpose was listed as “LABCORP 5/1-5/31/07,” while the  associated invoices showed that the obligation was for laboratory testing  services. Without procedures calling for more definitive descriptions of  the purpose, we could not confirm that these miscellaneous obligations  were for bona fide needs or that the invoices reflected a legitimate use of  federal funds. Other instances of inadequate supporting documentation we  found during our case-study analysis included the absence of vendor  names for 20 of the 42 miscellaneous obligations, and missing contract  numbers for 16 of the 42 miscellaneous obligations.
Inadequate control requirements for supporting documentation and  completing data fields concerning the purpose of the obligation, vendor  information, and contract numbers can hinder oversight by senior VA  management officials. The Deputy Assistant Secretary for Logistics and  Acquisition said that he and other VHA officials use the IFCAP database  to monitor the extent and nature of miscellaneous obligations nationwide,  including analyzing the number and dollar amounts of miscellaneous  obligations and identifying the types of goods and services procured using  miscellaneous obligations. He told us that he was concerned with the  extent and nature of the use of miscellaneous obligations at VA, that he  lacked adequate oversight or control over procurements made through  miscellaneous obligations, and that he often did not know what was being  bought or whom it was being bought from. Our analysis of the IFCAP  database found that over 88,000 (69 percent) of 127,070 miscellaneous  obligations did not include vendor information, accounting for over $5  billion of the $6.9 billion in recorded miscellaneous obligations in fiscal  year 2007. Similarly, the IFCAP database did not contain a description of  what was purchased or information on the quantities purchased. As a  result, important management information was not available to senior VA  procurement officials.
section_title: VA Has Made Improvements in Its Policies and Procedures, but Implementation Has Not Been Assessed
paragraphs: Our September 2008 report included four recommendations to VA to  develop and implement policies and procedures intended to improve  overall control. These recommendations focused on the need to better  ensure adequate oversight of miscellaneous obligations by contracting  officials; segregation of duties from initiation through receipt of the  resulting goods and services; maintaining supporting documentation for  miscellaneous obligations; and establishing an oversight mechanism to  ensure control policies and procedures are fully and effectively  implemented. In comments on a draft of that report, VA concurred with  our recommendations and has since taken action to develop policies and  procedures to address them. Specifically, in January 2009, VA issued  volume II, chapter 6 of VA Financial Policies and Procedures— Miscellaneous Obligations which outlines detailed policies and procedures  aimed at addressing the deficiencies we identified in our September 2008  report.
Key aspects of the policies and procedures VA developed in response to  our four recommendations were the following:    Oversight of miscellaneous obligations by contracting officials—VA issued  procedures regarding the review of miscellaneous obligations by  contracting officials. Specifically, the request and approval of  miscellaneous obligations by contracting officials are to be reviewed by  the Head of Contracting Activity or delegated to the Local Head of  Contracting Activity. In addition, the obligation document will be returned  to the initiating office if the miscellaneous obligation is not appropriately  signed off by the Head of Contracting Activity.
Segregation of duties—VA issued procedures that require that no one  official may control all key aspects of a transaction or event. Specifically,  no one official may perform more than one of the following key functions:  requesting the miscellaneous obligation; approving the miscellaneous  obligation; recording the obligation of funds; or certifying the delivery of  goods and services or approving payment.
Supporting documentation for miscellaneous obligations—New  procedures require completion of the purpose, vendor, and contract  number fields on VA Form 1358, Estimated Miscellaneous Obligation or  Change in Obligation. The procedures permit that a new miscellaneous  obligation can only be processed if the appropriate information is  recorded in the purpose, vendor, and contract field. The purpose field  must be specific, contain adequate references, and note the period of  performance; the vendor name and address must be provided, except in  the case of multiple vendors; and the contract number must be included  on the miscellaneous obligation document.
Oversight mechanism to ensure control policies and procedures are fully  and effectively implemented—VA developed procedures requiring  oversight to help ensure the new policies and procedures are followed.  For example, each facility is now responsible for performing independent  oversight of the authorization and use of miscellaneous obligations. In  addition, facility reviews must be performed quarterly, at a minimum, and  should include all new miscellaneous obligations or changes to existing  miscellaneous obligations that occurred in the previous quarter. The  facility may use sampling to conduct the quarterly reviews. Further, the  results of the independent reviews are to be documented and  recommendations tracked by facility officials.
VA actions taken to develop policies and procedures intended to address  the deficiencies found in our September 2008 report represent an  important first step. However, full and effective implementation of VA’s  new policies and procedures will be even more important. We have not yet  fully evaluated the extent to which VA’s new policies and procedures are  in place and operating as intended. Further, VA’s ability to fully and  effectively address the deficiencies identified in our September 2008  report concerning miscellaneous obligations may be adversely affected by  continuing financial system weaknesses reported by agency auditors.  Specifically, one of the weaknesses we reported on in November 2009  was that VA lacked a system to track obligations and purchases by  vendors, resulting in VA relying on those vendors to supply operational  sales data on medical center purchases. Consequently, this type of  deficiency exposes VA to continued risk of errors in financial information  and reporting, potentially impacting actions VA has made in developing  policies and procedures intended to increase accountability and controls  over its use of miscellaneous obligations.
In summary, our September 2008 report demonstrated that without basic  controls in place over billions of dollars in miscellaneous obligations, VA  is at significant risk of fraud, waste, and abuse. Effectively designed  internal controls serve as the first line of defense for preventing and  detecting fraud, and they help ensure that an agency effectively and  efficiently meets its missions, goals, and objectives; complies with laws  and regulations; and is able to provide reliable financial and other  information concerning its programs, operations, and activities. VA  management has made progress to reduce the risks associated with the  authorization and use of miscellaneous obligations by developing policies  and procedures that improve overall control design over miscellaneous  obligations. However, full and effective implementation of this new  guidance will be critical to reducing the government’s risks associated  with VA’s use of miscellaneous obligations.
Mr. Chairman and Ranking Member Roe, this concludes my prepared  statement. I would be happy to respond to any questions you or other  members of the subcommittee may have at this time.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: For further information about this testimony, please contact Kay L. Daly,  Director, Financial Management and Assurance at (202) 512-9095, or  dalykl@gao.gov. Contact points for our Offices of Congressional Relations  and Public Affairs may be found on the last page of this testimony. Major  contributors to this testimony included Glenn Slocum, Assistant Director;  Carla Lewis, Assistant Director; Richard Cambosos; Debra Cottrell;  Francine DelVecchio; Daniel Egan; W. Stephen Lowrey; Robert Sharpe;  and George Warnock.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.