Department Of Veterans Affairs: Improvements Needed in Corrective Action Plans to Remediate Financial Reporting Material Weaknesses
Published: 2009-11-16T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In fiscal year 2008, the Department of Veterans Affairs (VA) identified three material internal control weaknesses over financial reporting--financial management system functionality, IT security controls, and financial management oversight. VA is developing a new financial system--FLITE--but full implementation is not expected until 2014. Therefore, the Subcommittee asked us to determine whether VA corrective action plans and oversight are appropriately focused on near-term actions to provide improved financial information. This report addresses (1) the nature of the internal control weaknesses identified in the VA fiscal year 2008 financial audit report and how long they have been outstanding, (2) whether VA had plans appropriately focused on near-term corrective actions, and (3) whether VA had appropriate oversight mechanisms in place to help assure that near-term corrective action plans are implemented on schedule. GAO reviewed corrective action plans for significant deficiencies underlying 2 of the 3 material weaknesses and performed additional analysis for two underlying significant deficiencies.
section_title: What GAO Found
paragraphs: VA's fiscal year 2008 material weaknesses in financial management system functionality and financial management oversight have been reported since fiscal years 2000 and 2005, respectively. These two material weaknesses are comprised of 16 underlying significant financial reporting control deficiencies. Although VA had eliminated some significant deficiencies in prior years, other deficiencies have emerged. As a result, continuing serious deficiencies in financial reporting leave VA at risk of processing errors and misstatements in its financial statements. Although VA had corrective action plans in place intended to result in near-term remediation of the 16 fiscal year 2008 significant control deficiencies, many of these plans did not contain the detail needed to provide VA officials with assurance that the plans could be effectively implemented on schedule. VA lacked documented policies and procedures needed to assure the consistent and comprehensive design of these corrective action plans, and 8 of 13 of VA's plans for correcting its financial reporting deficiencies lacked key information regarding milestones for action steps and validation activities.As of August 2009, VA had missed milestones in 5 of the 13 corrective action plans. For example, our analysis of plans for remediating deficiencies regarding the capitalization of property, plant, and equipment and inadequate benefit payment reconciliations showed that slipping milestones could jeopardize VA's timely completion of these plans, and consequently may impair VA's ability to obtain improved data reliability within the time frames originally envisioned. VA lacked documented policies and procedures for overseeing implementation of the corrective action plans, but recently took steps intended to better coordinate its oversight activities.

section_title: Letter
paragraphs: Each year, the Department of Veterans Affairs (VA) produces financial  statements intended to reflect its results of operations, status of budgetary  resources, and assets and liabilities. Accurate and timely financial  reporting helps provide accountability for billions of dollars of services  and benefits to veterans and their families, including medical services,  disability compensation, vocational rehabilitation, and burial benefits.  However, in VA’s fiscal year 2008 financial statement audit report, the  independent auditor reported serious weaknesses in internal control over  financial reporting. While VA has been developing a new financial  management system—Financial and Logistics Integrated Technology  Enterprise (FLITE)—intended to help address these control weaknesses,  the system is not expected to be fully implemented until fiscal year 2014.  Further, GAO has reviewed the FLITE program and reported, among other  things, that VA lacked assurance that the FLITE program would be  completed as planned. In light of the seriousness of VA’s internal control  weaknesses, and the need to improve the reliability of financial  information on VA programs and activities before FLITE implementation,  the Subcommittee asked us to determine whether VA corrective action  plans and oversight are appropriately focused on near-term actions to  address these internal control weaknesses.
Our objectives for this report were to determine (1) the nature of the  internal control weaknesses identified in the VA fiscal year 2008 financial  audit report and how long they have been outstanding, (2) whether VA had  plans appropriately focused on near-term actions to address financial  reporting deficiencies prior to the implementation of FLITE in fiscal year  2014, and (3) whether VA had appropriate oversight mechanisms in place  to help assure that near-term corrective action plans to address financial  reporting deficiencies are implemented on schedule.
To determine the nature of the internal control weaknesses identified in  the VA fiscal year 2008 financial audit report and how long they have been  outstanding, we analyzed the financial statement audit reports for fiscal  years 2000 to 2008. We summarized available information on the extent  and nature of the internal control weaknesses characterized as material  weaknesses, as well as the underlying significant deficiencies and  identified their evolution over time. We also interviewed VA and Office of  Inspector General (OIG) officials and VA’s independent auditor, and  reviewed VA documents, prior GAO and OIG reports, and independent  auditor workpapers to better understand the nature of the control  deficiencies underlying the material weaknesses. We did not perform  independent audit work to test and validate whether the material  weaknesses and related significant deficiencies reported by the  independent auditor were appropriate and comprehensive.
To determine whether VA had plans appropriately focused on near-term  actions to address financial reporting deficiencies prior to the full  implementation of FLITE in fiscal year 2014, we analyzed VA’s corrective  action plans for remediating significant deficiencies underlying two of the  three material weaknesses impacting the reliability of financial  information integral for helping inform management decision making— weaknesses in VA’s financial management systems and in its financial  management oversight. We interviewed VA officials, VA’s Office of  Inspector General (OIG), and independent auditor officials who completed  VA’s fiscal year 2008 financial statement audit about near-term actions in  VA plans to correct these underlying significant deficiencies. We also  analyzed related corrective action plans to determine whether they  included key information specified in the Chief Financial Officers  Council’s Implementation Guide for OMB Circular A-123, Management’s  Responsibility for Internal Control – Appendix A, Internal Control over  Financial Reporting (CFOC A-123 Guidance): action steps with related  milestones to provide a “road map” for remediation activities, validation  activities, a description of the deficiency to be corrected in sufficient detail  to provide clarity and facilitate a common understanding of what needs to  be done, and clear delineation of responsible officials for completing the  planned actions.
To determine whether VA had appropriate oversight mechanisms in place  to help assure that near-term corrective action plans to address financial  reporting deficiencies are implemented on schedule, we assessed the  status of plan implementation by identifying whether VA met specific  milestones and any slippages that had occurred. We also evaluated the  timeliness of implementation of corrective action plans for two significant  deficiencies—one to address the inadequate capitalization and accounting  for property, plant, and equipment (PP&E) and another to improve  reconciliations of benefit payments. We selected these plans for further  review because the related deficiencies were not currently being audited  or reviewed by other oversight organizations, their associated account  balances exceeded a material dollar threshold ($12.7 billion), and the  deficiencies contributed to the two material weaknesses that we, VA  officials, and the independent auditor considered most integral for  developing useful and reliable information for decision making. We  reviewed these plans’ implementation to determine the extent to which  delays jeopardized VA’s ability to remediate these control deficiencies  prior to FLITE implementation. In this regard, we reviewed documentation  and transactions concerning 25 projects that had been placed in service  since the start of fiscal year 2008—21 projects at the Albuquerque, New  Mexico Medical Center and 4 projects at the Lyons, New Jersey Medical  Center—to determine how long it took VA to capitalize these projects after  they had been placed in service. We also reviewed VA’s progress in  implementing benefit payment reconciliation procedures in a timely  manner. We interviewed VA, OIG, and independent auditor officials about  mechanisms in place to oversee the design and implementation of near- term corrective action plans to remediate material financial reporting  weaknesses identified through financial statement audits. We reviewed  minutes of oversight meetings involving senior VA management to  determine how VA monitored the status of remediation efforts related to  internal control deficiencies identified through financial statement audits.  We also interviewed agency officials about VA’s overall accountability for  timely remediation of internal control deficiencies in the near term, and  reviewed the status of ongoing VA efforts to staff a new office responsible  for coordination and oversight of the development of corrective action  plans. Appendix I provides a more detailed description of the scope and  methodology for our engagement.
We conducted our audit work from November 2008 to November 2009 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives. We received written comments on a draft of  this report from the Department of Veterans Affairs Chief of Staff which  are reprinted in appendix II.
subsections: section_title: Background
paragraphs: VA is responsible for providing federal benefits to veterans. Headed by the  Secretary of Veterans Affairs, VA operates nationwide programs for health  care, financial assistance, and burial benefits. According to VA, in fiscal  year 2009 the department received appropriations of almost $97 billion,  including over $50 billion in discretionary funding, primarily for health  care and approximately $47 billion in mandatory funding, primarily for  disability compensation, pensions, and education benefit programs.
VA is organized into three administrations to provide health care,  financial, and burial benefits to veterans and their families:    The Veterans Health Administration (VHA) provides a broad range of  primary health care, specialized care, and related medical and social  support services through its network of more than 1,200 medical  facilities.
The Veterans Benefit Administration (VBA) distributes financial  benefits to veterans and their families related to compensation and  pension, vocational rehabilitation and employment, home loans, life  insurance, and education.
The National Cemetery Administration (NCA) maintains national  cemeteries and provides burial and memorial services to veterans.
subsections: section_title: Legislative and Regulatory Framework for Financial Management, Reporting, and Internal Control
paragraphs: The Chief Financial Officers (CFO) of the 24 major departments and  agencies identified in 31 U.S.C. § 901(b) are required to, among other  things, develop and maintain integrated accounting and financial  management systems, including financial reporting and internal controls,  and to direct, manage, and provide policy guidance and oversight of all  agency financial management activities. These CFOs are also required to  assist the heads of their agencies with annually preparing and submitting  to Congress and the Office of Management and Budget audited financial  statements and statements of assurance on the effectiveness of their  agencies’ systems of internal control.
The Comptroller General’s Standards for Internal Control in the Federal  Government (the Green Book) provides that federal agencies should  establish policies and procedures to ensure that the findings of audits and  other reviews are promptly resolved. In addition, Office of Management  and Budget (OMB) Circular No. A-123, Management’s Responsibility for  Internal Control, requires management to develop corrective action plans  for material weaknesses—identified through management reviews, OIG  and GAO reports, program evaluations, and financial statement audits— and periodically assess and report on the progress of those plans. Further,  the CFOC A-123 Guidance provides that agencies construct a corrective  action planning framework to facilitate plan preparation, accountability,  monitoring, and communication. The guidance provides that agency  managers are responsible for developing and implementing action plans  for taking timely and effective action to correct deficiencies. The CFOC A- 123 Guidance is widely viewed as a “best practices” methodology for  executing the requirements of Appendix A of OMB Circular No. A-123.
section_title: Material Weaknesses Identified in VA’s Internal Control over Financial Reporting in Fiscal Year 2008
paragraphs: In the independent auditor’s report on VA’s fiscal year 2008 financial  statements, the auditor identified the following three material weaknesses:    Financial management system functionality—reported since fiscal year  2000, is linked to VA’s outdated legacy financial systems impacting VA’s  ability to prepare, process, and analyze financial information that is  reliable, timely, and consistent. Legacy system deficiencies  necessitated significant manual processing of financial data and a large  number of adjustments to the balances in the system, thereby  increasing the risk of processing errors and misstatements in the  financial statements.  IT security controls—also reported as a material weakness since fiscal  year 2000, resulted from the lack of effective implementation and  enforcement of an agencywide information security program. Security  weaknesses in the areas of access control, segregation of duties,  change control, and service continuity continued to place VA’s program  and financial data at risk. For example, weaknesses in information  security controls placed sensitive financial and veterans’ medical and  benefit information at risk of inadvertent or deliberate misuse,  improper disclosure, theft, or destruction, possibly occurring without  detection.
Financial management oversight—reported as a material weakness  beginning in fiscal year 2005 and as a significant deficiency in fiscal  years 2000 through 2004. This weakness stemmed from a number of  control deficiencies whose operational causes varied. Common issues  included the recording of financial data without sufficient review and  monitoring, a lack of human resources with the appropriate skills, and  a lack of capacity to effectively process a significant volume of  transactions. When aggregated, the independent auditor found that  these deficiencies suggested a recurring theme of inadequate or  ineffective financial management oversight.
section_title: VA Has Established FLITE Program
paragraphs: To help resolve the financial management system functionality material  weakness, modernize the IT environment, and implement an integrated  financial management system, VA established the Financial and Logistics  Integrated Technology Enterprise (FLITE) program, managed by the  FLITE Program Office, to replace its current legacy systems. The FLITE  Program involves a multiple-year phased approach comprised of three  major components: the Strategic Asset Management (SAM) project, a  logistics and asset management system; the Integrated Financial  Accounting System (IFAS), which focuses on financial management; and a  data warehouse that is intended to assist in financial reporting. As of  January 2009, VA planned to complete FLITE implementation in fiscal year  2014.
section_title: VA Faces Continuing Financial Reporting Deficiencies as a Result of Uncorrected Long-Standing Material Weaknesses
paragraphs: Although VA had eliminated some significant deficiencies in prior years,  other deficiencies have emerged that require attention. As a result of its  recurring internal control weaknesses in financial reporting, VA continues  to be at risk of processing errors and misstatements in VA’s financial  reports.
The financial management system functionality material weakness, which  is linked to VA’s outdated financial systems, consists of seven underlying  significant deficiencies. The following four significant deficiencies were  newly reported in fiscal year 2008.
VBA Benefit Delivery Network (BDN) and Veterans Services Network  (VETSNET) had insufficient audit trail documentation for the transfer  of data to a data warehouse and the storage of such data, increasing the  risk of misstatements in the financial statements and other financial  reports.
VETSNET lacked data mining capabilities, thereby preventing VA  financial managers from analyzing transactions at a level needed to  prepare routine reconciliations on billions of dollars in transactions.
Automated inventory systems at the Consolidated Mail Order  Pharmacy facilities could not provide the data needed to properly  record the cost of inventory, resulting in potential misstatements in the  financial statements and other financial reports.
VA lacked a system to track obligations and purchases by vendors  resulting in VA relying on vendors to supply operational sales data on  medical center purchases.
Three of the seven significant deficiencies were repeat conditions:  Inadequate year-end closing procedures for the financial system and  related records, reported since fiscal year 2000, created a significant  risk of error in the annual financial statements.
Business line system integration problems, reported since fiscal year  2004, resulted in inadequate support for amounts recorded in the  general ledger, such as VETSNET accounts receivables, and the  potential for misstatements in the financial statements and other  financial reports.
Fixed asset reporting limitations, reported since fiscal year 2007,  prohibited VA from readily identifying all current year PP&E additions  and reclassifications of work in process.
The financial management oversight material weakness, reflecting a  recurring theme of inadequate or ineffective financial management  oversight, consisted of nine underlying significant deficiencies. The  following three were newly reported in fiscal year 2008:    Missing records in the mortgage loan portfolio maintained by an  outside contractor resulted in unsupported amounts and potential  errors in the general ledger.  Incorrect formulas for estimating the projected default rate for  guaranteed and direct loans in VA’s housing model could lead to  material misstatements of estimated costs of guaranteed and direct  loans in the financial statements and other financial reports.  Incorrect expensing and capitalization of software development costs  could result in an understatement of PP&E and an overstatement of  operating program costs.
Six of the nine significant deficiencies were repeat conditions:    A lack of adequate review and follow-up procedures for accrued  services payable and undelivered orders, reported since fiscal year  2007, resulted in invalid balances for obligations and accrued services  payable and potential misstatements in the financial statements and  other financial reports. VA reported a total of $8 billion in undelivered  orders in fiscal year 2008.
Untimely depreciation, improper recording of disposed assets,  discrepancies in estimated useful life of equipment, and other  inadequate capitalization and accounting for PP&E, reported since  fiscal year 2000, could result in misstated PP&E and related expense  accounts. VA reported a $13 billion PP&E balance in fiscal year 2008.  Inconsistent methodologies and unsupported estimates for  environmental and disposal liabilities, reported since fiscal year 2004,  could lead to misstatements in the financial statements. VA reported a  $928 million balance in environmental and disposal liabilities in fiscal  year 2008.  Inadequate review of unbilled receivables and contractual adjustments,  reported since fiscal year 2007, could lead to misstatements of account  receivable balances. VA reported over $1.7 billion in accounts  receivable for fiscal year 2008.  Inadequate BDN and VETSNET reconciliations, reported since fiscal  year 2007, increased the likelihood that an error in the financial  statements will occur and go undetected. BDN and VETSNET  processed over $40 billion in compensation, pension, education, and  vocational rehabilitation and employment benefits in fiscal year 2008.  Inadequate reconciliations of the data input to the compensation and  pension actuarial liability model, reported since fiscal year 2007, could  result in misstatements in the financial statements. VA reported a $1.4  trillion actuarial liability in fiscal year 2008.
In fiscal year 2008, VA reported successfully eliminating two prior  significant deficiencies concerning insufficient follow-up of accounts  receivable collections and errors in payroll data submissions to the Office  of Personnel Management underlying the financial management oversight  material weakness, as well as a prior material weakness regarding the  retention of computer-generated detail records for benefit payments.
section_title: Most VA Corrective Action Plans Lacked Key Information
paragraphs: VA has established corrective action plans intended to remediate many of  its 16 significant deficiencies in the near term independent of FLITE  implementation. However, although VA had corrective action plans in  place, many of these corrective action plans did not contain the detail  needed to provide VA or congressional oversight officials with assurance  that the plans had near-term actions that could be effectively implemented  on schedule. As shown in the table 1, VA planned to remediate 9  deficiencies in fiscal year 2009, 3 in fiscal year 2010, 3 in fiscal year 2012,  and 1 in fiscal year 2014. However, VA lacked documented policies and  procedures to ensure the consistent and comprehensive design of these  plans, and most of VA’s plans for correcting financial reporting  deficiencies in the near term lacked key information suggested in CFOC A- 123 Guidance.
Eight of the 13 plans we reviewed lacked key information as  recommended by the CFOC A-123 Guidance. As shown in table 2, 5 plans  lacked milestone dates for action steps, 1 plan lacked validation activities,  and 2 plans lacked both milestone dates and validation activities.
In accordance with CFOC A-123 Guidance, agencies should prepare  comprehensive corrective action plans that list action steps with related  monthly milestone dates to help ensure senior VA officials can monitor  progress. Seven of VA’s corrective action plans did not include  intermediate milestone dates necessary to gauge whether planned  corrective actions are proceeding according to schedule, thus increasing  the risk that corrective action plans will not be implemented on schedule.  For example,  In one plan, VA combined several action steps, needed to rewrite the  Consolidated Mail Order Pharmacy inventory management software,  into one 2-year milestone period. For example, VA combined  developing a statement of work, rewriting the software, and developing  an inventory module for each CMOP into one 2-year milestone period.  In addition, two other action steps lacked completion dates. Without  interim milestones and completion dates, it is more difficult for VA  officials to identify whether the necessary activities for remediating  weaknesses are occurring and whether they are on schedule. Without  such information, VA could miss opportunities to address issues that  might hamper timely completion of the remediation.
VHA’s plan for addressing the inadequate monitoring and accounting  for PP&E only specified the fiscal year in which the tasks were to be  completed. The lack of intermediate milestones makes it difficult for  senior management to adequately monitor the progress of  implementation efforts. Because most action steps only had a fiscal  year target date, it was unclear when during the year the steps were to  be taken and whether or not they were sequential. In addition, the plan  did not include any descriptions or related milestones for two action  steps.
In accordance with CFOC A-123 Guidance, senior management is  responsible for determining when sufficient action has been taken to  declare that a significant deficiency or a material weakness has been  corrected, and corrective action plans should include activities to validate  the resolution of the deficiency. Without such validation measures, it is  difficult for VA management to provide assurance that the corrective  actions have effectively remediated the deficiency. Three of VA’s  corrective action plans did not include activities to validate that the  planned actions would resolve the deficiency. For example, the corrective  action plan to address deficiencies in VA’s automated inventory systems at  its Consolidated Mail Order Pharmacy facilities did not include activities  to validate whether action steps were implemented and the desired results  achieved.
section_title: Deficient Corrective Action Plans and Ineffective Oversight of Remediation Efforts Result in Ongoing Risks to VA’s Financial Information
paragraphs: Deficient corrective action plans (discussed previously) and ineffective  oversight of corrective action plan implementation have resulted in missed  remediation milestones, placing VA at risk of continued errors and  misstatements in financial information. As of August 2009, VA had missed  milestones in 5 of the 13 corrective action plans to remediate fiscal year  2008 significant deficiencies underlying the financial management system  functionality and financial management oversight material weaknesses.  Our analysis of corrective action plans for two significant deficiencies— the untimely capitalization of construction projects and inadequate  reconciliations related to benefit payments—showed that slipping  milestones could jeopardize VA’s completion of these plans by fiscal years  2009 and 2012 respectively, and therefore may impair VA’s ability to obtain  the improved data reliability originally envisioned within those time  frames. For the plans lacking interim milestones, it is difficult for VA  management to monitor progress, identify whether there is any slippage,  and take timely steps to keep actions on track. The lack of milestones and  the related accountability for meeting targets could also limit incentives  for staff to ensure actions are implemented on schedule. In addition, VA  lacked documented policies and procedures for overseeing the  implementation of corrective action plans to remediate material  weaknesses identified in financial statement audits. In January 2009, VA  recognized the need to better coordinate these oversight activities and  created an office of Financial Process Improvement and Audit Readiness  (FPIAR).
subsections: section_title: VA Missed Milestones for Five Plans and Status of Other Plans Was Unknown
paragraphs: As shown in table 3, VA missed milestones in 5 of the 13 corrective action  plans that we reviewed, and the status of progress in implementing 3 other  plans was unknown because they lacked sufficient interim milestones.  VA missed milestones related to preparation of detailed procedures for the  Fixed Asset Package, PP&E policies and procedures, benefit payment  reconciliations, the development of reports to support reconciliations of  expense accounts in the actuarial liability model, and year-end closing  procedures.
section_title: Missed Milestones for Two Significant Deficiencies Illustrate Continuing Adverse Impacts on VA’s Financial Management
paragraphs: An analysis of the status of corrective action plans for two significant  deficiencies—the inadequate monitoring and accounting for PP&E and  inadequate reconciliations related to benefit payments—provided  examples of how missed milestones result in continuing risks of errors in  related VA financial reporting. Specifically, VA missed its milestones for  the creation of detailed procedures for capitalizing PP&E and automated  reconciliations to support veteran benefit payments.
Although the PP&E corrective action plan called for procedures related to  timely capitalization of PP&E to be developed by March 2009, they had not  been issued by August 2009. Failing to capitalize construction projects in a  timely manner may lead to misstated financial information if projects are  not capitalized in the same fiscal year they are placed in service. In  addition, related depreciation expenses may also be misstated as a result  of time lags in capitalizing projects. Finally, if projects are not closed out  in a timely fashion, VA is unable to determine whether funds are available  for use on other construction projects. Our analysis at two VHA medical  facilities identified continuing problems in the timely capitalization of  PP&E.
According to federal accounting standards and VA policy issued by VA’s  Assistant Secretary for Management (the VA CFO), construction projects  are to be recorded as work in process (WIP) until they are placed in  service, at which time the WIP balances are to be transferred to general  PP&E. We reviewed the 21 projects at the Albuquerque, New Mexico  Medical Center and the 4 projects at the Lyons, New Jersey Medical Center  that had been placed into service since the start of fiscal year 2008 and  found continuing significant delays in the amount of time it took to close  out and capitalize projects after they were placed in service. In  Albuquerque, VA fiscal staff told us their undocumented practice was to  capitalize projects within 30 days of being placed in service. However,  while they had capitalized 11 of 21 projects within 30 days, 6 projects were  not capitalized for 30 to 60 days, and 4 projects were not capitalized for  more than 120 days after they had been placed into service. At Lyons, VA  staff capitalized 3 of 4 projects more than 180 days after they were placed  in service.
VBA also experienced slipping milestones in remediating the benefit  payment reconciliation deficiency. VBA did not perform necessary  reconciliations between the BDN and VETSNET systems and VA’s general  ledger on a monthly basis prior to March 2008. Lacking such reconciliation  VA is at continuing risk of improper reporting of benefit payments. That  year, these systems processed over $41.6 billion in benefits payments  related to compensation and pension, as well as a portion of education  benefit programs as authorized by law. This information is critical to the  correct determination of VA’s overall cost of operations.
VBA developed a corrective action plan to correct this deficiency that  contained 43 separate activities with related milestones, including  developing automated reconciliations, documenting processes, and  training end users. According to VBA documents and officials, VBA missed  and pushed back milestones related to the development of reports  supporting veteran education payments and automated reconciliations.  For example, as of August 2009, work on the development of detailed  reports supporting the Vocational Rehabilitation and Employment  education payments was pushed back 5 months from November 2009 to  April 2010 and VBA reported slippage ranging from 3 to14 months in the  development of various reconciliations supporting Dependent’s Education  Benefits.
section_title: VA Lacked Effective Agencywide Oversight for the Correction of Material Weaknesses
paragraphs: VA lacked policies and procedures for overseeing the design and  implementation of corrective action plans to correct financial reporting  material weaknesses identified in financial statement audits. Further, VA  did not have an agencywide accountability mechanism in place to oversee  and coordinate the remediation of the material weaknesses in financial  reporting. Rather, VA delegated responsibility for the design,  implementation, and oversight of the corrective action plans to the various  administrations and offices responsible for the areas in which the  deficiencies were identified (e.g., VHA and VBA). Lacking centralized VA- wide guidance, the administrations inconsistently defined the parameters  for milestone dates in corrective action plans. For example, VHA  corrective action plans provided milestones by fiscal year, while VBA  plans often had monthly milestone dates. As a result, VA’s ability to  determine the status of corrective action plan implementation and identify  and address any slippages was impaired.
In contrast to its financial reporting weaknesses, VA had documented  policies and procedures to identify and correct its programmatic material  weaknesses, specifically those in the areas of accountability and  effectiveness over VA programs and operations. These policies and  procedures, which could also be applied to the remediation of financial  reporting material weaknesses identified through financial statement  audits, are outlined in a manual which includes a detailed template for  developing corrective action plans that specified parameters for milestone  dates and other key information. Further, VA had a Senior Assessment  Team (SAT) in place (chaired by the Assistant Secretary for Management  and comprised of other senior management representatives from VA and  its three administrations) to oversee remediation of programmatic control  weaknesses detected through VA’s internal control reviews completed  under OMB Circular No. A-123.
In January 2009, VA recognized the need to better oversee and coordinate  agencywide oversight activities for financial reporting material  weaknesses identified through financial statement audits. Specifically, VA  recruited a director to head a new office of Financial Process  Improvement and Audit Readiness (FPIAR) reporting to the VA Deputy  CFO in the Office of Finance under the VA Assistant Secretary for  Management. FPIAR was established with responsibility for:    coordinating and overseeing comprehensive corrective action plans for  VA’s audit-related material weaknesses, in consultation and  coordination with VA’s three administrations and applicable staff  offices;    assisting VA and the three administrations and staff offices in executing  and monitoring the corrective action plans;    ensuring compliance of VA offices and field stations with VA policies,  plans, procedures, and internal controls; and    assisting in updating corrective action plans as needed and developing  recommendations and actions for ensuring completion of stated  objectives and milestones in the event of slippage.
In addition, the FPIAR Director’s position description calls for FPIAR to  perform analysis and remediation efforts for any comparable internal  control deficiencies being resolved as part of VA’s ongoing OMB Circular  No. A-123 reviews in concert with work to remediate VA’s audit-related  material weaknesses. Integrating VA’s A-123 review process and  remediation activities for financial reporting material weaknesses  identified in financial statement audits could enhance the efficiency of  VA’s corrective actions and the elimination of material weaknesses.
As of September 2009, according to FPIAR’s Director, VA had filled three  permanent staff positions and hired six full-time contractors to assist VA  in addressing a variety of financial reporting issues (e.g., helping address  the IT Security Controls material weakness and outstanding issues  surrounding the capitalization of software development costs, updating  and reformatting corrective action plans, and developing requirements for  an interface between VETSNET and VA’s general ledger). The VA Deputy  CFO said that as office operations have evolved, VA has decided to hire  one or two more permanent staff for the FPIAR and use contractors to fill  other positions. He said that contractors can provide VA with the  flexibility to address short-term staffing needs as well as the necessary  technical expertise to remediate individual significant deficiencies.  However, the FPIAR did not have a workforce plan defining the number of  staff and expertise needed in the office.
In fiscal year 2009, while not included in documented policies and  procedures, the FPIAR began practices intended to establish agencywide  procedures for oversight of corrective action plans to remediate material  weaknesses identified in financial statement audits. For example, the  FPIAR Director began participating in monthly SAT meetings chaired by  the Assistant Secretary for Management and attended by other senior VA  officials including the VHA CFO and VBA CFO. These meetings provide an  opportunity for the FPIAR Director to highlight the status of specific  corrective actions underway to address financial reporting significant  deficiencies requiring the attention of key stakeholders across the agency.  Further, the director told us that by the end of calendar year 2009, the  FPIAR intends to begin using a corrective action plan template consistent  with the CFOC A-123 Guidance to remediate significant deficiencies  identified in the fiscal year 2009 financial statement audit. Because VA has  developed a corrective action template for addressing A-123 control  deficiencies, the FPIAR Director told us she is considering whether to  adopt this template for corrective action plans to remediate financial  reporting control weaknesses, which could provide efficiencies and help  integrate resolution of some deficiencies. VA’s Deputy CFO also told us  that oversight by the SAT, combined with the use of the corrective action  plan template, will allow for more rigorous oversight of remediation  efforts of weaknesses detected in the financial statement audits.
section_title: Conclusion
paragraphs: VA has had serious, long-standing material weaknesses in financial  reporting that could result in significant misstatements in financial  information reported to Congress and used by VA to manage its  operations. One of the significant deficiencies is not planned for resolution  until FLITE is fully implemented, which will not be until 2014. Other  deficiencies can be addressed in the near term. While VA has corrective  action plans for near-term actions intended to provide more accurate and  complete financial data, they often lacked key information. Consequently,  VA managers could not readily identify and address slippage in  remediation activities, exposing VA to continued risk of errors in financial  information and reporting. Immediate actions to provide a rigorous  framework for the design and oversight of corrective action plans will be  essential to ensuring the timely remediation of internal control  weaknesses before FLITE implementation. Well-defined corrective action  plans provide a “road map” for remediation activities and facilitate  effective oversight by senior VA officials. Continued support from senior  VA officials and administration CFOs will also be critical to ensure that  key corrective actions are developed and implemented on schedule.
section_title: Recommendations
paragraphs: To help focus VA’s corrective action plans on more effectively establishing  and completing consistent and comprehensive near-term actions, we  recommend that the Secretary of VA direct the Assistant Secretary for  Management to issue policies and procedures for identifying and reporting  on financial audit weaknesses to include:    Detailed guidance (such as a set of tools and templates in place to  identify and report on programmatic weaknesses) on required  corrective action plan elements (including milestones for completion of  interim action steps and validation steps).
Establishing a VA Secretariat-level agency-wide governance structure  for overseeing all OMB Circular No. A-123 and financial statement audit  material weakness remediation activities that provides for (1) involving  key stakeholders in the remediation process (such as the FPIAR,  administration CFO’s, and other senior VA officials); (2) clearly  defining stakeholder roles and responsibilities; (3) establishing and  implementing strategic workforce planning for FPIAR; and (4)  regularly assessing and reporting on the status of corrective action  plans and identification of any actions needed to address any slippages  of remediation activities.
To help ensure the timely and complete capitalization of property, plant,  and equipment, we recommend that the Secretary of VA direct the  Assistant Secretary for Management to issue procedures on specific  actions and identify specific reasonable time frames, such as within 30  days, to implement VA policy to capitalize PP&E projects when they are  placed in service.
section_title: Agency Comments and Our Evaluation
paragraphs: In its written comments, VA generally agreed with our findings and  recommendations and identified specific actions it has taken and plans to  take to implement these recommendations. In response to our  recommendation to provide detailed guidance (such as a set of tools and  templates in place to identify and report on programmatic weaknesses) on  required corrective action plan elements (including milestones for  completion of interim action steps and validation steps), VA stated that the  FPIAR has begun integrating its corrective actions for financial audit  weaknesses with VA’s OMB Circular No. A-123 processes. VA also said  that FPIAR will migrate to a set of corrective action plan tools, templates,  and documented procedures in fiscal year 2010.
VA partially concurred with our recommendation that VA establish a  Secretariat-level agencywide governance structure for OMB Circular No.  A-123 and financial statement audit remediation activities. In its  comments, VA stated it already established a Senior Assessment Team as  the coordinating body for corrective action planning to address control  deficiencies identified as a result of OMB Circular No. A-123 reviews and  financial statement audits. As discussed in our draft report, we recognized  VA has taken action to establish agencywide accountability for oversight  of its corrective action plans and has begun to establish related practices.  However, these practices had not yet evolved into the rigorous framework  needed to effectively ensure timely control weakness remediation. VA  stated that its Internal Controls Service is developing a handbook for all  stakeholders that will provide detailed guidance for corrective action  planning, monitoring, reporting, and validation procedures for all financial  statement audit and OMB Circular No. A-123 significant deficiencies and  material weaknesses. Also, VA noted that as FPIAR matures, it will  continue to define and meet staffing requirements.
VA also concurred with our recommendation that VA issue procedures for  specific actions and identify reasonable time frames, such as within 30  days, to implement VA policy to capitalize PP&E projects when they are  placed in service. VA provided a copy of recently issued procedures which  identified specific actions and time frames for the capitalization of PP&E.  These procedures provide guidance for monthly communications between  engineering staffs, program directors, and the appropriate fiscal activity  regarding construction project status, costs, and useful life. The  procedures also provide that property should be capitalized no later than  the end of the fiscal month following the month that the property is put  into use or accepted by VA. If fully and effectively implemented, the  guidance should help address the problems we found related to timely  capitalization of VA’s PP&E.
In its written comments, VA also provided technical comments which we  considered and incorporated as appropriate.
We are sending copies of this report to other interested congressional  committees and to affected federal agencies. In addition, this report is  available at no charge on the GAO Web site at http://www.gao.gov.
If you or your staff have any questions regarding this report, please  contact me at (202) 512-9095 or at raglands@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made major contributions to  this report are listed in appendix III.
section_title: Appendix I: Scope and Methodology
paragraphs: To determine the nature of the internal control weaknesses identified in  the Department of Veterans Affairs (VA) fiscal year 2008 financial audit  report and how long they have been outstanding, we obtained and  analyzed the financial statement audit reports for fiscal years 2000 to 2008.  We summarized available information on the extent and nature of the  internal control weaknesses characterized as material weaknesses, as  well as the underlying significant deficiencies and identified their  evolution over time. We also interviewed VA and Office of Inspector  General (OIG) officials and VA’s independent auditor, and reviewed VA  documents, prior GAO and OIG reports, and independent auditor  workpapers to better understand control deficiencies underlying the  material weaknesses. We did not perform independent audit work to test  and validate whether the material weaknesses and related significant  deficiencies reported by the independent auditor were accurate and  complete.
To determine whether VA had plans appropriately focused on near-term  actions to address financial reporting deficiencies prior to the  implementation of its Financial and Logistics Integrated Technology  Enterprise (FLITE) system in fiscal year 2014, we analyzed VA’s corrective  action plans for remediating significant deficiencies underlying two of the  three material weaknesses impacting the reliability of financial  information integral for helping inform management decision making— weaknesses in VA’s financial management systems and in its financial  management oversight. We interviewed VA officials, VA OIG officials, and  independent auditor officials who completed VA’s fiscal year 2008  financial statement audit about near-term actions in VA plans to correct  these underlying significant deficiencies. We also analyzed related  corrective action plans to remediate 15 of the 16 significant deficiencies  underlying two material weaknesses to determine whether they included  key information specified in the Chief Financial Officers Council’s (CFOC)  Implementation Guide for OMB Circular A-123, Management’s  Responsibility for Internal Control – Appendix A, Internal Control over  Financial Reporting: action steps with related milestones to provide a  “road map” for remediation activities, validation activities to help ensure  the proposed actions worked as envisioned, a description of the deficiency  to be corrected in sufficient detail to provide clarity and facilitate a  common understanding of what needs to be done, and clear delineation of  responsible officials for completing the planned actions. We also reviewed  VA’s task work plan to remediate the final significant deficiency—the  documentation of data transfer from VBA benefit payment systems to a  data warehouse—in fiscal year 2009.
To determine whether VA had appropriate oversight mechanisms in place  to help ensure that near-term corrective action plans to address financial  reporting deficiencies are implemented on schedule, we assessed the  status of plan implementation in July and August 2009 by identifying  whether VA met specific milestones and any slippages that had occurred.  We also evaluated the timeliness of implementation of corrective action  plans for two significant deficiencies—one to address the inadequate  capitalization and accounting for property, plant, and equipment (PP&E)  and another to improve reconciliations of benefit payments. One plan was  designed and implemented by the Veterans Health Administration, and one  by the Veterans Benefit Administration—the two principal VA  administrations. We selected these plans for further review because the  related deficiencies were not currently being audited or reviewed by other  oversight organizations, their associated account balances exceeded a  material dollar threshold ($12.7 billion), and the deficiencies contributed  to the two material weaknesses that we, VA officials, and VA’s  independent auditor considered most integral for developing useful and  reliable information for decision making. We reviewed these plans’  implementation in detail to determine the extent to which delays  jeopardized VA’s ability to remediate these control deficiencies and  provide reliable financial management information to senior VA officials  prior to FLITE implementation. In this regard, we reviewed documentation  and transactions concerning 25 projects that had been placed in service  since the start of fiscal year 2008: 21 projects at the Albuquerque, New  Mexico Medical Center and 4 projects at the Lyons, New Jersey Medical  Center to determine how long it took VA to capitalize these projects after  they had been placed in service. We also reviewed VA’s progress in  implementing benefit payment reconciliation procedures in a timely  manner. We interviewed VA, OIG, and independent auditor officials about  mechanisms in place to oversee the design and implementation of near- term corrective action plans to remediate material financial reporting  weaknesses identified through financial statement audits. We reviewed  minutes of oversight meetings involving senior VA management to  determine how VA monitored the status of remediation efforts related to  internal control deficiencies identified through financial statement audits.  We also interviewed agency officials about VA’s overall accountability for  timely remediation of internal control deficiencies in the near term, and  reviewed the status of ongoing VA efforts to staff a new office responsible  for coordination and oversight of the development of corrective action  plans.
We conducted our audit work from November 2008 to November 2009 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
section_title: Appendix II: Coments from the Department of Veterans Affairs
section_title: Appendix III: GAO Contact and Staff Acknowledgments
paragraphs: GAO Contact – Susan Ragland, (202) 512-9095 or raglands@gao.gov. Staff  Acknowledgments – In addition to the contact named above, Glenn  Slocum (Assistant Director), Richard Cambosos, Patrick Frey, W. Stephen  Lowrey, David Ramirez, and George Warnock made key contributions to  this report.