Veterans Affairs: Sustained Leadership Needed to Address High-Risk Issues
Released: 2019-05-22T00:00:00

Letter

Background

VA is responsible for providing benefits to veterans, including health care, disability compensation, and various types of financial assistance. In fiscal year 2019, VA received a total budget of $201.1 billion, and the largest discretionary budget in its history—$86.6 billion, about $20 billion higher than in 2015. The department operates one of the largest health care delivery systems in the nation through its Veterans Health Administration (VHA), with 172 medical centers and more than 1,000 outpatient facilities organized into regional networks. VA has faced growing demand by veterans for its health care services, with the total number of veterans enrolled in VA’s health care system rising from 7.9 million to more than 9 million from fiscal year 2006 through fiscal year 2017. In fiscal year 2019, VHA received $73.1 billion of VA’s $86.6 billion discretionary budget.

In addition to providing health care services, VA provides cash benefits to veterans for disabling conditions incurred in or aggravated by military service. To carry out its mission, VA spends tens of billions of dollars to procure a wide range of goods and services, including medical supplies; to construct hospitals, clinics, and other facilities; and to provide the information technology (IT) to support its operations.

We have made hundreds of recommendations to improve VA’s management and oversight of the services it provides to veterans. Specifically, since 2000, we have made 1,225 recommendations to VA. While VA has implemented most of the recommendations, a number remain open, as of April 2019. Specifically, more than 125 recommendations related to VA health care remain open, including 17 recommendations that have remained open for 3 years or more;

15 recommendations related to improving VA acquisition management remain open, including 1 recommendation that has remained open for 3 years or more; and

12 recommendations related to management of disability claims workloads.

In 2017, we began sending letters to VA and appropriate congressional committees identifying priority recommendations for VA to implement in order to significantly improve its operations. We categorized these recommendations into nine areas: (1) veterans’ access to timely health care; (2) veterans’ community care program; (3) human capital management; (4) information technology; (5) appeals reform for disability benefits; (6) quality of care and patient safety; (7) national policy documents; (8) contracting policies and practices; and (9) veterans’ access to burial options.

Overall Rating for the Managing Risks and Improving VA Health Care High-Risk Area Remained Unchanged in 2019

Since we designated VA health care as a high-risk area in 2015, VA has begun to address each of the identified five areas of concern related to managing risks and improving VA health care: (1) ambiguous policies and inconsistent processes; (2) inadequate oversight and accountability; (3) IT challenges; (4) inadequate training for VA staff; and (5) unclear resource needs and allocation priorities.

Since our 2017 High-Risk Report, ratings for all five criteria remain unchanged as of March 2019. Specifically, the leadership commitment and action plan criteria remain partially met. Although VA has experienced leadership instability over the past 2 years in several senior positions, a new Secretary was confirmed in July 2018. Secretary Wilkie has demonstrated his commitment to addressing the department’s high- risk designation by, among other things, creating an office to direct an integrated, focused high-risk approach and communicating to VA leaders the importance of addressing our recommendations and working with GAO. The Secretary’s actions, to date, have allowed the department to maintain its leadership commitment rating as of March 2019.

The action plan criterion also remains partially met as of March 2019. In March 2018, VA submitted an action plan to address the underlying causes of its high-risk designation, but the plan did not clearly link actions to stated outcomes and goals or establish a framework to assess VA’s progress. VA officials told us that instead of revising the March 2018 action plan, it will incorporate its plans to address the high-risk designation into the department’s current initiatives. Specifically, VA is currently implementing the VHA Plan for Modernization, through which the department intends to modernize VA’s structure, culture, governance, and systems through organizational improvements. VA officials have indicated that the VHA Plan for Modernization is intended, among other things, to address the high-risk areas for VA health care. VA officials also told us they are currently developing operational plans for the VHA Plan for Modernization, and these plans will include goals, time frames, and metrics, among other things. VA estimates that the operational plans will be complete by September 2019.

The monitoring, demonstrated progress, and capacity criteria remain unmet since our 2017 High-Risk Report. In order to address the monitoring and demonstrated progress criteria, VA’s ongoing revisions to its action plan need to include the addition of certain essential components, including metrics, milestones, and mechanisms for monitoring and demonstrating progress in addressing the high-risk areas of concern. VA’s capacity rating also remains not met. Though the department took steps to establish offices, workgroups, and initiatives to address its high-risk designation, many of these efforts are either in the initial stages of development or resources have not been allocated.

For each of the five identified areas of concern related to managing risks and improving VA health care, ratings reflect the level of progress VA has made to address them.

Ambiguous policies and inconsistent processes. Since our 2017 High-Risk Report, ratings for all five criteria remain unchanged for this area of concern as of March 2019.

Leadership commitment: partially met. In September 2017, we reported that VHA had approximately 800 national policies, the majority of which were outdated. VHA reported reducing the number of national policies by 26 percent, and work continues in this area. In addition, VHA established an inventory of approximately 55,000 local policies as of October 2017. In October 2018, VHA noted its plans to determine who is responsible for monitoring implementation of national and local policy, as well as the alignment between these levels of policy. At that time, VHA also discussed its future plans to monitor the implementation and alignment of national and local policy and update its national policy directive by the end of June 2019. Additionally, VA has implemented a structure for leadership input into the policy process, such as at the VHA Chief of Staff level. However, senior leadership has lacked the stability needed to ensure issued policy meets agency goals.

Capacity: not met. Since 2017, VA has issued an updated directive on policy management, and put in place procedures to train staff and obtain input from all levels on policy development. However, VA continues to face challenges in this area because it is reliant on contracts and information technology resources, which if delayed, can impede progress toward meeting goals.

Action plan: partially met. Since 2017, VA has further refined its root cause analysis for this area of concern. In June 2017, VA also identified the following as enterprise-wide root causes of its high-risk designation: disjointed strategic planning; poorly defined roles, responsibilities, and decision authorities; poor horizontal and vertical integration; lack of reliable data and analysis; ineffective human capital management; and inadequate change management.

VA relied on these root cause analyses as the foundational drivers for the VHA Plan for Modernization. However, VA has not used these analyses to develop and prioritize appropriate milestones and metrics in the action plan.

Monitoring: not met. Since the March 2018 action plan lacked specific metrics and mechanisms for assessing and reporting progress, it is not clear how VA is monitoring its progress.

Demonstrated progress: not met. Our work continues to indicate VA is not yet able to show progress in this area. Since its 2015 high-risk designation, we have made 50 new recommendations in this area of concern, 32 of which were made since our 2017 report was issued. For example, In November 2017, we reported that, due in part to misinterpretation or lack of awareness of VHA policy, VA medical center officials did not always conduct or document timely required reviews of providers when allegations were made against them. We also found that VHA was unable to reasonably ensure appropriate reporting of providers to oversight entities such as state licensing authorities. As a result, VHA’s ability to provide safe, high quality care to veterans is hindered because other VA medical centers, as well as non-VA health care entities, may be unaware of serious concerns raised about a provider’s care.

We recommended that VHA direct medical centers to document and oversee reviews of providers’ clinical care after concerns are raised, among other recommendations. All of our recommendations remain open. As of January 2019, VA estimated completing the recommended revisions to its policy and audit processes in August 2019 and August 2020, respectively.

In July 2018, we reported that VA collected data related to employee misconduct and disciplinary actions, but data fragmentation, reliability issues, and inadequate guidance impeded department-wide analysis of those data. Thus, VA management is hindered in making knowledgeable decisions regarding the extent of misconduct and how it was addressed.

We recommended that VA develop and implement guidance to collect complete and reliable misconduct and associated disciplinary-action data department-wide, whether through a single information system, or multiple interoperable systems. VA concurred with this priority recommendation, which remains open. VA reported that it expects to implement one or more information systems that will collect misconduct and associated disciplinary action data in January 2020.

Inadequate oversight and accountability. Since our 2017 High-Risk Report, ratings for one criterion improved and four remain unchanged for this area of concern as of March 2019.

Leadership commitment: partially met. VA has made organizational changes, including establishing the Office of Integrity, to standardize and streamline the agency’s oversight of its programs and personnel. However, since 2017, the lack of stability in the Under Secretary for Health position has hindered its ability to demonstrate sustained commitment to improving this area of concern.

Capacity: not met. VA has begun to implement capacity-building initiatives directed at improving oversight and accountability. For example, VHA’s Office of Internal Audit and Risk Assessment, a key component of the department’s oversight and accountability model, began conducting audits in 2018. However, according to VA’s action plan, the department has yet to allocate resources for this office, such as sufficient staff to carry out its activities.

Action plan: partially met. In March 2019, the rating for this criterion improved to partially met. In 2018, VA conducted an analysis of the root causes contributing to findings of inadequate oversight and accountability, an important step in identifying the underlying factors contributing to this area of concern. addresses gaps in physician staffing, including those for mental health providers, which may affect veterans’ access to care, among other issues.

We recommended that VHA should develop and implement a process to accurately count all physicians providing care at each medical center, including physicians who are not employed by VHA. VHA did not concur with this recommendation, which we reiterated in our priority recommendation letter.

In a series of reports from 2012 through 2018, GAO found VA’s wait time data unreliable for primary and specialty care, as well as for care in the community. GAO also found that VA did not measure the full wait times that veterans experience in obtaining care across these settings. Specifically, in December 2012, we made two recommendations to VA to improve the reliability and oversight of wait time measures, both of which are designated as priority, and remain open.

Similarly, in June 2018, we reported that VHA could not systematically monitor the timeliness of veterans’ access to Veterans Choice Program care because it lacked complete, reliable data to do so. Specifically, we found (1) a lack of data on the timeliness of accepting referrals and opting veterans in to the program, (2) inaccuracy of clinically indicated dates, which are used to measure the timeliness of care, and (3) unreliable data on the timeliness of urgent care.

We recommended that VA take steps to improve the timeliness and accuracy of data on veterans’ wait times for care and its oversight of the future community care program that will consolidate other community care programs with the Veterans Choice Program, whose authority sunsets on June 6, 2019. VA concurred with eight of the 10 recommendations related to these findings, all of which remain open. VA reported that, in order to improve wait times data accuracy under the Veterans Community Care Program, it intends to implement several initiatives through September 2019.

In September 2018, we reported on the timeliness of third-party administrators’ payments to community providers under VA’s largest community care program, the Veterans Choice Program. Although VA has taken steps to improve the timeliness of claim payments to these providers, VA is not collecting data or monitoring compliance with third-party administrators’ customer service requirements for provider calls. This could adversely affect the timeliness with which community providers are paid, possibly making them less willing to participate and affecting veterans’ access to care.

We recommended that VA collect data on and monitor compliance with its requirements pertaining to customer service for community providers. VA agreed with the recommendations, but has not yet implemented them.

In November 2018, we reported that VHA’s suicide prevention media outreach activities declined in recent years due to leadership turnover and reorganization. Additionally, we found that VHA did not assign key leadership responsibilities or establish clear lines of reporting for its suicide prevention media outreach campaign, which hindered its ability to oversee the campaign.

In April 2019, VA implemented one of the recommendations by providing a new oversight plan for its suicide prevention media outreach campaign. It plans to implement the remaining recommendation by working with communications experts to develop metrics, targets, and an evaluation strategy to improve its outreach efforts.

In April 2019, we reported that VHA’s appraisal process for assessing medical center director performance relies heavily on medical center performance information. VHA designed the Strategic Analytics for Improvement and Learning (SAIL) system to provide internal benchmarking of medical center performance and to promote high quality health care delivery across its system of regional networks and medical centers. SAIL was evaluated in 2014 and 2015 by VHA and an external contractor, respectively, but VHA has not assessed the recommendations from those evaluations, or taken action on them. The evaluations, which found issues related to the validity and reliability of SAIL and its ratings for measuring performance and fostering accountability, together included more than 40 recommendations for improvement.

Without ensuring that the recommendations resulting from these previous evaluations are assessed and implemented as appropriate, the identified deficiencies may not be adequately resolved, and VHA’s ability to hold officials accountable for taking the necessary actions may be diminished. VA concurred with the two recommendations we made to address these findings, both of which remain open.

Information technology challenges. Since our 2017 High-Risk Report, ratings for one criterion regressed, one improved, and three remain unchanged this area of concern as of March 2019.

Leadership commitment: not met. In March 2019, the rating for this criterion declined to not met. In January 2019, the Senate confirmed a new VA Chief Information Officer (CIO). This is the fourth official to lead VA’s IT organization since our 2017 High-Risk Report, and the frequent turnover in this position raises concerns about VA’s ability to address the department’s IT challenges.

Capacity: not met. In May 2018, VA awarded a contract to acquire the same commercial electronic health record system as the Department of Defense (DOD). However, VA is early in the transition and its actions are ongoing. Additionally, VA has developed a strategy for decommissioning its legacy IT systems, which are tying up funds that could be reallocated for new technology to enable improved veteran care, but has made limited progress in implementing this effort.

Action plan: partially met. In March 2019, the rating for this criterion improved to partially met. In 2018, VA conducted an analysis to identify the root causes of IT challenges, which informed the goals in its action plan. However, VA’s action plan contained significant information gaps, including missing interim milestone dates. These information gaps raise questions about VA’s commitment to addressing IT-related root causes and need to be addressed before we can consider this criterion met.

Monitoring: not met. The March 2018 action plan lacked specific metrics and mechanisms for assessing and reporting progress.

Demonstrating progress: not met. Our work continues to indicate VA is not yet able to show progress in this area. Since its 2015 high-risk designation, we have made 14 new recommendations in this area, 12 of which were made since our 2017 report was issued. For example: In June 2017, to address deficiencies we found related to VA’s pharmacy system, we recommended that VA take six actions to provide clinicians and pharmacists with improved tools to support pharmacy services to veterans and reduce risks to patient safety. This included assessing the extent to which the interoperability of VA and DOD’s pharmacy systems impacts transitioning service members. VA generally concurred with these recommendations, all of which remain open.

In April 2019, we testified that from 2001 through 2018, VA pursued three efforts to modernize its health information system— the Veterans Health Information Systems and Technology Architecture (VistA). (See Fig. 2.) However, these efforts resulted in high costs, created challenges ensuring the interoperability of health data, and ultimately did not result in a modernized VistA. Specifically, in December 2017, we reported that VA obligated over $1.1 billion for contracts with 138 contractors during fiscal years 2011 through 2016 for two modernization initiatives, an Integrated Electronic Health Record program with the DOD and VistA Evolution. We have ongoing work that examines the cost to VA of VistA and the department’s actions to transition from VistA to a new electronic health record system.

Regarding the department’s most recent effort, the Electronic Health Record Modernization, we testified in April 2019 that the governance plan for this program was not fully defined, which could jeopardize its fourth attempt to modernize its electronic health record system. VA plans to implement the same electronic health record system the DOD is currently deploying. The new system is intended to be the authoritative source of clinical data to support improved health, patient safety, and quality of care provided by VA.

VA has not fully implemented our priority recommendation calling for the department to define the role of the Interagency Program Office in the governance plans for acquisition of the department’s new electronic health record system. VA concurred with this recommendation and reported that the Joint Executive Committee, a joint governance body, approved a role for the Interagency Program Office, but as of April 2019 VA has yet to provide us with documentation of this development.

We also testified in April 2019 that VA has not yet fully addressed the recommendation we made in September 2014 to expedite the process for identifying and implementing an IT system for the Family Caregiver Program. We reported in September 2014 that the Family Caregiver Program, which was established to support family caregivers of seriously injured post-9/11 veterans, has not been supported by an effective IT system. Specifically, we reported that, due to limitations with the system, the program office did not have ready access to the types of workload data that would allow it to routinely monitor workload problems created by the program. Without such information, the program’s workload issues could persist and impact the quality and scope of caregiver services, and ultimately the services that veterans receive.

VA concurred with our recommendation and subsequently began taking steps to implement a replacement system. However, the department has encountered delays and reported recently initiating an effort to implement a new IT system to support the program based on existing commercially available software. We have ongoing work to evaluate VA’s effort to acquire a new IT system to support the Family Caregiver Program.

Inadequate training for VA staff. Since our 2017 High-Risk Report, ratings for one criterion improved and four remain unchanged for this area of concern as of March 2019.

Leadership commitment: not met. VA officials have reported progress in establishing a process to develop an enterprise-wide annual training plan to better ensure that VA staff are adequately trained to provide high-quality care to veterans. However, the actions necessary to complete and implement this training plan are not reflected in VA’s March 2018 action plan for the training area of concern, raising questions about the process through which it will be developed. The lack of progress in setting clear goals for improving training demonstrates that VA lacks leadership commitment to address our concerns in this area.

Capacity: not met. VA has created working groups and task forces— such as the Learning Organization Transformation Subcommittee in the National Leadership Council—with specific responsibilities. However, VA’s ability to demonstrate capacity is limited because, according to VA’s March 2018 action plan, the department relies on external contractor support services to meet training goals.

Action plan: partially met. In March 2019, the rating for this criterion improved to partially met. VA completed a root cause analysis for training deficiencies, which informed the goals underlying its action plan. However, the action plan continues to have deficiencies identified in 2017. For example, not all goal descriptions correspond to planned actions and the action plan lacks detail about how and which data will be collected to assess progress.

Monitoring: not met. The March 2018 action plan lacked specific metrics and mechanisms for assessing and reporting progress.

Demonstrated progress: not met. Our work continues to indicate that VA is not yet able to show progress in this area. Since its 2015 designation, we have made 11 new recommendations in this area of concern, 3 of which were made since our 2017 report was issued. For example, in April 2018 we reported that, while the department has recommended training for patient advocates—staff members who receive and document feedback from veterans or their representatives—it has not developed an approach to routinely assess their training needs or monitored training completion. The failure to conduct these activities increases VA’s risk that staff may not be adequately trained to advocate on behalf of veterans. As a result, we recommended VHA develop an approach to routinely assess training needs and monitor training completion. VA concurred with our recommendations, which remain open.

Unclear resource needs and allocation priorities. Since our 2017 High-Risk Report, ratings for one criterion improved and four remain unchanged for this area of concern as of March 2019.

Leadership commitment: partially met. In December 2017, a VA Chief Financial Officer (CFO) was confirmed after the department spent over 2.5 years under an interim CFO. In addition, VA is in the process of establishing a new office to estimate workforce resource requirements.

Capacity: not met. VA has established functions intended to inform cost analyses of major VA initiatives, including a new financial management process to replace its outdated financial systems. However, it is unclear in its action plan the extent to which VA has identified the resources needed to establish and maintain these functions.

Action plan: partially met. In March 2019, the rating for this criterion improved to partially met. Since our 2017 High-Risk Report, VA conducted a root cause analysis of this area of concern. However, VA’s action plan lacks metrics for monitoring progress and does not include all of VA’s ongoing actions, such as efforts to assess current and future regional demand for veterans’ health care services.

Monitoring: not met. Since VA’s action plan lacks specific metrics and mechanisms for assessing and reporting progress, it is not clear how VA is monitoring its progress.

Demonstrating progress: not met. Our work continues to indicate VA is not yet able to show progress in this area. Since its 2015 designation, we have made 16 new recommendations in this area of concern, 10 of which were made since our 2017 report. For example: In May 2017, we reported identifying several limitations with VA’s clinical productivity metrics and statistical models for tracking clinical efficiency; this limits VA’s ability to assess whether resources are being used effectively to serve veterans. Specifically, we found that productivity metrics may not account for all providers or clinical services, reflect the intensity of clinical workload, and reflect providers’ clinical staffing levels. Additionally, we found that efficiency models may also be adversely affected by inaccurate workload and staffing data. As a result, VA cannot systematically identify best practices to address low productivity and inefficiency as well as determine the factors VA medical centers commonly identify as contributing to low productivity and inefficiency.

We made four recommendations to address these findings; three of which VA implemented in the spring of 2018 by improving productivity metrics and staffing and workload data. To implement the remaining recommendation, VA should establish a process to oversee medical centers’ plans for addressing low clinical productivity and inefficiency.

In August 2018 we reported that VA medical centers face challenges operating their Sterile Processing Services programs— notably, addressing workforce needs, such as lengthy hiring time frames and limited pay and professional growth potential. VHA’s Sterile Processing Services workforce challenges pose a potential risk to VA medical centers’ ability to ensure access to sterilized medical equipment. Until VHA examines these workforce needs, VHA won’t know whether or to what extent the reported challenges adversely affect VA medical centers’ ability to effectively operate their Sterile Processing Services programs and ensure access to safe care for veterans.

We recommended that VA examine workforce needs and take action based on this assessment, as appropriate. VA concurred with this recommendation, which remains open.

VA Acquisition Management Was Added to GAO’s High-Risk List in 2019

In light of numerous contracting challenges that we have identified, and given the significant investment in resources to fulfill its critical mission of serving veterans, we added VA acquisition management as a new high- risk area in 2019. VA has one of the most significant acquisition functions in the federal government, both in dollar amount of obligations and number of contract actions. Specifically, about a third of VA’s discretionary budget in fiscal year 2018, or about $27 billion, has been used to contract for goods and services.

We have identified challenges in the following areas of concern related to VA’s acquisition management: (1) outdated acquisition regulations and policies; (2) lack of an effective medical supplies procurement strategy; (3) inadequate acquisition training; (4) contracting officer workload challenges; (5) lack of reliable data systems; (6) limited contract oversight and incomplete contract file documentation; and (7) leadership instability.

Outdated acquisition regulations and policies. VA’s procurement policies have historically been outdated, disjointed, and difficult for contracting officers to use. In September 2016, we reported that (1) the acquisition regulations contracting officers currently follow have not been fully updated since 2008 and (2) VA had been working on completing a comprehensive revision of its acquisition regulations since 2011.

VA’s delay in updating this fundamental source of policy has impeded the ability of contracting officers to effectively carry out their duties. We recommended in September 2016 that VA identify measures to expedite the revision of its acquisition regulations and clarify what policies are currently in effect. VA concurred with this priority recommendation and, as of January 2019, had rescinded or re-issued updated policy memoranda for all information letters, which VA previously used to provide guidance that was temporary in nature.

VA has also made some progress in updating its acquisition regulations, but more work remains to be done over the next several years. As of April 2019, VA reports that 15 of the 41 parts in its acquisition regulations update were published as final rules, 10 were issued as proposed rules for public comment, and the remainder are at an earlier stage of the rulemaking process. All parts are scheduled to be out for public comment by March 2020, but the final rules are not expected to be published until April 2021.

Lack of an effective medical supplies procurement strategy. VA’s program for purchasing medical supplies has not been effectively executed, nor is it in line with practices at leading hospitals. To support more efficient purchasing of medical supplies for its 172 medical centers that serve the needs of about 9 million veterans, VA launched the Medical Surgical Prime Vendor-Next Generation (MSPV-NG) program in December 2016. MSPV-NG was part of VA’s overall effort to transform its supply chain and achieve $150 million in cost avoidance.

In November 2017, we reported that VA’s approach to developing its catalog of supplies was rushed and lacked key stakeholder involvement and buy-in. It also relied on establishing non-competitive blanket purchase agreements for the overwhelming majority of products, resulting in low utilization by medical centers. VA had set a target that medical centers would order 40 percent of their supplies from the MSPV-NG catalog, but utilization rates were below this target with a nationwide average utilization rate across medical centers of about 24 percent as of May 2017. This low utilization adversely affected VA’s ability to achieve its cost avoidance goal.

We recommended in November 2017 that VA develop, document, and communicate to stakeholders an overarching strategy for the program. VA concurred with this priority recommendation and is developing strategies to address it. First, in February 2019, VA developed and documented a new, overarching acquisition strategy for its Medical Surgical Prime Vendor (MSPV) program, and has begun the process of communicating it to key stakeholders, including clinical and logistics staff. Further, VA is developing a separate strategy to involve clinicians in developing requirements with plans to complete a pre-pilot of this strategy by September 2019. In response to a congressional request to assess these and other program changes, we recently began a review of VA’s MSPV program.

Inadequate acquisition training. VA acquisition training, at times, has not been comprehensive nor provided to staff that could benefit from it. A 2006 statute required, and a 2016 Supreme Court decision (Kingdomware Technologies, Inc. v. United States) reaffirmed, that VA is to give preference to veteran-owned small businesses when competitively awarding contracts—a program known as Veterans First. In September 2018, we reported that training on VA’s Veterans First policy did not address some of its more challenging aspects. For example, many of the contracting officers we interviewed were uncertain about how to balance the preference for veteran-owned small businesses with fair and reasonable price determinations when lower prices might be found on the open market.

In addition, VA provided several installments of online training sessions on the Veterans First policy to contracting officers but did not make them mandatory. As a result, only 52 percent of VA contacting officers completed the follow-up training by the spring of 2018. We recommended in September 2018 that VA provide more targeted training to contracting officers on how to implement the Veterans First policy, particularly in the area of making fair and reasonable price determinations, and assess whether this training should be designated as mandatory. VA concurred, and in April 2019, VA’s Chief Acquisition Officer (CAO) stated that VA is taking steps to make this training mandatory. VA also reported that its Acquisition Academy will provide Veterans First training to all contracting staff on May 30, 2019.

Contracting officer workload challenges. The majority of our reviews since 2015 have highlighted workload as a contributing factor to the challenges that contracting officers face. Most recently, in September 2018, we reported that about 54 percent of surveyed VA contracting officers said their workload was not reasonable and found that workload stresses have exacerbated the struggles that they face implementing the department’s Veterans First policy.

In addition, in September 2016, we reported that VHA contracting officers processed a large number of small dollar-value actions to support medical center operations, many of which involve emergency procurements of routine items to support immediate patient care. Contracting officers and the department’s Acting CAO told us that these frequent and urgent small-dollar transactions reduce contracting officers’ efficiency and ability to take a strategic view of VHA’s overarching procurement needs. We reported in November 2017 that emergency procurements accounted for approximately 20 percent—$1.9 billion—of VHA’s overall contract actions in fiscal year 2016. Figure 3 shows the percent of VHA contract actions designated as emergencies in fiscal year 2016 by each network contracting office.

We recommended in November 2017 that VHA network contracting offices work with medical centers to identify opportunities to more strategically purchase goods and services frequently purchased on an emergency basis. VA concurred with this recommendation and recently offered to provide us with a demonstration of the supply chain dashboard that VA uses to track items purchased on an emergency basis, which we plan to attend by the end of May 2019. VA also agreed to conduct an analysis of its purchase card spending to identify items that should be purchased through its MSPV program. VA expects to complete this analysis by July 2019. If implemented, this would allow for both greater contracting officer efficiency and cost savings. For example, based on a similar recommendation we made in 2012, VA began more systematically employing strategic sourcing in FY 2013, and in subsequent fiscal years reported about $10 billion in savings over a 5-year period.

Lack of reliable data systems. The lack of accurate data has been a long-standing problem at VA. In September 2016, we reported that VA had not integrated its contract management and accounting systems, resulting in duplicative efforts on the part of contracting officers and increased risk of errors. We and VA’s Inspector General each recommended that VA perform data checks between the two systems. VA concurred with this recommendation and some VA contracting organizations have made efforts to address this risk. Further, VA reported in March 2019, that it plans to adopt a new integrated financial and contract management system, which it plans to install VA-wide over a 9- year period, with the final site receiving the system in 2027.

Limited contract oversight and incomplete contract file documentation. VA has had difficulty ensuring that its contracts are properly monitored and documented. In September 2018, we reported that, although VA obligated $3.9 billion to veteran-owned small businesses in fiscal year 2017, its contracting officers were not effectively monitoring compliance with key aspects of the department’s Veterans First policy, such as limits on subcontracting (which ensure that the goal of the program—to promote opportunities for veteran-owned businesses—is not undermined). In many cases, we found that clauses requiring compliance were not included in the VA’s contracts and orders with veteran businesses because the contracting officers either forgot to include them or were unaware of the requirement.

The contracting officers we spoke with also said that they do not have sufficient time or knowledge to conduct oversight. Through limited reviews, VA has identified a number of violations that would warrant a broader assessment of the fraud risks to the program. We recommended in September 2018 that VA establish a mechanism to ensure that mandatory subcontracting-related clauses be consistently incorporated into set-aside contracts with veteran-owned businesses and that VA conduct a fraud risk assessment for the Veterans First program. VA concurred with these recommendations and is taking steps to implement them. For example, VA reported in April 2019 that it had made modifications to its electronic contract management system to ensure the clauses would be included in set-aside contracts and anticipated completing testing of the modifications in May 2019.

We also reported in September 2016 that a number of VA contract files we reviewed were missing key documents, increasing the risk that key processes and regulations were not followed. We recommended that VA focus its internal compliance reviews to ensure that required contract documents are properly prepared and documented. VA concurred with this recommendation. Since then, VA has made policy changes that revised its processes for compliance reviews of contract documentation. We are currently following up with VA to obtain the results of its compliance reviews to determine if VA has fully implemented this recommendation.

Leadership instability. We have previously reported, most recently in September 2018, that procurement leadership instability has made it difficult for the VA to execute and monitor the implementation of key acquisition programs and policies. For example, changes in senior procurement leadership, including the CAO and VHA’s Chief Procurement and Logistics Officer, occurred during the implementation of MSPV-NG and similar instability in leadership affected the MSPV-NG program office itself. Overall, the MSPV-NG program office has had four directors, two of whom served in an acting capacity, since its inception in 2014.

To address this instability, we recommended in November 2017 that VA appoint a non-career employee as the CAO and prioritize the hiring of the MSPV-NG program office’s director position on a permanent basis. VA concurred with these recommendations and implemented them in 2018. Stable leadership should help bring consistent and much needed direction to the MSPV-NG program, but we recently identified other areas within the VA where sustained leadership is also needed. For instance, in September 2018, we reported there have been six Acting Directors within the past 2 and a half years within an oversight office that helps assess whether VA is in compliance with aspects of its Veterans First policy.

Ratings for the VA Disability High-Risk Areas Either Remained Unchanged or Regressed in 2019

We designated improving and modernizing federal disability programs as high risk in 2003. An estimated one in six working-age Americans reported a disability in 2010. Many of these Americans need help finding or retaining employment, or rely on cash benefits if they cannot work. Three of the largest federal disability programs—one run by VA— disbursed about $270 billion in cash benefits to 21 million people with disabilities in fiscal year 2017. However, federal disability programs, including VA’s, struggle to meet their needs. In particular, VA struggles to manage its disability claims workloads, and, when determining whether individuals qualify for disability benefits, VA relies on outdated eligibility criteria.

Managing disability claims workloads. Since our 2017 High-Risk Report, our assessment of ratings for all five criteria remains unchanged for this area of concern for VA as of March 2019.

Leadership commitment: met. VA has maintained leadership focus on managing initial disability claims and appeals workloads through various initiatives to improve benefits processing and reduce backlogs. Enhancing and modernizing VA’s disability claims and appeals processes are goals in its 2018–2024 strategic plan.

Capacity: partially met. VA has continued building the capacity to process initial disability claims, such as using an electronic system to distribute claims ready for decisions to available staff. On appeals, VA is reforming its process, onboarding hundreds of new staff, and implementing new technology. However, as we reported in March 2018, VA’s appeals plan does not provide reasonable assurance that it will have the capacity to implement the new process and manage risks. VA agreed with our recommendation to better assess risks associated with appeals reform and took some steps to address risks, such as limited testing of the new process. However, as of April 2019 VA has not fully addressed this recommendation. For example, VA has not developed plans to fully address risks, such as veterans choosing more resource-intensive options at higher rates than expected.

Action plan: partially met. VA continues to implement plans to reduce the initial disability claims backlog. For appeals reform, VA submitted its appeals plan in November 2017 and provided several progress reports throughout 2018. In March 2018, we reported that VA’s plan for implementing a new disability appeals process did not explain how VA would assess the new process compared to the legacy process, and did not fully address risks associated with implementing a new process.

We made two recommendations to improve VA’s disability benefit appeals process, including that VA (1) clearly articulate in its appeals plan how it will monitor and assess the new appeals process compared to the legacy process, and (2) ensure that its appeals plan more fully addresses related risks, given the uncertainties associated with implementing a new process. As of April 2019, VA has taken actions to address our recommendations, although key steps remain. For example, VA has not fully articulated detailed steps and time frames for assessing the relative performance of the new and legacy appeals processes. Without this assessment, VA cannot determine the extent to which the new process will achieve final resolution of veterans’ appeals sooner than the legacy process.

Monitoring: partially met. VA monitors the timeliness of initial disability claims and legacy appeals, and has set timeliness goals for some, but not all, of the appeal options under the new process. VA’s plans also signal how it intends to monitor the allocation of staff for concurrent workloads in its legacy and new appeals processes. However, as of April 2019, VA has yet to specify a complete set of balanced goals for monitoring the new and legacy appeals processes (including timely and accurate processing of appeals while ensuring veteran satisfaction).

Demonstrated progress: partially met. VA reported it reduced the backlog of initial disability claims from 611,000 in March 2013 to about 81,000 at the end of fiscal year 2018. However, VA’s Inspector General reported in September 2018 that VA overstated its performance by only reporting about 79 percent of the backlog. For appeals, VA addressed some gaps in its plan for implementing appeals reform, in accordance with our 2017 and 2018 recommendations, and has prioritized processing of legacy appeals. However, as of September 2018, VA still had a backlog of about 396,000 legacy appeals.

Updating disability benefit eligibility criteria. Since our 2017 High-Risk Report, VA’s ratings for the action plan and monitoring criteria regressed while the other three remain unchanged as of March 2019.

Leadership commitment: met. VA has sustained leadership focus on updating its Veterans Affairs Schedule for Rating Disabilities (VASRD)—used to assign degree of disability and compensation levels for veterans with military service-connected injuries or conditions—to reflect advances in medicine and labor market changes.

Capacity: partially met. In August 2017, VA officials told us that it had taken actions to hire more staff for the regulations updates and leverage outside researchers to evaluate veterans’ loss of earnings in the current economy. However, as of September 2018, the agency was still working to hire these staff. Moreover, VA’s current earnings loss study covers only 8 of over 900 diagnostic codes and 2 of 15 body systems. VA needs to continue its current hiring and earnings loss planning efforts to ensure it has the capacity to comprehensively update the VASRD.

Action plan: partially met. In March 2019, the rating for this criterion declined to partially met. As of April 2019, VA’s efforts to update the VASRD included new plans to conduct earnings loss studies. Veterans Benefits Administration officials stated they completed a study for eight diagnostic codes under two body systems, and the agency is determining whether its current approach for evaluating earnings loss is applicable to updating other diagnostic codes. However, we lowered VA’s prior rating of met to partially met because its latest August 2018 updated plan, issued since our 2017 High-Risk Report, provided limited detail on key planned activities, potentially jeopardizing its third attempt at modernization over the past decade. For example, VA’s plans do not indicate how and when VA will assess the applicability of its current approach, and does not include plans for updating earnings loss information for the remaining diagnostic codes and body systems.

Monitoring: partially met. In March 2019, the rating for this criterion declined to partially met. According to VA officials, VA continues to track its progress toward finishing the medical updates by fiscal year 2020 and has updated its project plan to reflect delayed time frames. However, we lowered VA’s prior rating for this criterion from met to partially met because VA’s plans have changed since our last update, and although it is conducting a study to update earnings loss information for some diagnostic codes and body systems, its plan does not include timetables for monitoring these or future updates to earnings loss information.

Demonstrated progress: partially met. VA reported that as of December 2018, it promulgated final regulations for 6 of 15 body systems, proposed regulations for 2, and is reviewing draft regulations for the remaining 7. However, VA has fallen about 4 years behind in its efforts to fully update the VASRD and has not completed earnings loss updates.

Other Government- Wide High-Risk Areas Have Implications for VA Operations

Several other government-wide high-risk areas include VA and its operations. These areas include (1) improving the management of IT acquisitions and operations, (2) strategic human capital management, (3) managing federal real property, and (3) ensuring the cybersecurity of the nation.

Improving the management of IT acquisitions and operations. The executive branch has undertaken numerous initiatives to better manage the more than $90 billion that is annually invested in IT across the government. However, our work shows that federal IT investments, including those made by VA, too frequently fail or incur cost overruns and schedule slippages while contributing little to mission-related outcomes. Thus, in 2015, we added improving the management of IT acquisitions and operations to the High-Risk List. To address the portion of the high-risk area for which it is responsible, VA should, among other things, implement our past recommendations on improving IT workforce planning practices and establishing action plans to modernize or replace obsolete IT investments.

In August 2018, for example, we found that VA’s policies did not fully address the role of its CIO consistent with federal laws and guidance in the areas of IT workforce, IT strategic plan, IT budgeting, and IT investment management. Until VA fully addresses the role of the CIO in all of its policies, it will be limited in addressing longstanding IT management challenges. We recommended that VA’s IT management policies address the role of the CIO for key responsibilities in the four areas we identified. VA concurred with this recommendation, which remains open.

Strategic human capital management. This area was added to our High-Risk List in 2001 and continues to be at risk today because mission-critical skills gaps both within federal agencies and across the federal workforce are impeding the government from cost-effectively serving the public and achieving results. As of December 2018, VA reported an overall vacancy rate of 11 percent at VHA medical facilities, including vacancies of over 24,000 medical and dental positions and around 900 human resource positions. Also, with 32 percent of the VA workforce eligible to retire in the next 5 fiscal years, VA must address these mission-critical skill gaps and vacancies that we continue to identify in our work.

In December 2016, for example, we found that VHA’s limited human resources capacity combined with weak internal control practices has undermined VHA’s human resources operations and its ability to improve delivery of health care services to veterans. Further, VHA is challenged by inefficiencies in its performance management processes, including the lack of a performance appraisal IT system, which prevents it from identifying trends and opportunities for improvement. VHA can better support medical centers by establishing clear lines of accountability for engagement efforts, collecting and leveraging leading practices, and addressing barriers to improving engagement. We made three recommendations to VA to improve its performance management system. VA partially concurred with these recommendations, which remain open.

Managing federal real property. Since federal real property management was placed on the High-Risk List in 2003, the federal government has given high-level attention to this issue. However, federal agencies, including VA, continue to face long-standing challenges, including (1) effectively disposing of excess and underutilized property, (2) relying too heavily on leasing, (3) collecting reliable real property data for decision making, and (4) protecting federal facilities.

In January 2019, for example, we reported that VA has enhanced its data collection on vacant properties, but the agency does not collect information needed to track and monitor disposal projects at the headquarters level. Without information on the status of disposal projects, VA cannot readily track and monitor its progress and identify areas where facilities’ managers may need additional assistance. As a result, we recommended that VA improve its procedures related to disposal of excess and underutilized property to help local facility managers plan, implement, and execute projects to dispose of those properties. In addition, VA should collect key information on the status of these disposal projects to help manage the process and identify areas where management attention is needed. VA concurred with the three recommendations we made related to these findings, all of which remain open.

Ensuring the cybersecurity of the nation. We have designated information security as a government-wide high-risk area since 1997. We expanded this high-risk area in 2003 to include protection of critical cyber infrastructure and, in 2015, to include protecting the privacy of personally identifiable information. Federal agencies and our nation’s critical infrastructures are dependent on IT systems and electronic data to carry out operations and to process, maintain, and report essential information. The security of these systems and data is vital to public confidence and national security, prosperity, and well- being. Because many of these systems contain vast amounts of personally identifiable information, agencies must protect the confidentiality, integrity, and availability of this information. In addition, they must effectively respond to data breaches and security incidents when they occur.

In May 2016, for example, we found that VA had developed a risk assessment for their selected high-risk systems, but had not always effectively implemented access controls. These control weaknesses included those protecting system boundaries, identifying and authenticating users, authorizing access needed to perform job duties, and auditing and monitoring system activities. Weaknesses also existed in patching known software vulnerabilities and planning for contingencies. An underlying reason for these weaknesses is that the key elements of information security programs had not been fully implemented. VA concurred with all of our five recommendations related to improving its cybersecurity controls. However, two recommendations—which specifically call for the department to conduct security control assessments and develop a continuous monitoring strategy—remain open.

In November 2018, the department’s inspector general reported that VA had made progress in developing, documenting, and distributing policies and procedures to support its security program, but identified IT security as a major management challenge due to the persistence of deficiencies. For example, the inspector general identified significant deficiencies related to access, configuration management, change management, and service continuity. In addition, VA’s financial statement auditor reported deficiencies in the department’s IT security controls as a material weakness for financial reporting purposes. The auditor has reported IT security controls as a material weakness for more than 10 years.

VA’s Transformational Efforts Are Ongoing

Since his confirmation in July 2018, Secretary Wilkie has demonstrated his commitment to addressing the department’s high-risk designations by, among other things, creating an office to direct an integrated approach for high-risk concerns and communicating to VA leaders the importance of addressing our recommendations. Additionally, VA leadership has also encouraged senior leaders to meet with GAO subject matter experts from acquisition, performance, human capital, and financial management, among other areas, to discuss leading practices and VA’s modernization efforts. In addition, senior leaders from GAO and VA meet regularly to identify and address the root causes of high-risk issues, and discuss the status of our recommendations and VA’s efforts to address them.

Fully addressing these issues will require sustained leadership attention on these issues as well as leadership stability—something that VA has not had in recent years. In particular, in the 2 years prior to Secretary Wilkie’s confirmation, VA experienced leadership instability with senior- level vacancies in key positions, including the Under Secretary for Health, CIO, and Deputy Under Secretary for Health for Community Care.

In addition to sustained leadership, VA must develop action plans for addressing the high-risk issues. As noted earlier, VA officials have stated that they are currently working to address our high-risk concerns through the implementation of the VHA Plan for Modernization. The plan, which identifies high-level implementation targets through 2020, provides a framework to address the Secretary’s four priorities: (1) improving training and customer service; (2) implementing the VA MISSION Act and improving veterans’ access to care; (3) connecting the VA’s electronic health records system to the DOD’s to ensure a continuum of care for transitioning service members; and (4) transforming VA’s business systems. As part of this effort, VA is focused on “10 lanes of effort,” including transitioning to the same electronic health record system the DOD is currently deploying, and transforming its business systems— including its human resource management, finance and acquisition management, and supply chain functions—to improve the quality and availability of services at VA medical centers.

In closing, VA has launched several significant efforts to address many of the underlying management challenges it faces, including transforming its electronic health record and financial management systems, updating its medical surgical prime vendor program, and implementing the VA MISSION Act. Any one of these efforts would be a significant undertaking for an agency given their scope, time frames, and costs, and VA is attempting to concurrently implement them. If successful, these efforts could be transformative for VA. Sustained congressional oversight of VA’s efforts will also be needed. We stand ready to support this oversight through continued monitoring of VA’s efforts as it ensures that the modernization efforts integrate and address many of the concerns that led to the designation of various VA areas as high risk.

Chairman Pappas, Ranking Member Bergman, and Members of the Subcommittee, this concludes my statement. I would be pleased to respond to any questions you may have.

GAO Contacts and Staff Acknowledgments

For further information about this statement, please contact Debra A. Draper at (202) 512-7114 or draperd@gao.gov or Sharon M. M. Silas at (202) 512-7114 or silass@gao.gov for VHA health care issues; Shelby S. Oakley at (202) 512-4841 or oakleys@gao.gov for VA acquisition management issues; or Elizabeth H. Curda at (202) 512-7215 or curdae@gao.gov for VA disability claims issues. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Key contributors to this statement were Ann Tynan, Mark Bird, David Bruno, Keith Cunningham, Cathleen Hamann, Lisa Gardner, Steven Lozano, William Reinsberg, Maria Storts, Jamie Whitcomb, Amanda Cherrin (Analyst-in-Charge), Kate Tussey, Jeff Hartnett, and Teague Lyons. Vikki Porter and Jacquelyn Hamilton also contributed to this statement.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.