VA is responsible for providing federal benefits to veterans. Headed by the Secretary of Veterans Affairs, VA operates nationwide programs for health care, financial assistance, and burial benefits. In fiscal year 2007, VA received appropriations of over $77 billion, including over $35 billion for health care and approximately $41.4 billion for other benefits. The Congress appropriated more than $87 billion for VA in fiscal year 2008. VHA is responsible for implementing the VA medical assistance programs. In fiscal year 2007, VHA operated more than 1,200 sites of care, including 155 medical centers, 135 nursing homes, 717 ambulatory care and community-based outpatient clinics, and 209 Readjustment Counseling Centers. VHA health care centers provide a broad range of primary care, specialized care, and related medical and social support services. The number of patients treated increased by 47.4 percent from 3.8 million in 2000 to nearly 5.6 million in 2007 due to an increased number of veterans eligible to receive care. As shown in figure 1, VHA has organized its health care centers under 21 Veterans Integrated Service Networks (VISN), which oversee the operations of the various medical centers and treatment facilities within their assigned geographic areas. During fiscal year 2007, these networks provided more medical services to a greater number of veterans than at any time during VA's long history. VA has used "Estimated Miscellaneous Obligation or Change in Obligation" (VA Form 4-1358) to record estimated obligations for goods and services for over 60 years. According to VA policy, miscellaneous obligations can be used to record obligations against appropriations for the procurement of a variety of goods and services, including fee-based medical, dental, and nursing services; non-VA hospitalization; nursing home care; beneficiary travel; and rent and utilities. The policy states that miscellaneous obligations should be used as obligation control documents when a formal purchase order or authorization is not required, and when necessary to record estimated obligations to be incurred by the subsequent issue of purchase orders. The policy also states that the use of miscellaneous obligations should be kept to an absolute minimum, consistent with sound financial management policies on the control of funds, and should only be used in cases where there was a bona fide need for the goods and services being procured. In September 2006, VA policy for miscellaneous obligations was revised in an attempt to minimize the use of miscellaneous obligations as an obligation control document. The revision states that miscellaneous obligations should not be used as obligation control documents unless the head contracting official for the station has determined that a purchase order or contract will not be required. However, the policy provides that fiscal staff can use miscellaneous obligations as a tracking mechanism for obligations of variable quantity contracts, as well as for public utilities. In January 2008, VA issued interim guidance on the use of miscellaneous obligations; however, the guidance did not apply to the fiscal year 2007 miscellaneous obligations we reviewed. In recent years VHA has attempted to improve its oversight of miscellaneous obligations. For example, VHA's Clinical Logistics Group created the IFCAP system database in April 2006 to analyze the use of miscellaneous obligations agencywide. The database is updated monthly and contains information on the miscellaneous obligations created monthly by the 21 VISN offices and their associated stations. VHA officials are using the IFCAP database to (1) analyze the number and dollar amounts of procurements being done using contracts and purchase cards, and recorded using miscellaneous obligations, and (2) identify the types of goods and services recorded as miscellaneous obligations. Prior to the creation of the IFCAP database, such information on the use of miscellaneous obligations nationwide was not readily available to VHA upper-level management. The creation and processing of miscellaneous obligations (VA Form 4-1358) is documented in IFCAP--a component of VA's Veterans Health Information System and Technology Architecture (VISTA). The miscellaneous obligation request passes through several stages illustrated in figure 2. The IFCAP database shows that in fiscal year 2007 nearly 132,000 miscellaneous obligations, with a total value of nearly $9.8 billion, were created (see table 1). While VA's Central Office had $2.9 billion in miscellaneous obligations during fiscal year 2007, our review focused on the $6.9 billion in miscellaneous obligations used by VHA's 129 stations, located in every VISN throughout the country, for a variety of mission- related activities. (See app. III for a list of the uses of miscellaneous obligations by VISN, and app. IV for a list of the uses of miscellaneous obligations by station). According to available VHA data, VHA used miscellaneous obligations to record estimated obligations of over $6.9 billion for mission-related goods and services. As shown in figure 3, about $3.8 billion (55.1 percent) was for fee-based medical and dental services for veterans, and another $1.4 billion (20.4 percent) was for drugs, medicines, and hospital supplies. The remainder was for, among other things, state veterans homes, transportation of veterans to and from medical centers for treatment, and logistical support and facility maintenance for VHA medical centers nationwide. Other, such as dietetic proviion, operting supplie, clening ervice, nd d processing. Trporttion of peron/thing. Ste home nd homeless vetersupport. Rent, commniction, nd tilitie inclding gas, electricity, wter, ewer, nd phone. Supplie inclding dr, medicine, hopitsupplie, lood prodct, nd prothetic supplie. Service inclding fee-bas phyicin, ning, dentl, hopitliztion , rerch, nd prothetic repir. According to VHA contracting and fiscal service officials, using miscellaneous obligations tends to reduce administrative workload and facilitates the payment for contracted goods and services, including drugs, medicines, and transportation, and for goods and services for which no preexisting contracts exist, such as fee-basis medical and dental services and utilities. VHA officials stated that miscellaneous obligations facilitate the payment for contracted goods and services when the quantities and delivery dates are not known. A miscellaneous obligation can be created for an estimated amount and then modified as specific quantities are needed or specific delivery dates are set. When a purchase order is created, however, the obligated amount cannot be changed without a modification of the purchase order. According to VHA officials, the need to prepare numerous modifications to purchase orders could place an undue burden on the limited contracting personnel available at individual centers and could also require additional work on the part of fiscal services personnel. VHA officials stated that the use of miscellaneous obligations can simplify the procurement process when no preexisting contract or purchase order exists. For example, providing medical care on a fee-basis to veterans outside of VHA medical centers may involve the services of thousands of private physicians nationwide. Attempting to negotiate a separate agreement or contract with each of these individuals would be a difficult task for VHA's contracting staff. Under the policies and procedures in place during fiscal year 2007, VHA centers could use miscellaneous obligations as umbrella authorizations for fee-based medical services performed by a number of different physicians. In effect, in cases for which there is no preexisting contract, the miscellaneous obligation form becomes the record of an obligation. However, use of miscellaneous obligations may also increase the risk of fraud, waste, and abuse. Consequently, mitigating controls must be designed to help compensate for the lack of a negotiated contract. Absent contractual terms, one risk area is the authorized fee schedule for the medical services being provided. In this case, federal regulations call for payments to non-VA physicians for services associated with outpatient and inpatient care provided at non-VA facilities to be the lesser of the amount billed or the amount calculated using the formula developed by the Department of Health and Human Services under Medicare's participating physician fee schedule for the period in which the service is provided. However, we did not verify that VHA officials were properly following the fee schedule. VA policies and procedures were not designed to provide adequate controls over the use of miscellaneous obligations. According to our Standards for Internal Control in the Federal Government, agency management is responsible for developing detailed policies and procedures for internal control suitable for their agency's operations and ensuring that they provide for adequate monitoring by management, segregation of duties, and supporting documentation for the need to acquire specific goods in the quantities purchased. We identified control design flaws in each of these oversight areas, and we confirmed that these weaknesses existed at the three locations where we conducted case studies. Collectively, these control design flaws increase the risk of fraud, waste, and abuse (including employees converting government assets to their own use without detection). New guidance for the use of miscellaneous obligations was released in January 2008 and finalized in May 2008. We reviewed the new guidance and found that while it offered some improvement, it did not fully address the specific control design flaws we identified. Furthermore, VA officials told us that this guidance was not subject to any legal review. Such an analysis is essential to help ensure that the design of policies and procedures comply with all applicable federal appropriations law and internal control standards. We reviewed 42 miscellaneous obligations at the three case study locations and developed illustrative, more detailed information on the extent and nature of these control design flaws. Table 2 summarizes the locations visited, the miscellaneous obligations reviewed at each location, and the extent and nature of control design deficiencies found. To help minimize the use of miscellaneous obligations, VA policy stated that miscellaneous obligations would not be used as obligation control documents unless the contracting authority for a station had determined that purchase orders or contracts would not be required. Furthermore, VA policy required review of miscellaneous obligations by contracting officials to help ensure proper use in accordance with federal acquisition regulations, but did not address the intended extent and nature of these reviews or how the reviews should be documented. Contracting officials were unable to electronically document their review of miscellaneous obligations and no manual documentation procedures had been developed. Our review of 42 miscellaneous obligations prepared at three VHA stations showed that contracting officers were at times familiar with specific miscellaneous obligations at their facilities, but that they had no documented approvals available for review. Furthermore, none of the three sites we visited had procedures in place to document review of the miscellaneous obligations by the appropriate contracting authorities. Effective oversight and review by trained, qualified officials is a key factor in identifying a potential risk for fraud, waste, or abuse. Without control procedures to help ensure that contracting personnel review and approve miscellaneous obligations prior to their creation, VHA is at risk that procurements will not have safeguards established through a contract approach. For example, in our case study at the VA Pittsburgh Medical Center, we found 12 miscellaneous obligations, totaling about $673,000, used to pay for laboratory services provided by the University of Pittsburgh Medical Center (UPMC). The Chief of Acquisition and Materiel Management for the VA Pittsburgh Medical Center stated that she was not aware of the UPMC's laboratory testing service procurements and would review these testing services to determine whether a contract should be established for these procurements. Subsequently, she stated that VISN 4, which includes the VA Pittsburgh Medical Center, was going to revise procedures to procure laboratory testing services through purchase orders backed by reviewed and competitively awarded contracts, instead of funding them through miscellaneous obligations. Another Pittsburgh miscellaneous obligation for about $141,000 was used to fund the procurement of livers for transplant patients. Local officials said that there was a national contract for the services, and that livers were provided at a standardized price of $21,800. However, officials could not provide us with a copy of the contract, nor documentation of the standardized pricing schedule. Therefore, we could not confirm that VHA was properly billed for these services or that the procurement was properly authorized. Furthermore, in the absence of review by contracting officials, controls were not designed to prevent miscellaneous obligations from being used for unauthorized purposes, or for assets that could be readily converted to personal use. Our analysis of the IFCAP database for fiscal year 2007 identified 145 miscellaneous obligations for over $30.2 million that appeared to be used in the procurement of such items as passenger vehicles; furniture and fixtures; office equipment; and medical, dental, and scientific equipment. Although VA's miscellaneous obligation policy did not address this issue, VA officials stated that acquisition of such assets should be done by contracting officials and not through miscellaneous obligations. Without adequate controls to review miscellaneous obligations and prevent them from being used for the acquisition of such assets, it is possible that VHA may be exposing the agency to unnecessary risks by using miscellaneous obligations to fund the acquisitions of goods or services that should have been obtained under contract with conventional controls built in. In January 2008, VHA issued interim guidance effective for all miscellaneous obligations created after January 30, 2008, concerning required procedures for using miscellaneous obligations. The guidance provides that prior to creating a miscellaneous obligation, fiscal service staff are required to check with the contracting activity to ensure that a valid contract is associated with the miscellaneous obligation, except in specific, itemized cases. Under this guidance, the using service is to have the contracting activity determine (1) if a valid procurement authority exists, (2) if a procurement needs to be initiated, and (3) the appropriate method of obligation. Also, this guidance requires that a copy of the head contracting official's approval be kept with a copy of the miscellaneous obligation for future audit purposes. In addition, the guidance provides that the fiscal service may not create a miscellaneous obligation without appropriate information recorded in the purpose, vendor, and contract number fields on the document. The guidance specifically cites a number of invalid uses for miscellaneous obligations, including contract ambulance, lab tests, blood products, and construction, but did not always specify a procurement process to be used for these items. In May 2008, VHA management finalized the interim guidance. This guidance represents a step in the right direction. It includes a manual process for documenting contracting approval of miscellaneous obligations and specifically states that a miscellaneous obligation cannot be created if the purpose, vendor, and contract number fields are incomplete. However, the new guidance does not address the segregation of duties issues we and others have identified and does not establish an oversight mechanism to ensure that control procedures outlined are properly implemented. In our view, VHA has missed an opportunity to obtain an important legal perspective on this matter. According to VA officials, these policies have not been subject to any legal review, which is essential in ensuring that the policies and procedures comply with federal funds control laws and regulations and any other relevant VA policies or procedures dealing with budgetary or procurement matters. For example, such a review would help ensure that the guidance adequately addresses Federal Acquisition Regulation, requiring that no contract shall be entered into unless the contracting officer ensures that all requirements of law, executive orders, regulations, and all other applicable procedures, including clearances and approvals, have been met. In addition, a legal review could help to ensure that this guidance (1) provides that all legal obligations of VA are supported by adequate documentation to meet the requirements of the recording statute 31 U.S.C. SS1501(a) and (2) prevents any individual from committing the government for purchases of supplies, equipment, or services without being delegated contracting authority as a contracting officer, purchase card holder, or a designated representative of a contracting officer. The absence of a legal review to determine the propriety of VA's miscellaneous obligations policies and procedures places VA at risk of not complying with important laws and regulations. Without basic controls in place over billions of dollars in miscellaneous obligations, VA is at significant risk of fraud, waste, and abuse. Effectively designed internal controls serve as the first line of defense for preventing and detecting fraud, and they help ensure that an agency effectively and efficiently meets its missions, goals, and objectives; complies with laws and regulations; and is able to provide reliable financial and other information concerning its programs, operations, and activities. Although miscellaneous obligations can facilitate and streamline the procurement process, they require effectively designed mitigating controls to avoid impairing full accountability and transparency. In the absence of effectively designed key funds and acquisition controls, VA has limited assurance that its use of miscellaneous obligations is kept to a minimum, for bona fide needs, in the correct amounts, and to the correct vendors. Improved controls in the form of detailed policies and procedures, along with a management oversight mechanism, will be critical to reducing the government's risks from VA's use of miscellaneous obligations. In order for VA to reduce the risks associated with the use of miscellaneous obligations, we recommend that the Secretary of Veterans Affairs, in conjunction with VA's Office of General Counsel, develop and implement policies and procedures consistent with federal appropriations law and internal control standards that establish a process for the review of miscellaneous obligations by contracting officials, including requiring appropriate documentation that the review has occurred; segregate duties for (1) creating, approving, and recording miscellaneous obligations; (2) the certification and payment of invoices; and (3) the receipt of the resulting goods or services; document the purposes, vendors, and contract numbers of establish an oversight mechanism to ensure that these control policies and procedures are fully and effectively implemented. We received written comments on a draft of this report from the Deputy Secretary of Veterans Affairs, which are reprinted in appendix II. VA concurred with our recommendations and identified specific actions it plans to take to implement these recommendations. For example, VA commented it plans to include electronic approval requirements of miscellaneous obligations by contracting officials in the financial component of its new accounting system. Also, VA commented it plans to address the segregation of duties issues identified in our report in an upcoming VA Office of Finance Bulletin, and that VA policy now requires documentation of the purpose, vendor, and contract number for all miscellaneous obligations. Finally, VA commented it plans to implement reporting and auditing processes to help ensure that the internal control procedures are properly implemented agencywide. If effectively implemented, these planned actions should enable VHA to substantially resolve the deficiencies pointed out in our report. VA also provided technical comments which we considered and incorporated as appropriate. We are sending copies of this report to other interested congressional committees and to affected federal agencies. Copies of this report will also be made available to others upon request. In addition, this report is available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions regarding this report, please contact me at (202) 512-9095 or at dalykl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix V. In order to determine how VHA used miscellaneous obligations during fiscal year 2007, we obtained and analyzed a copy of VHA's Integrated Funds Distribution, Control Point Activity, Accounting and Procurement (IFCAP) database of miscellaneous obligations for that year. IFCAP is used to create miscellaneous obligations (VA Form 4-1358) at VA, and serves as a feeder system for VA's Financial Management System (FMS)-- the department's financial reporting system of record. According to VA officials, FMS cannot be used to identify the universe of miscellaneous obligations at VHA in fiscal year 2007 because FMS does not identify the procurement method used for transactions (i.e., miscellaneous obligation, purchase card, purchase order). Furthermore, FMS does not capture the contract number, requester, approving official, and obligating official for obligations. However, according to senior agency officials, the IFCAP database is the most complete record of miscellaneous obligations available at VHA and can be used to provide an assessment of how miscellaneous obligations were used during fiscal year 2007. IFCAP's data included information on the appropriation codes, vendors, budget object codes (BOC), date and amount of obligations, obligation numbers, approving officials, and VISN and VHA stations for VHA miscellaneous obligations. We converted the database to a spreadsheet format and sorted the data by VISN, station, and BOC to determine where and how miscellaneous obligations were used in fiscal year 2007 (See app. III and IV.) To determine whether VHA's policies and procedures are designed to provide adequate controls over the use of miscellaneous obligations, we first reviewed VHA's policies and procedures governing the use of miscellaneous obligations at VA. Specifically, we reviewed the VA Controller Policy, MP-4, Part V, Chapter 3, Section A, Paragraph 3A.02 - Estimated Miscellaneous Obligation or Change in Obligation (VA Form 4-1358); the VA Office of Finance Bulletin 06GA1.05, Revision to MP-4, Part V, Chapter 3, Section A, Paragraph 3A.02 - Estimated Miscellaneous Obligation or Change in Obligation (VA Form 4-1358), dated September 29, 2006; VA Interim Guidance on Miscellaneous Obligations, VA Form 1358, dated January 30, 2008; VHA Revised Guidance for Processing of Miscellaneous Obligations, VA Form 1358, dated May 18, 2008; and other VA and VHA directives, policies, and procedures. We also used relevant sections of the Federal Acquisition Regulation (FAR); VA's Acquisition Regulation; appropriations law; and our Standards for Internal Control in the Federal Government in assessing the design of VA's policies and procedures. We met with VA and VHA officials in Washington, D.C., and coordinated with VHA's Office of Inspector General staff to identify any previous audit findings relevant to our audit work. In addition, we interviewed representatives of VA's independent public accounting firm and reviewed copies of their reports. In order to better understand the extent and nature of VA policy and procedure design deficiencies related to miscellaneous obligations, we conducted case studies at three VHA stations in Cheyenne, Wyoming; Kansas City, Missouri; and Pittsburgh, Pennsylvania. The stations in Kansas City and Pittsburgh were selected because they had a high volume of miscellaneous obligation activity, and they were located in different regions of the country. We conducted field work at the Cheyenne, Wyoming, station during the design phase of our review to better understand the extent and nature of miscellaneous obligation control design deficiencies at a small medical center. Inclusion of the Cheyenne facility in our review increased the geographic diversity of our analysis and allowed us to compare the extent and nature of miscellaneous obligation design deficiencies at medical centers in the eastern, midwestern, and western portions of the United States. During the case studies, we met with senior medical center administrative, procurement, and financial management officials to discuss how VA policies and procedures were designed with regard to specific obligations, and assess the control environment design for using miscellaneous obligations at the local level. We discussed how miscellaneous obligations were used as part of the procurement process and the effect of new VHA guidance on medical center operations. We also reviewed the design of local policies and procedures for executing miscellaneous obligations and conducted walkthroughs of the processes. To provide more detailed information on the extent and nature of the control design deficiencies we found at our case study locations, we identified a nongeneralizable sample of obligations for further review at each site. Through data mining techniques, we identified a total of 42 miscellaneous obligations for more detailed examination at our case study sites: 11 from Cheyenne, 17 from Kansas City, and 14 from Pittsburgh. We based our selection on the nature, dollar amount, date, and other identifying characteristics of the obligations. For each miscellaneous obligation selected, we accumulated information on the extent and nature of control design weaknesses in the areas of review and documentation by contracting officials; segregation of duties during the procurement process; and the purpose, timing, and documentation of obligations. Concerning the adequacy of control design with respect to contracting review, we reviewed miscellaneous obligations for evidence of review by contracting officials and, for selected miscellaneous obligations, followed up with contracting officials to discuss contracts in place for miscellaneous obligations, whether review by contracting officials was needed, and when and how this review could occur and be documented. Concerning the control design deficiencies with respect to segregation of duties, we reviewed miscellaneous obligation documents to determine which officials requested, approved, and obligated funds for the original miscellaneous obligations and then which officials certified delivery of goods and services and approved payment. We noted those instances where control design deficiencies permitted one official to perform multiple functions. With respect to control design deficiencies relating to the supporting documentation for the miscellaneous obligations, we reviewed the purpose, vendor, and contract number fields for each obligation. For the purpose field, we assessed whether the required description was adequate to determine the nature, timing, and extent of the goods or services being procured and whether controls provided for an adequate explanation for any estimated miscellaneous obligation amounts. For the vendor and contract number fields, we assessed whether controls were designed to ensure entered information was complete, and we identified those instances where control deficiencies permitted fields to be left blank. Because of time limitations, we did not review VHA's procurement or service authorization processes. In addition, in our case study approach, we were unable to analyze a sufficient number of obligations to allow us to generalize our conclusions to the sites visited, nor to the universe of VHA medical centers. The 42 obligations represented a total of approximately $36.0 million; however, the results cannot be projected to the overall population of miscellaneous obligations in fiscal year 2007. While we found no examples of fraudulent or otherwise improper purchases made by VHA, our work was not specifically designed to identify such cases or estimate their full extent. We assessed the reliability of the IFCAP data provided by (1) performing various tests on required data elements, (2) reviewing related policies and procedures, (3) performing walkthroughs of the system, (4) interviewing VA officials knowledgeable about the data, and (5) tracing selected transactions from source documents to the database. In addition, we verified that totals from the fiscal year 2007 IFCAP database agreed with a method of procurement compliance report provided by VA. We did not reconcile the IFCAP miscellaneous obligations reported to us to FMS--the VA system of record--and published VA financial statements because FMS does not identify the procurement method used for transactions (i.e., miscellaneous obligations, purchase card, purchase order). We determined that the data were sufficiently reliable for the purposes of our report and that the data can be used to provide an assessment of how miscellaneous obligations were used during fiscal year 2007. We conducted this audit from November 2007 through July 2008 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We requested comments on a draft of this report from the Secretary of Veterans Affairs or his designee. We received written comments from the Deputy Secretary of Veterans Affairs, which are reprinted in appendix II. VISNs 13 and 14 were consolidated and designated as VISN 23. Pacific Islands HCS (Honolulu) James E. Van Zandt VA (Altoona) Kay Daly, (202) 512-9095 or dalykl@gao.gov. In addition to the contact named above, Glenn Slocum (Assistant Director), Richard Cambosos, Debra Cottrell, Francine DelVecchio, Daniel Egan, W. Stephen Lowrey, Robert Sharpe, and George Warnock made key contributions to this report.

Summary:
The Veterans Health Administration (VHA) has been using miscellaneous obligations for over 60 years to record estimates of obligations to be incurred at a later time. The large percentage of procurements recorded as miscellaneous obligations in fiscal year 2007 raised questions about whether proper controls were in place over the authorization and use of billions of dollars. GAO was asked to review (1) how VHA used miscellaneous obligations during fiscal year 2007, and (2) whether Department of Veterans Affairs (VA) policies and procedures were designed to provide adequate controls over their authorization and use. GAO obtained and analyzed available VHA data on miscellaneous obligations, reviewed VA policies and procedures, and reviewed a nongeneralizable sample of 42 miscellaneous obligations at three case study locations. VHA recorded over $6.9 billionof miscellaneous obligationsfor the procurement of mission-related goods and services in fiscal year 2007. According to VHA officials, miscellaneous obligations were used to facilitate payment for goods and services when the quantities and delivery dates are not known. According to VHA data, almost $3.8 billion (55.1 percent) of VHA's miscellaneous obligations was for fee-based medical services for veterans and another $1.4 billion (20.4 percent) was for drugs and medicines. The remainder funded, among other things, state homes for the care of disabled veterans, transportation of veterans to and from medical centers for treatment, and logistical support and facility maintenance for VHA medical centers nationwide. GAO's Standards for Internal Control in the Federal Government states that agency management is responsible for developing detailed policies and procedures for internal control suitable for their agency's operations. However, VA policies and procedures were not designed to provide adequate controls over the authorization and use of miscellaneous obligations with respect to oversight by contracting officials, segregation of duties, and supporting documentation for the obligation of funds. Collectively, these control design flaws increase the risk of fraud, waste, and abuse (including employees converting government assets to their own use without detection). These control design flaws were confirmed in our case studies at VHA Medical centers in Pittsburgh, Pennsylvania; Cheyenne, Wyoming; and Kansas City, Missouri. In May 2008, VHA issued revised guidance on required procedures for authorizing and using miscellaneous obligations. GAO reviewed the revised guidance and found that while it offered some improvement, it did not fully address the specific control design flaws GAO identified. Furthermore, according to VA officials, VA's policies governing miscellaneous obligations have not been subject to legal review by VA's Office of General Counsel. Such a review is essential to ensure that policies and procedures comply with applicable federal appropriations law and internal control standards.