To meet property management requirements and provide data for personal property reporting needs, VA field facilities use an inventory accounting system, the Automated Engineering Management System/Medical Equipment Reporting System. The system was originally designed to schedule preventive maintenance. In 1996, the system was expanded to incorporate the agency’s previously separate property management function, becoming the agency’s official record of inventory for capitalized and noncapitalized equipment. VHA’s Acquisition and Materiel Management (A&MM) service maintains the property management portion of the system while Engineering Services operates the property maintenance portion. The property management system includes a detailed listing of the agency’s personal property, providing information that among other things, is (1) a control for the accuracy of property cost information presented in the agency’s financial report, (2) the basis for physical inventories of agency personal property, and (3) the primary control record for accountability over the agency’s personal property. The system is used to prepare bar code labels that are affixed to nonexpendable property acquired by VHA to identify items as VHA property and to provide for efficient physical inventories using portable bar code readers. The property management software has been updated occasionally to incorporate, for example, the addition of a disposal date capability and changes in the agency’s cost thresholds for property accountability and capitalization. A VHA official told us that once a property item is entered in the system’s database, a system application control retains the record, even after disposal of the item. Pharmaceutical manufacturers allow VA a credit for certain drugs that are returned. Each manufacturer establishes its own criteria for issuing credit, which can change at any time and differ among a single manufacturer’s products. The differing criteria can include such attributes as units of packaging and length of time between the return date and the expiration date. Some drugs are not returnable and must be destroyed if not used before the expiration date. To obtain available credits with minimal agency resources, VA has arranged contracts with pharmaceutical returns vendors that individual VHA medical facilities may utilize. One hundred forty of VHA’s 160 medical centers use the services of Devos, Ltd., doing business as Guaranteed Returns, to assist them in returning drugs for credit or disposing of nonreturnable drugs in accordance with environmental standards and preparing required paperwork to monitor the movement of narcotic drugs. Guaranteed Returns receives a percentage of credits issued for returnable drugs and a fee based on weight for destruction of nonreturnable drugs. VHA also uses the services of part-time physicians where necessary to alleviate recruitment difficulties or when practicality would not indicate full-time employees. While VA policy states a part-time appointment requires a tour of duty scheduled in advance that normally does not significantly change from one pay period to another, it also provides that a part-time physician whose other responsibilities make adherence to the same schedule every pay period impractical may have an adjustable work schedule. Part-time physicians with adjustable tours of duty have a biweekly work requirement consisting of non-core hours that may be adjusted at the request of the employee and core hours that are the days and times when the employee must be present unless granted an appropriate form of leave or excused absence. VA policy requires core hours to be at least 25 percent of total scheduled hours. In April 2003, the OIG reported that part-time physicians were not working the hours established in their VA appointments. A February 2004 follow-up report by the OIG stated that while most part-time physicians were on duty as required, 8 percent of the part-time physicians tested were not on duty or on approved leave or authorized absence as scheduled. To gain an understanding of VHA’s policies and procedures and the related internal controls for the three areas of operation we assessed, to identify key control activities, and to assess the design effectiveness of those controls, we obtained and reviewed VA and VHA directives, handbooks, and other policy guidance and reports issued by VA’s OIG. We also conducted interviews and system walk-throughs with VHA personnel and reviewed our previous reports. To assess the implementation effectiveness of the key control activities for the three areas of operation, we used a case study approach, reviewing transaction documentation at six VA medical centers selected based on size and medical specialization diversity of the location’s part-time physicians and other factors. For personal property management, we discussed requirements and procedures with VHA headquarters and medical center personnel. We performed tests of each medical center’s property records to assess their accuracy. Because our initial review disclosed incomplete and inaccurate information in property database records from each location we visited, we could not design our work to make a statistically based projection on the results of our work. Instead, we tested a nonstatistical selection of 100 items from each location’s property records to verify property existence by locating the item and comparing bar code, serial number, and item description information in the records to the item that we observed. For drugs returned for credit, we discussed requirements and procedures for managing turned-in drugs with personnel at VHA headquarters, the selected medical centers, and a pharmaceutical return contractor. Also, for each of the six medical centers we visited, we obtained and reviewed inventory lists of returned drugs for one contractor pickup of drugs held for return and vendor credit documents. For part-time physician time and attendance, we discussed policy requirements with VHA headquarters personnel and asked medical center staff about the processes for collecting, approving, and recording time and attendance data for part-time physicians. We reviewed time and attendance and corresponding payroll documentation for a judgmental selection of 10 part-time physicians for two biweekly pay periods ending in September 2003 at each of the six medical centers that we visited. We also reviewed medical center procedures for monitoring part-time physician attendance. We reviewed and used as guides, our Standards for Internal Control in the Federal Government and the Internal Control Management and Evaluation Tool. The Comptroller General issued these standards to provide the overall framework for establishing and maintaining internal control. According to these standards, internal control, also referred to as “management control,” comprises the plans, methods, and procedures used to meet the missions, goals, and objectives of an organization. Internal control also serves as the first line of defense in safeguarding assets and preventing and detecting errors and fraud. Our Management and Evaluation Tool provides a systematic, organized, and structured approach to assessing internal control. We performed our work at VA medical centers in Atlanta, Houston, Los Angeles, San Francisco, Tampa, and Washington, D.C.; at VA headquarters; and for drugs returned for credit, at a return contractor’s facility in East Setauket, New York. Our work was performed using a case study approach, and therefore, results of our study cannot be projected beyond the locations and transactions we reviewed. We conducted our review from February 2003 through March 2004 in accordance with U.S. generally accepted government auditing standards. We requested comments on a draft report from the Secretary of Veterans Affairs or his designee. Written comments were received from the Secretary of Veterans Affairs and are reprinted in appendix II. We found that VHA’s property control databases did not provide a complete and accurate record of personal property on hand, compromising effective management and security of agency assets at the six locations we visited. Our tests to determine whether the six medical centers had adequate control over items that were recorded in the property control databases showed that property officials could locate only about one-third of the 600 items we selected. We found that in addition to noncompliance with VA property management requirements, current VA physical inventory and property accountability policies were a major cause of unreliable property records and reduced the opportunity to adequately control personal property at five of the six medical centers we visited. Standards for Internal Control in the Federal Government requires that agencies establish physical control to secure and safeguard vulnerable assets such as equipment, periodically count those assets, and compare the counts to control records. However, through our initial reviews, we found that the property control records for the six locations we visited contained incomplete or incorrect information, such as missing property location or acquisition cost information. The property control records were such that we could not select a statistical sample of test items that would allow our results to be projected to the location’s entire property universe. We proceeded instead with a case study approach, reviewing 100 property items selected from each of the six medical centers’ databases using a nonstatistical selection method. Medical center property officials told us that some of the incorrect or incomplete information in the databases resulted from the incorrect transfer of some information from the previous property control system to the current system in 1996. The lack of accurate property control records hampered medical center property managers’ efforts to effectively safeguard and manage VHA personal property. Property officials located only 201 of 600 items (or about one-third) that we selected from the six medical centers’ property control records to observe and verify. At five locations, VHA officials found from 13 to 39 of the 100 items we tested at each location to determine if they were on hand, while at the sixth medical center, Atlanta, 62 of 100 items were found. The 600 assets we selected to observe were recorded at a total value of $104,220,868 in the property control system. However, because 125 of the 600 test items selected had no acquisition cost entered in the databases, the total cost of our selection could not be determined. Table 1 summarizes the results of our property observation tests at all locations we visited. Each category of items not observed is discussed below. Database errors or omissions represented 156 items that were not observed ostensibly because of insufficient database information. These errors included assets for which the property database did not (1) indicate a disposal date, though property officials told us the item had been disposed of, or (2) did not indicate a location for the property item. One property official said the predecessor property control system had not included a field for a disposal date, and when the program was modified to add that capability, then-existing records were not updated. Other database errors included records that did not accurately identify the asset as building service equipment, which represent items that are essentially part of facility buildings rather than personal property, or entries with one equipment identification number that represented several component items constituting one system. At the Washington medical center, we could not locate three property items, each valued at over $1 million, because of other data entry errors. The explanation for two of the three items was that the assets were on order but had not yet been received. Center officials attributed these errors to property personnel entering these assets into the property control system prior to receipt. For the third item, center officials informed us that one bar code number had been issued for a system of several pill dispensing machines, the components of which were at various locations throughout the medical center and had a combined value over $1 million, rather than bar coding each component and entering it in the property record to provide a means of controlling each item. Inadequate labeling of property items prevented us from verifying the identity of 17 items with a total acquisition cost of $29,463,952 selected from the property records at four medical centers. According to VA officials, nonexpendable property costing $5,000 or more must be bar coded and recorded in the property system. However, none of these 17 items had bar code labels attached, and either serial number labeling was also not attached to the asset or the serial number was not entered in the property records. For example, at the Tampa medical center, five property items totaling $9,996,491, including a telephone operating system, two X- ray systems, and two components of an X-ray system, were inadequately labeled. Although items that we observed matched the general description and location indicated by the property records for these items, we were unable to specifically verify their identity because bar codes had not been placed on the items and serial number information could not be compared between the property records and the physical items. When both bar code and serial number information cannot be compared between the property records and the property item, the physical inventory process is impaired and property accountability is compromised. Under these circumstances, even the most effective physical inventory procedure cannot provide the requisite assurance that assets are controlled adequately. Forty-two mobile or portable items, such as a wheelchair, adjustable bed, and Intensive Care Unit module, also could not be located. Officials stated that these items are moved from one location to another within the medical centers to meet patients’ needs. At the Houston medical center, from our selection of 100 items, property officials were unable to locate 13 portable assets, totaling $19,997, before the end of our visit. Some of these items included patient beds, patient feeding pumps, and a portable defibrillator. Regarding the remaining 184 items, property officials at the six medical centers could neither locate them at the time of our visits nor provide documentation supporting the disposal, loan, or loss of the items, or otherwise explain why they were not found. A 1997 addition to VA’s Handbook 7127, “Materiel Management Procedures,” established a $5,000 threshold for property that must be inventoried. The handbook stated that it is a local decision to maintain inventory on "other" nonexpendable equipment not capitalized or accounted for and also required accountability for sensitive property regardless of cost. Referring to the inventory provisions, A&MM staff at four of the six locations we visited told us they were only accountable for property items costing $5,000 or more and items in the four categories of sensitive assets specifically identified by VA policy: handguns, ammunition, canines, and automobiles. By ignoring VA’s general requirement to account for sensitive property regardless of cost, property managers at those locations did not keep the property control database current for most items costing less than $5,000 and lost control of the items not tracked. Medical center property officials at two centers said we should not expect to locate items with a cost lower than $5,000 because they do not inventory these assets. This practice means that some items, such as computers, monitors, and other sensitive equipment, which by their nature are subject to theft, loss, or conversion to personal use, are not inventoried or tracked. Of the 184 items that were neither found nor had plausible explanations for not being found, over half (95) were sensitive assets. Table 2 shows the nature of these 95 sensitive items categorized as personal computers, laptop computers, scanners, printers, monitors, facsimile or copier machines, and videocassette recorders. The Information Resources Management department (IRM) at the six medical centers we visited had developed alternative procedures to maintain accountability for computer equipment that cost less than $5,000. However, we found many instances in which these procedures were not used effectively. For example, a separate listing prepared by the Los Angeles center’s IRM was not used to update the property location information in the property control record, which showed the initial IRM storage room instead of the final location to which computer equipment was assigned. Further, the IRM record was not kept up to date, a factor in IRM personnel being unable to locate 22 of the 30 IRM items we selected for observation. Our standards for internal control require that key duties be divided or segregated among different people to reduce the risk of error or fraud. However, one of the methods for taking physical inventory of property established in VA’s handbook provides that each party responsible for property items will (1) receive a listing of accountable property items charged to him or her according to the property management system; (2) conduct a physical count; and (3) sign and date the listing, certifying the existence of and continuing need for the property for which he or she was responsible. Allowing the party responsible for the custody of property assets to attest to the existence of those same assets is contrary to the segregation of duties standard and compromises the control provided by taking an independent physical inventory. To illustrate the minimal value of such procedures, property officials at two medical centers told us that some service line managers just sign the inventory list without verifying the existence of the equipment. These practices would result in creating or perpetuating property control record errors if listed items had been lost, stolen, loaned, transferred, or otherwise disposed of. VA’s handbook also requires the involvement of A&MM officials in quarterly spot checks to verify inventory accuracy, but A&MM officials at only two of the locations we visited indicated they perform regular spot checks. A&MM staff at the Atlanta medical center told us they conducted periodic inventories of personal property rather than delegating that control function to parties responsible for the property. They also told us that the Atlanta facility considers computer equipment to be sensitive and, therefore, accountable. At this location, we observed 62 of 100 test items compared to from 13 to 39 of the 100 items at each of the other five locations we visited, all of which performed physical inventories primarily by using equipment lists certified by property custodians. Subsequent to our visit, property officials from the San Francisco medical center told us that they had located all equipment items with an acquisition cost of $5,000 or more that we had selected for testing, and officials from the Washington medical center told us they had located 10 additional items that we selected for observation, one of which was over $5,000. However, because we were no longer on site and could not verify the existence of these items, the additional found items are not incorporated in the statistics we present. Agency officials provided us with a copy of proposed revisions to VA’s property policy guidance that address some of the weaknesses we identified. While the draft policy adds 27 specific categories of equipment that would require accountability regardless of cost, including computer equipment, it reduces the frequency of spot checks from quarterly to semiannually and addresses the physical inventory segregation of duties issue only minimally by requiring that 5 percent of inventory be verified by disinterested parties. Internal control over drugs held for return credit, which according to VHA officials is left to the discretion of medical center management, provided no assurance that the six pharmacies we visited were receiving the proper amount of credits for returned drugs. All six of the pharmacies used contractors to return the drugs, and agency officials said that using contractors had increased the amount of credits VA received for returned drugs. However, all six locations lacked information about which drugs qualified for credit, and only one pharmacy inventoried non-narcotic drugs before they were turned over to the contractor. Accordingly, none of the pharmacies had the basic information needed to verify that credits received were correct and complete. We also found that no analytical review of credits for returned drugs, focused on maximizing the amount of credits received, was performed at the location, network, or agency level. In addition, we identified security weaknesses. Non-narcotic drugs held for return without a control listing were stored in unsecured open bins readily accessible to anyone within the pharmacy at each facility except the San Francisco and Tampa medical centers. Standards for Internal Control in the Federal Government states that internal control should provide reasonable assurance that effective and efficient use of the entity’s resources is achieved. VHA officials told us that controls over returned drugs and related credits were left up to pharmacy managers at individual medical centers. However, we found that each of the six medical centers we visited essentially used an honor system for returning drugs to manufacturers for credit, relying on contractors that collected and processed recalled, expired, or deteriorated drugs. The contractors packaged the drugs at the medical centers and shipped them either to the contractors’ processing facilities or, if required by the manufacturers, to the manufacturers’ processing facilities. For drugs shipped to the contractors’ facilities, the contractors (1) determined which drugs were returnable; (2) returned drugs qualified for credit to the manufacturers and destroyed the nonreturnable drugs; and (3) provided the pharmacy an itemized list of drugs collected, and their disposition, and an itemized estimate of credits to be received. The drug manufacturers determined the final amount of credits issued. While reviewing documentation for drugs that were returned by the six medical centers in September 2002, we found none of the pharmacies had determined if they received appropriate credit for the drugs they turned over to the contractor. Further, none of the pharmacies could determine if the credits received were complete or correct because all lacked detailed information about which drugs the manufacturers accepted for credit. In addition, none of the medical centers except Tampa maintained lists of non-narcotic drugs turned over to the return drug contractor. Medical center pharmacy staff told us there are over 1,000 drug manufacturers, each with its own policies for returning drugs for credit. For example, one drug manufacturer might require that a drug be returned 30 days prior to its expiration to qualify for credit, another drug manufacturer might allow a credit for a drug 30 days past its expiration, and another might not allow credits at all. Furthermore, a VA pharmaceutical return contractor informed us that the manufacturers frequently change their policies. Consequently, medical center pharmacy managers lacked information that would enable them to determine whether the credits they received for returned drugs were correct. As a result, the pharmacies relied on the contractors’ determination of the type and quantity of drugs that were returnable and relied solely on the drug manufacturers’ determination of the final amount of credits issued for returned drugs. In addition to establishing a return policy for drugs, each drug manufacturer set its own requirements for the process of returning the drugs and issuing credits. Some drug manufacturers allowed the pharmacy’s contractor to process returned drugs and issued a credit through the pharmacy’s prime vendor. Other manufacturers would only accept returned drugs directly from VHA. Our review of the estimated credits for non-narcotic drugs returned in September 2002 showed most were processed through each pharmacy’s prime vendor. Table 3 shows the contractors’ estimated value of credits to be received by the six medical center pharmacies we visited for non-narcotic drugs returned during September 2002. The return contractor informed us that if pharmacies requested, it could provide a report on the actual credits issued through the prime vendor for specific returned drugs. None of the pharmacies we visited indicated they were aware of this capability. Using these reports might facilitate the pharmacies’ reconciliation of credits received with drugs returned. As shown in table 3, analyzing the credits processed through the prime vendor could account for 80 percent or more of estimated credits. Standards for Internal Control in the Federal Government calls for establishing performance measures that facilitate analysis so appropriate actions are taken. None of the six medical centers had established performance measures or any kind of mechanism to oversee credits received for returned drugs. For example, medical center pharmacy managers we interviewed did not review the lists of drugs processed for credit provided by the pharmaceutical return contractor to determine if unusual trends occurred that might indicate an opportunity to increase credits received. Periodic analysis of drugs turned in throughout the year could reveal whether specific drugs were not accepted for credit on a recurring basis. For instance, drugs being consistently turned in too late to receive credit would indicate a need to process the drugs differently. If pharmacy managers reviewed actual returned drugs and credit data and took necessary corrective action to optimize returns, the net cost of pharmaceutical operations might be reduced. For example, at the Los Angeles pharmacy we found that 23 percent, or more than $60,000, of the $274,000 estimated value of drugs returned in September 2002 did not receive a credit because the drug expiration dates exceeded the manufacturers’ requirements. Medical center pharmacy officials stated that it was not cost effective to perform any of these control activities for returned drugs. However, the pharmacies had done no studies or analyses to document this conclusion. In fact, at one pharmacy, we noted that the chief pharmacist was not aware of the value of his pharmacy’s yearly credits from returned drugs. Having initially told us that his pharmacy’s yearly credits from returned drugs were only about $10,000, he subsequently reviewed the return documentation and told us his pharmacy received over $124,000 in returned drug credits for fiscal year 2003. We inquired of VA’s Pharmacy Benefit Management staff whether any agencywide analysis or study had been done to determine the reasons why more returned drugs had not qualified for credit. They stated that they had not undertaken such an analysis but believed credits had greatly increased through the use of a contractor to return drugs to manufacturers. They also told us that under their previous system, the material management staff of each medical center returned the drugs to the manufacturers and credits received for returned drugs had been minimal. Guaranteed Returns, contractor for five of the six medical centers we visited, reported that of the $21.5 million estimated return value of drugs it processed for VHA in fiscal year 2003, VHA received $5.7 million in credits for returned drugs. Without review and analysis of return drug documentation, the pharmacies cannot determine what control procedures would be cost effective. Further, despite the improved results obtained from using pharmaceutical return contractors, without agency oversight of returned drugs and related credits based on established performance measures as called for in our standards for internal control, VHA cannot be reasonably assured that stewardship of agency resources is effective. Standards for Internal Control in the Federal Government states that access to resources should be limited to authorized individuals. We found that at four of the six pharmacies visited, physical control over non- narcotic drugs held for return was lacking. The San Francisco pharmacy stored such drugs in a locked bin and the Tampa facility limited access to a secured area, but the other four locations used open, unsecured bins. Anyone with access to the pharmacy also had access to the drugs. Thefts would be very difficult, if not impossible, to detect because the pharmacies did not maintain lists of the non-narcotic drugs held for return. The drugs were simply deposited in the bin. The lack of physical control over non- narcotic drugs held for return represents a potential lost opportunity to maximize return credits and to reduce the risk of theft or misuse of these drugs. During our review, lapses in security at two of the pharmacies we visited were reported. The VA OIG reported that three employees of the Houston medical center were convicted of conspiring to steal large amounts of non-narcotic pharmaceutical drugs from the pharmacy. These employees had stolen over $1.3 million of drugs over 3 years. At the Washington, D.C., medical center, as discussed in our recent report on VHA personnel screening procedures, we found that one employee of the pharmacy had been convicted for possession of illegal drugs prior to VHA employment. While these incidents may not relate directly to drugs held for return to manufacturers, they indicate the risks involved and underscore the clear need for effective control over these drugs. The combination of weaknesses in record keeping and physical controls over non-narcotic drugs held for return exposed them to potential loss, theft, or unauthorized use. Our review of part-time physician time and attendance documentation for the two pay periods ending in September 2003 showed that scheduled and actual hours worked were not always documented according to policy at the six medical centers we visited. Also, specific hours worked recorded by physicians on their time and attendance reports sometimes differed from information entered in the payroll system. We also found that latitude provided in VHA’s Directive 2003-001, issued in January 2003, on time and attendance of part-time physicians was a factor in the various ways the six locations carried out part-time physician attendance monitoring responsibilities. While newly emphasized policies stressed the importance of this matter, compliance in some cases had been slow to develop and oversight processes varied and were not fully effective. Our standards for internal control state that control activities, such as approvals and authorizations, are integral to an entity’s accountability for stewardship of resources. Consistent with that management control objective, VHA’s January 2003 directive called for specifying work schedules in writing in advance of the biweekly pay period, showing the specific days and hours that part-time physicians were to work, including core hours when employees working adjustable shifts must be present. Our review showed that schedules were not always established in advance of the pay period as required by VHA. For the two pay periods ending in September 2003, our review of records for 10 part-time physicians at each of the six locations we visited revealed that only the Houston medical center had documented preapproved schedules for all physicians whose records we tested. A contributing factor for this weakness was that an official at one location told us part-time physicians with fixed schedules did not require a documented preapproved schedule. Almost one-third of the part-time physician records that we reviewed did not include the required documented schedule. However, all those who had documented schedules also had core hours established as required. Table 4 summarizes the results of our work regarding part-time physician policies and their schedules at the centers we visited. Failure to document schedules can lead to confusion about when a physician should be at work. The VA OIG’s February 2004 report on VA medical center part-time physician time and attendance stated that 15 of 58 part-time physicians who were not present when scheduled during a 1-day test said they had changed their hours without getting written approval. Our internal control standard regarding accurate recording of transactions and events applies to the entire process or life cycle of a transaction or event from initiation and authorization through its final classification in summary records. Our comparison of manually prepared time and attendance records with computerized payroll system timecards indicated no differences between total hours worked and total hours entered in the payroll system for the cases we tested. However, we found that when part- time physicians temporarily modified their approved work schedules, the changes they noted on their forms 4-5631a, used to document, review, and approve actual hours worked, were sometimes not entered in the computerized payroll system. At five of the six medical centers, we compared information shown on the payroll system timecards to the forms 4-5631a that were signed by the part-time physicians, timekeepers, and the physicians’ supervisors. At four of those five medical centers, we noted at least one instance of a difference between the specific days and hours worked shown on a part-time physician’s form 4-5631a and that information shown on the corresponding payroll system timecard. Timekeepers and other medical center officials told us that recording temporary changes for actual time worked in VHA’s computerized payroll system is difficult because the system is inflexible. As a result, if total hours that a part-time physician actually worked during a pay period equaled the total hours scheduled, timekeepers often entered the physician’s scheduled hours into the computerized payroll system rather than the actual hours worked. However, accurate payroll system information about specific hours worked is important to satisfy VHA’s need to document whether part-time physicians fulfill their core hour requirements. Our standards for internal control state that an entity’s documentation of transactions and other significant events must be complete and accurate. At the six medical centers we visited, we found variation in the design and effectiveness of medical center procedures concerning the way supervisors and timekeepers checked and documented daily employee attendance and how facility management periodically monitored employee compliance with time and attendance requirements. VHA’s January 2003 directive on part-time physician time and attendance referred to VA’s underlying policy manual that established requirements for supervisors or timekeepers to have personal knowledge that part-time physicians worked the hours or days shown on their time and attendance forms. Timekeeping procedures that included keeping a record of each physician’s daily attendance throughout a pay period provided greater reliability than those that relied on the physicians’, their timekeepers’, or their supervisors’ memories. With working arrangements of part-time physicians, their supervisors, and timekeepers that vary among the service centers within a medical center, we found that the timekeepers at the medical centers we visited accounted for daily attendance of physicians using a wide variety of procedures. While the Houston medical center established a sign-in procedure for all part-time physicians, the other five medical centers relied primarily on the timekeepers’ observation of physicians’ daily attendance. At those facilities, the procedures often differed among service centers and included activities such as timekeepers making informal notes on their personal calendars or preparing calendar- like worksheets to check off the names of each part-time physician when he or she was observed at the center during a scheduled workday. While each process offered a level of control over time and attendance, they all had limitations and none provided assurance that part-time physicians were on duty during their core hours. For example, on the surface, a sign-in procedure would seem to offer more definitive assurance; however, effectiveness depends on how well the procedure is implemented. On the day we reviewed part-time physician sign-in sheets at the Houston medical center, we noted that only 2 of 15 physicians scheduled to work had signed in. Timekeepers told us they observed 5 other physicians in the facility and 1 had advance approval to attend a lecture. However, the timekeepers also told us 2 other part-time physicians scheduled to work had called in and stated that they were “accounted for,” and the remaining 5 had not reported in or otherwise confirmed their attendance. Houston’s failure to enforce its sign-in procedures for its part-time physicians is an example of compromised control effectiveness that impaired medical center management’s ability to know if part-time physicians worked when scheduled. While VHA’s January 2003 directive identified medical center management’s responsibility for monitoring compliance with part-time physician time and attendance policy, the methodology for implementing that responsibility was left to the discretion of facility management. Some of the methodologies adopted were less effective than others. For example, while the Atlanta medical center service areas checked attendance for 5 percent of part-time physicians one day each month, at the San Francisco center service areas checked attendance of all part-time physicians at least one day per quarter, and its Office of Human Resource Management made random spot checks. In addition to physical observation, other methods used for making these periodic surveys of attendance at the six locations included monitoring doctors logging into the facility’s computer network, monitoring doctors’ notes entered into VHA’s patient records system, and paging doctors to determine if physicians used medical center telephones to respond. The wide variety of part-time physician time and attendance procedures that have been developed by the medical centers we visited reduces VHA management’s level of assurance that controls are effective and agency objectives are being achieved. We believe an opportunity exists for the agency to study the various medical center and service area procedures so that VHA can provide more specific direction about the most effective ways to improve control over part-time physician time and attendance agencywide. The weaknesses in internal control that we identified at the six VA medical centers we visited leave the agency vulnerable to waste, fraud, and abuse. Improving the design and implementation of policies regarding personal property will help improve accountability for agency assets, especially sensitive property. VHA managers performed no analytical oversight of credits for returned drugs, and the six medical centers had no effective control over the amount of credits for drugs returned to manufacturers. Some analysis of drug return transactions would provide management with a basis to determine what control activities would provide an appropriate cost/benefit ratio. Current policies and procedures for monitoring part- time physician time and attendance, if implemented more effectively, may provide reasonable assurance that management’s objectives will be met. In addition, the wide range of physician attendance monitoring procedures developed by the various medical centers and service areas provides an opportunity to improve controls agencywide if their relative effectiveness is studied. While some medical centers have already taken positive steps to improve controls over these areas, appropriate direction from management will spur action agencywide and help reduce vulnerability to waste, fraud, and abuse. We are making the following 17 recommendations to improve the internal controls over the operating areas that were the subject of our work. Some of these recommendations require attention of VA management at the department level, others VHA, and still others VA medical center management. We recommend that the Secretary of Veterans Affairs direct the Assistant Secretary for Management to clarify existing guidance and establish consistent parameters for personal property that is required to be accounted for in the property control records and that is subject to physical inventory to include sensitive property, provide a more comprehensive list of the type of personal property assets that are considered sensitive for accountability purposes, direct that physical inventories of personal property be performed by the A&MM staff or other parties who are independent of those with property custodian responsibilities, and reinforce VA’s requirement to attach bar code labels to agency personal property. To improve accuracy of VA’s time and attendance records for part-time physicians, we recommend that the Secretary of Veterans Affairs direct the Assistant Secretary for Management to coordinate all time and attendance system changes with VHA, in order to ensure that the time and attendance system facilitates entry of actual hours and days worked by part-time physicians into VA’s permanent electronic time and attendance record. To improve oversight of medical center operations, we recommend that the Acting Under Secretary for Health designate a headquarters-level staff office to monitor medical facilities’ credits for returned drugs; review returned drug credits and related pertinent information for VA medical facilities and determine, especially for those with unusual performance patterns, whether there might be additional opportunities for credits; develop procedures to periodically test whether the amount of credits received for returned drugs is correct; implement procedures to periodically test whether the amount of credits that medical centers received for returned drugs is correct; conduct a best practices review of procedures implemented by VA medical centers and service areas to identify those most effective in documenting daily attendance of part-time physicians and periodically monitoring employee compliance with time and attendance requirements; and use the results of the best practices review to provide more definitive policy guidance to improve control effectiveness over part-time physician attendance monitoring. To address the weaknesses noted during our visits to six VA medical centers, we recommend that the Acting Under Secretary for Health require the directors of those medical centers to determine the location or disposition of personal property items not found during our site visits; review property records to identify and correct erroneous or incomplete prepare a running list of all non-narcotic drugs held for return in facility pharmacies as they are removed from current supplies to compare with contractor-prepared lists of returned drugs; improve physical security over non-narcotic drugs held for return in facility pharmacies as they are removed from current supplies; and analyze information regarding drugs returned to manufacturers to identify potential improvements that might increase the amount of credits received, such as improving the timeliness of returning drugs consistently turned in too late to qualify for credit. We also recommend that the Acting Under Secretary for Health determine whether the above recommendations pertaining to the facilities we visited are applicable to all VA medical facilities. VA provided written comments on a draft of this report. In its response, VA agreed with our conclusions and recommendations and reported that it is developing an action plan to implement them. Additionally, VA’s response stated that it is pursuing a number of strategies to improve the processing of expired medications held for credit, the monitoring of part-time physician time and attendance, and the inventory records of all equipment. VA also provided technical clarifications, which we incorporated where appropriate. VA’s written comments are reprinted in appendix II. We are sending copies of this report to the Ranking Minority Member, Subcommittee on Oversight and Investigations, House Committee on Veterans’ Affairs; the Chairman and Ranking Minority Member, House Committee on Veterans’ Affairs; the Chairman and Ranking Minority Member, Senate Committee on Veterans’ Affairs; the Secretary of Veterans Affairs; the Acting Under Secretary for Health, Veterans Health Administration; and other interested parties. We will also make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. Should you or your staff have any questions on matters discussed in this report, please contact me at (202) 512-6906 or by e-mail at williamsm1@gao.gov or Jack Warner, Assistant Director, at (202) 512-4679 or by e-mail at warnerj@gao.gov. Major contributors to this report are acknowledged in appendix III. In addition to those named above, the following individuals made important contributions to this report: Kwabena Ansong, Sharon Byrd, Cary Chappell, Lisa Crye, Fred Evans, Lou Fernheimer, Jeff Isaacs, Julia Matta, Bonnie McEwan, Christina Quattrociocchi, Donell Ries, Alana Stanfield, and Jason Strange. The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to www.gao.gov and select “Subscribe to Updates.”

Summary: The Department of Veterans Affairs (VA) provides health care to veterans through the $27 billion Veterans Health Administration (VHA) medical programs. VHA administers and operates VA's medical system, providing care to nearly 5 million patients in 2003. As of September 2003, VHA operated 160 hospitals, 847 outpatient clinics, 134 nursing homes, 42 domiciliaries, and 73 comprehensive home care programs, including facilities in every state, Puerto Rico, the Philippines, and Guam. VHA is responsible for effective stewardship of the resources provided to it by Congress, which asked GAO to review internal controls in three areas of operation at selected VHA medical centers. GAO conducted a review to assess the effectiveness of control activities over (1) personal property, (2) drugs returned for credit, and (3) part-time physician time and attendance. GAO's review found that six selected VA medical centers lacked a reliable property control database. The property databases for the six medical centers contained incomplete information. As a result, GAO could not select a statistical sample of test items so that results could be projected to each location's entire property universe. Key policies and procedures established by VA to control personal property provided facilities with substantial latitude in conducting physical inventories and maintaining their property management systems, which resulted in reduced property accountability. For example, VA's Materiel Management Procedures handbook allowed the person responsible for custody of VA property to attest to the existence of that property rather than requiring independent verification. Also, personnel at some locations interpreted a policy that established a $5,000 threshold for property that must be inventoried as a license to ignore VA requirements to account for lower cost items that are susceptible to theft or loss, such as personal computers and peripheral equipment. These weak practices, combined with lax implementation, resulted in low levels of accountability and heightened risk of loss. VHA personnel located fewer than half of the 100 items GAO selected at each of five medical centers and 62 of 100 items at the sixth medical center. The process for obtaining credit for recalled, expired, or deteriorated drugs was, in essence, an honor system. Each of the six pharmacies GAO visited used a contractor to return drugs to the manufacturer for credit, but only one of the pharmacies inventoried non-narcotic drugs before they were turned over to the contractor. None of the pharmacies had enough information about which drugs qualified for credit to be able to reconcile the credits they received with the drugs they had turned over to the contractor. There was no agency-level oversight of returned drug information to help identify improvements that might increase the credits that VA receives. At four of the six facilities, non-narcotic drugs held for return were stored in unsecured open bins accessible to anyone in the pharmacy. The combined lack of record keeping and physical controls over non-narcotic drugs held for return exposed them to potential loss, theft, or unauthorized use. Scheduled and actual hours worked by part-time physicians at the six locations GAO visited were not always documented in accordance with a January 2003 VHA directive. Five of the six locations had not prepared written work schedules for all part-time physicians as required. GAO found that latitude provided in the directive resulted in wide variation in procedures used by the six medical centers to verify physician compliance with work schedules. While some timekeepers used informal notes to record daily attendance, one facility required physicians to sign in. However, on the day of GAO's review, only two of 15 scheduled physicians had signed in. Attendance monitoring procedures at the six locations varied in frequency and included monitoring all part-time physicians once per quarter at one location and 5 percent of part-time physicians each month at another.