According to the IFCAP database, in fiscal year 2007 nearly 132,000 miscellaneous obligations, with a total value of nearly $9.8 billion, were created (see table 1). While VA’s Central Office had $2.9 billion in miscellaneous obligations during fiscal year 2007, our review focused on the $6.9 billion in miscellaneous obligations used by VHA's 129 stations, located in every Veterans Integrated Services Network (VISN) throughout the country, for a variety of mission-related activities. (See app. III for a listing of the use of miscellaneous obligations by VISN, and app. IV for a listing of the use of miscellaneous obligations by station.) According to available VHA data, VHA used record estimated obligations of over $6.9 billion for mission-related goods and services. As shown in figure 1, about $3.8 billion (55.1 percent) was for fee-based medical and dental services for veterans, and another $1.4 billion (20.4 percent) was for drugs, medicines, and hospital supplies. The remainder was for, among other things, state veterans homes, transportation of veterans to and from medical centers for treatment, and miscellaneous obligations to logistical support and facility maintenance for VHA medical centers nationwide. Other, such as dietetic proviion, operting supplie, clening ervice, nd d processing. Trporttion of peron/thing. Ste home nd homeless vetersupport. Rent, commniction, nd tilitie inclding gas, electricity, wter, ewer, nd phone. Supplie inclding dr, medicine, hopitsupplie, lood prodct, nd prothetic supplie. Service inclding fee base phyicin, ning, dentl, hopitliztion , rerch, nd prothetic repir. According to VHA contracting and fiscal service officials, using miscellaneous obligations tends to reduce administrative workload and facilitates the payment for contracted goods and services, such as drugs, medicines, and transportation, and for goods and services for which no pre-existing contracts exist, such as fee-basis medical and dental service and utilities. VHA officials stated that miscellaneous obligations facilitate the payment for contracted goods and services when the quantities and delivery dates are not known. A miscellaneous obligation can be created for an estimated amount and then modified as specific quantities are needed or specific delivery dates are set. When a purchase order is created, however, the obligated amount cannot be changed without a modification of the purchase order. According to VHA officials, the need to prepare num modifications to purchase orders could place an undue burden on the limited contracting personnel available at individual centers and could also require additional work on the part of fiscal services personnel. Our preliminary observations on VA policies and procedures indicate they were not designed to provide adequate controls over the use of miscellaneous obligations. According to GAO’s Standards for Internal Control in the Federal Government, agency management is responsible for developing detailed policies and procedures for internal control suitable for their agency’s operations and ensuring that they provide for adequate monitoring by management, segregation of duties, and supporting documentation for the need to acquire specific goods in the quantities purchased. We identified control design flaws in each of these oversight areas, and we confirmed that these weaknesses existed at the three locations where we conducted case studies. Collectively, these control design flaws increase the risk of fraud, waste, and abuse (including employees converting government assets to their own use without detection). New guidance for the use of miscellaneous obligations was released in January 2008 and finalized in May 2008. We reviewed the new guidance and found that while it offered some improvement, it did not fully address the specific control design flaws we identified. Furthermore, VA officials told us that this guidance was not subject to any legal review. Such an analysis is essential to help ensure that the design of policies and procedures comply with all applicable federal appropriations law and internal control standards. We reviewed 42 miscellaneous obligations at the three case study locations and developed illustrative, more detailed information on the extent and nature of these control design flaws. Table 2 summarizes the locations visited, the miscellaneous obligations reviewed at each location, and the extent and nature of control design deficiencies found. To help minimize the use of miscellaneous obligations, VA policy stated that miscellaneous obligations would not be used as obligation control documents unless the contracting authority for a station had determined that purchase orders or contracts would not be required. Furthermore, VA policy required review of miscellaneous obligations by contracting officials to help ensure proper use in accordance with federal acquisition regulations, but did not address the intended extent and nature of these reviews or how the reviews should be documented. Contracting officials were unable to electronically document their review of miscellaneous obligations and no manual documentation procedures had been developed. Our review of 42 miscellaneous obligations prepared at three VHA stations showed that contracting officers were at times familiar with specific miscellaneous obligations at their facilities, but that they had no documented approvals available for review. Furthermore, none of the three sites we visited had procedures in place to document review of the miscellaneous obligations by the appropriate contracting authorities. Effective oversight and review by trained, qualified officials is a key factor in identifying a potential risk for fraud, waste, or abuse. Without control procedures to help ensure that contracting personnel review and approve miscellaneous obligations prior to their creation, VHA is at risk that procurements will not have safeguards established through a contract approach. For example, in our case study at the VA Pittsburgh Medical Center, we found 12 miscellaneous obligations, totaling about $673,000, used to pay for laboratory services provided by the University of Pittsburgh Medical Center (UPMC). The Chief of Acquisition and Materiel Management for the VA Pittsburgh Medical Center stated that she was not aware of the UPMC's laboratory testing service procurements and would review these testing services to determine whether a contract should be established for these procurements. Subsequently, she stated that VISN 4, which includes the VA Pittsburgh Medical Center, was going to revise procedures to procure laboratory testing services through purchase orders backed by reviewed and competitively awarded contracts, instead of funding them through miscellaneous obligations. Another Pittsburgh miscellaneous obligation for about $141,000 was used to fund the procurement of livers for transplant patients. Local officials said that there was a national contract for the services, and that livers were provided at a standardized price of $21,800. However, officials could not provide us with a copy of the contract, nor documentation of the standardized pricing schedule. Therefore, we could not confirm that VHA was properly billed for these services or that the procurement was properly authorized. Furthermore, in the absence of review by contracting officials, controls were not designed to prevent miscellaneous obligations from being used for unauthorized purposes, or for assets that could be readily converted to personal use. Our analysis of the IFCAP database for fiscal year 2007 identified 145 miscellaneous obligations for over $30.2 million that appeared to be used in the procurement of such items as passenger vehicles; furniture and fixtures; office equipment; and medical, dental, and scientific equipment. Although the VA's miscellaneous obligation policy did not address this issue, VA officials stated that acquisition of such assets should be done by contracting officials and not through miscellaneous obligations. Without adequate controls to review and prevent miscellaneous obligations from being used for the acquisition of such assets, it is possible that the VHA may be exposing the agency to unnecessary risks by using miscellaneous obligations to fund the acquisitions of goods or services that should have been obtained under contract with conventional controls built in. In January 2008, VA issued interim guidance effective for all miscellaneous obligations created after January 30, 2008, concerning required procedures for using miscellaneous obligations. The guidance provides that prior to creating a miscellaneous obligation, fiscal service staff are required to check with the contracting activity to ensure that a valid contract is associated with the miscellaneous obligation, except in specific, itemized cases. Under this guidance, the using service is to have the contracting activity determine (1) if a valid procurement authority exists, (2) if a procurement needs to be initiated, and (3) the appropriate method of obligation. Also, this guidance requires that a copy of the head contracting official’s approval be kept with a copy of the miscellaneous obligation for future audit purposes. In addition, the guidance provides that the fiscal service may not create a miscellaneous obligation without appropriate information recorded in the purpose, vendor, and contract number fields on the document. The guidance specifically cites a number of invalid uses for miscellaneous obligations, including contract ambulance, lab tests, blood products, and construction, but did not always specify a procurement process to be used for these items. In May 2008, VHA management finalized the interim guidance. This guidance represents a step in the right direction. It includes a manual process for documenting contracting approval of miscellaneous obligations and specifically states that a miscellaneous obligation cannot be created if the vendor, contract number, and purpose fields are incomplete. However, the new guidance does not address the segregation of duties issues we and others have identified and does not establish an oversight mechanism to ensure that control procedures outlined are properly implemented. In our view, VHA has missed an opportunity to obtain an important legal perspective on this matter. According to VA officials, these policies have not been subject to any legal review. Such a review is essential in ensuring that the policies and procedures comply with federal funds control laws and regulations and any other relevant VA policies or procedures dealing with budgetary or procurement matters. For example, such a review would help ensure that the guidance adequately addresses Federal Acquisition Regulations, requiring that no contract shall be entered into unless the contracting officer ensures that all requirements of law, executive orders, regulations, and all other applicable procedures, including clearances and approvals, have been met. In addition, a review could help to ensure that this guidance (1) provides that all legal obligations of VA are supported by adequate documentation to meet the requirements of the recording statute 31 U.S.C. §1501(a) and (2) prevents any individual from committing the government for purchases of supplies, equipment, or services without being delegated contracting authority as a contracting officer, purchase card holder, or as a designated representative of a contracting officer. The absence of a legal review to determine the propriety of VA’s miscellaneous obligations policies and procedures places VA at risk of not complying with important laws and regulations. In conclusion, Mr. Chairman, without basic controls in place over billions of dollars in miscellaneous obligations, VA is at significant risk of fraud, waste, and abuse. Effectively designed internal controls serve as the first line of defense for preventing and detecting fraud, and they help ensure that an agency effectively and efficiently meets its missions, goals, and objectives; complies with laws and regulations; and is able to provide reliable financial and other information concerning its programs, operations, and activities. Although miscellaneous obligations can facilitate and streamline the procurement process, they require effectively designed mitigating controls to avoid impairing full accountability and transparency. In the absence of effectively designed key funds and acquisition controls, VA has limited assurance that its use of miscellaneous obligations is kept to a minimum, for bona fide needs, in the correct amount, and to the correct vendor. Improved controls in the form of detailed policies and procedures, along with a management oversight mechanism, will be critical to reducing the government’s risks from VA’s use of miscellaneous obligations. To that end, our draft report includes specific recommendations, including a number of preventive actions that, if effectively implemented, should reduce the risks associated with the use of miscellaneous obligations. We are making recommendations to VA to modify its policies and procedures, in conjunction with VA’s Office of General Counsel, to better ensure adequate oversight of miscellaneous obligations by contracting officials, segregation of duties throughout the process, and sufficient supporting documentation for miscellaneous obligations. Mr. Chairman, this completes my prepared statement. I would be happy to respond to any questions you or other Members of the Subcommittee may have at this time. For more information regarding this testimony, please contact Kay Daly, Acting Director, Financial Management and Assurance, at (202) 512-9095 or dalykl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. In order to determine how VHA used miscellaneous obligations during fiscal year 2007, we obtained and analyzed a copy of VHA’s Integrated Funds Distribution, Control Point Activity, Accounting and Procurement (IFCAP) database of miscellaneous obligations for that year. IFCAP is used to create miscellaneous obligations (VA Form 4-1358) at VA, and serves as a feeder system for VA’s Financial Management System (FMS)— the department’s financial reporting system of record. According to VA officials, FMS cannot be used to identify the universe of miscellaneous obligations at VHA in fiscal year 2007 because FMS does not identify the procurement method used for transactions (i.e., miscellaneous obligations, purchase card, purchase order). Furthermore, FMS does not capture the contract number, requester, approving official, and obligating official for obligations. However, according to senior agency officials, the IFCAP database is the most complete record of miscellaneous obligations available at VHA and can be used to provide an assessment of how miscellaneous obligations were used during fiscal year 2007. IFCAP’s data included information on the appropriation codes, vendors, budget object codes (BOC), date and amount of obligations, obligation numbers, approving officials, and VISN and VHA station for VHA miscellaneous obligations. We converted the database to a spreadsheet format and sorted the data by VISN, station, and BOC to determine where and how miscellaneous obligations were used in fiscal year 2007 (see app. III and IV). To determine whether VHA’s polices and procedures are designed to provide adequate controls over the use of miscellaneous obligations, we first reviewed VHA’s policies and procedures governing the use of miscellaneous obligations at VA. Specifically, we reviewed the VA Controller Policy, MP-4, Part V, Chapter 3, Section A, Paragraph 3A.02 – Estimated Miscellaneous Obligation or Change in Obligation (VA Form 4-1358); the VA Office of Finance Bulletin 06GA1.05, Revision to MP-4, Part V, Chapter 3, Section A, Paragraph 3A.02 – Estimated Miscellaneous Obligation or Change in Obligation (VA Form 4-1358), dated September 29, 2006; VA Interim Guidance on Miscellaneous Obligations, VA Form 1358, dated January 30, 2008; VHA Revised Guidance for Processing of Miscellaneous Obligations, VA Form 1358, dated May 18, 2008; and other VA and VHA directives, policies, and procedures. We also used relevant sections of the Federal Acquisition Regulations (FAR); VA’s Acquisition Regulations; appropriation law; and GAO’s Standards for Internal Control in the Federal Government in assessing the design of VA's policies and procedures, and we met with VA and VHA officials in Washington, D.C., and coordinated with VHA’s Office of Inspector General staff to identify any previous audit findings relevant to our audit work. We also interviewed representatives of VA’s independent public accounting firm and reviewed copies of their reports. In order to better understand the extent and nature of VA policy and procedure design deficiencies related to miscellaneous obligations, we conducted case studies at three VHA stations in Cheyenne, Wyoming; Kansas City, Missouri; and Pittsburgh, Pennsylvania. The stations in Kansas City and Pittsburgh were selected because they had a high volume of miscellaneous obligation activity, and they were located in different regions of the country. We conducted field work at the Cheyenne, Wyoming, station during the design phase of our review to better understand the extent and nature of miscellaneous obligation control design deficiencies at a small medical center. Inclusion of the Cheyenne facility in our review increased the geographic diversity of our analysis and allowed us to compare the extent and nature of miscellaneous obligation design deficiencies at medical centers in the eastern, midwestern, and western portions of the United States. During the case studies, we met with senior medical center administrative, procurement, and financial management officials to discuss how VA policies and procedures were designed with regard to specific obligations, and assess the control environment design for using miscellaneous obligations at the local level. We discussed how miscellaneous obligations were used as part of the procurement process and the effect of new VHA guidance on medical center operations. We also reviewed the design of local policies and procedures for executing miscellaneous obligations and conducted walk-throughs of the processes. To provide more detailed information on the extent and nature of the control design deficiencies we found at our case study locations, we identified a nongeneralizable sample of obligations for further review at each site. Through data mining techniques, we identified a total of 42 miscellaneous obligations for more detailed examination at our case studies: 11 from Cheyenne, 17 from Kansas City, and 14 from Pittsburgh. We based our selection on the nature, dollar amount, date, and other identifying characteristics of the obligations. For each miscellaneous obligation selected, we accumulated information on the extent and nature of control design weaknesses concerning miscellaneous obligations: review and documentation by contracting officials; segregation of duties during the procurement process; and the purpose, timing, and documentation for obligations. Concerning the adequacy of control design with respect to contracting review, we reviewed miscellaneous obligations for evidence of review by contracting officials and, for selected miscellaneous obligations, followed up with contracting officials to discuss contracts in place for miscellaneous obligations, whether review by contracting officials was needed, and when and how this review could occur and be documented. Concerning the control design deficiencies with respect to segregation of duties, we reviewed miscellaneous obligation documents to determine which officials requested, approved, and obligated funds for the original miscellaneous obligations and then which officials certified delivery of goods and services and approved payment. We noted those instances where control design deficiencies permitted one official to perform multiple functions. With respect to control design deficiencies relating to the supporting documentation for the miscellaneous obligations, we reviewed the purpose, vendor, and contract number fields for each obligation. For the purpose field, we assessed whether the required description was adequate to determine the nature, timing, and extent of the goods and/or services being procured and whether controls provided for an adequate explanation for any estimated miscellaneous obligation amounts. For the vendor and contract number fields, we assessed whether controls were designed to ensure entered information was correct, and we identified those instances where control deficiencies permitted fields to be left blank. Because of time limitations, we did not review VHA’s procurement or service authorization processes. In addition, in our case study approach, we were unable to analyze a sufficient number of obligations to allow us to generalize our conclusions to the sites visited, nor to the universe of VHA medical centers. The 42 obligations represented a total of approximately $36.0 million; however, the results cannot be projected to the overall population of miscellaneous obligations in fiscal year 2007. While we found no examples of fraudulent or otherwise improper purchases made by VHA, our work was not specifically designed to identify such cases or estimate its full extent. We assessed the reliability of the IFCAP data provided by (1) performing various testing of required data elements, (2) reviewing related policies and procedures, (3) performing walkthroughs of the system, (4) interviewing VA officials knowledgeable about the data, and (5) tracing selected transactions from source documents to the database. In addition, we verified that totals from the fiscal year 2007 IFCAP database agreed with a method of procurement compliance report provided to Subcommittee staff during a September 7, 2007 briefing. We did not reconcile the IFCAP miscellaneous obligations reported to us to FMS—the VA system of record—and published VA financial statements because FMS does not identify the procurement method used for transactions (i.e., miscellaneous obligations, purchase card, purchase order). We determined that the data were sufficiently reliable for the purposes of our report and that they can be used to provide an assessment of how miscellaneous obligations were used during fiscal year 2007. We briefed VA and VHA headquarter officials, including the Deputy Assistant Secretary for Logistics and Acquisition, as well as VHA officials at the three case study locations, on the details of our audit, including our findings and their implications. During the briefings officials generally agreed with our findings and said that they provided useful insights into problems with the miscellaneous obligation process and corrective actions that could be taken to address them. We conducted this audit from November 2007 through July 2008 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We recently provided our draft report to the Secretary of Veterans Affairs for review and comment. Following this testimony, we plan to issue a report, which will incorporate VA’s comments as appropriate and include recommendations for improving internal controls over miscellaneous obligations. The Department of Veterans Affairs (VA) is responsible for providing federal benefits to veterans. Headed by the Secretary of Veterans Affairs, VA operates nationwide programs for health care, financial assistance, and burial benefits. In fiscal year 2007, VA received appropriations of over $77 billion, including over $35 billion for health care and approximately $41.4 billion for other benefits. The Congress appropriated more than $87 billion for VA in fiscal year 2008. The Veterans Health Administration (VHA) is responsible for implementing the VA medical assistance programs. In fiscal year 2007, VHA operated more than 1,200 sites of care, including 155 medical centers, 135 nursing homes, 717 ambulatory care and community-based outpatient clinics, and 209 Readjustment Counseling Centers. VHA health care centers provide a broad range of primary care, specialized care, and related medical and social support services. The number of patients treated increased by 47.4 percent from 3.8 million in 2000 to nearly 5.6 million in 2007 due to an increased number of veterans eligible to receive care. As shown in figure 2, VHA has organized its health care centers under 21 Veterans Integrated Services Networks (VISN), which oversee the operations of the various medical centers and treatment facilities within their assigned geographic areas. During fiscal year 2007, these networks provided more medical services to a greater number of veterans than at any time during VA’s long history. VA has used “Estimated Miscellaneous Obligation or Change in Obligation” (VA Form 4-1358) to record estimated obligations for goods and services for over 60 years. According to VA policy, miscellaneous obligations can be used to record obligations against appropriations for the procurement of a variety of goods and services, including fee-based medical, dental, and nursing services; non-VA hospitalization; nursing home care; beneficiary travel; rent; utilities; and other purposes. The policy states that miscellaneous obligations should be used as obligation control documents when a formal purchase order or authorization is not required, and when necessary to record estimated obligations to be incurred by the subsequent issue of purchase orders. The policy also states that the use of miscellaneous obligations should be kept to an absolute minimum, consistent with sound financial management policies regarding the control of funds, and should only be used in cases where there was a bona fide need for the goods and services being procured. In September 2006, VA policy for miscellaneous obligations was revised in an attempt to minimize the use of miscellaneous obligations as an obligation control document. The revision states that miscellaneous obligations should not be used as an obligation control document unless the head contracting official for the station has determined that a purchase order or contract will not be required. However, the policy provides that fiscal staff can use miscellaneous obligations as a tracking mechanism for obligations of variable quantity contracts, as well as for public utilities. In January 2008, VA issued interim guidance regarding the use of miscellaneous obligations; however, the guidance did not apply to the fiscal year 2007 miscellaneous obligations we reviewed. In recent years VHA has attempted to improve its oversight of miscellaneous obligations. For example, VHA’s Clinical Logistics Group created the Integrated Funds Distribution, Control Point Activity, Accounting and Procurement (IFCAP) system database in April 2006 to analyze the use of miscellaneous obligations agencywide. The database is updated on a monthly basis and contains information on the miscellaneous obligations created monthly by the 21 VISN offices and their associated stations. VHA officials are using the IFCAP database to (1) analyze the number and dollar amounts of procurements being done using contracts and purchase cards, and recorded using miscellaneous obligations, and (2) identify the types of goods and services recorded as miscellaneous obligations. Prior to the creation of the IFCAP database, such information on the use of the miscellaneous obligations nationwide was not readily available to VHA upper level management. The creation and processing of miscellaneous obligations (VA Form 4- 1358) is documented in IFCAP—a component of VA’s Veterans Health Information System and Technology Architecture (VISTA). The miscellaneous obligation request passes through several stages illustrated in figure 3. Pacific Islands HCS (Honolulu) James E. Van Zandt VA(Altoona) $6,908,827,084 This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The Veterans Health Administration (VHA) has been using miscellaneous obligations for over 60 years to record estimates of obligations to be incurred at a later time. The large percentage of procurements recorded as miscellaneous obligations in fiscal year 2007 raised questions about whether proper controls were in place over the authorization and use of billions of dollars. GAO's testimony provides preliminary findings related to (1) how VHA used miscellaneous obligations during fiscal year 2007, and (2) whether the Department of Veterans' Affairs (VA) policies and procedures were designed to provide adequate controls over their authorization and use. GAO recently provided its related draft report to the Secretary of Veterans Affairs for review and comment and plans to issue its final report as a follow-up to this testimony. GAO obtained and analyzed available VHA data on miscellaneous obligations, reviewed VA policies and procedures, and reviewed a nongeneralizable sample of 42 miscellaneous obligations at three case study locations. GAO's related draft report includes four recommendations to strengthen internal controls governing the authorization and use of miscellaneous obligations, in compliance with applicable federal appropriations law and internal control standards. VHA recorded over $6.9 billion of miscellaneous obligations for the procurement of mission-related goods and services in fiscal year 2007. According to VHA officials, miscellaneous obligations were used to facilitate the payment for goods and services when the quantities and delivery dates are not known. According to VHA data, almost $3.8 billion (55.1 percent) of VHA's miscellaneous obligations was for fee-based medical services for veterans and another $1.4 billion (20.4 percent) was for drugs and medicines. The remainder funded, among other things, state homes for the care of disabled veterans, transportation of veterans to and from medical centers for treatment, and logistical support and facility maintenance for VHA medical centers nationwide. GAO's Standards for Internal Control in the Federal Government states that agency management is responsible for developing detailed policies and procedures for internal control suitable for their agency's operations. However, based on GAO's preliminary results, VA policies and procedures were not designed to provide adequate controls over the authorization and use of miscellaneous obligations with respect to oversight by contracting officials, segregation of duties, and supporting documentation for the obligation of funds. Collectively, these control design flaws increase the risk of fraud, waste, and abuse (including employees converting government assets to their own use without detection). These control design flaws were confirmed in the case studies at Pittsburgh, Cheyenne, and Kansas City. In May 2008, VA issued revised guidance concerning required procedures for authorizing and using miscellaneous obligations. GAO reviewed the revised guidance and found that while it offered some improvement, it did not fully address the specific control design flaws GAO identified. Furthermore, according to VA officials, VA's policies governing miscellaneous obligations have not been subject to legal review by VA's Office of General Counsel. Such a review is essential in ensuring that the policies and procedures comply with applicable federal appropriations law and internal control standards.