VA is responsible for providing federal benefits to veterans. Headed by the Secretary of Veterans Affairs, VA operates nationwide programs for health care, financial assistance, and burial benefits. According to VA, in fiscal year 2009 the department received appropriations of almost $97 billion, including over $50 billion in discretionary funding, primarily for health care and approximately $47 billion in mandatory funding, primarily for disability compensation, pensions, and education benefit programs. VA is organized into three administrations to provide health care, financial, and burial benefits to veterans and their families: The Veterans Health Administration (VHA) provides a broad range of primary health care, specialized care, and related medical and social support services through its network of more than 1,200 medical facilities. The Veterans Benefit Administration (VBA) distributes financial benefits to veterans and their families related to compensation and pension, vocational rehabilitation and employment, home loans, life insurance, and education. The National Cemetery Administration (NCA) maintains national cemeteries and provides burial and memorial services to veterans. The Chief Financial Officers (CFO) of the 24 major departments and agencies identified in 31 U.S.C. § 901(b) are required to, among other things, develop and maintain integrated accounting and financial management systems, including financial reporting and internal controls, and to direct, manage, and provide policy guidance and oversight of all agency financial management activities. These CFOs are also required to assist the heads of their agencies with annually preparing and submitting to Congress and the Office of Management and Budget audited financial statements and statements of assurance on the effectiveness of their agencies’ systems of internal control. The Comptroller General’s Standards for Internal Control in the Federal Government (the Green Book) provides that federal agencies should establish policies and procedures to ensure that the findings of audits and other reviews are promptly resolved. In addition, Office of Management and Budget (OMB) Circular No. A-123, Management’s Responsibility for Internal Control, requires management to develop corrective action plans for material weaknesses—identified through management reviews, OIG and GAO reports, program evaluations, and financial statement audits— and periodically assess and report on the progress of those plans. Further, the CFOC A-123 Guidance provides that agencies construct a corrective action planning framework to facilitate plan preparation, accountability, monitoring, and communication. The guidance provides that agency managers are responsible for developing and implementing action plans for taking timely and effective action to correct deficiencies. The CFOC A- 123 Guidance is widely viewed as a “best practices” methodology for executing the requirements of Appendix A of OMB Circular No. A-123. In the independent auditor’s report on VA’s fiscal year 2008 financial statements, the auditor identified the following three material weaknesses: Financial management system functionality—reported since fiscal year 2000, is linked to VA’s outdated legacy financial systems impacting VA’s ability to prepare, process, and analyze financial information that is reliable, timely, and consistent. Legacy system deficiencies necessitated significant manual processing of financial data and a large number of adjustments to the balances in the system, thereby increasing the risk of processing errors and misstatements in the financial statements. IT security controls—also reported as a material weakness since fiscal year 2000, resulted from the lack of effective implementation and enforcement of an agencywide information security program. Security weaknesses in the areas of access control, segregation of duties, change control, and service continuity continued to place VA’s program and financial data at risk. For example, weaknesses in information security controls placed sensitive financial and veterans’ medical and benefit information at risk of inadvertent or deliberate misuse, improper disclosure, theft, or destruction, possibly occurring without detection. Financial management oversight—reported as a material weakness beginning in fiscal year 2005 and as a significant deficiency in fiscal years 2000 through 2004. This weakness stemmed from a number of control deficiencies whose operational causes varied. Common issues included the recording of financial data without sufficient review and monitoring, a lack of human resources with the appropriate skills, and a lack of capacity to effectively process a significant volume of transactions. When aggregated, the independent auditor found that these deficiencies suggested a recurring theme of inadequate or ineffective financial management oversight. To help resolve the financial management system functionality material weakness, modernize the IT environment, and implement an integrated financial management system, VA established the Financial and Logistics Integrated Technology Enterprise (FLITE) program, managed by the FLITE Program Office, to replace its current legacy systems. The FLITE Program involves a multiple-year phased approach comprised of three major components: the Strategic Asset Management (SAM) project, a logistics and asset management system; the Integrated Financial Accounting System (IFAS), which focuses on financial management; and a data warehouse that is intended to assist in financial reporting. As of January 2009, VA planned to complete FLITE implementation in fiscal year 2014. Although VA had eliminated some significant deficiencies in prior years, other deficiencies have emerged that require attention. As a result of its recurring internal control weaknesses in financial reporting, VA continues to be at risk of processing errors and misstatements in VA’s financial reports. The financial management system functionality material weakness, which is linked to VA’s outdated financial systems, consists of seven underlying significant deficiencies. The following four significant deficiencies were newly reported in fiscal year 2008. VBA Benefit Delivery Network (BDN) and Veterans Services Network (VETSNET) had insufficient audit trail documentation for the transfer of data to a data warehouse and the storage of such data, increasing the risk of misstatements in the financial statements and other financial reports. VETSNET lacked data mining capabilities, thereby preventing VA financial managers from analyzing transactions at a level needed to prepare routine reconciliations on billions of dollars in transactions. Automated inventory systems at the Consolidated Mail Order Pharmacy facilities could not provide the data needed to properly record the cost of inventory, resulting in potential misstatements in the financial statements and other financial reports. VA lacked a system to track obligations and purchases by vendors resulting in VA relying on vendors to supply operational sales data on medical center purchases. Three of the seven significant deficiencies were repeat conditions: Inadequate year-end closing procedures for the financial system and related records, reported since fiscal year 2000, created a significant risk of error in the annual financial statements. Business line system integration problems, reported since fiscal year 2004, resulted in inadequate support for amounts recorded in the general ledger, such as VETSNET accounts receivables, and the potential for misstatements in the financial statements and other financial reports. Fixed asset reporting limitations, reported since fiscal year 2007, prohibited VA from readily identifying all current year PP&E additions and reclassifications of work in process. The financial management oversight material weakness, reflecting a recurring theme of inadequate or ineffective financial management oversight, consisted of nine underlying significant deficiencies. The following three were newly reported in fiscal year 2008: Missing records in the mortgage loan portfolio maintained by an outside contractor resulted in unsupported amounts and potential errors in the general ledger. Incorrect formulas for estimating the projected default rate for guaranteed and direct loans in VA’s housing model could lead to material misstatements of estimated costs of guaranteed and direct loans in the financial statements and other financial reports. Incorrect expensing and capitalization of software development costs could result in an understatement of PP&E and an overstatement of operating program costs. Six of the nine significant deficiencies were repeat conditions: A lack of adequate review and follow-up procedures for accrued services payable and undelivered orders, reported since fiscal year 2007, resulted in invalid balances for obligations and accrued services payable and potential misstatements in the financial statements and other financial reports. VA reported a total of $8 billion in undelivered orders in fiscal year 2008. Untimely depreciation, improper recording of disposed assets, discrepancies in estimated useful life of equipment, and other inadequate capitalization and accounting for PP&E, reported since fiscal year 2000, could result in misstated PP&E and related expense accounts. VA reported a $13 billion PP&E balance in fiscal year 2008. Inconsistent methodologies and unsupported estimates for environmental and disposal liabilities, reported since fiscal year 2004, could lead to misstatements in the financial statements. VA reported a $928 million balance in environmental and disposal liabilities in fiscal year 2008. Inadequate review of unbilled receivables and contractual adjustments, reported since fiscal year 2007, could lead to misstatements of account receivable balances. VA reported over $1.7 billion in accounts receivable for fiscal year 2008. Inadequate BDN and VETSNET reconciliations, reported since fiscal year 2007, increased the likelihood that an error in the financial statements will occur and go undetected. BDN and VETSNET processed over $40 billion in compensation, pension, education, and vocational rehabilitation and employment benefits in fiscal year 2008. Inadequate reconciliations of the data input to the compensation and pension actuarial liability model, reported since fiscal year 2007, could result in misstatements in the financial statements. VA reported a $1.4 trillion actuarial liability in fiscal year 2008. In fiscal year 2008, VA reported successfully eliminating two prior significant deficiencies concerning insufficient follow-up of accounts receivable collections and errors in payroll data submissions to the Office of Personnel Management underlying the financial management oversight material weakness, as well as a prior material weakness regarding the retention of computer-generated detail records for benefit payments. VA has established corrective action plans intended to remediate many of its 16 significant deficiencies in the near term independent of FLITE implementation. However, although VA had corrective action plans in place, many of these corrective action plans did not contain the detail needed to provide VA or congressional oversight officials with assurance that the plans had near-term actions that could be effectively implemented on schedule. As shown in the table 1, VA planned to remediate 9 deficiencies in fiscal year 2009, 3 in fiscal year 2010, 3 in fiscal year 2012, and 1 in fiscal year 2014. However, VA lacked documented policies and procedures to ensure the consistent and comprehensive design of these plans, and most of VA’s plans for correcting financial reporting deficiencies in the near term lacked key information suggested in CFOC A- 123 Guidance. Eight of the 13 plans we reviewed lacked key information as recommended by the CFOC A-123 Guidance. As shown in table 2, 5 plans lacked milestone dates for action steps, 1 plan lacked validation activities, and 2 plans lacked both milestone dates and validation activities. In accordance with CFOC A-123 Guidance, agencies should prepare comprehensive corrective action plans that list action steps with related monthly milestone dates to help ensure senior VA officials can monitor progress. Seven of VA’s corrective action plans did not include intermediate milestone dates necessary to gauge whether planned corrective actions are proceeding according to schedule, thus increasing the risk that corrective action plans will not be implemented on schedule. For example, In one plan, VA combined several action steps, needed to rewrite the Consolidated Mail Order Pharmacy inventory management software, into one 2-year milestone period. For example, VA combined developing a statement of work, rewriting the software, and developing an inventory module for each CMOP into one 2-year milestone period. In addition, two other action steps lacked completion dates. Without interim milestones and completion dates, it is more difficult for VA officials to identify whether the necessary activities for remediating weaknesses are occurring and whether they are on schedule. Without such information, VA could miss opportunities to address issues that might hamper timely completion of the remediation. VHA’s plan for addressing the inadequate monitoring and accounting for PP&E only specified the fiscal year in which the tasks were to be completed. The lack of intermediate milestones makes it difficult for senior management to adequately monitor the progress of implementation efforts. Because most action steps only had a fiscal year target date, it was unclear when during the year the steps were to be taken and whether or not they were sequential. In addition, the plan did not include any descriptions or related milestones for two action steps. In accordance with CFOC A-123 Guidance, senior management is responsible for determining when sufficient action has been taken to declare that a significant deficiency or a material weakness has been corrected, and corrective action plans should include activities to validate the resolution of the deficiency. Without such validation measures, it is difficult for VA management to provide assurance that the corrective actions have effectively remediated the deficiency. Three of VA’s corrective action plans did not include activities to validate that the planned actions would resolve the deficiency. For example, the corrective action plan to address deficiencies in VA’s automated inventory systems at its Consolidated Mail Order Pharmacy facilities did not include activities to validate whether action steps were implemented and the desired results achieved. Deficient corrective action plans (discussed previously) and ineffective oversight of corrective action plan implementation have resulted in missed remediation milestones, placing VA at risk of continued errors and misstatements in financial information. As of August 2009, VA had missed milestones in 5 of the 13 corrective action plans to remediate fiscal year 2008 significant deficiencies underlying the financial management system functionality and financial management oversight material weaknesses. Our analysis of corrective action plans for two significant deficiencies— the untimely capitalization of construction projects and inadequate reconciliations related to benefit payments—showed that slipping milestones could jeopardize VA’s completion of these plans by fiscal years 2009 and 2012 respectively, and therefore may impair VA’s ability to obtain the improved data reliability originally envisioned within those time frames. For the plans lacking interim milestones, it is difficult for VA management to monitor progress, identify whether there is any slippage, and take timely steps to keep actions on track. The lack of milestones and the related accountability for meeting targets could also limit incentives for staff to ensure actions are implemented on schedule. In addition, VA lacked documented policies and procedures for overseeing the implementation of corrective action plans to remediate material weaknesses identified in financial statement audits. In January 2009, VA recognized the need to better coordinate these oversight activities and created an office of Financial Process Improvement and Audit Readiness (FPIAR). As shown in table 3, VA missed milestones in 5 of the 13 corrective action plans that we reviewed, and the status of progress in implementing 3 other plans was unknown because they lacked sufficient interim milestones. VA missed milestones related to preparation of detailed procedures for the Fixed Asset Package, PP&E policies and procedures, benefit payment reconciliations, the development of reports to support reconciliations of expense accounts in the actuarial liability model, and year-end closing procedures. An analysis of the status of corrective action plans for two significant deficiencies—the inadequate monitoring and accounting for PP&E and inadequate reconciliations related to benefit payments—provided examples of how missed milestones result in continuing risks of errors in related VA financial reporting. Specifically, VA missed its milestones for the creation of detailed procedures for capitalizing PP&E and automated reconciliations to support veteran benefit payments. Although the PP&E corrective action plan called for procedures related to timely capitalization of PP&E to be developed by March 2009, they had not been issued by August 2009. Failing to capitalize construction projects in a timely manner may lead to misstated financial information if projects are not capitalized in the same fiscal year they are placed in service. In addition, related depreciation expenses may also be misstated as a result of time lags in capitalizing projects. Finally, if projects are not closed out in a timely fashion, VA is unable to determine whether funds are available for use on other construction projects. Our analysis at two VHA medical facilities identified continuing problems in the timely capitalization of PP&E. According to federal accounting standards and VA policy issued by VA’s Assistant Secretary for Management (the VA CFO), construction projects are to be recorded as work in process (WIP) until they are placed in service, at which time the WIP balances are to be transferred to general PP&E. We reviewed the 21 projects at the Albuquerque, New Mexico Medical Center and the 4 projects at the Lyons, New Jersey Medical Center that had been placed into service since the start of fiscal year 2008 and found continuing significant delays in the amount of time it took to close out and capitalize projects after they were placed in service. In Albuquerque, VA fiscal staff told us their undocumented practice was to capitalize projects within 30 days of being placed in service. However, while they had capitalized 11 of 21 projects within 30 days, 6 projects were not capitalized for 30 to 60 days, and 4 projects were not capitalized for more than 120 days after they had been placed into service. At Lyons, VA staff capitalized 3 of 4 projects more than 180 days after they were placed in service. VBA also experienced slipping milestones in remediating the benefit payment reconciliation deficiency. VBA did not perform necessary reconciliations between the BDN and VETSNET systems and VA’s general ledger on a monthly basis prior to March 2008. Lacking such reconciliation VA is at continuing risk of improper reporting of benefit payments. That year, these systems processed over $41.6 billion in benefits payments related to compensation and pension, as well as a portion of education benefit programs as authorized by law. This information is critical to the correct determination of VA’s overall cost of operations. VBA developed a corrective action plan to correct this deficiency that contained 43 separate activities with related milestones, including developing automated reconciliations, documenting processes, and training end users. According to VBA documents and officials, VBA missed and pushed back milestones related to the development of reports supporting veteran education payments and automated reconciliations. For example, as of August 2009, work on the development of detailed reports supporting the Vocational Rehabilitation and Employment education payments was pushed back 5 months from November 2009 to April 2010 and VBA reported slippage ranging from 3 to14 months in the development of various reconciliations supporting Dependent’s Education Benefits. VA lacked policies and procedures for overseeing the design and implementation of corrective action plans to correct financial reporting material weaknesses identified in financial statement audits. Further, VA did not have an agencywide accountability mechanism in place to oversee and coordinate the remediation of the material weaknesses in financial reporting. Rather, VA delegated responsibility for the design, implementation, and oversight of the corrective action plans to the various administrations and offices responsible for the areas in which the deficiencies were identified (e.g., VHA and VBA). Lacking centralized VA- wide guidance, the administrations inconsistently defined the parameters for milestone dates in corrective action plans. For example, VHA corrective action plans provided milestones by fiscal year, while VBA plans often had monthly milestone dates. As a result, VA’s ability to determine the status of corrective action plan implementation and identify and address any slippages was impaired. In contrast to its financial reporting weaknesses, VA had documented policies and procedures to identify and correct its programmatic material weaknesses, specifically those in the areas of accountability and effectiveness over VA programs and operations. These policies and procedures, which could also be applied to the remediation of financial reporting material weaknesses identified through financial statement audits, are outlined in a manual which includes a detailed template for developing corrective action plans that specified parameters for milestone dates and other key information. Further, VA had a Senior Assessment Team (SAT) in place (chaired by the Assistant Secretary for Management and comprised of other senior management representatives from VA and its three administrations) to oversee remediation of programmatic control weaknesses detected through VA’s internal control reviews completed under OMB Circular No. A-123. In January 2009, VA recognized the need to better oversee and coordinate agencywide oversight activities for financial reporting material weaknesses identified through financial statement audits. Specifically, VA recruited a director to head a new office of Financial Process Improvement and Audit Readiness (FPIAR) reporting to the VA Deputy CFO in the Office of Finance under the VA Assistant Secretary for Management. FPIAR was established with responsibility for: coordinating and overseeing comprehensive corrective action plans for VA’s audit-related material weaknesses, in consultation and coordination with VA’s three administrations and applicable staff offices; assisting VA and the three administrations and staff offices in executing and monitoring the corrective action plans; ensuring compliance of VA offices and field stations with VA policies, plans, procedures, and internal controls; and assisting in updating corrective action plans as needed and developing recommendations and actions for ensuring completion of stated objectives and milestones in the event of slippage. In addition, the FPIAR Director’s position description calls for FPIAR to perform analysis and remediation efforts for any comparable internal control deficiencies being resolved as part of VA’s ongoing OMB Circular No. A-123 reviews in concert with work to remediate VA’s audit-related material weaknesses. Integrating VA’s A-123 review process and remediation activities for financial reporting material weaknesses identified in financial statement audits could enhance the efficiency of VA’s corrective actions and the elimination of material weaknesses. As of September 2009, according to FPIAR’s Director, VA had filled three permanent staff positions and hired six full-time contractors to assist VA in addressing a variety of financial reporting issues (e.g., helping address the IT Security Controls material weakness and outstanding issues surrounding the capitalization of software development costs, updating and reformatting corrective action plans, and developing requirements for an interface between VETSNET and VA’s general ledger). The VA Deputy CFO said that as office operations have evolved, VA has decided to hire one or two more permanent staff for the FPIAR and use contractors to fill other positions. He said that contractors can provide VA with the flexibility to address short-term staffing needs as well as the necessary technical expertise to remediate individual significant deficiencies. However, the FPIAR did not have a workforce plan defining the number of staff and expertise needed in the office. In fiscal year 2009, while not included in documented policies and procedures, the FPIAR began practices intended to establish agencywide procedures for oversight of corrective action plans to remediate material weaknesses identified in financial statement audits. For example, the FPIAR Director began participating in monthly SAT meetings chaired by the Assistant Secretary for Management and attended by other senior VA officials including the VHA CFO and VBA CFO. These meetings provide an opportunity for the FPIAR Director to highlight the status of specific corrective actions underway to address financial reporting significant deficiencies requiring the attention of key stakeholders across the agency. Further, the director told us that by the end of calendar year 2009, the FPIAR intends to begin using a corrective action plan template consistent with the CFOC A-123 Guidance to remediate significant deficiencies identified in the fiscal year 2009 financial statement audit. Because VA has developed a corrective action template for addressing A-123 control deficiencies, the FPIAR Director told us she is considering whether to adopt this template for corrective action plans to remediate financial reporting control weaknesses, which could provide efficiencies and help integrate resolution of some deficiencies. VA’s Deputy CFO also told us that oversight by the SAT, combined with the use of the corrective action plan template, will allow for more rigorous oversight of remediation efforts of weaknesses detected in the financial statement audits. VA has had serious, long-standing material weaknesses in financial reporting that could result in significant misstatements in financial information reported to Congress and used by VA to manage its operations. One of the significant deficiencies is not planned for resolution until FLITE is fully implemented, which will not be until 2014. Other deficiencies can be addressed in the near term. While VA has corrective action plans for near-term actions intended to provide more accurate and complete financial data, they often lacked key information. Consequently, VA managers could not readily identify and address slippage in remediation activities, exposing VA to continued risk of errors in financial information and reporting. Immediate actions to provide a rigorous framework for the design and oversight of corrective action plans will be essential to ensuring the timely remediation of internal control weaknesses before FLITE implementation. Well-defined corrective action plans provide a “road map” for remediation activities and facilitate effective oversight by senior VA officials. Continued support from senior VA officials and administration CFOs will also be critical to ensure that key corrective actions are developed and implemented on schedule. To help focus VA’s corrective action plans on more effectively establishing and completing consistent and comprehensive near-term actions, we recommend that the Secretary of VA direct the Assistant Secretary for Management to issue policies and procedures for identifying and reporting on financial audit weaknesses to include: Detailed guidance (such as a set of tools and templates in place to identify and report on programmatic weaknesses) on required corrective action plan elements (including milestones for completion of interim action steps and validation steps). Establishing a VA Secretariat-level agency-wide governance structure for overseeing all OMB Circular No. A-123 and financial statement audit material weakness remediation activities that provides for (1) involving key stakeholders in the remediation process (such as the FPIAR, administration CFO’s, and other senior VA officials); (2) clearly defining stakeholder roles and responsibilities; (3) establishing and implementing strategic workforce planning for FPIAR; and (4) regularly assessing and reporting on the status of corrective action plans and identification of any actions needed to address any slippages of remediation activities. To help ensure the timely and complete capitalization of property, plant, and equipment, we recommend that the Secretary of VA direct the Assistant Secretary for Management to issue procedures on specific actions and identify specific reasonable time frames, such as within 30 days, to implement VA policy to capitalize PP&E projects when they are placed in service. In its written comments, VA generally agreed with our findings and recommendations and identified specific actions it has taken and plans to take to implement these recommendations. In response to our recommendation to provide detailed guidance (such as a set of tools and templates in place to identify and report on programmatic weaknesses) on required corrective action plan elements (including milestones for completion of interim action steps and validation steps), VA stated that the FPIAR has begun integrating its corrective actions for financial audit weaknesses with VA’s OMB Circular No. A-123 processes. VA also said that FPIAR will migrate to a set of corrective action plan tools, templates, and documented procedures in fiscal year 2010. VA partially concurred with our recommendation that VA establish a Secretariat-level agencywide governance structure for OMB Circular No. A-123 and financial statement audit remediation activities. In its comments, VA stated it already established a Senior Assessment Team as the coordinating body for corrective action planning to address control deficiencies identified as a result of OMB Circular No. A-123 reviews and financial statement audits. As discussed in our draft report, we recognized VA has taken action to establish agencywide accountability for oversight of its corrective action plans and has begun to establish related practices. However, these practices had not yet evolved into the rigorous framework needed to effectively ensure timely control weakness remediation. VA stated that its Internal Controls Service is developing a handbook for all stakeholders that will provide detailed guidance for corrective action planning, monitoring, reporting, and validation procedures for all financial statement audit and OMB Circular No. A-123 significant deficiencies and material weaknesses. Also, VA noted that as FPIAR matures, it will continue to define and meet staffing requirements. VA also concurred with our recommendation that VA issue procedures for specific actions and identify reasonable time frames, such as within 30 days, to implement VA policy to capitalize PP&E projects when they are placed in service. VA provided a copy of recently issued procedures which identified specific actions and time frames for the capitalization of PP&E. These procedures provide guidance for monthly communications between engineering staffs, program directors, and the appropriate fiscal activity regarding construction project status, costs, and useful life. The procedures also provide that property should be capitalized no later than the end of the fiscal month following the month that the property is put into use or accepted by VA. If fully and effectively implemented, the guidance should help address the problems we found related to timely capitalization of VA’s PP&E. In its written comments, VA also provided technical comments which we considered and incorporated as appropriate. We are sending copies of this report to other interested congressional committees and to affected federal agencies. In addition, this report is available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions regarding this report, please contact me at (202) 512-9095 or at raglands@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. To determine the nature of the internal control weaknesses identified in the Department of Veterans Affairs (VA) fiscal year 2008 financial audit report and how long they have been outstanding, we obtained and analyzed the financial statement audit reports for fiscal years 2000 to 2008. We summarized available information on the extent and nature of the internal control weaknesses characterized as material weaknesses, as well as the underlying significant deficiencies and identified their evolution over time. We also interviewed VA and Office of Inspector General (OIG) officials and VA’s independent auditor, and reviewed VA documents, prior GAO and OIG reports, and independent auditor workpapers to better understand control deficiencies underlying the material weaknesses. We did not perform independent audit work to test and validate whether the material weaknesses and related significant deficiencies reported by the independent auditor were accurate and complete. To determine whether VA had plans appropriately focused on near-term actions to address financial reporting deficiencies prior to the implementation of its Financial and Logistics Integrated Technology Enterprise (FLITE) system in fiscal year 2014, we analyzed VA’s corrective action plans for remediating significant deficiencies underlying two of the three material weaknesses impacting the reliability of financial information integral for helping inform management decision making— weaknesses in VA’s financial management systems and in its financial management oversight. We interviewed VA officials, VA OIG officials, and independent auditor officials who completed VA’s fiscal year 2008 financial statement audit about near-term actions in VA plans to correct these underlying significant deficiencies. We also analyzed related corrective action plans to remediate 15 of the 16 significant deficiencies underlying two material weaknesses to determine whether they included key information specified in the Chief Financial Officers Council’s (CFOC) Implementation Guide for OMB Circular A-123, Management’s Responsibility for Internal Control – Appendix A, Internal Control over Financial Reporting: action steps with related milestones to provide a “road map” for remediation activities, validation activities to help ensure the proposed actions worked as envisioned, a description of the deficiency to be corrected in sufficient detail to provide clarity and facilitate a common understanding of what needs to be done, and clear delineation of responsible officials for completing the planned actions. We also reviewed VA’s task work plan to remediate the final significant deficiency—the documentation of data transfer from VBA benefit payment systems to a data warehouse—in fiscal year 2009. To determine whether VA had appropriate oversight mechanisms in place to help ensure that near-term corrective action plans to address financial reporting deficiencies are implemented on schedule, we assessed the status of plan implementation in July and August 2009 by identifying whether VA met specific milestones and any slippages that had occurred. We also evaluated the timeliness of implementation of corrective action plans for two significant deficiencies—one to address the inadequate capitalization and accounting for property, plant, and equipment (PP&E) and another to improve reconciliations of benefit payments. One plan was designed and implemented by the Veterans Health Administration, and one by the Veterans Benefit Administration—the two principal VA administrations. We selected these plans for further review because the related deficiencies were not currently being audited or reviewed by other oversight organizations, their associated account balances exceeded a material dollar threshold ($12.7 billion), and the deficiencies contributed to the two material weaknesses that we, VA officials, and VA’s independent auditor considered most integral for developing useful and reliable information for decision making. We reviewed these plans’ implementation in detail to determine the extent to which delays jeopardized VA’s ability to remediate these control deficiencies and provide reliable financial management information to senior VA officials prior to FLITE implementation. In this regard, we reviewed documentation and transactions concerning 25 projects that had been placed in service since the start of fiscal year 2008: 21 projects at the Albuquerque, New Mexico Medical Center and 4 projects at the Lyons, New Jersey Medical Center to determine how long it took VA to capitalize these projects after they had been placed in service. We also reviewed VA’s progress in implementing benefit payment reconciliation procedures in a timely manner. We interviewed VA, OIG, and independent auditor officials about mechanisms in place to oversee the design and implementation of near- term corrective action plans to remediate material financial reporting weaknesses identified through financial statement audits. We reviewed minutes of oversight meetings involving senior VA management to determine how VA monitored the status of remediation efforts related to internal control deficiencies identified through financial statement audits. We also interviewed agency officials about VA’s overall accountability for timely remediation of internal control deficiencies in the near term, and reviewed the status of ongoing VA efforts to staff a new office responsible for coordination and oversight of the development of corrective action plans. We conducted our audit work from November 2008 to November 2009 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. GAO Contact – Susan Ragland, (202) 512-9095 or raglands@gao.gov. Staff Acknowledgments – In addition to the contact named above, Glenn Slocum (Assistant Director), Richard Cambosos, Patrick Frey, W. Stephen Lowrey, David Ramirez, and George Warnock made key contributions to this report.

Summary: In fiscal year 2008, the Department of Veterans Affairs (VA) identified three material internal control weaknesses over financial reporting--financial management system functionality, IT security controls, and financial management oversight. VA is developing a new financial system--FLITE--but full implementation is not expected until 2014. Therefore, the Subcommittee asked us to determine whether VA corrective action plans and oversight are appropriately focused on near-term actions to provide improved financial information. This report addresses (1) the nature of the internal control weaknesses identified in the VA fiscal year 2008 financial audit report and how long they have been outstanding, (2) whether VA had plans appropriately focused on near-term corrective actions, and (3) whether VA had appropriate oversight mechanisms in place to help assure that near-term corrective action plans are implemented on schedule. GAO reviewed corrective action plans for significant deficiencies underlying 2 of the 3 material weaknesses and performed additional analysis for two underlying significant deficiencies. VA's fiscal year 2008 material weaknesses in financial management system functionality and financial management oversight have been reported since fiscal years 2000 and 2005, respectively. These two material weaknesses are comprised of 16 underlying significant financial reporting control deficiencies. Although VA had eliminated some significant deficiencies in prior years, other deficiencies have emerged. As a result, continuing serious deficiencies in financial reporting leave VA at risk of processing errors and misstatements in its financial statements. Although VA had corrective action plans in place intended to result in near-term remediation of the 16 fiscal year 2008 significant control deficiencies, many of these plans did not contain the detail needed to provide VA officials with assurance that the plans could be effectively implemented on schedule. VA lacked documented policies and procedures needed to assure the consistent and comprehensive design of these corrective action plans, and 8 of 13 of VA's plans for correcting its financial reporting deficiencies lacked key information regarding milestones for action steps and validation activities.As of August 2009, VA had missed milestones in 5 of the 13 corrective action plans. For example, our analysis of plans for remediating deficiencies regarding the capitalization of property, plant, and equipment and inadequate benefit payment reconciliations showed that slipping milestones could jeopardize VA's timely completion of these plans, and consequently may impair VA's ability to obtain improved data reliability within the time frames originally envisioned. VA lacked documented policies and procedures for overseeing implementation of the corrective action plans, but recently took steps intended to better coordinate its oversight activities.