VHA provides a broad range of primary and specialized health care, as well as related medical and social support services through a network of more than 1,200 medical facilities. In carrying out its responsibilities, VHA uses “miscellaneous obligations” to obligate (or administratively reserve) estimated funds against appropriations for the procurement of a variety of goods and services when specific quantities and time frames are uncertain. According to VA policy, miscellaneous obligations can be used to record estimated obligations to facilitate the procurement of goods and services, such as fee-based medical and nursing services and beneficiary travel. In fiscal year 2007, VHA recorded over $6.9 billion of miscellaneous obligations for the procurement of mission-related goods and services. According to VHA fiscal year 2007 data, almost $3.8 billion (55.1 percent) of VHA’s miscellaneous obligations was for fee-based medical services and another $1.4 billion (20.4 percent) was for drugs and medicines. The remainder funded, among other things, state homes for the care of disabled veterans, transportation of veterans to and from medical centers for treatment, and logistical support and facility maintenance for VHA medical centers nationwide. In September 2008, we reported that VA policies and procedures were not designed to provide adequate controls over the authorization and use of miscellaneous obligations with respect to (1) oversight by contracting officials, (2) segregation of duties, and (3) supporting documentation for the obligation of funds. Collectively, these flaws increased the risk of fraud, waste, and abuse. Our case studies at three medical centers showed, for example, that VA did not have procedures in place to document any review by contracting officials, and none of the 42 obligations we reviewed had such documented approval. Effective oversight and review by trained, qualified officials is a key factor in helping to ensure that funds are used for their intended purposes. Without control procedures to help ensure that contracting personnel review and approve miscellaneous obligations prior to their creation, VHA is at risk that procurements do not have the necessary safeguards. In addition, our analysis of VA data identified 145 miscellaneous obligations, amounting to over $30.2 million, that appeared to have been used in the procurement of such items as passenger vehicles; furniture and fixtures; office equipment; and medical, dental and scientific equipment. VA officials told us, however, that the acquisition of such assets should be done by contracting rather than through miscellaneous obligations. Our 2008 report also cited inadequate segregation of duties. Federal internal control standards provide that for an effectively designed control system, key duties and responsibilities need to be divided or segregated among different people to reduce the risk of error or fraud. These controls should include separating the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and accepting any acquired assets. In 30 of the 42 obligations reviewed, one official performed two or more of the following functions: requesting, approving, or recording the miscellaneous obligation of funds, or certifying delivery of goods and services and approving payment. In two instances involving employee grievance settlements, one official performed all four of these functions. In 2007, the VA OIG noted a similar problem in its review of alleged mismanagement of funds at the VA Boston Healthcare System. For example, according to OIG officials, they obtained documents showing that a miscellaneous obligation was used to obligate $200,000. This miscellaneous obligation was requested, approved, and obligated by one fiscal official. The OIG concluded that Chief of the Purchasing and Contracting Section and four other contracting officers executed contract modifications outside the scope of original contracts and the Chief of the Fiscal Service allowed the obligation of $5.4 million in expired funds. In response to the OIG recommendations, VA officials notified contracting officers that the practice of placing money on a miscellaneous obligation for use in a subsequent fiscal year to fund new work was a violation of appropriations law, and that money could no longer be “banked” on a miscellaneous obligation absent a contract to back it up. Similarly, an independent public accountant’s July 2007 report found, among other things, that the segregation of duties for VA’s miscellaneous obligation process was inadequate. Without the proper segregation of duties, risk of errors, improper transactions, and fraud increases. Our 2008 case studies also identified a lack of adequate supporting documentation at the three medical centers we visited. Specifically, VA policies and procedures were not sufficiently detailed to require the type of information needed such as purpose, vendor, and contract number that would provide crucial supporting documentation for the obligation. In 8 of 42 instances, we could not determine the nature, timing, or the extent of the goods or services being procured from the description in the purpose field. As a result, we could not confirm that the miscellaneous obligations were for bona fide needs or that the invoices reflected a legitimate use of federal funds. Our report concluded that without basic controls in place over billions of dollars in miscellaneous obligations, VA is at significant risk of fraud, waste, and abuse. In the absence of effectively designed key funds and acquisition controls, VA has limited assurance that its use of miscellaneous obligations is kept to a minimum, for bona fide needs, and in the correct amounts. We made four recommendations, concerning review by contracting officials, segregation of duties, supporting documentation, and oversight mechanisms. These recommendations aimed at reducing the risks associated with the use of miscellaneous obligations. In response to our recommendations, in January of 2009, VA issued Volume II, Chapter 6, of VA Financial Policies and Procedures— Miscellaneous Obligations, which outlines detailed policies and procedures aimed at addressing control deficiencies identified in our September 2008 report. Key aspects of the policies and procedures VA developed in response to our four recommendations included: Review of miscellaneous obligations by contracting officials—The request and approval of miscellaneous obligations are to be reviewed by contracting officials, and the contracting reviews are to be documented. Segregation of duties—No one official is to perform more than one of the following key functions: requesting the miscellaneous obligation; approving the miscellaneous obligation; recording the obligation of funds; or certifying the delivery of goods and services or approving payment. Supporting documentation for miscellaneous obligations—New procedures require providing the purpose, vendor, and contract number fields before processing obligation transactions, including specific references, the period of performance, and the vendor name and address. Oversight mechanism to ensure control policies and procedures are fully and effectively implemented—Each facility is now responsible for performing independent quarterly oversight reviews of the authorization and use of miscellaneous obligations. Further, the results of the independent reviews are to be documented and recommendations tracked by facility officials. The policies and procedures also note that the Office of Financial Policy is to conduct quarterly reviews of VA miscellaneous obligation usage to ensure compliance with the new requirements. As part of its fiscal year 2009 review activities, VA’s Office of Business Oversight (OBO) Management Quality Assurance Service (MQAS) evaluated VA compliance with new VA policies and procedures concerning the use of miscellaneous obligations—Financial Policies and Procedures, Volume II, Chapter 6, Miscellaneous Obligations. According to its executive summary report, the MQAS reviewed 476 miscellaneous obligations at 39 different medical centers, health care systems, and regional offices in fiscal year 2009. The MQAS found 379 instances of noncompliance with the new policies and procedures. Examples include: Inadequate oversight of miscellaneous obligations by contracting officials—Many miscellaneous obligations were not submitted for the required approval by the Head of Contracting Activity. Further, some miscellaneous obligation were used for invalid purposes, including employee tuition, utilities, general post, lab tests, and blood products. Segregation of duties— Many miscellaneous obligations had inadequate segregation of duties concerning the requesting, approving, and recording of miscellaneous obligations, and the certifying receipt of goods and services and approving payment. For example, the MQAS identified 48 instances where two individuals performed all four of these functions. Supporting documentation for miscellaneous obligations—Some miscellaneous obligations also lacked adequate supporting documentation concerning the vendor name, performance period, and the contract number. These noncompliance issues were similar to those we identified in our September 2008 report on VHA miscellaneous obligations. Overall, MQAS found that there was a lack of timely dissemination of the new miscellaneous obligation policy, and issued 34 recommendations to VA facility officials. Fiscal year 2010 facility-level recommendations included the need to develop standard operating procedures for implementing the policy, to provide training for new accounting personnel, to require documentation establishing segregation of duties, and to institute facility-level quarterly reviews. According to the MQAS Associate Director, VHA facilities are in the process of taking corrective actions to address the MQAS recommendations. In November of 2009, we reported that VA had three long-outstanding material weaknesses in internal control over financial reporting identified during VA’s annual financial audits. Financial management oversight—reported as a material weaknesses since fiscal year 2005. This issue was also identified as a significant deficiency in fiscal years 2000 through 2004. This weakness stemmed from a variety of control deficiencies, including the recording of financial data without sufficient review and monitoring, a lack of sufficient human resources with the appropriate skills, and a lack of capacity to effectively process a significant volume of transactions. Financial management system functionality—reported since fiscal year 2000—is linked to VA’s outdated legacy financial systems affecting VA’s ability to prepare, process, and analyze financial information that is timely, reliable, and consistent. Legacy system deficiencies necessitated significant manual processing of financial data and a large number of adjustments to the balances in the system. IT security controls—also reported since fiscal year 2000—resulted from the lack of effective implementation and enforcement of an agencywide information security program. Security weaknesses were identified in the areas of access control, segregation of duties, change control, and service continuity. We also found that while VA had corrective action plans in place intended to result in near-term remediation of its significant deficiencies, many corrective action plans did not contain the detail needed to provide VA officials with assurance that the plans could be effectively implemented on schedule. Eight of the 13 plans we reviewed lacked key information regarding milestones for completion of specific action steps and/or validation activities. Consequently, VA managers could not readily identify and address slippage in remediation activities, exposing VA to continued risk of errors in financial information and reporting. VA recognized the need to better oversee and coordinate agencywide oversight activities for financial reporting material weaknesses, and began to staff a new office responsible for, in part, assisting VA and the three administrations and staff offices in executing and monitoring corrective actions plans. Our report concluded that actions to provide a rigorous framework for the design and oversight of corrective action plans will be essential to ensuring the timely remediation of VA’s internal control weaknesses, and that continued support from senior VA officials and administration CFOs would be critical to ensure that key corrective actions are developed and implemented on schedule. We made three recommendations to help improve corrective action plan development and oversight. VA concurred with the recommendations and said that it took some actions to address the recommendations, including developing a manual with guidance on corrective action planning and monitoring, creating a corrective action plan repository, and establishing a Senior Assessment Team of senior VA officials as the coordinating body for corrective action planning, monitoring, reporting, and validation of deficiencies identified during financial audits. VA’s independent auditor fiscal year 2009 financial audit report included the three material weaknesses that have been reported as deficiencies since 2000. In addition, it also included a new material weakness concerning compensation, pension, and burial liabilities. Furthermore, VA’s reporting indicated remediation timetables for the previously reported material weaknesses appear to be slipping. In the fiscal year 2009 Performance and Accountability Report, VA officials noted that in fiscal year 2009 they had closed 10 of the underlying significant deficiencies reported in fiscal year 2008, but that their timetables had slipped for remediating the IT security controls and financial management oversight material weaknesses to 2010 and 2012, respectively. In addition, milestones for remediating the new material weakness—compensation, pension, and burial liabilities—had yet to be determined. According to the independent auditor, the causes for the fiscal year 2009 material weaknesses related to challenges to implement security policies and procedures, a lack of sufficient personnel with the appropriate knowledge and skills, a significant volume of transactions, and decentralization. These findings are consistent with those we identified in our 2009 report and are all long-standing issues at the VA. The auditor noted that VA did not consistently monitor, identify, and detect control deficiencies. The auditor recommended that VA assess the resource and control challenges associated with operating in a highly decentralized accounting function, and develop an immediate interim review and monitoring plan to detect and resolve deficiencies. In summary, while we have not independently validated the status of VA’s actions to address our 2008 and 2009 reports’ findings concerning VA’s controls over miscellaneous obligations and financial reporting, VA’s recent inspections and financial audit report indicate that the serious, long-standing deficiencies we identified are continuing. Effective remediation will require well-designed plans and diligent and focused oversight by senior VA officials. Further, the extent to which such serious weaknesses continue raises questions concerning whether VA management has established an appropriate “tone at the top” necessary to ensure that these matters receive the full, sustained attention needed to bring about their full and effective resolution. Until VA’s management fully addresses our previous recommendations, VA will continue to be at risk of improper payments, waste, and mismanagement. Mr. Chairman, this concludes my prepared statement. I would be happy to respond to any questions you or other members of the committee may have at this time. For further information about this testimony, please contact Susan Ragland, Director, Financial Management and Assurance at (202) 512-9095, or raglands@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. Major contributors to this testimony included Glenn Slocum, Assistant Director; Richard Cambosos; Debra Cottrell; Daniel Egan; Patrick Frey; W. Stephen Lowrey; David Ramirez; Robert Sharpe; and George Warnock. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: In September 2008, GAO reported internal control weaknesses over the Veteran Health Administration's (VHA) use of $6.9 billion in miscellaneous obligations in fiscal year 2007. In November 2009, GAO reported on deficiencies in corrective action plans to remediate financial reporting control deficiencies. This testimony is based on these previous reports that focused on (1) VHA miscellaneous obligation control deficiencies and (2) Department of Veterans Affairs (VA) financial reporting control deficiencies and VA plans to correct them. For its review of VHA miscellaneous obligations, GAO evaluated VA's policies and procedures and documentation, interviewed cognizant agency officials, and conducted case studies at three VHA medical centers. For its review of financial reporting control deficiencies, GAO evaluated VA financial audit reports from fiscal years 2000 to 2008 and analyzed related corrective action plans. In September 2008, we reported that VHA recorded over $6.9 billion of miscellaneous obligations for the procurement of mission-related goods and services in fiscal year 2007. We also reported that VA policies and procedures were not designed to provide adequate controls over the authorization and use of miscellaneous obligations, placing VA at significant risk of fraud, waste, and abuse. We made four recommendations with respect to (1) oversight by contracting officials, (2) segregation of duties, (3) supporting documentation for the obligation of funds, and (4) oversight mechanisms. In January 2009, VA issued new policies and procedures aimed at addressing the deficiencies identified in GAO's September 2008 report. In November of 2009, we reported that VA's independent public auditor had identified two of VA's three fiscal year 2008 material weaknesses--in financial management system functionality and IT security controls--every year since fiscal year 2000 and the third--financial management oversight--each year since fiscal year 2005. While VA had corrective action plans in place that intended to result in near-term remediation of its internal control deficiencies, many of these plans did not contain the detail needed to provide VA officials with assurance that the plans could be effectively implemented on schedule. For example, 8 of 13 plans lacked key information about milestones for steps to achieve the corrective action and how VA would validate that the steps taken had actually corrected the deficiency. While VA began to staff a new office responsible for, in part, assisting VA and the three administrations in executing and monitoring corrective action plans, we made three recommendations to improve corrective action plan development and oversight. VA concurred with our recommendations and took some steps to address them. In fiscal year 2009, VA's own internal VA inspections and financial statement audit determined that the internal control deficiencies identified in our prior reports on miscellaneous obligations and material weaknesses identified in prior financial audits continued to exist. VA conducted 39 inspections, which identified problems with how VHA facilities had implemented VA's new miscellaneous obligation policies and procedures. Similarly, VA's independent auditor reported that VA continued to have material weaknesses in financial management system functionality, IT security controls, and financial management oversight in fiscal year 2009. To the extent that the deficiencies we identified continue, it will be critical that VA have an effective "tone at the top" and mechanisms to monitor corrective actions related to deficient internal controls. In its September 2008 report, GAO made four recommendations to improve VA's internal controls over miscellaneous obligations. In its November 2009 report, GAO made three recommendations to improve VA corrective action plans to remediate financial reporting control deficiencies. VA generally concurred with these recommendations and has since reported taking actions to address the recommendations.