Since 1990, we have regularly reported on government operations that we have identified as high risk due to their vulnerability to fraud, waste, abuse, and mismanagement, or the need for transformation to address economy, efficiency, or effectiveness challenges. Our high-risk program— which is intended to help inform the congressional oversight agenda and to guide efforts of the administration and agencies to improve government performance—has brought much-needed focus to problems impeding effective government and costing billions of dollars. In 1990, we designated 14 high-risk areas. Since then, generally coinciding with the start of each new Congress, we have reported on the status of progress to address previously designated high-risk areas, determined whether any areas could be removed or consolidated, and identified new high-risk areas. Since 1990, a total of 60 different areas have appeared on the High-Risk List, 24 areas have been removed, and 2 areas have been consolidated. On average, high-risk areas that have been removed from the list remained on it for 9 years after they were initially added. Our experience has shown that the key elements needed to make progress in high-risk areas are top-level attention by the administration and agency leaders grounded in the five criteria for removal from the High-Risk List, as well as any needed congressional action. The five criteria for removal that we issued in November 2000 are as follows: Leadership Commitment. The agency demonstrates strong commitment and top leadership support. Capacity. The agency has the capacity (i.e., people and resources) to resolve the risk(s). Action Plan. A corrective action plan exists that defines the root cause and solutions, and provides for substantially completing corrective measures, including steps necessary to implement solutions we recommended. Monitoring. A program has been instituted to monitor and independently validate the effectiveness and sustainability of corrective measures. Demonstrated Progress. The agency is able to demonstrate progress in implementing corrective measures and in resolving the high-risk area. These five criteria form a road map for efforts to improve and ultimately address high-risk issues. Addressing some of the criteria leads to progress, while satisfying all of the criteria is central to removal from the list. In our April 2016 report, we provided additional information on how agencies had made progress addressing high-risk issues. Figure 1 shows the five criteria for removal for a designated high-risk area and examples of actions taken by agencies as cited in that report. Importantly, the actions listed are not “stand alone” efforts taken in isolation from other actions to address high-risk issues. That is, actions taken under one criterion may also be important in meeting other criteria. For example, top leadership can demonstrate its commitment by establishing a corrective action plan including long-term priorities and goals to address the high-risk issue and using data to gauge progress— actions which are also vital to monitoring criteria. VA officials have expressed their commitment to addressing the concerns that led to the high-risk designation for VA health care. As part of our work for the 2017 high-risk report, we identified actions VA had taken, such as establishing a task force, working groups, and a governance structure for addressing the five areas of concern contributing to the designation: (1) ambiguous policies and inconsistent processes; (2) inadequate oversight and accountability; (3) information technology (IT) challenges; (4) inadequate training for VA staff; and (5) unclear resource needs and allocation priorities. For example, in July 2016, VA chartered the GAO High Risk List Area Task Force for Managing Risk and Improving VA Health Care to develop and oversee implementation of VA’s plan to address the root causes of the five areas of concern we identified in 2015. VA’s task force and associated working groups are responsible for developing and executing the department’s high-risk mitigation plan for each of the five areas of concern we identified. VA also executed two contracts with a total value of $7.8 million to support its actions to address the concerns behind the high-risk designation. These contracts—with the MITRE Corporation and Atlas Research, LLC—are intended to provide additional support for actions such as developing and executing an action plan, creating a plan to enhance VA’s capacity to manage the five areas, and assisting with establishing the management functions necessary to oversee the five high-risk-area working groups. On August 18, 2016, VA provided us with an action plan that acknowledged the deep-rooted nature of the areas of concern, and stated that these concerns would require substantial time and work to address. Although the action plan outlined some steps VA plans to take over the next several years to address the concerns that led to its high-risk designation, several sections were missing critical actions that would support our criteria for removal from the High-Risk List, such as analyzing the root causes of the issues and measuring progress with clear metrics. In our feedback to VHA on drafts of its action plan, we highlighted these missing actions and also stressed the need for specific timelines and an assessment of needed resources for implementation. For example, VA plans to use staff from various sources, including contractors and temporarily detailed employees, to support its high-risk-area working groups, so it is important for VA to ensure that these efforts are sufficiently resourced. As we reported in the February 2017 high-risk report, when we applied the five criteria for High-Risk List removal to each of the areas of concern, we determined that VA has partially met two of the five criteria: leadership commitment and an action plan. VA has not met the other three criteria for removal: capacity to address the areas of concern, monitoring implementation of corrective actions, and demonstrating progress. It is worth noting that although both criteria were rated as partially met, the department made significantly less progress in developing a viable action plan than it has in demonstrating leadership commitment. Specifically, VA partially met the action plan criterion for only one of the five areas of concern—ambiguous policies and inconsistent processes—whereas VA partially met the leadership commitment criterion for four out of five areas of concern. The following is a summary of the progress VA has made in addressing the five criteria for removal from the High-Risk List for each of the five areas of concern we identified. Summary of concern. When we designated VA health care as a high- risk area in 2015, we reported that ambiguous VA policies led to inconsistent processes at local VA medical facilities, which may have posed risks for veterans’ access to VA health care. Since then, we highlighted the inconsistent application of policies in two recent reports examining mental health and primary care access at VA medical facilities in 2015 and 2016, respectively. In both reports, we found wide variation in the time that veterans waited for primary and mental health care, which was in part caused by a lack of clear, updated policies for appointment scheduling; therefore, we recommended that VA update these policies. These ambiguous policies contributed to errors made by appointment schedulers, which led to inconsistent and unreliable wait-time data. For mental health, we also found that two policies conflicted, leading to confusion among VA medical center staff as to which wait-time policy to follow. In 2015, VA resolved this policy conflict by revising its mental health handbook, but other inconsistent applications of mental health policy have not yet been addressed, such as our recommendation to issue guidance about the definitions used to calculate veteran appointment wait times, and communicate any changes to those definitions within and outside VHA. 2017 assessment of VA’s progress. Based on actions taken since 2015, VA has partially met our criteria for removal from the High-Risk List for this area of concern for leadership commitment and action plan. VA has partially met the leadership commitment criterion because it established a framework for developing and reviewing policies—with the goal of ensuring greater consistency and clarity—and set goals for making the policy-development process more efficient. VA has partially met the action plan criterion for this high-risk area of concern because its action plan described an analysis of the root causes of problems related to ambiguous policies and inconsistent processes, an important aspect of an action plan. However, VA has not met our criteria for removal from the High-Risk List for capacity, monitoring, and demonstrated progress for this area of concern because it has not addressed gaps that exist between its stated goals and available resources, addressed inconsistent application of policies at the local level, or demonstrated that its actions are linked to identified root causes. Summary of concern. In our 2015 high-risk report, we found that VA had problems holding its facilities accountable for their performance because it relied on self-reported data from facilities, its oversight activities were not sufficiently focused on compliance, and it did not routinely assess policy implementation. We continued to find a lack of oversight in our October 2015 review of the efficiency and timeliness of VA’s primary care. For example, we found inaccuracies in VA’s data on primary care panel sizes, which are used to help medical centers manage their workload and ensure that veterans receive timely and efficient care. We found that while VA’s primary care panel management policy required facilities to ensure the reliability of their panel size data, it did not assign responsibility for verifying data reliability to regional- or national-level officials or require them to use the data for monitoring purposes. As a result, VA could not be assured that local panel size data were reliable, or know whether its medical centers had met VA’s goals for efficient, timely, and quality care. We recommended that VA incorporate an oversight process in its primary care panel management policy that assigns responsibility, as appropriate, to regional networks and to VA’s central office for verifying and monitoring panel sizes. 2017 assessment of VA’s progress. VA has partially met the leadership commitment criterion for this area of concern because it established a high-level governance structure and adopted a new model to guide the department’s oversight and accountability activities. However, VA has not met our criteria for removal from the High-Risk List for capacity, action plan, monitoring, or demonstrated progress for this area of concern because the department continues to rely on existing processes that contribute to inadequate oversight and accountability. Summary of concern. In our 2015 high-risk report, we identified limitations in the capacity of VA’s existing IT systems, including the outdated, inefficient nature of certain systems and a lack of system interoperability as contributors to VA’s IT challenges related to VA health care. We have continued to report on the importance of VA working with the Department of Defense to achieve electronic health record interoperability. In August 2015, we reported on the status of these interoperability efforts and noted that the departments had engaged in several near-term efforts focused on expanding interoperability between their existing electronic health record systems. However, we were concerned by the lack of outcome-oriented goals and metrics that would more clearly define what VA and the Department of Defense aim to achieve from their interoperability efforts. Accordingly, we recommended that the departments establish a time frame for identifying outcome- oriented metrics and define related goals for achieving interoperability. In February 2017, we reported that VA has begun to define an approach for identifying outcome-oriented metrics focused on health outcomes in selected clinical areas, and it also has begun to establish baseline measurements. We intend to continue monitoring the departments’ efforts to determine how these metrics define and measure the results achieved by interoperability between the departments. 2017 assessment of VA’s progress. VA has partially met our leadership commitment criterion by involving top leadership from VA’s Office of Information & Technology in this area of concern, but it has not met our four remaining criteria for removing IT challenges from the High-Risk List. For example, VA has not demonstrated improvement in several capacity actions, such as establishing specific responsibilities for its new functions, improving collaboration between internal and external stakeholders, and addressing skill gaps. VA also needs to conduct a root cause analysis that would help identify and prioritize critical actions and outcomes to address IT challenges. Summary of concern. When identifying this area of concern in our 2015 high-risk report, we described several gaps in VA’s training, as well as burdensome training requirements. We have continued to find these issues in our subsequent work. For example, in our December 2016 report on VHA’s human resources (HR) capacity, we found that VA’s competency assessment tool did not address two of the three personnel systems under which VHA staff may be hired. We recommended that VHA (1) develop a comprehensive competency assessment tool for HR staff that evaluates knowledge of all three of VHA’s personnel systems and (2) ensure that all VHA HR staff complete it so that VHA may use the data to identify and address competency gaps among HR staff. Without such a tool, VHA will have limited insights into the abilities of its HR staff and will be ill-positioned to provide necessary support and training. 2017 assessment of VA’s progress. VA has not met any of our criteria for removing this area of concern from the High-Risk List. VA intends to establish a comprehensive health care training management policy and a mandatory annual training process; however, as of December 2016, VA officials said they had not begun drafting a new policy to replace an outdated document from 2002 that contains training requirements that are no longer relevant. The high-level nature of the descriptions in the action plan and lack of action to update outdated policies and set goals for improving training shows that VA lacks leadership commitment to address the concerns that led to our inclusion of this area in the 2015 high-risk report. Summary of concern. In our 2015 high-risk report, we described gaps in the availability of data needed for VA to identify the resources it needs and ensure they are effectively allocated across VA’s health care system as contributors to our concern about unclear resource needs and allocation priorities. We have continued to report on this concern. For example, in our September 2016 report on VHA’s organizational structure, we found that VA devoted significant time, effort, and funds to generate recommendations for organizational structure changes intended to improve the efficiency of VHA operations. However, the department then either did not act or acted slowly to implement the recommendations. Without robust processes for evaluating and implementing recommendations, there was little assurance that VHA’s delivery of health care to the nation’s veterans would improve. We recommended that VA develop a process to ensure that it evaluates organizational structure recommendations resulting from internal and external reviews of VHA. This process should include documenting decisions and assigning officials or offices responsibility for ensuring that approved recommendations are implemented. We concluded that such a process would help VA ensure that it is using resources efficiently, monitoring and evaluating implementation, and holding officials accountable. 2017 assessment of VA’s progress. VA’s actions have partially met our criterion for leadership commitment but not met the other four criteria for removing this area of concern from the High Risk List. VA’s planned actions do not make clear how VHA, as the agency managing VA health care, is or will be incorporated into VA’s new framework for the strategic planning and budgeting process. It is also not clear how the framework will be communicated and reflected at the regional network and medical center levels. VA also has not identified what resources may be necessary to establish and maintain new functions at the national and local levels, or established performance measures based on a root cause analysis of its unclear resource needs and allocation priorities. Since we added VA health care to our High-Risk List in 2015, VA’s leadership has increased its focus on implementing our prior recommendations, but additional work is still needed. Between January 2010 and February 2015 (when we first designated VA health care as a high-risk area), we made 178 recommendations to VA related to VA health care. When we made our designation in 2015, the department only had implemented about 22 percent of them. Since February 2015, we have made 74 new recommendations to VA related to VA health care, for a total of 252 recommendations from January 1, 2010 through February 15, 2017 (when we issued the 2017 high-risk report). VA has implemented about 50 percent of these recommendations. However, there continue to be more than 100 open recommendations related to VA health care, almost a quarter of which have remained open for 3 or more years. We believe that it is critical that VA implement our recommendations not only to remedy the specific weaknesses we previously identified, but because they may be symptomatic of larger underlying problems that also need to be addressed. Since the 2015 high-risk report, we have made new recommendations to VA relating to each of the five areas of concern. (See table 1.) VA has taken an important step toward addressing our criteria for removal from the High-Risk List by establishing the leadership structure necessary to ensure that actions related to the High-Risk List are prioritized within the department. It is imperative, however, that VA demonstrate strong leadership support as it continues its transition under a new administration, address weaknesses in its action plan, and continue to implement our open recommendations. As a new administration sets its priorities, VA will need to integrate those priorities with its high-risk-related actions, and facilitate their implementation at the local level through strategies that link strategic goals to actions and guidance. In its action plan, VA separated its discussion of department-wide initiatives, like MyVA, from its description of High-Risk List mitigation strategies. We do not view high-risk mitigation strategies as separate from other department initiatives; actions to address the High-Risk List can, and should be, integrated in VA’s existing activities. VA’s action plan did not adequately address the concerns that led to the high-risk designation because it lacked root cause analyses for most areas of concern, as well as clear metrics and identified resources needed for achieving VA’s stated outcomes. This is especially evident in VA’s plans to address the IT and training areas of concern. In addition, with the increased use of community care programs, it is imperative that VA’s action plan include a discussion of the role of community care in decisions related to policies, oversight, IT, training, and resource needs. VA will also need to demonstrate that it has the capacity to sustain efforts by devoting appropriate resources—including people, training, and funds—to address the high-risk challenges we identified. Until VA addresses these serious underlying weaknesses, it will be difficult for the department to effectively and efficiently implement improvements addressing the five areas of concern that led to the high-risk designation. We will continue to monitor VA’s institutional capacity to fully implement an action plan and sustain needed changes in all five of our areas of concern. To the extent we can, we will continue to provide feedback to VA officials on VA’s action plan and areas where they need to focus their attention. Additionally, we have ongoing work focusing on VA health care that will provide important insights on progress, including the policy development and dissemination process, implementation and monitoring of VA’s opioid safety, Veterans Choice Program implementation, physician recruitment and retention, and processes for enrolling veterans in VA health care. Finally, we plan to also continue to monitor VA’s efforts to implement our recommendations and recommendations from other reviews such as the Commission on Care. To this end, we believe that the following GAO recommendations require VA’s immediate attention: improving oversight of access to timely medical appointments, including the development of wait-time measures that are more reliable and not prone to user error or manipulation, as well as ensuring that medical centers consistently and accurately implement VHA’s scheduling policy. improving oversight of VA community care to ensure—among other things—timely payment to community providers. improving planning, deployment, and oversight of VA/VHA IT systems, including identifying outcome-oriented metrics and defining goals for interoperability with DOD. ensuring that recommendations resulting from internal and external reviews of VHA’s organizational structure are evaluated for implementation. This process should include the documentation of decisions and assigning officials or offices responsibility for ensuring that approved recommendations are implemented. Moreover, it is critical that Congress maintain its focus on oversight of VA health care to help address this high-risk area. Congressional committees responsible for authorizing and overseeing VA health care programs held more than 70 hearings in 2015 and 2016 to examine and address VA health care challenges. As VA continues to change its health care service delivery in the coming years, some changes may require congressional action—such as VA’s planned consolidation of community care programs after the Veterans Choice Program expires. Sustained congressional attention to these issues will help ensure that VA continues to improve its management and delivery of health care services to veterans. Chairman Isakson, Ranking Member Tester, and Members of the Committee, this concludes my statement. I would be pleased to respond to any questions you may have. For further information about this statement, please contact Debra A. Draper at (202) 512-7114 or draperd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Key contributors to this statement were Malissa G. Winograd (Analyst-in-Charge), Jennie Apter, Jacquelyn Hamilton, and Alexis C. MacDonald. High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts Needed on Others. GAO-17-317. Washington, D.C.: February 15, 2017. VA Health Care: Actions Needed to Ensure Medical Facility Controlled Substance Inspection Programs Meet Agency Requirements. GAO-17-242. Washington, D.C.: February 15, 2017. Veterans Affairs Information Technology: Management Attention Needed to Improve Critical System Modernizations, Consolidate Data Centers, and Retire Legacy Systems. GAO-17-408T. Washington, D.C.: February 7, 2017. Veterans Health Administration: Management Attention Is Needed to Address Systemic, Long-standing Human Capital Challenges. GAO-17-30. Washington, D.C.: December 23, 2016. VA Health Care: Improved Monitoring Needed for Effective Oversight of Care for Women Veterans. GAO-17-52. Washington, D.C.: December 2, 2016. Veterans Health Care: Improvements Needed in Operationalizing Strategic Goals and Objectives. GAO-17-50. Washington, D.C.: October 21, 2016. VA Health Care: Processes to Evaluate, Implement, and Monitor Organizational Structure Changes Needed. GAO-16-803. Washington, D.C.: September 27, 2016. Veterans’ Health Care: Improved Oversight of Community Care Physicians’ Credentials Needed. GAO-16-795. Washington, D.C.: September 19, 2016. VA IT Management: Organization Is Largely Centralized; Additional Actions Could Improve Human Capital Practices and Systems Development Processes. GAO-16-403. Washington, D.C.: August 17, 2016. Veterans Affairs: Sustained Management Attention Needed to Address Numerous IT Challenges. GAO-16-762T. Washington, D.C.: June 22, 2016. VA’s Health Care Budget: In Response to a Projected Funding Gap in Fiscal Year 2015, VA Has Made Efforts to Better Manage Future Budgets. GAO-16-584. Washington, D.C.: June 3, 2016. Veterans Crisis Line: Additional Testing, Monitoring, and Information Needed to Ensure Better Quality Service. GAO-16-373. Washington, D.C.: May 26, 2016. Veterans’ Health Care: Proper Plan Needed to Modernize System for Paying Community Providers. GAO-16-353. Washington, D.C.: May 11, 2016. VA Health Care: Actions Needed to Improve Newly Enrolled Veterans’ Access to Primary Care. GAO-16-328. Washington, D.C.: March 18, 2016. DOD and VA Health Care: Actions Needed to Help Ensure Appropriate Medication Continuation and Prescribing Practices. GAO-16-158. Washington, D.C.: January 5, 2016. VA Mental Health: Clearer Guidance on Access Policies and Wait-Time Data Needed. GAO-16-24. Washington, D.C.: October 28, 2015. VA Primary Care: Improved Oversight Needed to Better Ensure Timely Access and Efficient Delivery of Care. GAO-16-83. Washington, D.C.: October 8, 2015. VA Health Care: Oversight Improvements Needed for Nurse Recruitment and Retention Initiatives. GAO-15-794. Washington, D.C.: September 30, 2015. Electronic Health Records: Outcome-Oriented Metrics and Goals Needed to Gauge DOD’s and VA’s Progress in Achieving Interoperability. GAO-15-530. Washington, D.C.: August 13, 2015. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: VA operates one of the largest health care delivery systems in the nation, including 168 medical centers and more than 1,000 outpatient facilities organized into regional networks. Enrollment in the VA health care system has grown significantly, from 7.9 million in fiscal year 2006 to almost 9 million in fiscal year 2016. Over that same period, VA's Veterans Health Administration's total budgetary resources have increased substantially, from $37.8 billion in fiscal year 2006 to $91.2 billion in fiscal year 2016. Since 1990, GAO has regularly updated the list of government operations that it has identified as high risk due to their vulnerability to fraud, waste, abuse, and mismanagement, or the need for transformation to address economy, efficiency, or effectiveness challenges. VA health care was added as a high-risk area in 2015 because of concerns about VA's ability to ensure the timeliness, cost-effectiveness, quality, and safety of veterans' health care. GAO assesses High-Risk List removal against five criteria: (1) leadership commitment, (2) capacity, (3) action plan, (4) monitoring, and (5) demonstrated progress. This statement, which is based on GAO's February 2017 high-risk report, addresses (1) actions VA has taken over the past 2 years to address the areas of concern that led GAO to designate VA health care as high risk, (2) the number of open GAO recommendations related to VA health care, and (3) additional actions VA needs to take to address the concerns that led to the high-risk designation. The Department of Veterans Affairs (VA) has taken action to partially meet two of the five criteria GAO uses to assess removal from the High-Risk List (leadership commitment and an action plan), but it has not met the other three (agency capacity, monitoring efforts, and demonstrated progress). Specifically, VA officials have taken leadership actions such as establishing a task force, working groups, and a governance structure for addressing the issues that led to the high-risk designation. VA provided GAO with an action plan in August 2016 that acknowledged the deep-rooted nature of the five areas of concern GAO identified: (1) ambiguous policies and inconsistent processes; (2) inadequate oversight and accountability; (3) information technology challenges; (4) inadequate training for VA staff; and (5) unclear resource needs and allocation priorities. Although VA's action plan outlined some steps VA plans to take over the next several years, several sections were missing analyses of the root causes of the issues, resources needed, and clear metrics to measure progress. Also of concern are the more than 100 open recommendations GAO has made between January 2010 and February 2017 related to VA health care, almost a quarter of which have been open for 3 or more years. Since February 2015, GAO has made 74 new recommendations relating to the areas of concern. To address its high-risk designation, additional actions are required of VA, including: (1) demonstrating stronger leadership support as it continues its transition under a new administration; (2) developing an action plan to include root cause analyses for each area of concern, clear metrics to assess progress, and the identification of resources for achieving stated outcomes; and (3) implementing GAO's recommendations, not only to remedy the specific weaknesses identified, but because they may be symptomatic of larger underlying problems that also need to be addressed. Until VA addresses these serious underlying weaknesses, it will be difficult for the department to effectively and efficiently implement improvements addressing the five areas of concern that led to the high-risk designation.