In fiscal year 2007, VHA used miscellaneous obligations to record over $6.9 billion against its appropriations for the procurement of mission-related goods and services at 129 VHA stations throughout the country. As shown in figure 1, $3.8 billion of this total (55.1 percent) was for fee-based medical and dental services for veterans, and another $1.4 billion (20.4 percent) was for drugs, medicines, and hospital supplies. The remainder covered, among other things, state homes for the care of disabled veterans, transportation of veterans to and from medical centers for treatment, and logistical support and facility maintenance for VHA medical centers nationwide. Other, such as dietetic provisions, operating supplies, cleaning services, and data processing. Transportation of persons/things. State homes and homeless veteran support. Rent, communications, and utilities including gas, electricity, water, sewer, and phone. Supplies including drugs, medicines, hospital supplies, blood products, and prosthetic supplies. Services including fee-basis physician, nursing, dental, hospitalization stays, research, and prosthetic repair. VHA officials said they used miscellaneous obligations to administratively reserve estimated funds required to facilitate the payments for goods and services for which specific quantities and time frames were uncertain. Specifically, a miscellaneous obligation can be created for an estimated amount and then modified as specific quantities are needed or specific delivery dates are set. In contrast, when a purchase order is used to obligate funds, the obligated amount cannot be changed without a modification of the purchase order. According to VHA officials, the need to prepare numerous modifications to purchase orders could place an undue burden on the limited contracting personnel available at individual centers and could also require additional work on the part of fiscal services personnel. Therefore, VHA officials view the use of miscellaneous obligations as having the benefit of reduced workload. Another cited benefit was that miscellaneous obligations simplify the procurement process when no underlying contract or purchase order exists. For example, providing medical care on a fee-basis to veterans outside of VHA medical centers may involve the services of thousands of private physicians nationwide. Attempting to negotiate a separate agreement or contract with each of these individuals would be a difficult task for VHA’s contracting staff. Under the policies and procedures in place during fiscal year 2007, VHA centers could use miscellaneous obligations as umbrella authorizations for fee-based medical services performed by a number of different physicians. In effect, in cases for which there is no preexisting contract, the miscellaneous obligation form becomes the record of an obligation. In September 2008, we reported that VA policies and procedures were not designed to provide adequate controls over the use of miscellaneous obligations. The use of miscellaneous obligations carries inherent risk due to a lack of a negotiated contract. Without effectively designed mitigating controls, the use of miscellaneous obligations may also expose VHA to increased risk of fraud, waste, and abuse. VHA did not have effective basic internal controls nor mitigating controls with respect to oversight by contracting officials, segregation of duties, and supporting documentation for recording the obligation of funds. Our Standards for Internal Control in the Federal Government state that agency management is responsible for developing detailed policies and procedures for internal control suitable for its agency’s operations and ensuring that they provide for adequate monitoring by management, segregation of duties, and supporting documentation for the need to acquire specific goods in the quantities purchased. We identified control design flaws in each of these areas, and we confirmed that these weaknesses existed in our case studies of VA fiscal year 2007 transactions at Pittsburgh, Cheyenne, and Kansas City, as shown below in table 1. Collectively, these control design flaws increase the risk of unauthorized procurements, overpayments for services rendered, and the conversion of VHA assets for personal use without detection. The 42 miscellaneous obligations we reviewed at three VHA stations had no evidence of approval by contracting officials. The systems used did not have a mechanism for contracting officials to electronically document their review of miscellaneous obligations, and no manual documentation procedures had been developed. Furthermore, none of the three sites we visited had procedures in place to document review of the miscellaneous obligations by the appropriate contracting authorities. As a result, VHA lacks assurance that miscellaneous obligations are being reviewed and that related policies are being followed. Effective oversight and review by trained, qualified officials is a key factor in helping to assure that funds are used for their intended purposes, in accordance with laws, while minimizing the risk for fraud, waste, or abuse. Without control procedures to help ensure that contracting personnel review and approve miscellaneous obligations prior to their creation, VHA is at risk that procurements do not have the necessary safeguards. For example, in our case study at the VA Pittsburgh Medical Center, we found 12 miscellaneous obligations, totaling about $673,000, used to pay for laboratory services provided by the University of Pittsburgh Medical Center (UPMC). The Chief of Acquisition and Materiel Management for the VA Pittsburgh Medical Center stated that she was not aware of the UPMC’s laboratory testing service procurements and would review these testing services to determine whether a contract should have been established for these procurements. Subsequently, she stated that VISN 4—the Veterans Integrated Service Network (VISN) that oversees the operations of the VA Pittsburgh Medical Center—would revise procedures to procure laboratory testing services through purchase orders backed by reviewed and competitively awarded contracts, instead of funding them through miscellaneous obligations. In the absence of review by contracting officials, controls were not designed to prevent miscellaneous obligations from being used for unauthorized purposes, or for assets that could be readily converted to personal use. Our analysis of the IFCAP database for fiscal year 2007 identified 145 miscellaneous obligations for over $30.2 million that were used for procurement of such items as passenger vehicles; furniture and fixtures; office equipment; and medical, dental, and scientific equipment. Although VA’s miscellaneous obligation policy did not address this issue, VA officials stated that acquisition of such assets should be done by contracting rather than through miscellaneous obligations. Without adequate controls to review miscellaneous obligations and prevent them from being used for the acquisition of such assets, it is possible that VHA may be exposing the agency to unnecessary risks by using miscellaneous obligations to fund the acquisitions of goods or services that should have been obtained under contract with conventional controls built in. VA policies and procedures and IFCAP’s control design allowed a single official to perform multiple key roles in the process of creating and executing miscellaneous obligations. Control point officials were authorized to create, edit, and approve requests for miscellaneous obligations. In addition, these same individuals could certify the delivery of goods and services and approve payment. Similar weaknesses have been reported by agency auditors as well. Federal internal control standards provide that for an effectively designed control system, key duties and responsibilities need to be divided or segregated among different people to reduce the risk of error or fraud. These controls should include separating the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and accepting any acquired assets. Without proper segregation of duties, risk of errors, improper transactions, and fraud increases. The lack of segregation could allow for improper expenditures to occur without detection. Our case studies showed inadequate segregation of key duties in 30 of the 42 obligations we reviewed. In these instances, controls were not designed to prevent one official from performing two or more of the following key functions: requesting the miscellaneous obligation, approving the miscellaneous obligation, recording the obligation of funds, or certifying delivery of goods and services and approving payment. For example, in one case in Pittsburgh, one official requested and approved a miscellaneous obligation of over $140,000 for medical services and then certified receipt and approved payment for at least $43,000 of those services. In another case in Cheyenne, we found one miscellaneous obligation for utilities where one official requested, approved, and certified receipt and approved payment of over $103,000 in services. Such weak control design could enable a VHA employee to convert VHA assets to his or her personal use, without detection. Control design flaws in VA’s policies and procedures resulted in several instances of insufficient documentation to determine whether the miscellaneous obligations we reviewed as part of our case-study analysis represented a bona fide need. Specifically, VA policies and procedures were not sufficiently detailed to require the type of information needed such as purpose, vendor, and contract number that would provide crucial supporting documentation for the obligation. Internal control standards provide that transactions should be clearly documented and all documentation and records should be properly managed and maintained. Adequate documentation is essential to support an effective funds control system; is crucial in helping to ensure that a procurement represents a bona fide need; and reduces the risk of fraud, waste, and abuse. When a legal obligation is recorded, it must be supported by adequate documentary evidence of the liability. An agency should use its best estimate to reserve an amount for future obligation when the amount of the government’s final liability is undefined. Further, the basis for the estimated liability and the computation must be documented. We found that 8 of the 42 miscellaneous obligations had insufficient data to determine whether the miscellaneous obligation represented a bona fide need. This level of documentation was not sufficient for an independent reviewer to determine what items were procured and whether the appropriate budget object code was charged. As a result of these deficiencies, in several cases we had to rely on invoices to determine the probable purpose of the miscellaneous obligation and whether it represented a bona fide need. For example, in Kansas City, we found one miscellaneous obligation for over $1.3 million whose purpose was listed as “To obligate funds for the Oct 06 payment,” while the associated invoices showed that the miscellaneous obligation was used to cover the services of medical resident staff. In Pittsburgh, we found a miscellaneous obligation for over $45,000 whose purpose was listed as “LABCORP 5/1-5/31/07,” while the associated invoices showed that the obligation was for laboratory testing services. Without procedures calling for more definitive descriptions of the purpose, we could not confirm that these miscellaneous obligations were for bona fide needs or that the invoices reflected a legitimate use of federal funds. Other instances of inadequate supporting documentation we found during our case-study analysis included the absence of vendor names for 20 of the 42 miscellaneous obligations, and missing contract numbers for 16 of the 42 miscellaneous obligations. Inadequate control requirements for supporting documentation and completing data fields concerning the purpose of the obligation, vendor information, and contract numbers can hinder oversight by senior VA management officials. The Deputy Assistant Secretary for Logistics and Acquisition said that he and other VHA officials use the IFCAP database to monitor the extent and nature of miscellaneous obligations nationwide, including analyzing the number and dollar amounts of miscellaneous obligations and identifying the types of goods and services procured using miscellaneous obligations. He told us that he was concerned with the extent and nature of the use of miscellaneous obligations at VA, that he lacked adequate oversight or control over procurements made through miscellaneous obligations, and that he often did not know what was being bought or whom it was being bought from. Our analysis of the IFCAP database found that over 88,000 (69 percent) of 127,070 miscellaneous obligations did not include vendor information, accounting for over $5 billion of the $6.9 billion in recorded miscellaneous obligations in fiscal year 2007. Similarly, the IFCAP database did not contain a description of what was purchased or information on the quantities purchased. As a result, important management information was not available to senior VA procurement officials. Our September 2008 report included four recommendations to VA to develop and implement policies and procedures intended to improve overall control. These recommendations focused on the need to better ensure adequate oversight of miscellaneous obligations by contracting officials; segregation of duties from initiation through receipt of the resulting goods and services; maintaining supporting documentation for miscellaneous obligations; and establishing an oversight mechanism to ensure control policies and procedures are fully and effectively implemented. In comments on a draft of that report, VA concurred with our recommendations and has since taken action to develop policies and procedures to address them. Specifically, in January 2009, VA issued volume II, chapter 6 of VA Financial Policies and Procedures— Miscellaneous Obligations which outlines detailed policies and procedures aimed at addressing the deficiencies we identified in our September 2008 report. Key aspects of the policies and procedures VA developed in response to our four recommendations were the following: Oversight of miscellaneous obligations by contracting officials—VA issued procedures regarding the review of miscellaneous obligations by contracting officials. Specifically, the request and approval of miscellaneous obligations by contracting officials are to be reviewed by the Head of Contracting Activity or delegated to the Local Head of Contracting Activity. In addition, the obligation document will be returned to the initiating office if the miscellaneous obligation is not appropriately signed off by the Head of Contracting Activity. Segregation of duties—VA issued procedures that require that no one official may control all key aspects of a transaction or event. Specifically, no one official may perform more than one of the following key functions: requesting the miscellaneous obligation; approving the miscellaneous obligation; recording the obligation of funds; or certifying the delivery of goods and services or approving payment. Supporting documentation for miscellaneous obligations—New procedures require completion of the purpose, vendor, and contract number fields on VA Form 1358, Estimated Miscellaneous Obligation or Change in Obligation. The procedures permit that a new miscellaneous obligation can only be processed if the appropriate information is recorded in the purpose, vendor, and contract field. The purpose field must be specific, contain adequate references, and note the period of performance; the vendor name and address must be provided, except in the case of multiple vendors; and the contract number must be included on the miscellaneous obligation document. Oversight mechanism to ensure control policies and procedures are fully and effectively implemented—VA developed procedures requiring oversight to help ensure the new policies and procedures are followed. For example, each facility is now responsible for performing independent oversight of the authorization and use of miscellaneous obligations. In addition, facility reviews must be performed quarterly, at a minimum, and should include all new miscellaneous obligations or changes to existing miscellaneous obligations that occurred in the previous quarter. The facility may use sampling to conduct the quarterly reviews. Further, the results of the independent reviews are to be documented and recommendations tracked by facility officials. VA actions taken to develop policies and procedures intended to address the deficiencies found in our September 2008 report represent an important first step. However, full and effective implementation of VA’s new policies and procedures will be even more important. We have not yet fully evaluated the extent to which VA’s new policies and procedures are in place and operating as intended. Further, VA’s ability to fully and effectively address the deficiencies identified in our September 2008 report concerning miscellaneous obligations may be adversely affected by continuing financial system weaknesses reported by agency auditors. Specifically, one of the weaknesses we reported on in November 2009 was that VA lacked a system to track obligations and purchases by vendors, resulting in VA relying on those vendors to supply operational sales data on medical center purchases. Consequently, this type of deficiency exposes VA to continued risk of errors in financial information and reporting, potentially impacting actions VA has made in developing policies and procedures intended to increase accountability and controls over its use of miscellaneous obligations. In summary, our September 2008 report demonstrated that without basic controls in place over billions of dollars in miscellaneous obligations, VA is at significant risk of fraud, waste, and abuse. Effectively designed internal controls serve as the first line of defense for preventing and detecting fraud, and they help ensure that an agency effectively and efficiently meets its missions, goals, and objectives; complies with laws and regulations; and is able to provide reliable financial and other information concerning its programs, operations, and activities. VA management has made progress to reduce the risks associated with the authorization and use of miscellaneous obligations by developing policies and procedures that improve overall control design over miscellaneous obligations. However, full and effective implementation of this new guidance will be critical to reducing the government’s risks associated with VA’s use of miscellaneous obligations. Mr. Chairman and Ranking Member Roe, this concludes my prepared statement. I would be happy to respond to any questions you or other members of the subcommittee may have at this time. For further information about this testimony, please contact Kay L. Daly, Director, Financial Management and Assurance at (202) 512-9095, or dalykl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. Major contributors to this testimony included Glenn Slocum, Assistant Director; Carla Lewis, Assistant Director; Richard Cambosos; Debra Cottrell; Francine DelVecchio; Daniel Egan; W. Stephen Lowrey; Robert Sharpe; and George Warnock. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: In September 2008, GAO reported internal control weaknesses over the Veterans Health Administration's (VHA) use of miscellaneous obligations to record estimates of obligations to be incurred at a future date. GAO was asked to testify on its previously reported findings that focused on (1) how VHA used miscellaneous obligations, and (2) the extent to which the Department of Veterans Affairs' (VA) related policies and procedures were adequately designed. GAO also obtained an update on the status of VA's activities to improve controls over its use of miscellaneous obligations. GAO's testimony is primarily a summary of its prior report (GAO-08-976), and also includes follow-up work to obtain information on the status of VA's efforts to implement our prior recommendations. In September 2008, GAO reported that VHA recorded over $6.9 billion of miscellaneous obligations for the procurement of mission-related goods and services in fiscal year 2007. VHA officials stated that miscellaneous obligations were used to facilitate payment for goods and services when the quantities and delivery dates are not known. According to VHA data, almost $3.8 billion (55.1 percent) of VHA's miscellaneous obligations was for fee-based medical services for veterans and another $1.4 billion (20.4 percent) was for drugs and medicines. The remainder funded, among other things, state homes for the care of disabled veterans, transportation of veterans to and from medical centers for treatment, and logistical support and facility maintenance for VHA medical centers nationwide. In 2008, GAO found that VA policies and procedures were not designed to provide adequate controls over the authorization and use of miscellaneous obligations with respect to oversight by contracting officials, segregation of duties, and supporting documentation for the obligation of funds. Collectively, these control design flaws increased the risk of fraud, waste, and abuse. These control design flaws were confirmed in GAO's case studies at VHA medical centers in Pittsburgh, Pennsylvania; Cheyenne, Wyoming; and Kansas City, Missouri. For example, in all of the 42 obligations reviewed, GAO found no documented approval by contracting officials. The systems used did not have a mechanism for contracting officials to electronically document their review of miscellaneous obligations and no manual documentation procedures had been developed. Furthermore, in 30 of the 42 obligations reviewed, one official performed two or more of the following functions: requesting, creating, approving or obligating funds for the miscellaneous obligation, or certifying delivery of goods and services and approving payment. Without proper segregation of duties, risk of errors, improper transactions, and fraud increases. Lastly, GAO found a lack of adequate supporting documentation at the three medical centers we visited. In 8 of 42 instances, GAO could not determine the nature, timing, or the extent of the goods or services being procured from the description in the purpose field. As a result, GAO could not confirm that these miscellaneous obligations were for bona fide needs or that the invoices reflected a legitimate use of federal funds. In January 2009, VA issued volume II, chapter 6 of VA Financial Policies and Procedures--Miscellaneous Obligations which outlines detailed policies and procedures aimed at addressing the deficiencies GAO identified in the September 2008 report. Full and effective implementation of this new guidance will be critical to reducing the government's risks associated with VA's use of miscellaneous obligations. GAO has not yet evaluated the extent to which these new policies have been fully and effectively implemented.