VA comprises a Veterans Affairs Central Office (VACO) and over 1,000 facilities and offices throughout the nation, as well as the U.S. territories and the Philippines. As shown in figure 1, VA’s three major administrations are the Veterans Health Administration (VHA), Veterans Benefits Administration (VBA), and National Cemetery Administration (NCA). The largest of the administrations, in terms of workforce, is VHA and its associated Veterans Integrated Service Networks (VISN). VHA is estimated to employ about 316,800 employees in 2017, followed by the VBA and NCA with about 22,700 and 1,850 employees, respectively. The remaining 15,000 employees are in various staff offices. VA’s budget request for fiscal year 2018 of $186.4 billion includes $82.1 billion in discretionary resources and $104.3 billion in mandatory funding. The following offices are involved in addressing misconduct at VA. Office of Human Resource Management (OHRM): OHRM develops policies with regard to performance management and assesses the effectiveness of department-wide human-resource programs and policies. Office of Accountability Review (OAR): OAR was established in 2014 within VA’s Office of General Counsel and was intended to ensure leadership accountability for improprieties related to patient scheduling and access to care, whistle-blower retaliation, and related disciplinary matters that affect public trust in VA. Office of Inspector General (OIG): The VA OIG provides oversight through independent audits, inspections, and investigations to prevent and detect criminal activity, waste, abuse, and mismanagement in VA programs and operations. Office of Accountability and Whistleblower Protection (OAWP): As required by the Department of Veterans Affairs Accountability and Whistleblower Protection Act of 2017, OAWP will take on the responsibility of, among other things, receiving whistle-blower complaints. Corporate Senior Executive Management Office (CSEMO): CSEMO supports the entire life-cycle management of VA’s senior executives by developing policy and providing corporate-level personnel services, such as training and coaching to VA’s senior executive workforce. Client Services Response Team (CSRT): CSRT serves to centralize and streamline internal processes to improve VHA’s overall responsiveness to concerns of veterans, employees, and other internal and external stakeholders. This office works closely with VA and VHA program offices and facilities to review, research, and respond to inquiries sent to the Office of the Under Secretary for Health, Office of the Secretary, and other concerns received via program offices within VACO, which lack a formalized response process. National Cemetery Administration (NCA): NCA honors veterans and their families with final resting places in national shrines that commemorate their service. NCA’s Office of Management oversees and administers all human-resource management, including activities associated with labor and employee relations. Office of the Medical Inspector (OMI): OMI is responsible for assessing the quality of VA health care through investigations of VA facilities nationwide, which include employee whistle-blower allegations referred to VA by the OSC; veteran complaints referred by the OIG, Congress, or other stakeholders; and site-specific internal reviews directed by the Office of the Under Secretary for Health. Office of Research Oversight (ORO): ORO promotes the responsible conduct of research, serves as the primary VHA office in advising the Office of the Under Secretary for Health on matters of research compliance, and is to provide oversight of compliance with VA and other federal requirements related to research misconduct. Office of Resolution Management (ORM): ORM provides Equal Employment Opportunity (EEO) discrimination complaint processing services to VA employees, applicants for employment, and former employees, which include counseling, investigation, and final agency procedural decisions. Office of Security and Law Enforcement (OS&LE): OS&LE develops policies, procedures, and standards that govern VA’s infrastructure law- enforcement program. The Law Enforcement Oversight and Criminal Investigations Division is responsible for conducting investigations of serious incidents of misconduct. Veterans Benefits Administration (VBA): VBA provides benefits and services to veterans, their families and survivors. VBA’s Office of Management directs and oversees nationwide human-resources activities and supports ORM in processing EEO complaints filed by employees and applicants who allege employment discrimination. The process for addressing employee misconduct involves various components within VA that are responsible for investigating and adjudicating allegations, as shown in figure 2. Receipt of Allegation: The OIG receives allegations of criminal activity and employee misconduct from VA employees, the OSC, members of Congress, the public, or other stakeholders. The allegations received by the OIG are initially routed to the OIG Hotline Division. The OIG also receives other types of allegations outside the scope of this review, such as issues pertaining to VA employee benefits and contracts. In addition to reporting allegations of employee misconduct to the OIG, VA employees may also report allegations of misconduct directly to their supervisors. Review and Referral of Allegation: Due to the substantial number of allegations received through the OIG Hotline Division, the OIG exercises a “right of first refusal” on misconduct cases, which allows it to take no further action, refer the case to program offices within VA for review and response, or open an investigation. For example, the OIG can either decide to (1) take no further action on matters not within the OIG’s jurisdiction or too vague to warrant further review; (2) refer allegations that warrant some action to the OMI, OAR, or VA facilities or program offices within each administration to conduct an independent review of the allegations; or (3) open cases for further review for serious allegations of criminal activity, fraud, waste, abuse, and mismanagement. Cases opened by the OIG typically involve misconduct by senior officials, or matters relating to the quality of care provided by licensed professionals. In contrast, the OIG typically refers allegations to VA facility or program offices for matters where the OIG does not have sufficient resources to open an internal case. The OIG generally does not review matters that are addressed in other legal or administrative forums, such as allegations of discrimination or whistle-blower retaliation. Notice to Employee Once Allegations Are Substantiated: The type of appointment an employee holds determines whether an employee is to be provided advance notice of planned disciplinary action once misconduct is substantiated at the conclusion of an investigation. Employees holding a permanent appointment are entitled to receive a notice of proposed action that states the specific charges for which the proposed disciplinary action is based and informs the employee of his or her right to review the material that is relied upon to support the reasons for the action. Employees in the competitive service serving in a permanent appointment (who have completed their probationary period) are treated differently than those who are still in their probationary period or serving under temporary appointments. An employee serving a probationary period or under a temporary appointment does not receive a notice of proposed action and may be immediately terminated because his or her work performance or conduct fails to demonstrate fitness or qualifications for continued employment. Temporary employees are terminated by notifying employees in writing as to why they are being separated and the effective date of the action. Disciplinary Action: VA Handbook 5021, Employee/Management Relations, governs policy for disciplinary and grievance procedures for all employees. Supervisory staff or appropriate higher-level officials use the results from investigations to help determine whether any disciplinary actions are warranted and, if so, the type and severity of each action. Other VA staff, such as human-resources and general-counsel staff may also provide guidance to management in determining appropriate disciplinary actions. After determining the facts in a case, VA may employ either disciplinary or adverse action. Adverse action involves a more- severe type of discipline (e.g., removal, suspension more than 14 days, or reduction in grade) as described in table 1. As a federal agency, VA is required to report department-wide information on certain disciplinary personnel actions to the Office of Personnel Management (OPM). OPM’s Enterprise Human Resources Integration (EHRI) system currently collects, integrates, and publishes data for executive-branch employees on a biweekly basis. This system provides federal workforce data to other government systems and the public. To adhere to this reporting requirement, VA provides information on certain disciplinary actions such as terminations and removals to OPM. The Department of Veterans Affairs Accountability and Whistleblower Protection Act of 2017 also requires the Secretary to provide a report on the disciplinary procedures and actions of the department to Congress. To understand the depth and breadth of misconduct and related issues in a large entity, such as VA, comprehensive and reliable information is needed. Standards for Internal Control in the Federal Government states that an information system represents the life cycle of information used for the entity’s operational processes that enables the entity to obtain, store, and process quality information. Therefore, management should design the entity’s information system to obtain and process information to meet each operational process’s information requirements and to respond to the entity’s objectives and risks, such as the ability to systematically analyze misconduct department-wide to identify trends and make management decisions regarding misconduct. A deficiency exists when (1) a control necessary to meet an objective is missing or (2) an existing control is not properly designed, so that even if the control operates as designed, the objective would not be met. We identified 12 fragmented information systems that VA has used, or continues to use, to collect employee misconduct and disciplinary actions. Although VA has made efforts to develop repositories to collect information pertaining to misconduct and disciplinary action, none of the 12 information systems contain complete information. Six of these systems collect partial misconduct and disciplinary action information and contain fields that could potentially be shared with other systems to obtain additional information, while the other six systems are intended for internal office use only, each containing their own unique fields and values tailored to the needs of that particular office, which are not shared. Therefore, the number of eligible fields for each information system was also limited to those not specifically designated for internal use. On the basis of our review, the 12 information systems are not currently able to communicate, or interoperate, with one another to provide a complete picture of misconduct and disciplinary actions across VA. Table 2 provides an overview of VA’s six information systems and associated data files that collect partial misconduct and disciplinary-action data that could potentially be shared with other systems. According to OHRM officials, VA’s information system for recording adverse disciplinary actions—the Personnel and Accounting Integrated Data (PAID) system—was not designed to track all misconduct cases. In addition, OHRM stated that the 53-year-old PAID system was developed primarily to track payroll actions for all employees and is the system of record that holds department-wide personnel information that is reported to OPM’s EHRI system. It contains information about adverse disciplinary actions that affect employee leave or salary, or result in a Notification of Personnel Action Form (Standard Form 50). However, PAID does not track comprehensive information on instances of misconduct such as the offense, or the date of occurrence, and it does not include instances of other types of disciplinary actions, such as admonishments or reprimands that would not affect leave or salary, or result in a Standard Form 50. OHRM officials stated VA implemented a system called HR Smart in June 2016 that is intended to replace PAID, but the agency does not plan to upgrade the functionality of the new system to enable reliable collection of misconduct information. According to OHRM, HR Smart includes the same personnel-processing functions as PAID but will allow for tracking data changes and transaction history over time. However, as with the PAID system, adverse disciplinary actions involving leave and salary will be tracked, but other actions, such as reprimands and admonishments, will not. It also will not track information related to the offense that prompted the disciplinary action. While the HR Smart system has the capability to include modules to enhance performance features, such as the ability to track misconduct, according to OHRM officials VA does not currently have plans to implement these modules. As a result, the HR Smart system will not have the capability to track all employee misconduct department-wide and will not improve VA management’s visibility over the depth and breadth of misconduct so that it can systematically understand misconduct department-wide. VA has five additional information systems for tracking complaints or allegations of misconduct and disciplinary actions, but, similar to the agency’s PAID information system, each of these information systems contains a subset of the information that would be needed to understand all misconduct department-wide. According to Standards for Internal Control in the Federal Government, systems should include relevant data from reliable internal sources that are reasonably free from error and faithfully represent what they purport to represent. Additionally, management is advised to process data into quality information that is appropriate, current, complete, accurate, accessible, and provided on a timely basis. Management should also evaluate processed information, make revisions when necessary so that the information is quality information, and use the information to make informed decisions. Additionally, according to Standards for Internal Control in the Federal Government, management should design the entity’s information system and related control activities to achieve objectives and respond to risks. The standards add that the information system design should consider defined information requirements for each of the entity’s operational processes. Defined information requirements allow management to obtain relevant data from reliable internal and external sources. In order to achieve complete and accurate data, internal controls are needed, among other things, to ensure that fields are not left blank, data elements are clearly defined and standardized, and common data elements are included across data systems to allow for interoperability and aggregation. Our analysis of VA’s 14 data files identified the following three categories that reduced the reliability of the data: lack of data standardization, and lack of identifiers. We found that 7 data files we reviewed contained a majority of data within fields, but 5 data files were missing a significant amount of data within certain fields. We were unable to analyze the remaining two files due to a number of data-quality issues. Among the fields that were missing data were several that would be useful for analyzing misconduct, including complainant name, proposed action, and person of interest, as shown in table 4. For example, we found that in the OAR Legacy Referral Tracking List, 97 percent of the entries for the Proposed Action field (1,210 of 1,245) and 96 percent for the Disciplinary Action field (1,190 of 1,245) were blank. If available, comparison of the proposed and disciplinary action-taken fields would allow VA to assess whether actions are consistently implemented department-wide. However, the high percentages of blank values in multiple fields impair VA’s ability to conduct a comprehensive analysis of misconduct to identify and address trends. See appendix II for a further listing of the five data files and the corresponding fields that were missing data. In addition, we found that several data files had options such as “not applicable” or “no” for certain fields so that the field would not be left blank, but these options were not consistently used. For example, the Complainant Name field within the Legacy Referral Tracking List was blank for some entries and not applicable (N/A) for others. Accordingly, we did not know whether data were intentionally omitted or not entered by mistake. In addition, the Offense Sustained field found within the VA-Wide Adverse Employment Action and Performance Improvement Plan Database was blank for some entries and either a yes or no for others. Eight of the 14 data files we reviewed did not have key data elements that were defined within and across information systems. In other words, the data files contained entries that described similar information in different ways. For example: The Complaints Automated Tracking System (CATS) Employment data were not mutually exclusive, or independent of one another. For example, this field includes two distinct categories of information: employment status, such as full time or part time; or hiring authority, such as Title 5 or Title 38. This method of storing information resulted in undercounting each of the separate values due to the system’s inability to account for expected overlap. For instance, an employee could be both a full-time and Title 5 employee and the field only tracks one or the other. ORM officials stated that this field has since been modified to capture more options to account for the overlap. The NCA data file’s Action Proposed/Decided/Taken data were tracked in a single field and updated with the most-recent action, rather than capturing proposed actions, decided actions, and actions taken in separate fields. We also identified standardization issues with the newly updated VA- Wide Adverse Employment Action and Performance Improvement Plan Database. For example, we found 15 different variations of Registered Nurse, such as “Registered Nurse,” “Staff RN,” and “RN” position names. In addition, we found 28 alternate values that identified Diagnostic Radiologic Technologists (e.g., Diagnostic Radiologic Technologist, Diagnostic Radiological Technologist, and Radiologic Technologist). See appendix III for a description of the fields that did not have standardization within the eight data files. We determined that 5 out of the 14 data files did not have identifiers that would allow comparisons of information across systems. Identifiers are important because they reference one unique individual or case, which makes it possible to analyze historical data pertaining to all records with the same identifier and analyze trends in employee misconduct over time. For example: The OAR VA-Wide Adverse Employment Action Database and the VBA data files had a combined total of 4,487 closed cases of misconduct that received adverse corrective action during the combined period of November 2013 through December 2016. We found that these two data files did not contain unique identifiers for complainants or accused individuals for a given case. OAR officials stated that this system does not contain Personal Identifying Information since its purpose is to track proposed and taken adverse actions. If more-specific information is needed, OAR staff coordinate with the human-resource point of contact. Although OAR may obtain additional information, this information is not entered into the OAR VA-Wide Adverse Employment Action Database, which would assist with conducting analysis. VAPS tracks misconduct in two separate subsystems, one of which tracks traffic violations and other administrative offenses, and one of which also tracks more-egregious offenses such as criminal violations. These subsystems also do not have unique identifiers that would allow data matching between the two subsystems, which could impede the analysis of this information. Even with both files, there is no ready way to capture the complete number of individuals with misconduct in both files due to the lack of a shared identifier. The newly updated VA-Wide Adverse Employment Action and Performance Improvement Plan Database does not contain unique identifiers, such as employee identification number, name of the complainant or accused, or other linking variables, to allow for the analysis of historical trends or comparison of information among other information systems. The data-quality issues described above are due in part to most of VA information systems not having data dictionaries, field definitions, or other documented guidance and procedures on data entry and automated edit checks to control for erroneous entries and blank fields. Absent guidance and procedures, VA lacks assurance that employees will enter complete and accurate information in the various data systems. Further, the lack of unique identifiers such as employee identification number, case number, or other linking variables for each of the records does not allow for analysis of historical trends or comparison of information among different information systems. Consequently, this precludes VA from determining the frequency and nature of allegations by specified category, or identifying trends, thus impeding senior officials’ ability to analyze misconduct department-wide and develop corrective actions. VA Directive 5021, Employee/Management Relations, governs policy for disciplinary procedures for all employees and outlines the provisions for the adjudication of each disciplinary action and associated file documentation requirements. Specifically, files must be established before a notice of proposed adverse action is issued to the employee to document that the adjudication procedures were followed. The file must contain all available evidence upon which the notice of proposed action is based and that supports the reasons in that notice. In addition, each file should contain specific documentation related to the adjudication of employee misconduct. VA Handbook 5021 states that disciplinary actions and associated adjudication procedures for all VA employees appointed under Title 5 are governed by three basic principles: (1) an employee shall be informed in writing honestly and specifically why the action is being brought against him or her; (2) an employee shall be given a reasonable opportunity to present his or her side of the case; and (3) the employee and representative shall have assurance of freedom from restraint, interference, coercion, discrimination, or reprisal in discussing, preparing, and presenting a defense. Our review of a generalizable sample of 544 misconduct case files (from a universe of 23,622 files) associated with disciplinary actions that affect pay from October 2009 through May 2015 revealed that VA officials did not consistently adhere to VA’s policy for retaining files containing evidence of misconduct. Specifically, VA was unable to provide the files for 10 percent (55 of 544) of the files we requested. We determined that administrations and program offices within VA have various record- retention schedules. Offices that have not established a record-retention schedule refer to the general records schedule developed by the National Archives and Records Administration (NARA). However, we found that some offices are misinterpreting OPM and NARA guidance and specify the record retention period for adverse action files as a range between 4 to 7 years rather than selecting a specific number of years in their record- retention schedules. All of the files were within VA’s record-retention range specified during the time of our review. The files that were unaccounted for were dispersed throughout most of the VISNs, but one VISN was not able to account for 19 of the missing files in our sample. On the basis of our weighted analysis of the generalizable sample, we estimate that VA would not be able to account for approximately 1,800 files in the full population that were within the record-retention period specified. In addition, VA officials did not consistently adhere to VA’s policy for documenting that procedures were followed in the adjudication of misconduct cases. We identified 22 out of 36 file requirements where VA was not able to consistently demonstrate compliance with VA policy due to the lack of documentation contained in files, based on our generalizable sample. Specific to both Title 5 and Title 38 permanent- employee misconduct case files, table 5 shows the estimated number and percentage that deviated from file documentation requirements. A list of the 22 identified requirements and the percentage of files not in compliance can be found in appendix IV. As table 5 indicates, Title 5 and Title 38 permanent employee files did not always contain documentation that employees were informed of the reason the action was brought against them. For example, on the basis of our generalizable sample, we estimate that the advance notice of proposed action, which includes a statement of the specific alleged misconduct upon which the proposed action is based, was not included in 16 percent of the files department-wide. A final decision letter, which contains a statement of the decision official’s determination regarding which charges, if any, in the advance notice were sustained, was not included for an estimated 15 percent of all files. Further, an estimated 35 percent of all files did not include a written acknowledgement from the employees that they received the final decision letter in person, and an estimated 23 percent of all files did not include the required return receipt for certified mail indicating that the decision letter was mailed to the employee. In addition, Title 5 and Title 38 permanent employee files did not always contain documentation that employees were provided a reasonable opportunity to present their side of the case. Our review found that permanent-employee disciplinary files did not adhere to basic principles outlined in VA Handbook 5021 and lacked evidence to demonstrate that employees were adequately informed regarding their rights during the adjudication procedure. Specifically, our generalizable sample found that an estimated 21 percent of all files did not include statements regarding the employee’s rights to due process, such as his or her entitlement to be represented by an attorney or other representative. In addition, an estimated 8 percent of all files did not mention that more information regarding appeal rights could be obtained by consulting Human Resources Management offices. For files where the employee provided an oral reply in response to proposed disciplinary action, an estimated 29 percent of files did not include the required written summary, which is to be signed by the official hearing the oral reply. Where a written reply was submitted, an estimated 11 percent of files did not include a copy of the employee’s written reply. Further, VA officials did not consistently adhere to VA’s best practices specific to Title 5 permanent employees only. We found that in a majority of these files (an estimated 72 percent) the proposal letters did not include a statement that assured the employee he or she had freedom from restraint, discrimination, or reprisal in discussing, preparing, and presenting a defense. VA Handbook 5021, Employee/Management Relations, also states that Title 5 employees should provide their written responses through supervisory channels to the decision official. We estimate that a total of 6,819 files (47 percent) of Title 5 permanent employee files did not provide their written reply through supervisory channels to the decision official. Although OHRM is responsible for assessing the effectiveness of department-wide human resource programs and policies of VA Handbook 5021, according to OHRM officials, each facility is responsible for oversight of implementing policies and guidelines pertaining to how disciplinary actions are processed. We found no evidence that OHRM has assessed whether documentation exists that demonstrates adherence to policy governing cases involving disciplinary actions or provided oversight of VA’s implementation of record-retention requirements, or that human- resource personnel adhere to basic principles outlined in policy to ensure employees are informed of their rights during the adjudication process. The resulting lack of oversight to HR policies increases the risk that employees will not be adequately informed of their rights during the adjudication process. Accordingly, employees may not (1) be provided with information on why an action is being brought against them, (2) be provided with a reasonable opportunity to present their case, and (3) be adequately protected from potential reprisal in preparing their defense. Regarding retention of records, according to NARA, disciplinary and adverse action case files should be destroyed no sooner than 4 years but no later than 7 years after the case is closed. According to OPM, to implement this authority, each agency must select one fixed retention period between 4 and 7 years and publish the retention in the agency’s records disposition manual. We determined that some offices are misinterpreting OPM and NARA guidance by not selecting a specific number of years in their record- retention schedules. For example, three of the six policy record-retention schedules we reviewed did not establish a specific number of years for record retention. Specifically, record-retention policies for the Office of Information and Technology, VACO staff offices, and VBA specified the record-retention period for adverse action files as a range between 4 to 7 years rather than selecting a fixed retention period. For example, we found that the Records Control Schedule pertinent to VACO was dated June 30, 1967, without references to new or revised items since 1969. Our results are consistent with an October 2016 inspection conducted by NARA. The inspection report contained 16 findings and 19 recommendations for improvement of the records-management program at VA. Among the findings and recommendations were the following. Finding: The VA records management program has not ensured that the VACO maintains a current Records Management Handbook and a current Records Control Schedule, which together establish program objectives, responsibilities, and authorities for the creation, maintenance, and disposition of agency records. Recommendation: The Department Records Office must update and maintain the VACO handbook and the Records Control Schedule for Central Office Staff Offices and the Offices of the Assistant Secretaries to include specific Records Management roles and responsibilities for all VACO staff and to include mandates for implementation of records management policies and procedures in accordance with Federal statutes and regulations. Finding: The VA Departmental Records Management program does not conduct regular records management evaluations within VACO and the Offices of the Secretary and Assistant Secretaries or monitor the oversight activities of the Administrations. Recommendation: The VA Departmental Records Management program, working with the Administrations, VACO, and Enterprise Risk Management, must establish effective Records Management evaluation programs to monitor VA compliance with Federal regulations. Recommendation: The VA Departmental Records Management program, working with the Senior Agency Official for Records Management, must establish effective Records Management evaluation programs to monitor the records management practices within the Office of the Secretary and Assistant Secretaries to ensure compliance with Federal regulations. Finding: VACO Staff Offices and the Offices of the Assistant Secretaries are not routinely conducting records inventories. Recommendation: VACO Staff Offices and the Offices of the Assistant Secretaries, with support from the Department Records Management program, must conduct inventories of existing electronic and non-electronic records to identify scheduled, unscheduled, and vital records. In response to NARA findings, VA is to submit a plan of corrective action that specifies how the agency will address each inspection report recommendation, including a timeline for completion and proposed progress reporting dates. VA does not have a method in place to evaluate the implementation of records-management practices outside of those being conducted by VHA and VBA. Accordingly, VA has not been conducting records-management oversight with any uniformity department-wide. Further, VA’s use of multiple retention periods for adverse action files, and in some cases the lack of adherence to OPM and NARA guidance in defining a specific retention period for these files, results in inconsistent retention of these files across VA. The OIG receives allegations of employee misconduct from VA employees, the OSC, members of Congress, the public, and other stakeholders. When the OIG receives allegations it can either take no further action, open an investigation, or refer the case to facility or program offices within VA for review and response. For cases referred to facility or program offices, the OIG has developed a policy for VA facilities and program offices to use when investigating allegations of misconduct. This policy includes six elements that VA facility and program officials are to incorporate in their investigations, as shown in table 6. According to OIG officials, if the reviewing employees have concerns about the adequacy of the response provided, the OIG can either ask for additional information to supplement the response or open an internal case. Departmental heads (Under Secretaries for Health, Benefits, and Memorial Affairs, Assistant Secretaries, and other key officials) are responsible for ensuring that referrals are properly reviewed, documented, and answered within specified time frames. Our review of the 23 OIG cases of alleged misconduct between calendar years 2011 and 2014 involving senior officials found that VA facility and program offices did not consistently follow policies and procedures established by the OIG for investigating such allegations. In several instances, VA facility and program offices did not include one or more of the six elements required in their investigative response to allegations of misconduct. In addition, our review of the 23 cases found instances in which VA facility and program offices did not include sufficient documentation for their findings, or provide a timely response to the OIG. The OIG was not able to produce the documentation provided by the facility or program office that was used to close 2 of the 23 cases in our review. All of the requested files were within the OIG’s 7-year record- retention period during the time of our review. As shown in table 7, we identified four cases that did not contain evidence of an independent review by an official separate from and at a higher pay grade than the accused. In three of the four cases that were not reviewed by an independent official at a higher grade, the review was performed by the medical center director, who was one of the accused named in the allegation. For example, in one case involving alleged time-and-attendance abuse by a physician, the medical center director, who was also named in the allegation as having received a similar complaint against the physician 2 years earlier, reviewed the allegations made against the physician and himself. The documentation provided showed that the medical center director conducted the investigation of allegations and found the allegations were not substantiated and no corrective actions were implemented. In all four cases, both the independence and higher-grade criteria were not followed when the accused senior officials investigated allegations against themselves. As shown in table 8, we generally found that VA facility and program offices reviewed each allegation contained in the original referrals, although in one case the reviewer did not respond directly to all allegations. As shown in table 9, VA facility and program offices clearly indicated their findings for each allegation in 14 of the 21 cases of misconduct involving senior officials for which files could be located, as well as their assessment of whether the allegations were substantiated or unsubstantiated. However, we identified seven cases in which VA discussed its findings but did not provide a clear indication of whether all allegations were substantiated or unsubstantiated. Responses lacking a clear statement of substantiation may be more difficult for subsequent reviewers, including OIG and OAR investigators, to track and perform follow-up where necessary. For example, in one case involving 11 allegations, no statement of substantiation was provided, but VA’s response included seven recommendations, three of which involved disciplinary action. We did not find evidence in the case file that follow-up was performed by the OIG personnel to clarify this discrepancy, and the case was closed. As shown in table 10, most allegations involving senior officials (16 of 21 cases for which files could be found) were not formally substantiated and did not require a recommendation for corrective action based on OIG case-referral criteria. Specifically, the criteria require a description of corrective actions taken or proposed as a result of substantiated allegations, but make no mention of allegations that were not substantiated as part of VA’s response. For one substantiated allegation, however, we found no evidence of a recommendation for corrective action. Table 11 shows that 17 cases from VA facility and program offices did not provide the supporting documentation they used to reach their conclusions about the OIG case referrals. In 17 cases, including one case reviewed by an AIB panel, VA referenced documents reviewed but did not attach any of the supporting evidence. OIG case-referral criteria state that VA facility or program offices must provide supporting documentation used in their review, such as copies of pertinent documents. However, the criteria do not specify whether copies of all documentation reviewed must be included in the file. Supporting documentation, which must be provided according to OIG policy, will vary depending on the circumstances of the case, but those used to support the findings and recommendations should be included. For example, we reviewed one case where pertinent documents were referenced to support the allegation, but documents supporting the findings and recommendation were not included. The case contained allegations involving false patient wait-time documentation and abuse of authority. Specifically, a medical center director instructed staff to review patient wait times between follow-up appointments in order to meet VA’s 14-day timeliness metric. The investigation revealed that VA staff had changed several hundred veteran appointment wait times. The investigation concluded that the false documentation allegation was substantiated, but attributed the cause to the staff not understanding how to enter a follow-up appointment date into the system. However, there was no documentation in the files to support (1) that the medical center director had not abused his authority by instructing staff to review wait times greater than 14 days to determine how they could be reduced, and (2) findings for the conclusion that the original wait times were entered in error. Absent supporting documentation, it is difficult for the OIG to determine whether enough evidence was gathered before closing alleged cases of misconduct that were found to be unsubstantiated or closing substantiated cases of misconduct that required further action. VA Directive 0701 states that copies of voluminous transcripts of interviews, the entire claims folder, and medical charts are not necessary. However, VA Directive 0701 further states that such materials should be available if the OIG subsequently requests them within the record-retention period. Case examples of allegations reviewed, and subsequently closed, by the VA OIG based on its evaluation of evidence provided by facility and program offices in response to allegations of misconduct can be found in appendix V. As shown in table 12, VA facilities’ or program offices’ response letters, which were sent to the OIG, included a point of contact for further questions in 15 of the 21 OIG case referrals involving senior officials, including the individual’s name and a means of contact (phone or e-mail). In 2 of the 15 cases where a point of contact was provided, the contact was also one of the accused in the allegation. Although that is not technically a violation of OIG criteria, it likely presents a conflict of interest in regard to independent reviewers obtaining objective case information. In six other cases, no contact was listed, although the letter was signed by the reviewer. If a specific point of contact is not identified, including position title, it may be assumed erroneously by employees involved in the case, or following up on the case, that the default contact is the reviewer, who may not be the appropriate point of contact, and may or may not be able to provide objective case information. OIG guidelines state that VA facilities and program offices assigned Hotline case referrals are responsible for reporting written findings to the Hotline Division within 60 days, unless an extension is requested. Our review of the 21 cases found instances in which VA facility or program offices did not always provide a timely response to the OIG. Table 13 shows five instances in which VA facility or program offices submitted a response after the deadline requested by the OIG. One response was not reported timely after an extension was provided by the OIG. In one of the five cases involving allegations of abuse of authority by a VA medical center director, the reviewer requested an extension, which is permitted by OIG policy, but still missed the revised deadline. The five case files did not contain any information regarding any follow-up actions taken in response to delays. According to OIG officials, when a case has been referred to a program office for investigation, the OIG reviews the program office’s response for completeness and sufficiency before closing the case. However, there is no requirement for the OIG to ensure that the responses contain the six elements listed in VA Directive 0701 and confirm that case referral allegations have been addressed. Consequently, the lack of verification could have contributed to insufficient evidence that does not meet the requirements outlined by the OIG. Additionally, VA facility and program offices have not consistently adhered to VA Directive 0701 policy and do not always provide supporting documentation for their findings and recommendations, or always provide a timely response when reporting findings to the OIG’s Hotline division. Inconsistent adherence to the reporting standards provided by the OIG to VA facilities and program offices for investigating and resolving misconduct case referrals from the OIG Hotline impedes VA’s ability to ensure that misconduct cases are being handled appropriately. According to OIG officials, the OIG has taken steps to enhance the review of case responses. Specifically, OIG officials stated that in April 2018 the OIG implemented a new Enterprise Management System to reduce reliance on certain manual processes. According to OIG officials, Hotline analysts will now have more time to review their work and perform other quality-assurance activities. In implementing this new system, it will be important for the OIG to consider how the system can assist in ensuring requirements are met and responses are received timely. Our review of VA’s information systems that track misconduct involving senior officials department-wide indicates that they may not always be held accountable for misconduct. Specifically, (1) misconduct was sometimes substantiated, but the proposed disciplinary action was not taken; (2) misconduct was sometimes substantiated, but no disciplinary action was recommended; (3) previous penalties did not have the corrective effect for officials found to have engaged in repeated acts of misconduct and who have remained in VA management positions; and (4) senior officials violated separation-of-duty policy when taking disciplinary action. VA Handbook 5021 allows the deciding official to determine the appropriate disciplinary action if one or more allegations are substantiated. However, the disciplinary action may not be more severe than what had been proposed. In several cases, misconduct was substantiated, but the proposed action was not always taken. Our review of the OAR Legacy Referral Tracking List identified 17 officials between calendar year 2011 through May 2015 with substantiated misconduct where action was proposed. However, in some of these cases, the officials were given a lesser penalty than the one proposed, while in other cases there is no evidence that action was taken. As shown in figure 3, we found that for 12 of the 17 officials with substantiated misconduct, an adverse disciplinary action (removal) was proposed. Of those 12 officials, 3 were removed, 2 received a suspension, 4 received a reprimand or admonishment, 2 were allowed to resign or retire before receiving disciplinary action, and we found no evidence of disciplinary action for the remaining individual. For the other 5 officials, actions such as counseling, admonishment, suspension, or reprimand were proposed. Of the 5 officials, 2 received the actions that were proposed, 1 received a lesser penalty than what had been proposed, 1 was allowed to retire before receiving action, and we found no evidence of the proposed action for the remaining individual. For the two officials for whom there was no evidence that disciplinary action was taken, we found no evidence within the PAID information system or personnel files that these officials received the action proposed in the OAR Legacy Referral Tracking List. Counseling was proposed for one official, and removal from the position for the other official. OAR did not provide us with evidence that the officials had received the action proposed. We also reviewed an additional 15 cases that involved a fact-finding or an AIB. Our review of these cases found that 11 out of 23 officials were associated with instances of substantiated misconduct and proposed action was recommended. For 4 of the 23 officials where the proposed action field was populated, the information within the OAR Legacy Referral Tracking List reflected the action recommended. The applicable data fields for the remaining 19 officials within the OAR Legacy Referral Tracking List were not in agreement with the action recommended, or blank. This review also identified two officials with substantiated misconduct where OAR did not provide evidence that the disciplinary action proposed was taken: Two officials were involved in a case concerning alleged whistle- blower retaliation at the Phoenix VA Health Care System. The investigative report documented that allegations were sustained. The retaliation included allegations of involuntary reassigning the whistle- blower to another position, placement of the whistle-blower on administrative leave, and lowered performance pay ratings following disclosures regarding poor patient care and nursing triage errors. Appropriate administrative action for persons identified as having engaged in retaliation was recommended. We did not find any evidence in the PAID system that these two officials involved in retaliation received disciplinary action. OAR provided documentation to show that no action was taken against one official, and was unable to provide documentation to show that the disciplinary action had been taken for the other. The official who received no action received approximately $11,500 in performance pay during a 2-year period following the allegations. OAR’s quality-review process for investigative reports does not ensure that reports with findings of substantiated misconduct include recommendations for action. Our review of OAR’s Legacy Referral Tracking List identified 70 out of 1,245 closed cases involving officials where misconduct was either substantiated, or partially substantiated, but no disciplinary action was recommended. One case involved three allegations of poor dental care provided to patients by three different senior officials. One physician cut underneath a patient’s tongue with the bur of a hand-piece drill (substantiated), another administered medication the patient was allergic to (partially substantiated), and the final senior official extracted the wrong tooth (substantiated). We did not find any evidence in the PAID system that these senior officials received disciplinary action. Further, OAR did not provide documentation to show that any disciplinary action had been proposed or taken. The physician that cut underneath a patient’s tongue received performance pay totaling $15,000 approximately 6 days after the investigation had concluded that misconduct was substantiated. As of March 2018, two of these senior officials received performance pay, and appear to still be employed at VA. While an investigation was conducted that substantiated (or partially substantiated) the allegations, there is an increased risk that some substantiated misconduct will go unaddressed if there is no recommendation for corrective action. Our review of OAR’s Legacy Referral Tracking List indicated that some officials who had been disciplined for misconduct remained in positions where they were responsible for proposing or deciding disciplinary action for other employees. We identified 15 officials in the OAR VA-Wide Adverse Employment Action Database who received disciplinary action between 14 days to 1 year prior to proposing disciplinary action for another employee. Most of the 15 officials (12 officials) had received a suspension. We also found that five officials in the OAR Legacy Referral Tracking List had received prior disciplinary actions for offenses unrelated to the new OAR allegations. A prior history of disciplinary actions indicates that some officials may be repeat offenders for whom the previous penalties did not have the desired corrective effect. For example, 4 out of 5 officials were suspended for a different offense prior to being the subject of a new allegation. One of the four officials was suspended less than 2 months prior to being the subject of a new allegation, while another received a suspension before, and again approximately 7 months following, the OAR allegation. According to VA Handbook 5021, the deciding official must use the “Douglas” factors, which include the employee’s past disciplinary record, to determine a reasonable penalty. One of the five VA officials was eventually removed approximately 6 months after the new OAR allegation. In analyzing cases involving senior management, we noted that the OAR Legacy Referral Tracking List often did not accurately reflect the disciplinary action that was decided based on the results of the investigation. In numerous instances for the OAR Legacy Referral Tracking List, the applicable data fields indicating the proposed and final disciplinary action were blank. In these cases where the disciplinary fields were populated, the data usually did not agree. Specifically, for 32 out of the 40 records we reviewed where misconduct was substantiated, the final disciplinary action taken did not reflect the information within the OAR Legacy Referral Tracking List. When disciplinary actions are taken in response to findings of misconduct but are not entered within an appropriate information system, or are inaccurately recorded, it is more difficult to (1) monitor whether disciplinary actions have been implemented, and (2) ensure information relevant to management for making decisions is available. Further, without a prior record of misconduct or disciplinary action, senior officials who are repeat offenders may not receive the appropriate penalty required. Pursuant to the Department of Veterans Affairs Accountability and Whistleblower Protection Act of 2017, OAWP will now be responsible for receiving, reviewing, and investigating allegations of misconduct, retaliation, or poor performance involving senior officials. According to OAWP officials, their office investigates allegations of misconduct at the senior level only. OAWP officials also stated that misconduct issues that occur below the senior level will be referred to each of the three major VA administrations for investigation and resolution. In addition to the VA- Wide Adverse Employment Action and Performance Improvement Plan Database, OAWP officials stated that it has implemented two additional information systems that are used concurrently to capture case information. OAWP officials stated that they are currently working with VA Information Technology to assess options for other case-management systems that could consolidate these three information systems into one comprehensive system. VA Handbook 5021, Employee/Management Relations, states that the decision on a proposed major adverse action will be made by an official who is in a higher position than the official who proposed the action, unless the action is proposed by the Secretary. Standards for Internal Control in the Federal Government states that management should divide or segregate duties among different people. Our review of the OAR VA-Wide Adverse Employment Action Database, OAWP VA-Wide Adverse Employment Action and Performance Improvement Plan Database, and VBA data file identified examples where VA officials did not follow separation-of-duty requirements. As shown in table 14, 73 (out of an estimated 7,886) VA officials acted as both the proposing and deciding official in cases involving removals for employees found to have engaged in misconduct. Fourteen VA officials acted as both the proposing and deciding official in two or more cases. One of these 14 officials acted as both the proposing and deciding official for seven different removal cases. Further, our review of 29 VA officials found that none received disciplinary action for violating separation-of-duty policy. The systemic lack of adherence to VA’s separation-of-duty policy is reflective of a lack of controls that would allow such activity to occur. Focusing on ensuring such controls are implemented would help ensure that VA decreases the risk of abuse when officials act as both proposing and deciding officials. VA has procedures in place to ensure that allegations of misconduct are investigated, but these procedures allow VA program offices or facilities where a whistle-blower has reported misconduct to conduct the investigation. According to VA officials, investigations that are deemed necessary are occasionally ordered directly from the head of the facility or VA leadership, which takes the lead on an investigation into the allegation. Alternatively, an OIG official stated if allegations of misconduct are received by the OIG, the OIG has the option of investigating the allegation or exercising a “right of first refusal” whereby it refers allegations of misconduct to VA facilities or program offices where the allegation originated to complete an independent review and provide a response to the OIG. As shown in figure 4, the majority of contacts the OIG received (127,265 out of 133,435) from calendar years 2010 through 2014 were not investigated due to several reasons, such as insufficient evidence or lack of jurisdiction. Of those contacts that were investigated, the majority (4,208 of 6,170 investigated contacts) were not investigated by the OIG but rather were referred to facility or program offices for investigation. Whistle-blowers also have the option of reporting alleged misconduct outside VA by filing a disclosure with the OSC, and may do so if they believe there has not been a resolution to their complaint internally. If the OSC determines that there is substantial likelihood of wrongdoing, it may refer the disclosure back to the Secretary of Veterans Affairs for further investigation. According to OSC officials, as a general policy, the OSC will not refer a disclosure to the Secretary if the OIG is already conducting an investigation of that particular complaint and defers to the OIG to finalize the investigation. According to OIG officials, the OIG may, in turn, exercise its “right of first refusal” when cases are referred from the OSC. Consequently, this process can result in a disclosure that was originally made to the OSC being referred back to the facility or program office where the allegation originated. As shown in figure 4, the OSC referred 172 of 942 disclosures (18 percent) filed by VA employees back to the Secretary of Veterans Affairs for further investigation from calendar years 2010 through 2014. Of the 172 disclosures referred, VA referred 53 back to the facility or program offices where the complaint originated and 119 to the OIG. The independence of officials conducting or reviewing the results is paramount to the integrity of the process both in deed and appearance. According to VA Directive 0700, the decision whether to conduct an investigation should not be made by an official who may be a subject of the investigation, or who appears to have a personal stake or bias in the matter to be investigated. Moreover, according to OIG policy, investigations referred to VA offices must be reviewed by an official independent of and at least one level above the individual involved in the allegation. VA does not have oversight measures to ensure that all referred allegations of misconduct are investigated by an entity outside the control of the facility or program office involved in the misconduct, to ensure independence. VA OIG officials acknowledged that there have been concerns about referring cases back to the chain of command because the OIG is unsure where cases go once they are referred. The investigation of allegations of misconduct by the program office or facility where the complaint originated may present the appearance of a conflict of interest in which managers and staff at facilities may investigate themselves or other allegations where they may have a personal stake or bias in the matter to be investigated. Consequently, there may be an increased risk that the results of the investigation are minimized, not handled adequately, or questioned by the OSC or the individual who made the original allegation. According to VA Directive 0700, significant incidents occurring, and issues arising, within VA facilities or offices shall be reported and investigated as necessary to meet the informational and decision-making needs of VA. Primary responsibility in this regard rests with the chief executives of the facility or staff office involved, and with their supervisors in VA and its administrations. According to an OIG official, VA (the Secretary or a delegate) sends disclosures received from the OSC to the OIG, which may then refer to VA facility or program offices for further review and investigation. According to OSC officials, for cases that are referred to a program office, the OSC requires that the Secretary or delegate provide a report that outlines its conclusions and findings. This reporting is not required for disclosures where an ongoing OIG investigation is already under way. According to OSC officials, for each disclosure, the OSC is to review the report for statutory sufficiency and determine whether the findings of the agency head appear reasonable. The OSC is to send its final determination, report, and any comments made by the whistle-blower to the President and responsible congressional oversight committees. The OSC has raised concerns in its reports to the President about investigations conducted by VA program offices and facilities. Of the 172 whistle-blower disclosures referred by the OSC between calendar years 2010 through 2014, the Secretary of Veterans Affairs referred 53 to facility and program offices. Our review of these 53 OSC reports found that the OSC had concerns about the conclusions VA reached in 21 (40 percent) of the 53 disclosure cases. For example, the OSC found that the conclusions in some VA reports were unreasonable because VA reached its conclusion without interviewing the witness, provided shifting explanations that strained credibility and did not provide evidence of an unbiased investigation, ignored whistle-blower concerns by refusing to investigate allegations, and refused to acknowledge the impact on the health and safety of veterans seeking care after confirming problems in these areas. For disclosure cases that were referred from the OIG to facility and program offices during the 2010–2014 time frame of our review, the OIG acknowledged that these concerns arose because of a lack of communication between the department and the OIG regarding the scope of the review. At the time of our review, VA did not have a procedure in place to ensure the conclusions reached for investigations involving OSC disclosure cases are reasonable and meet the informational and decision- making needs of VA whereby all allegations are addressed. More recently, the OIG has started to communicate the scope of its reviews that involve matters referred by the OSC to the Office of the Secretary. In implementing this new process, it will be important for the Office of the Secretary to ensure that any allegations outside the purview of the OIG’s investigation are fully addressed by a departmental entity in accordance with OSC requirements. As shown in figure 4, of the 172 disclosure cases referred to VA by the OSC, a total of 119 cases were referred to the OIG. The OIG had conducted, or was already conducting, an investigation of the particular allegations for all 119 disclosures. Since these 119 disclosure cases were already under investigation by the OIG, the OSC deferred to the OIG’s investigation for these cases. A total of 37 of these 119 disclosure cases that were referred to the VA OIG were submitted to the OSC anonymously. Therefore, we were unable to conduct a review of these investigations because there was no information available to identify the individuals involved. According to Standards for Internal Control in the Federal Government, management’s ability to make informed decisions is affected by the quality of information. Accordingly, the information should be appropriate, timely, current, accurate, and accessible. The oversight body oversees management’s design, implementation, and operation of the entity’s organizational structure so that the processes necessary to enable the oversight body to fulfill its responsibilities exist and are operating effectively. Our review of the remaining 82 disclosure cases determined that the OIG does not have procedures in place to track cases that were referred from the OSC for further investigation. According to OIG officials, the OIG’s information system did not have a method in place to ensure that OSC case numbers are linked to the OIG investigative case number and final report. Consequently, the OIG was unable to produce the investigative documentation for these 82 disclosures. According to OIG officials, OSC case numbers and associated Hotline numbers are currently tracked in a spreadsheet until the implementation of a new system. The inability to locate investigative documentation prevents a third party from verifying whether the OIG examined the disclosures, whether any recommendations were addressed, or whether appropriate disciplinary action was taken for these cases. In addition, because the OSC defers to the OIG’s investigation for allegations that were already conducted, or being conducted, the OSC and individuals that made the allegations do not have documentation to demonstrate that the allegations were addressed. This information, or lack of it, has direct influence on management’s ability to make sound decisions relating to investigative matters. Pursuant to the Department of Veterans Affairs Accountability and Whistleblower Protection Act of 2017, OAWP will be responsible for recording, tracking, reviewing, and confirming implementation of recommendations from audits and investigations involving whistle-blower disclosures, including the imposition of disciplinary actions and other corrective actions contained in such recommendations. According to OAWP officials, the whistle-blower disclosure process will be similar to the current process when cases are referred to facility and program offices for investigation. OAWP will follow up on any open points with the level of leadership that is most appropriate in each case, such as the medical center or VISN director. Case details will be tracked through the three active databases that are being used concurrently. OAWP is currently working to develop an internal process that will bring the investigative communities together. For instance, OAWP would like to monitor cases that are referred to VA facility and program offices, but it does not currently have documented criteria to guide the process. According to OAWP officials, OAWP is finalizing new policies in the form of a policy manual and handbook. However, these officials were unable to provide a time frame for completion of the published guidance. Our analysis of VA data shows that individuals who filed a disclosure of misconduct with the OSC received disciplinary action, and left the agency, at a higher rate than the peer average for the rest of VA. We identified 135 disclosure cases that were received by the OSC between calendar years 2010 and 2014 and were alleging misconduct. Of the 135 disclosures, a total of 129 employees made a total of 130 disclosures nonanonymously. We compared the 129 employees who made nonanonymous disclosures to the PAID information system using the complainants’ information. As shown in table 15, on average approximately 1 percent of all employees in the VA roster received an adverse action in any given fiscal year. For the 129 nonanonymous whistle-blowers, we found that approximately 2 percent received an adverse action in the fiscal year prior to their disclosure, while 10 percent had received an adverse action in the fiscal year of their disclosure, and 8 percent received an adverse action in the year subsequent to this disclosure. While the fact that nonanonymous whistle-blowers faced higher rates of adverse action subsequent to their disclosure than the VA population as a whole is consistent with a pattern of retaliation for nonanonymous whistle-blowers, it is only an indication that retaliation could be occurring. Our analysis also showed that among employees who could be matched to the PAID end-of-year roster, attrition rates were higher for those individuals who filed a nonanonymous disclosure with the OSC. On average, approximately 9 percent of all VA employees on the end-of-year roster in one fiscal year were not on the subsequent year’s roster. In contrast, 66 percent of the 129 nonanonymous whistle-blowers did not appear in the subsequent year’s roster. Attrition rates were higher among employees who had filed a disclosure than among their peers who had not filed disclosures, for all fiscal years in our review (see table 16). Our analysis did not confirm the reasons for disciplinary action or attrition involving any of the 129 employees who made nonanonymous disclosures to the OSC. According to VA officials, employees who have a history of poor performance or conduct may be more likely to file a disclosure with the OSC or allege misconduct, which could explain some of the disparities between whistle-blowers and other employees. However, we also could not rule out instances where retaliation by senior officials may have occurred after misconduct was disclosed. The Civil Service Reform Act of 1978, as amended, states, among other things, that federal personnel management should be free from prohibited personnel practices (PPP). The law also authorizes the OSC to investigate allegations involving PPP that include reprisals against employees for the lawful disclosure of certain information pertaining to individuals who engage in such conduct or other wrongdoing. According to Standards for Internal Control in the Federal Government, laws and regulations may require entities to establish separate lines of communication, such as whistle-blower and ethics hotlines, for communicating confidential information. Management informs employees of these separate reporting lines, how they operate, and how they are used, and how the information will remain confidential. Reporting lines are defined at all levels of the organization and provide methods of communication that can flow down, across, up, and around the structure. Our interviews with six VA whistle-blowers who claim to have been retaliated against provided anecdotal evidence that retaliation may be occurring. Whistle-blowers we spoke to alleged that managers in their chain of command took a number of actions that were not traceable to retaliate against the whistle-blowers after they reported misconduct. These alleged actions included being reassigned to other duty locations or denied access to computer equipment necessary to complete assignments, and socially isolating these individuals from their peers, among other things. Whistle-blowers we spoke to also expressed concerns regarding the lack of guidance available to employees about how to file a disclosure through VA and the OSC. Whistle-blowers stated that employees are not provided adequate information on how to document or file a claim of misconduct or retaliation. Employees can file disclosures regarding misconduct and complaints of retaliation through multiple reporting lines. As mentioned previously, however, the OSC will generally not refer to the Secretary under its statutory process a disclosure if the OIG has conducted or is already conducting an investigation of that particular complaint. Thus, whistle-blowers may limit their chance of having an independent, non-VA entity oversee their complaint if they file a complaint with the OIG first. The Department of Veterans Affairs Accountability and Whistleblower Protection Act of 2017 requires the Secretary, in coordination with the Whistleblower Protection Ombudsman, to provide training regarding whistle-blower disclosures to each employee of VA. This information shall include, among other items, an explanation of each method established by law in which an employee may file a whistle-blower disclosure, an explanation that the employee may not be prosecuted or reprisal taken against him or her for disclosing information, and language that is required to be included in all nondisclosure policies, forms, and agreements. The Secretary shall also publish a website and display the rights of an employee making a whistle-blower disclosure. In August 2017, VA began providing additional information on its website for potential whistle-blowers who wish to report criminal or other activity to the OIG. The information provided focuses on reporting misconduct to the OIG and provides other lines of reporting established by law in which an employee may file a whistle-blower disclosure, such as directly to an immediate supervisor or the OSC. In addition, the information provided explains the process after misconduct is reported through the OIG Hotline, but does not clarify the process for referred disclosure cases received from the OSC. As mentioned previously, OIG officials stated that a disclosure made to the OSC or the OIG can be referred back to the facility or program office where the allegation originated, which may compromise confidentiality. Consequently, employees may not be aware that their information may be shared among the OSC, the OIG, OAWP, or VA facility and program offices when a disclosure is made to the OSC. Adequately communicating the investigative process to employees may alter their decision to report wrongdoing. Without a clear understanding of the lines for reporting misconduct and how they operate, whistle-blowers may be uncertain as to their options for reporting misconduct, which increases the risk that they may not report workplace misconduct. According to OSC, it has learned through its cases that OAWP has a practice of allowing VA employees, who are the subject of the allegations brought forward by whistle-blowers to review or participate in investigations, or both, which could make the whistle-blower feel uncomfortable or intimidated. This practice has led to confusion regarding the role and responsibilities of OAWP personnel. OAWP’s use of VA employees that are employed at the facility under investigation in the review of allegations creates the possibility of a conflict of interest or an appearance of a conflict of interest. For example, in a case OSC described in its comments on a draft of our report, an OAWP representative who was also associated with the human-resource office at the VISN that oversees the whistle-blower’s facility, placed the whistle- blower under oath and questioned her about issues unrelated to the referred allegations. OSC has since sought clarification of OAWP’s role and the OAWP employee’s possible connection to the VISN. While VA collects data on some types of disciplinary actions, it is limited in its ability to use those data because it does not collect all misconduct and associated disciplinary-action data through a single information system, or multiple interoperable systems. Absent a process to collect such data department-wide, VA does not have the ability to analyze and report data systematically. In addition, the data currently collected are not always reliable or useful. The inclusion of appropriate documented guidance and standardized field definitions would help to ensure VA collects reliable misconduct and associated disciplinary-action data. With high-quality information that is accurate and comprehensive, VA management would be better positioned to make knowledgeable decisions regarding the extent of misconduct occurring and how it was addressed, department-wide. VA has not ensured that program and facility human-resources personnel adhere to policy governing documentation contained within evidence files to support conclusions reached. In addition, VA often had no record of the evidence involved with the adjudication of these actions and could not verify whether these individuals received reasonable and fair due process. The absence of documentation in some files also raises the possibility that VA may not always be in compliance with its procedures for governing the adjudication of alleged employee misconduct. Additionally, ensuring that human-resources personnel adequately inform employees of their rights during the adjudication process would provide them with a reasonable opportunity to present their case when preparing their defense. VA also does not consistently adhere to OPM and NARA guidance in defining a specific retention period for adverse action files. This results in an inconsistent retention of these files across VA which complicates department-wide analysis. VA’s inconsistent adherence to the standards provided by the OIG to facilities and program offices for investigating and resolving misconduct cases increases the risk that misconduct case are not being handled appropriately. Additionally, the lack of verification of responses received to ensure documentation supports findings and recommendations has contributed to evidence that does not always meet the requirements outlined by the OIG. Finally, timely responses are not consistently provided when facility and program offices report findings to the OIG’s Hotline Division. OAR did not monitor whether substantiated instances of misconduct involving senior officials received disciplinary action. OAR’s Legacy Referral Tracking List also did not accurately reflect the disciplinary action that was decided based on the results of the investigation. When disciplinary actions are taken, in response to findings of misconduct, but are not entered within an appropriate information system, or are inaccurately recorded, it is more difficult to monitor whether disciplinary actions have been implemented in substantiated instances of misconduct involving senior officials. As demonstrated, this may result in no action being taken for substantiated misconduct or the previous penalties not having the corrective effect for repeat offenders. There is also an increased risk that substantiated misconduct will go unaddressed if there is no recommendation for corrective action. Further, VA also does not have internal controls to ensure adherence to proper separation-of-duty standards involving the removal of an employee. Such controls would minimize the risk of abuse when officials act as both proposing and deciding officials. In addition, VA does not have oversight measures to ensure that all allegations of misconduct referred by the OIG to facility and program offices are investigated by an entity outside the control of the facility or program office involved in the misconduct. The investigation of allegations of misconduct by the program office or facility where the complaint originated may present the appearance of a conflict of interest in which managers and staff at facilities may investigate themselves or other allegations where they may have a personal stake or bias in the matter to be investigated. Therefore, the risk that the results of the investigation are minimized, or not handled adequately, is increased. VA’s newly developed process to communicate the scope of its reviews that involve matters referred by the OSC to the Office of the Secretary will be important to ensure any allegations outside the purview of the OIG’s investigation are fully addressed by a departmental entity in accordance with OSC requirements. Further, the OIG’s inability to locate investigative documentation prevents a third party from verifying whether the OIG examined the disclosures, whether any recommendations were addressed, or whether appropriate disciplinary action was taken for these cases. This lack of information has direct influence on management’s ability to make sound decisions relating to investigative matters. According to OIG officials, a spreadsheet is being used for tracking case numbers associated with disclosures, but plans to implement a process within the new system. Nonanonymous whistle-blowers faced higher rates of adverse action subsequent to their disclosure than the VA population as a whole. In addition, these individuals also had attrition rates higher than their peers who had not filed a disclosure. The disparities between whistle-blowers and other employees may be an indication that retaliation by senior officials may have occurred after misconduct was disclosed. Although VA has started to provide additional information for potential whistle-blowers who wish to report criminal or other activity to the OIG, VA does not have a process to inform employees of how their information may be shared between organizations when misconduct is reported. Without a clear understanding of how the lines for reporting misconduct operate, whistle- blowers may be uncertain as to their options for reporting misconduct, increasing the risk that they may not report workplace misconduct. We are making the following 16 recommendations to VA. The Secretary of Veterans Affairs should develop and implement guidance to collect complete and reliable misconduct and associated disciplinary-action data department-wide, whether through a single information system, or multiple interoperable systems. Such guidance should include direction and procedures on addressing blank data fields, lack of personnel identifiers, and standardization among fields, and on accessibility. (Recommendation 1) The Secretary of Veterans Affairs should direct applicable facility and program offices to adhere to VA’s policies regarding employee misconduct adjudication documentation. (Recommendation 2) The Secretary of Veterans Affairs should direct the Office of Human Resource Management (OHRM) to routinely assess the extent to which misconduct-related files and documents are retained consistently with VA’s applicable documentation requirements. (Recommendation 3) The Secretary of Veterans Affairs should direct OHRM to assess whether human-resources personnel adhere to basic principles outlined in VA Handbook 5021 when informing employees of their rights during the adjudication process for alleged misconduct. (Recommendation 4) The Secretary of Veterans Affairs should adhere to OPM and NARA guidance and establish a specific record-retention period for adverse action files. In doing so, the Secretary should direct applicable administration, facility, and program offices that have developed their own record-retention schedules to then adhere to the newly established record-retention period. (Recommendation 5) The Department of Veterans Affairs (VA) Inspector General should revise its policy to include a requirement to verify whether evidence produced in senior-official case referrals demonstrates that the six elements required in VA Directive 0701 have been addressed. (Recommendation 6) The Secretary of Veterans Affairs should direct the Office of Accountability and Whistleblower Protection (OAWP) to review responses submitted by facility or program offices to ensure evidence produced in senior-official case referrals demonstrates that the six elements required in VA Directive 0701 have been addressed. (Recommendation 7) The Secretary of Veterans Affairs should direct OAWP to issue written guidance on how OAWP will verify whether appropriate disciplinary action has been implemented for all substantiated misconduct by senior officials. (Recommendation 8) The Secretary of Veterans Affairs should direct OAWP to develop a process to ensure disciplinary actions proposed in response to findings of misconduct are recorded within appropriate information systems to maintain their relevance and value to management for making decisions and take steps to monitor whether the disciplinary actions are implemented. (Recommendation 9) The Secretary of Veterans Affairs should direct OAWP to issue written guidance on how OAWP will review the disposition of accountability actions for all substantiated misconduct cases involving senior officials resulting from investigations. (Recommendation 10) The Secretary of Veterans Affairs should implement internal controls to ensure that proper adherence to separation-of-duty standards involving the removal of an employee are consistent with policy. (Recommendation 11) The Secretary of Veterans Affairs should develop oversight measures to ensure all investigations referred to facility and program offices are consistent with policy and reviewed by an official independent of and at least one level above the individual involved in the allegation. To ensure independence, referred allegations of misconduct should be investigated by an entity outside the control of the facility or program office involved in the misconduct. (Recommendation 12) The VA Inspector General, in consultation with the Assistant Secretary of OAWP, should develop a process to ensure that OSC case numbers are linked to the investigative case number and final report. (Recommendation 13) The Secretary of Veterans Affairs should direct OAWP to develop a time frame for the completion of published guidance that would develop an internal process to monitor cases referred to facility and program offices. (Recommendation 14) The Secretary of Veterans Affairs should ensure that employees who report wrongdoing are treated fairly and protected against retaliation. (Recommendation 15) The Secretary of Veterans Affairs should direct OAWP to develop a process to inform employees of how reporting lines operate, how they are used, and how the information may be shared between the OSC, the OIG, OAWP, or VA facility and program offices when misconduct is reported. (Recommendation 16) We provided a draft of this report to the Department of Veterans Affairs (VA), VA Office of Inspector General (OIG), and the Office of Special Counsel (OSC) for review and comment. In its comments, VA concurred with nine of our recommendations and partially concurred with five (see app. VI for a copy of VA’s letter). Regarding our recommendations to the Inspector General, the OIG concurred with one recommendation and partially concurred with the other. The OIG also provided comments on our findings (see app. VII for a copy of the OIG’s letter). We received technical comments by e-mail from OSC’s Principal Deputy Special Counsel, which we incorporated in the report as appropriate. Regarding VA’s comments, in its response to our first recommendation that the Secretary develop and implement guidance to collect complete and reliable misconduct and associated disciplinary-action data department-wide, VA concurred and outlined steps it plans to take to address our recommendations. These steps include the creation of new policies to address blank data fields, lack of personnel identifiers, lack of standardization among fields, and accessibility issues related to misconduct and associated disciplinary-action data department-wide. The target date for system implementation, dependent on approved funding and acquisition-related requirements, is January 1, 2020. On our second recommendation, that the Secretary direct applicable facility and program offices to adhere to VA’s policies regarding employee-misconduct adjudication documentation, VA concurred. It stated that a memorandum will be distributed to reiterate facility and program-office requirements to adhere to VA Handbook 5021, Employee/Management Relations, no later than October 1, 2018. VA also concurred with our third recommendation, that the Secretary direct the Office of Human Resource Management (OHRM) to routinely assess the extent to which misconduct-related files and documents are retained. According to VA, OHRM will assess, during periodic Oversight and Effectiveness Service reviews, the extent to which misconduct- related files and documents are retained. The first assessment is to be incorporated into the fiscal year 2019 Oversight and Effectiveness Service schedule no later than November 1, 2018. VA concurred with our fourth recommendation, that the Secretary direct OHRM to assess whether human-resources personnel adhere to basic principles outlined in VA Handbook 5021. VA stated that OHRM will assess, during periodic Oversight and Effectiveness Service reviews, whether human-resources and administration personnel adhere to basic principles outlined in VA Handbook 5021. The first assessment is to be incorporated into the fiscal year 2019 Oversight and Effectiveness schedule no later than November 1, 2018. In its response to our fifth recommendation, that the Secretary adhere to Office of Personnel Management (OPM) and National Archives and Records Administration (NARA) guidance and establish a specific record- retention period for adverse-action files, VA concurred and indicated that the Human Resources and Administration Assistant Secretary will establish VA guidance regarding the retention period for adverse-action files. In addition, the Human Resources and Administration Assistant Secretary is to advise applicable administration, facility, and program offices that have developed their own record-retention schedules to adhere to the newly established directive. According to VA, the directive will be established no later than November 1, 2018. VA partially concurred with our seventh recommendation, that the Secretary direct departmental heads to review responses submitted by facility or program offices to ensure evidence produced in senior-official case referrals demonstrates that the six elements required in VA Directive 0701 have been addressed. VA stated that the process described in our report pertaining to OIG findings or results will be changed to require all such reports to be submitted to OAWP. VA also indicated that it expects to publish new guidance by October 1, 2018, that will require the Office of Accountability and Whistleblower Protection (OAWP) to review responses and recommendations from facilities or program offices. Given VA’s comments, we have revised our draft recommendation to have the Secretary direct OAWP, not the department heads, to ensure evidence demonstrates that the six elements have been addressed. VA also partially concurred with our eighth recommendation, that the Assistant Secretary of OAWP review all substantiated misconduct by senior officials to verify whether disciplinary action has been implemented. VA stated that all substantiated misconduct by senior leaders in VA is handled by OAWP from intake, through investigation, working with the proposing and deciding officials. VA also stated that it expects to publish written guidance by October 1, 2018, that will clarify how OAWP will work with the appropriate servicing personnel office to ensure that the recommended disciplinary actions decided are implemented for substantiated misconduct involving senior officials. Given VA’s comments, we have revised our draft recommendation to have the Secretary of Veterans Affairs direct OAWP to issue written guidance on how OAWP will verify that appropriate disciplinary action has been implemented for all substantiated misconduct by senior officials. VA partially concurred with our ninth recommendation, that the Assistant Secretary of OAWP develop a process to ensure disciplinary actions proposed are recorded within appropriate information systems. VA stated that the VA-wide discipline tracking system currently used by OAWP will eventually be phased out. It added that once the Human Resources Information System (HRSmart) is capable of capturing and recording similar data, it will be used for this purpose. Accordingly, we have not revised our draft recommendation. VA partially concurred with our 10th recommendation, that the Assistant Secretary of OAWP assess all misconduct cases involving senior officials to ensure investigative reports with findings of substantiated misconduct include recommendations for action. According to VA, OAWP has instituted several processes since our review. VA plans to issue written guidance that outlines the process for the review and disposition of appropriate accountability actions for allegations of misconduct by senior officials by October 1, 2018. Given VA’s comments, we have revised our draft recommendation to have the Secretary of Veterans Affairs direct OAWP to issue written guidance on how OAWP will review the disposition of accountability actions for all substantiated misconduct cases involving senior officials resulting from investigations. In its response to our 11th recommendation, that the Secretary implement internal controls to ensure that separation-of-duty standards involving the removal of an employee are consistent with policy, VA concurred. It stated that it will also establish and distribute internal controls to ensure that separation-of-duty standards involving the removal of an employee are consistent with policy no later than November 1, 2018. VA partially concurred with our 12th recommendation, that the Secretary take steps to ensure independence of referred allegations of misconduct by requiring that investigations be conducted outside the control of the facility or program office involved in the misconduct. VA stated that OAWP is responsible for recording, tracking, reviewing, and confirming the implementation of recommendations from audits and investigations. However, VA did not address how it will ensure the independence of the entity responsible for conducting an investigation. As we discuss in our report, during the review OAWP officials stated that the process of referring cases of misconduct back to facilities and program offices where the misconduct occurred will continue. Accordingly, we have not revised our draft recommendation and believe implementation of it will help ensure independence. VA concurred with our 14th recommendation, that the Assistant Secretary of OAWP develop a time frame for the completion of published guidance for the development of an internal process to monitor cases referred to facility and program offices. VA provided an expected date of October 1, 2018, for publishing the internal VA guidance, with the subsequent Directive and Handbook to be published as rapidly as staff coordination permits. In its response to our 15th recommendation, that the Secretary ensure that employees who report wrongdoing are treated fairly and protected against retaliation, VA concurred. It stated that OAWP and OSC have developed a functional process to ensure whistle-blower protections are implemented, but did not indicate what the process entails. The VA Secretary has also delegated authority to the Executive Director, OAWP, to put individual personnel actions on hold if the actions appear motivated by whistle-blower retaliation. VA added that OAWP has also hired two whistle-blower program specialists specifically to increase awareness of whistle-blower protections and work with individuals that disclose employee wrongdoing to ensure individuals are treated fairly and protected from retaliation for their disclosures. VA concurred with our 16th recommendation, that the Assistant Secretary of OAWP develop a process to inform employees of how reporting lines operate. VA stated that it will provide whistle-blower training to all employees on a biennial basis, which will include the reporting lines for disclosures of wrongdoing, the manner in which disclosures flow once they are made, how information is shared among the whistle-blower entities, and what protections exists for those who disclose wrongdoing. Regarding our recommendations to the Inspector General, the OIG partially concurred with our sixth recommendation, to revise its policy to include a requirement to verify whether evidence produced in senior- official case referrals demonstrates that the six elements required in VA Directive 0701 have been addressed. The OIG indicated that VA Directive 0701 is currently being updated to require a written or electronic signature from the person preparing the responses as an attestation that the specific requirements of the directive were met. The OIG also indicated in its letter that the OIG’s Hotline staff carefully review the case response but Hotline staff are not required to request an updated response from VA to address matters not necessary to the resolution to the referral. The OIG asserted that requesting an update would detract from the resources for other important VA activities. On page 4 of the OIG’s letter, the OIG states that Hotline analysts are allowed to exercise some discretion in accepting responses that may include minor departures from the six elements. We continue to believe that, in order to have a complete response to a referral, all six elements required by the directive should be addressed. In addition, Directive 0701 does not allow for the use of professional judgement to decide which elements to include or not to include in a response. While we agree that requiring a written or electronic signature from the person preparing the responses as an attestation will help ensure that the specific requirements of the directive were met, we maintain that not requiring Hotline analysts to review responses to ensure that all elements of the directive are addressed is inconsistent with the intent of the directive. In its response to our 13th recommendation, that the OIG develop a process to ensure that an OSC case number is linked to the investigative case number and the final report, the OIG concurred. It stated that it will engage with the Executive Director of OAWP to develop a process to ensure that OSC case numbers are linked to OIG and OAWP investigative case numbers, as appropriate, and linked to any final report of investigation. In addition to its response to recommendations, the VA OIG also raised a number of concerns with our findings. Page 1 of its letter summarizes some of these concerns and then provides more detail on each concern raised, starting on page 2. Our responses to each of these detailed concerns are provided below. The OIG stated that our report does not focus on the most important cases, but focuses primarily on case referrals regarding senior officials that were not handled by the OIG because the allegations were lower risk or because of resource constraints. In addition, the OIG stated that GAO risks presenting a skewed picture of the OIG’s oversight work. We disagree with this characterization of our findings. We requested that the OIG provide us with data from the OIG’s Master Case Index (MCI) information system that would allow us to select a sample of cases, in accordance with the scope of our review. The OIG was unable to provide the requested information due to several reasons. Instead, the OIG provided data from the OIG Hotline and Office of Investigations case- management systems (subsystems within MCI) that contained a limited number of fields for analysis and 23 cases pertaining to SES misconduct that were referred to VA for investigation during GAO’s period of review. Therefore, as we discuss in the report, we were only able to review the 23 senior-official misconduct cases included in our report because the OIG was only able to provide related documentation for these cases. The OIG stated that we only reviewed a sample of just 23 case referrals from fiscal years 2011 through 2014. As described, we reviewed all 23 senior-official misconduct cases that were referred to VA for investigation that the OIG was able to provide us, not a sample. The OIG stated that our report inaccurately states that the extracts received from the MCI information system contained missing information. We disagree with this characterization of our findings. Our review included a comprehensive assessment of the reliability of the OIG’s data. To conduct this assessment, we requested an explanation of each data field to clarify when fields are normally populated and how they are used. Our findings are consistent with the information provided in response to this request. For example, the OIG’s response to our data-reliability assessment stated that the data field used to identify the type of allegations being investigated should never be blank. However, we found that field to be blank in some cases in the data that were provided to us, though the OIG asserted that the MCI information system is a relational database where each case may be associated with multiple allegations and codes. In response to the OIG’s comments on our report, we requested supporting documentation to demonstrate that the fields analyzed during our period of review did not contain missing data. The OIG provided the MCI information system user’s manual that contains detailed procedures for accessing and entering data into the MCI information system, and a compilation of various internal documents. However, the documentation did not provide evidence of the completeness of data entered into the MCI information system as part of quality-assurance reviews performed by the OIG or other designated entity. Absent evidence of data-quality reviews aimed at assessing the accuracy and completeness of data contained in the MCI information system, we did not change the conclusions based on our previous analysis. The OIG stated that our report provides incomplete information regarding sampled cases and mischaracterized one of the OIG’s case referrals in the body of the report. We disagree with this characterization of our findings. Specifically, the OIG said that we inaccurately stated that a medical center director conducted the investigation into his own alleged misconduct and found no allegations were substantiated. The synopsis included in our report clearly articulates that the medical center director was named in the allegation for having received a similar complaint involving time and attendance abuse by a physician. The medical center director, who provided the response to the OIG, was implicated in the allegation as having not addressed a similar time and attendance complaint regarding the same physician 2 years earlier. The OIG did not provide any supporting documentation to demonstrate that the alleged time and attendance abuse allegations against the physician were not substantiated. The OIG stated that our report inaccurately stated that the medical center director conducted his own investigation of himself and found no allegations were substantiated. We disagree. In response to the OIG’s comments on our report, we requested that the OIG provide additional support used to determine that the medical center director did not investigate the allegation in which he was named. The additional case documentation provided by the OIG further reaffirmed our assessment that the medical center director performed his own investigation and found no allegations were substantiated. Additional documentation provided by the OIG indicated that the OIG referred the case to the Veterans Integrated Service Network (VISN) for a response. However, documentation we examined during the course of our audit, and the documentation provided in response to our draft report, indicates that the medical center director performed the investigation of the allegations and then the results were routed through the VISN back to the OIG. The OIG stated that routing the response through the VISN should address our concerns of independence. This process does not address our concerns regarding independence because VA Directive 0701 states that all responses to Hotline case referrals must contain evidence of an independent review by an official separate from and at a higher grade than the subject / alleged wrongdoer. In this case, the name of the medical center director who signed the facility response provided to the OIG was the same individual named in the allegations. The OIG stated that the report does not provide a balanced presentation of the rigor with which the OIG reviews all incoming Hotline contacts and case responses. We disagree with this characterization of our findings. As described above, the OIG was unable to provide comprehensive data to select a sample of OIG audits, evaluations, and inspections for review due to the limitations cited. We focused on misconduct involving senior officials consistently with the scope of our review and thoroughly reviewed all 23 senior-official misconduct cases that were referred to VA for investigation, which were the only cases that the OIG was able to provide. The OIG stated that the description for one of the cases included in appendix V of the draft report was incomplete because we misunderstood the OIG’s process. We disagree with this characterization. In response to the OIG’s comments on our report, we requested additional supporting documentation. The documentation provided reaffirmed our assessment that another medical center director performed his own investigation and found no allegations were substantiated. Similar to the case described above, the medical center director completed his own investigation and then routed the response through the VISN back to the OIG. In contrast to the previous case, however, the Hotline Workgroup reviewed the response to the OIG and found it to be insufficient. Specifically, the OIG noted that the medical center director who provided the response was the subject of the complaint, despite the response being directed to the VISN, and requested clarification. The VISN informed the OIG that it is not its policy for the complainant to have any involvement in the review and data submission on a case in which the complainant is involved. The VISN stated that while this did obviously occur in this instance, it has taken steps to ensure it does not occur in the future. The supporting evidence provided for the case included in appendix V also contradicts the OIG’s previous assertion that the routing of a response through the entity with oversight (VISN) over the medical center director should have addressed GAO’s concerns of independence. The OIG stated our report provides a misrepresentation of the OIG’s failure to follow internal policies for department responses. We disagree. According to OIG statements on page 4 of the OIG’s letter, Hotline analysts are allowed to exercise some discretion in accepting responses that may include minor departures from the six elements required in VA Directive 0701. We continue to believe that in order to have a complete response to a referral, all six elements required by the directive should be addressed. On the basis of our review, the OIG does not have an effective method to ensure that cases referred to VA are reviewed in accordance with VA Directive 0701. Out of the 23 cases we reviewed, only 4 included sufficient documentation needed to support VA’s findings, and we could not identify a case that contained all six elements required in VA Directive 0701. This suggests that the current OIG review process is not adequately resolving case referrals, as asserted by the OIG’s response. In addition, VA Directive 0701 does not currently include a provision that would allow Hotline analysts to deviate from the six required elements. As stated in our report, the OSC also raised concerns regarding 40 percent of disclosure cases that were referred to VA facility and program offices. The OIG stated that much of the information in the draft report is dated and ignores system updates, specifically several key Hotline-related process improvements since 2014. Although our review began in 2015, we disagree with this characterization of our findings. In our report, we included relevant improvements to demonstrate where the OIG was able to provide support for those improvements. For example, our report discusses: (1) a new process for communicating the scope of reviews that involve matters referred by the OSC to the Office of the Secretary, (2) a description on the VA website of the process for employees who wish to report criminal or other activity to the OIG, (3) a new Enterprise Management System, and (4) a new process for receiving whistle-blower disclosures by the Secretary. In response to the OIG’s comments on our report, we requested additional documentation for any systems, practices, or personnel changes that have been implemented since 2011, including improvements to Hotline-related processes since 2014 that were not included in our report. In response, the OIG provided a copy of the OIG’s organizational chart (current as of Apr. 23, 2018), described the oversight responsibilities of each OIG component, and summarized the pertinent staff positions within each component. On the basis of this documentation, we identified a new office (the Office of Special Reviews), a promotion, staff reassignments, and numerous vacancies during our review period. However, the OIG did not provide evidence of any measures to improve the MCI information system, case-referral processes, or relevant staff roles that were not already included in our report. As described above, the OIG was unable to provide comprehensive data to select a sample of OIG audits, evaluations, and inspections for our initial review due to the limitations cited. In response to the OIG’s comments on our report, we requested documentation related to any significant changes that have been made to the MCI information system that allows the OIG to identify all allegations of misconduct for export and analysis. The OIG provided additional information regarding overall departmental achievements that are highlighted in the OIG’s Semiannual Report to Congress, and other products from its website published between fiscal years 2011 through 2018. We recognize the OIG’s broader administrative and oversight work described in the published reports. However, this information does not address changes specifically made to the MCI information system that would enable the OIG to analyze cases pertaining to alleged misconduct by senior officials that we requested. We are sending copies of this report to the appropriate congressional committees, the Secretary of Veterans Affairs, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-5045 or larink@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Our objectives were to determine the extent to which the Department of Veterans Affairs (VA) (1) collects reliable information associated with employee misconduct and disciplinary actions that is accessible and could be used to analyze misconduct department-wide; (2) retains documentation that demonstrates VA adheres to its policies when adjudicating cases of employee misconduct; (3) ensures allegations of misconduct involving senior officials are reviewed in accordance with VA investigative standards, and these officials are held accountable; (4) has procedures to investigate whistle-blower allegations of misconduct; and the extent to which (5) data and whistle-blower testimony indicate whether retaliation for disclosing misconduct occurs at VA. For the first objective, we obtained VA employee misconduct data from 12 information systems operated by various VA components covering October 2009 through July 2017, where available. To determine the reliability of VA’s misconduct data, we analyzed the contents of the 12 information systems operated by various offices across VA. These data encompass each of the three major administrations that constitute VA— the National Cemetery Administration (NCA), Veterans Benefits Administration (VBA), and Veterans Health Administration (VHA). We selected the information systems based on our discussions with VA officials and staff that oversee the data and, hence, identified databases capable of collecting information pertaining to either employee misconduct or disciplinary actions. Data fields were selected based on whether they would provide beneficial information to better understand the disciplinary process. VA’s Personnel and Accounting Integrated Data (PAID) system, which was developed to track payroll actions, contains information about adverse disciplinary actions that affect employee salary department-wide. We obtained an extract of all adverse disciplinary actions from the PAID system. We assessed the reliability of each system for the purposes of identifying and tracking misconduct cases. To do this, we performed electronic tests on 12 information systems to determine the completeness and accuracy of the fields contained in the data files. We also submitted to the overseeing offices for all 12 information systems general data-quality questions regarding the purpose of the data, their structure, definitions and values for certain fields, automated and manual data-quality checks to ensure the accuracy of the data, and limitations. As discussed further, the data were generally not reliable for a department-wide assessment of all misconduct and disciplinary actions due to the lack of completeness and compatibility of the data across all information systems. VA staff could not confirm whether some of the missing data we identified were artifacts of the database extraction process VA used to assemble the data files we used in our review. Despite challenges with aspects of the data, we found the data sufficiently reliable for conducting analysis where fields were populated and field definition concurrence was obtained by program offices. For the second objective, we selected a generalizable stratified random sample of 544 misconduct cases from October 2009 through May 2015. Where available, we reviewed the employees’ disciplinary-action files and Electronic Official Personnel Folders to determine the extent to which VA’s actions were consistent with disciplinary policy outlined in VA Handbook 5021, Employee/Management Relations. These data encompass each of the three major administrations that constitute VA— NCA, VBA, and VHA. We determined the data to be sufficiently reliable for analysis of disciplinary actions affecting salary that resulted from misconduct that was not reported to supervisors directly from employees. Accordingly, our sample only includes misconduct cases that resulted in a change in salary or were reported to departmental organizations within the 12 information systems selected. We developed a data-collection instrument to document the results of our case reviews. We revised our data-collection instrument to address issues found during the course of our analysis, and developed a companion document that outlined the decision rules for reviewing cases. We also designated two primary reviewers to ensure the decision rules were consistently applied across all cases. Our review of laws and regulations revealed that disciplinary rules sometimes vary depending on whether employees fall under Title 5, Title 38, or hybrid Title 5 and Title 38 hiring authority. To minimize confusion associated with these differences, we incorporated criteria into our data- collection instrument. In addition, we were unable to obtain complete case information for 25 percent of the cases. For these cases, we obtained direct access to the Office of Personnel Management’s (OPM) Electronic Official Personnel Folders system to attempt to recover some of the missing information. Ultimately, we were unable to complete our review for 10 percent of cases in our sample because of missing files. In addition to reporting missing case information, we used our generalizable analysis results to project VA-wide figures for several data elements that were not in compliance with VA policy. Unless otherwise noted, estimates in this report have a margin of error of +/-7.4 percentage points or less for a 95 percent confidence interval. For the third objective, we analyzed data from the Office of Accountability Review (OAR) Legacy Referral Tracking List and VA Office of Inspector General (OIG) case-referral and investigative case-management systems, and we selected cases for in-depth review. We selected these two systems based on discussions with VA officials who were knowledgeable with databases that have the capacity to track misconduct information pertaining to senior officials. The OAR Legacy Referral Tracking List comprises referrals from January 2011 through May 2015. The OIG provided 23 case-referral files involving senior officials from calendar years 2011 through 2014. As part of our review of the OIG case files, we evaluated specific data elements contained in VA’s response documents using VA policy for referring and reviewing misconduct cases. We assessed the reliability of the OAR Legacy Referral Tracking List and OIG case-management systems for the purposes of identifying and tracking misconduct cases. To do this, we performed electronic tests on each database to determine the completeness and accuracy of the fields contained in the data files, including senior-official indicators. Where feasible, we opted to match individual datasets to PAID to determine whether disciplinary actions were administered as prescribed. We also submitted to OAR and the OIG general data-quality questions regarding the purpose of the data, their structure, definitions and values for certain fields, automated and manual data-quality checks to ensure the accuracy of the data, and limitations. On the basis of this information, we found the OAR data to be sufficiently reliable for conducting analysis where fields were sufficiently populated. For the OAR data, we matched the persons of interest to adverse-action files from PAID to determine whether adverse disciplinary actions were administered as prescribed during the available time frame (January 2011 through May 2015). We also obtained VA’s response documents for the 23 case-referral files provided by the OIG to evaluate whether VA was adhering to its own policy for referring and reviewing misconduct cases. Through our OAR Legacy Referral Tracking List analysis, we identified illustrative case examples of misconduct involving senior officials. Further, based on our evaluation of the 23 OIG case referrals using VA’s referral policy, we developed several illustrative case examples. For the fourth objective, we interviewed senior officials from VA and the OSC responsible for investigating whistle-blower complaints. We obtained the OSC’s procedures for referring disclosure complaints and VA’s policy for investigating these complaints once received at the agency. In addition, we obtained whistle-blower disclosure data from the Office of Special Counsel (OSC) covering calendar years 2010 through 2014. To determine the reliability of the data, we conducted electronic testing and traced data elements to source documentation. We determined the data to be sufficiently reliable to identify the total number of cases that were investigated by the OIG, or referred to facility and program offices. We also observed a course to assess VA’s training provided to VA employees conducting investigations. We identified 135 OSC disclosure cases for analysis based on two criteria: (1) they contained at least partial complainant information (i.e., the allegations were not anonymously reported or could be identified with supplemental information) and (2) they contained an indicator that the case had been closed by the OSC pending an ongoing investigation by VA or the OIG. These cases represent the universe of VA disclosures accepted by the OSC. Of the 135 disclosure cases referred to VA, 53 cases were referred to VA facility and program offices for further investigation. The remaining 82 disclosure cases indicated that they were investigated by the OIG. We reviewed the results of OSC’s assessment of investigative documentation developed by VA for these whistle-blower disclosure cases. For the fifth objective, we analyzed the 135 whistle-blower disclosure cases obtained from the OSC. These cases represent the universe of VA disclosures accepted by the OSC from calendar years 2010 through 2014, which were investigated by VA. We obtained an extract of year-end rosters from the PAID system as of September for fiscal years 2010 through 2014, with a final extract through May 30, 2015. Finally, we interviewed representatives from whistle-blower advocacy groups, as well as established whistle-blowers who disclosed wrongdoing or retaliation at VA and who were referred to us by one advocacy group. Of the 135 disclosures received by the OSC, a total of 129 employees made a total of 130 disclosures nonanonymously. For these 130 disclosure cases, we reviewed OSC and OIG investigative reports, as well as PAID roster files, to gather additional information to perform analysis of potential retaliation. We also interviewed six individual whistle- blowers with formal disclosure cases accepted by the OSC, indicating that the OSC had previously reviewed the case and determined that it contained sufficient evidence and merit to warrant further investigation. Our analysis of potential retaliation comprised two parts. First, we compared the 129 employees associated with the selected OSC cases to the PAID rosters using the complainants’ information to determine whether employees associated with the selected OSC cases were more likely to leave the agency. We identified the overall count and proportion (across years) of roster-matched employees who made a disclosure between fiscal years 2010 through 2014 but were not employed at VA the following fiscal year. Second, to determine whether employees associated with the selected OSC cases were more likely to receive disciplinary action, we also calculated the yearly totals and proportion of roster-matched employees identified above for whom a record existed in the PAID disciplinary action information system. We did this by comparing the proportion of employees who received one or more disciplinary actions in the year prior to the appearance in the roster, in the same fiscal year as the roster, and in the subsequent fiscal year. We also completed this analysis utilizing the PAID roster file to determine the yearly proportion of all VA employees who left the agency. On the basis of the results of our analysis, we reported by fiscal year the percentage of whistle-blowers that received disciplinary action or left VA at a higher rate than the overall VA population following a disclosure. To address all objectives, we interviewed senior officials from VA’s major components responsible for investigating and adjudicating cases of employee misconduct. We also reviewed standard operating procedures, policy statements, and guidance for staff charged with investigating and adjudicating allegations of employee misconduct. We conducted this performance audit from January 2015 to May 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. This data file is designed to track referrals made to OAR, including allegations of misconduct related to senior officials. Through our analysis of this spreadsheet, we identified 11 fields out of 92 that were missing information that could be used to analyze misconduct. Complainant #1 (First Name) (20 percent of 1,245 blank)— According to OAR, this field is populated when there is a known complainant for a matter. Some matters referred to OAR may be anonymously disclosed and not contain complainant information. This file also contains a case-origin field that specifies whether a case was anonymous. Our review of both the complainant and case-origin field indicated that only 11 percent of the complaints were generated from an anonymous source, and the remaining records should have included a complainant name. Disciplinary Action (96 percent of 1,245 blank)—This field should be populated to indicate whether a disciplinary action was taken after the completion of an investigation. Grade (97 percent of 1,245 blank)—According to OAR, this field should be populated with the grade of the Person of Interest (POI), if known. Our review of this field indicated that 97 percent were blank, therefore we were unable to analyze the variation in grade level for officials who were the subject of complaints. OAR Action (77 percent of 1,245 blank)—According to OAR, this field should be populated as an internal reference to describe what stage in the administrative process the matter was in when received. The lack of information did not allow for analysis of the types of actions taken for each case. Person of Interest (POI) (47 percent of 1,245 blank)—This field specifies the first and last name of the Department of Veterans Affairs (VA) employee who is the subject of an allegation. POI (Person of Interest) Last Name 1–5 (51 to 99 percent of 1,245 blank)—This field specifies the last name of VA employee who is the subject of an allegation. There are a total of five person-of-interest (POI) fields for each matter. According to OAR, blank POI fields occur when the case has fewer than five POIs or the POI was not specified in the matter referred. Our review of the five POI fields indicated that more than half of the records did not contain at least one POI because no individual was specified. The lack of information did not allow for further investigation of senior-level officials involved in misconduct. Proposed Action (97 percent of 1,245 blank)—According to OAR, this field should be populated to notify OAR staff if any disciplinary action was proposed. Our review of this field indicated that 97 percent were blank, suggesting that very few high-level officials received corrective action, or the field was not consistently completed for each record. Due to the large share of blank values, the data posed limitations when analyzing how many senior officials received corrective action as a result of a complaint. This data file is designed to track misconduct and disciplinary actions taken against VA employees. Through our analysis of this spreadsheet, we identified 9 fields out of 21 that were missing information that could be used to analyze misconduct. Action Taken (3 percent of 9,851 blank)—According to OAR, this field should be populated with the action that the deciding official takes, with the exception of pending actions. If there is a pending action, this field will remain blank. Our review of the action-taken field found three records that were annotated as a “pending decision” within this field, which indicates that there is an option for entering information into this field when there is an action pending and the field should never be blank. Admin Leave (30 percent of 9,851 blank)—According to OAR, this field should be populated if an employee is placed on administrative leave while an adverse action is pending. If an employee is not placed on administrative leave, the field may be left blank. Our review of the admin-leave field found that about 66 percent of the records were annotated as “no” within this field, which indicates that there is an option for entering information into this field when an employee was not placed on administrative leave. Date Proposed (11 percent of 9,851 blank)—According to OAR, this field is used when an adverse action is proposed for an employee. There are some actions that are not proposed, such as probationary terminations or admonishments that may be taken without being proposed, and therefore result in this field being blank. Our analysis found that about 95 percent of these records containing blank proposed date fields also had an entry in the proposed adverse-action field, which contained such entries as removals, suspensions, and demotions that require a proposed date. Deciding Official (14 percent of 9,851 blank)—According to OAR, this field should be populated with the name of the official who issued the action taken. Effective Date (5 percent of 9,851 blank)—According to OAR, this field should be populated with the date of the action taken. Some entries will not have an effective date if an entry is pending decision. Also, if no action is taken, the decision was counseling, or the proposed action was rescinded, this field may not have an effective date. Our review found that about 14 percent of the cases that included adverse actions, such as a suspension, removal, reassignment, or demotion, and that should have included a date of action, were blank. Offense 2 and 3 (79 and 95 percent of 9,851 blank)—According to OAR, this field tracks the second- and third-most-significant charge against the employee when applicable. Proposing Official (16 percent of 9,851 blank)—According to OAR, this field should be populated with the name of the official who makes the proposed adverse action. Instances where a proposing official has left the agency at the time of entry and could not be found in the lookup feature that relies on the e-mail global address list may produce blank fields. Also, disciplinary actions that were taken without proposal would not have a proposing official. In these instances, the human-resources specialists who enter the actions are instructed to include the name in the other-comments box. Our review of these records indicated that a majority of records lacking an entry in the proposing official field also lacked an annotation in the other- comments field to accurately identify the proposing official. Settlement (14 percent of 9,851 blank)—According to OAR, this field tracks whether a settlement agreement occurred. This data file is designed to collect allegations of criminal activity, waste, abuse, and mismanagement received by the OIG Hotline Division. Through our analysis of this information system, we identified one field out of seven that was missing information that could be used to analyze misconduct. Nature of Complaint (54 percent of 896 blank)—According to the OIG, this field should contain a brief description of the issue that most closely matches the allegation. Each case can have more than one nature of complaint and corresponding administrative action, if any. OIG officials stated that this field identifies the type of allegations being investigated and should never be blank. Our review of these cases found that over half of the cases involving the OIG contained entries for administrative action taken, but the nature-of-complaint fields corresponding to these actions were blank. This data file is designed to track misconduct and disciplinary action taken against VBA employees. Through our analysis of this spreadsheet, we identified 3 fields out of 20 that were missing information that could be used to analyze misconduct. Alleged Offense 2 and 3 (92 and 99 percent of 1,375 blank)— According to VBA officials, this field should be populated if an individual is charged with multiple offenses, or has additional offenses in the same reporting period. In most instances, there is typically only one offense at the time of reporting. Sustained (52 percent of 1,375 blank)—According to VBA, this field should be populated if an offense is sustained at the time of reporting. This data file is designed to track all allegations of misconduct and associated disciplinary actions taken against VA employees. Through our analysis of this spreadsheet, we identified 8 fields out of 34 that were missing information that could be used to analyze misconduct. Deciding Official (3 percent of 5,571 blank)—According to OAWP, this field should be populated with the name of the official who makes the decision for adverse action. Detail Position (89 percent of 5,571 blank)—According to OAWP, this field should be populated with the position an employee was detailed to if removed from official position. Offense 2 and 3 (69 and 91 percent of 5,571 blank)—According to OAWP, this field tracks the most-significant charges against the employee. If there are fewer than three charges, these fields are left blank. Offense 1 Sustained (14 percent of 5,571 blank)—According to OAWP, this field should be populated if an individual’s first offense has been sustained. Offense 2 and 3 Sustained (73 and 91 percent of 5,571 blank)— According to OAWP, these fields should be populated if an individual’s second and third offenses have been sustained. The majority of cases only involve one offense. Proposing Official (9 percent of 5,571 blank)—According to OAWP, this field should be populated with the name of the official who makes the proposed adverse action. This data file tracks Equal Employment Opportunity (EEO) discrimination complaints. Through our analysis of this information system, we identified 1 field out of 66 that did not have standardization that could be useful to analyze misconduct. Employment—We found that the values for this field were not mutually exclusive, or independent of one another. For example, this field includes two distinct categories of information: employment status, such as full time or part time; and hiring authority, such as Title 5 or Title 38. This method of storing information resulted in undercounting each of the separate values due to the system’s failure to account for expected overlap. For instance, an employee could be both a full-time and Title 5 employee and the field only tracks one or the other. ORM officials stated that this field has since been modified to capture more options to account for the overlap. This data file is designed to track misconduct and disciplinary actions taken against Department of Veterans Affairs (VA) employees. Through our analysis of this spreadsheet, we identified 1 field out of 21 that did not have standardization that could be useful to analyze misconduct. Position—We found the VA-Wide Adverse Employment Action Database contained variations within this field, such as multiple values for the “Cemetery Caretaker” position name. According to OAR, this field is a free-text field, and the office conducts manual searches to review and analyze position titles when needed. Our review found that the different variations in position titles made it difficult to successfully determine the frequency and nature of allegations by position. This is an information system designed to collect allegations of criminal activity, waste, abuse, and mismanagement received by the OIG Hotline Division. Through our analysis of this data file, we identified 1 field out of 7 that did not have standardization that could be useful to analyze misconduct. Nature of Complaint—Our review of the Master Case Index file found variations of similar values in this field. For example, this field contained 21 different claim types pertaining to similar types of fraud, which made it difficult to assess the frequency and nature of claims entered into the system. OIG officials stated that they do not attempt to account for these variations or assess the frequency of use because they are assigned based on a “best match” to the allegations of the case. This data file is designed to track misconduct and disciplinary action taken against VBA employees. Through our analysis of this spreadsheet, we identified 1 field out of 20 that did not have standardization that could be useful to analyze misconduct. Position—Our review found some duplication and overlapping values among this field. For example, the position title for “service representative” contained 21 similar categories with numerous variations in spelling (i.e., Veteran Service Representative vs. Veterans Service Representative, and Rating Veteran Service Representative vs. Rating Veterans Service Representative). We were unable to verify the number of distinct positions due to the lack of standardization within this field. This data file is a tracking spreadsheet for monitoring misconduct and disciplinary action workload. Through our analysis of this spreadsheet, we identified 5 fields out of 12 that did not have standardization that could be useful to analyze misconduct. Action Proposed/Decided/Taken—We were unable to analyze this data field because the action taken was tracked in one single field and updated with the most-recent action, rather than each distinct action being entered in a separate field. Consequently, we were not able to distinguish those cases where corrective action may have been taken, to verify whether the corrective action had been implemented. Current Status—We were unable to analyze this data field because it was not a standardized field. For example, we were unable to determine the total number of cases that were closed, open, or pending due to the variations in the data field (e.g., Open, open, open – pending, open-pending). Full Name of Employee, Grievant, Appellant, Complainant, Non- Employee—We were unable to distinguish whether the individual filing a complaint was an employee, grievant, appellant, complainant, or nonemployee because the information entered into this single field only provided the employee’s full name and did not provide a distinction as to which category the record was assigned, as indicated by the field name. NCA Facility—We were unable to analyze this data field because it was not a standardized field. For example, we were unable to run demographic information on the different facilities involved because this field contained erroneous information. Examples of erroneous information included the name of the Memorial Service Network in one case, and the region, rather than the facility name, in another. Supervisor Name—We were unable to analyze this data field because it was not a standardized field. For example, we were unable to determine the total number of supervisors that were associated with each case due to the variations in the names entered within this field, which included misspelled first or last names, addition/omission of middle initials, or no first name. This data file is a tracking spreadsheet for all allegations received by the VA Secretary regarding misconduct, patient care, or other wrongdoing. Through our analysis of this spreadsheet, we identified 1 field out of 9 that did not have standardization that could be useful to analyze misconduct. Subject—Our review of this tracking spreadsheet found over 380 different possible categories that could be assigned to one record. These categories contained a significant number of variations. For example, we found 38 different categories that contained possible EEO-related issues such as “EEO/Whistleblower,” “Potential EEO,” and “EEO Violations.” We were unable to distinguish the different subject categories for this field due to the lack of standardization. CSRT officials stated that ExecVA reports contain only data corresponding to specific search criteria. This is an information system for tracking allegations of misconduct at all VA facilities that include violation of law and misdemeanors. Through our analysis of this data file, we identified 3 fields out of 29 that did not have standardization that could be useful to analyze misconduct. Classification—We found that this field contained at least three different variations of assault categories (i.e., assault, assault-other, and assault-aggravated). VAPS officials stated that this field is determined and entered by the user. Crime Type—We found this field contained at least five different variations of alcohol-consumption categories, such as “entering premises under the influence” and “alcohol – under the influence.” VAPS officials stated that this field is determined and entered by the user. Final Disposition—We found this field contained at least two different variations of charge type (i.e., charged, charged – Issued Ticket), six different variations of open type (for example, open/referred to Court, open/cvb), and two different variations of closed type (i.e., closed, case closed). VAPS officials stated that this field is determined and entered by the user. This data file is designed to track all allegations of misconduct and associated disciplinary actions taken against VA employees. Through our analysis of this spreadsheet, we identified 1 field out of 34 that did not have standardization that could be useful to analyze misconduct. Position Title—We found this field contained at least 15 different variations of Registered Nurse, such as “Registered Nurse,” “Staff RN,” and “RN.” Allegations surrounding inadequate staffing, patient care, and safety at a Department of Veterans Affairs (VA) emergency room were investigated by the medical center director of the facility. The medical center director found that the inadequate patient care and safety issue was unsubstantiated based on a review of patient safety incidents for the last 6 months. The medical center director did not provide a copy of her report review to support this conclusion. She also indicated that an external consultant was hired to assess staffing issues, and found generally that improvements could be made for staffing to address surge capacity. The director stated the medical center was in the process of implementing the recommendations made by the consultant, but her response did not discuss the specific improvements planned or include the external consultant’s report. A fact-finding was performed by a panel comprised of VA Connecticut Healthcare System officials in response to alleged violations of law, gross mismanagement, and waste of funds that included the improper billing of services for a Las Vegas conference and paying contracts through a VA nonprofit corporation to handle such expenditures. The allegations specifically requested a cost-benefit analysis for the conference location. The response received from the program office stated that an outside accounting firm performs an annual financial audit of the VA nonprofit corporation and found no material issues. Neither a copy of the annual financial audit nor a cost-benefit analysis was provided in the response as support. Additionally, the response did not address allegations regarding the status of several essential positions vacated over the prior 3 years. Allegations involved time-and-attendance abuse by a physician who was accused of not responding to calls from peers or coming into the clinic, in favor of his private practice. According to the complainant, physician assistants (PA) examine the physician’s patients at the clinic for him. The medical center director, who was also named in the allegation as having received a similar complaint against the physician 2 years earlier, reviewed the case against the physician and himself. The medical center director’s response claimed that the location indicated in the allegation was not a private practice, but rather a location where the physician reviews medical records and sometimes serves as an expert witness. He did not provide evidence to support his claim. The medical center director also stated that he had not received any reports against the physician for missed calls or clinics and that PAs are expected to participate in these activities. However, he did not provide the physician’s work log, or the PA position descriptions showing that they are allowed to perform these functions autonomously. Finally, the medical center director claimed he did not recall the allegation made against the physician 2 years prior and neither formally substantiated nor disproved the current allegations against the physician. No recommendations were made. The medical center director was accused of hiring an unqualified individual to a Quality Manager position due to their romantic relationship. The response received from the human-resources consultant noted that it was unusual to find a Nurse II manager with only an associate’s degree, but was not illegal, and the employee was qualified based on prior experience. Concerns were also raised concerning the medical center director’s use of over $400 in government funds to “soundproof” the Quality Manager’s office, including having panels attached to one wall and the hollow office door replaced with a solid door. The Chief of Engineering Services was interviewed regarding the request and stated it was an odd request, and the first time he was asked to soundproof an administrative employee’s office. The response provided by the program office did not address why the director used government funds to soundproof the Quality Manager’s office. The response provided also did not address whether recommendations that the Quality Manager’s retention allowance be reviewed for compliance and that she be counseled for appropriate office dress code were implemented. The medical center director was alleged to have misrepresented a plan to track and provide mental-health services to veterans in non-VA hospitals and created a hostile work environment against African-American veterans and employees. The medical center director investigated the allegations against himself and provided a response that was eventually submitted late to the OIG. His response indicated that a review was completed and all allegations were unsubstantiated. Several documents provided with his response showed that only 12 contacts were made to veterans with mental-health care needs during the requested 24-month period, the percentage of patients experiencing wait times greater than 14 days before receiving mental-health services averaged 18 percent, and two veteran suicides occurred. The medical center director did not address allegations of creating a hostile work environment for African American veterans and employees. The medical center director improperly reannounced a vacancy in order to hire an individual with whom he allegedly had a close personal relationship to an Assistant Director position. He also requested the master key to the facility be issued to her against regulations. The allegation involving the master key was substantiated, but the Deputy Under Secretary who conducted the investigation stated that while there was no record of the key being returned, the key was returned and the general engineer brought the facility into compliance with VA regulations. Nonetheless, the Deputy Under Secretary found that a master key was issued in violation of policy, but no recommendations were made to the medical center director for corrective action. Allegations involved false patient wait-time documentation and abuse of authority. Specifically, a medical center director instructed staff to falsify patient wait times between follow-up appointments in order to meet VA’s 14-day timeliness metric. The investigation concluded that the false documentation allegation was substantiated, but attributed the cause to staff not understanding how to enter a follow-up appointment date into the system. It was also concluded that the correction of several hundred dates in the system improved the performance of the department for the national wait-time metric. However, no documentation was provided to (1) prove the medical center director had not abused his authority by instructing staff to review wait times greater than 14 days to determine how they could be reduced, and (2) support the conclusion that the original wait times were entered in error. In addition to the contact above, Dave Bruno (Assistant Director), Erica Varner (Analyst in Charge), Hiwotte Amare, Chris Cronin, Carrie Davidson, Ranya Elias, Colin Fallon, Mitch Karpman, Grant Mallie, Anna Maria Ortiz, Sabrina Streagle, Reed Van Beveren, and April Van Cleef made key contributions to this report.

Summary: VA provides services and benefits to veterans through hospitals and other facilities nationwide. Misconduct by VA employees can have serious consequences for some veterans, including poor quality of care. GAO was asked to review employee misconduct across VA. This report reviews the extent to which VA (1) collects reliable information associated with employee misconduct and disciplinary actions, (2) adheres to documentation-retention procedures when adjudicating cases of employee misconduct, (3) ensures allegations of misconduct involving senior officials are reviewed according to VA investigative standards and these officials are held accountable, and (4) has procedures to investigate whistle-blower allegations of misconduct; and the extent to which (5) data and whistle-blower testimony indicate whether retaliation for disclosing misconduct occurs at VA. GAO analyzed 12 information systems across VA to assess the reliability of misconduct data, examined a stratified random sample of 544 misconduct cases from 2009 through 2015, analyzed data and reviewed cases pertaining to senior officials involved in misconduct, reviewed procedures pertaining to whistle-blower investigations, and examined a nongeneralizable sample of whistle-blower disclosures from 2010 to 2014. The Department of Veterans Affairs (VA) collects data related to employee misconduct and disciplinary actions, but fragmentation and data-reliability issues impede department-wide analysis of those data. VA maintains six information systems that include partial data related to employee misconduct. For example, VA's Personnel and Accounting Integrated Data system collects information on disciplinary actions that affect employee leave and pay, but the system does not collect information on other types of disciplinary actions. The system also does not collect information such as the offense or date of occurrence. GAO also identified six other information systems that various VA administrations and program offices use to collect specific information regarding their respective employees' misconduct and disciplinary actions. GAO's analysis of all 12 information systems found data-reliability issues—such as missing data, lack of identifiers, and lack of standardization among fields. Without collecting reliable misconduct and disciplinary action data on all cases department-wide, VA's reporting and decision making on misconduct are impaired. VA inconsistently adhered to its guidance for documentation retention when adjudicating misconduct allegations, based on GAO's review of a generalizable sample of 544 out of 23,622 misconduct case files associated with employee disciplinary actions affecting employee pay. GAO estimates that VA would not be able to account for approximately 1,800 case files. Further, GAO estimates that approximately 3,600 of the files did not contain required documentation that employees were adequately informed of their rights during adjudication procedures—such as their entitlement to be represented by an attorney. The absence of files and associated documentation suggests that individuals may not have always received fair and reasonable due process as allegations of misconduct were adjudicated. Nevertheless, VA's Office of Human Resource Management does not regularly assess the extent to which files and documentation are retained consistently with applicable requirements. VA did not consistently ensure that allegations of misconduct involving senior officials were reviewed according to investigative standards and these officials were held accountable. For example, based on a review of 23 cases of alleged misconduct by senior officials that the VA Office of Inspector General (OIG) referred to VA facility and program offices for additional investigation, GAO found VA frequently did not include sufficient documentation for its findings, or provide a timely response to the OIG. In addition, VA was unable to produce any documentation used to close 2 cases. Further, OIG policy does not require the OIG to verify the completeness of investigations, which would help ensure that facility and program offices had met the requirements for investigating allegations of misconduct. Regarding senior officials, VA did not always take necessary measures to ensure they were held accountable for substantiated misconduct. As the figure below shows, GAO found that the disciplinary action proposed was not taken for 5 of 17 senior officials with substantiated misconduct. As a result of June 2017 legislation, a new office within VA—the Office of Accountability and Whistleblower Protection—will be responsible for receiving and investigating allegations of misconduct involving senior officials. VA has procedures for investigating whistle-blower complaints, but the procedures allow the program office or facility where a whistle-blower has reported misconduct to conduct the investigation. According to the OIG, it has the option of investigating allegations of misconduct, or exercising a “right of first refusal” whereby it refers allegations of misconduct to the VA facility or program office where the allegation originated. VA does not have oversight measures to ensure that all referred allegations of misconduct are investigated by an entity outside the control of the facility or program office involved in the misconduct, to ensure independence. As a result, GAO found instances where managers investigated themselves for misconduct, presenting a conflict of interest. Data and whistle-blower testimony indicate that retaliation may have occurred at VA. As the table below shows, individuals who filed a disclosure of misconduct with the Office of Special Counsel (OSC) received disciplinary action at a much higher rate than the peer average for the rest of VA in fiscal years 2010–2014. Additionally, GAO's interviews with six VA whistle-blowers who claim to have been retaliated against provided anecdotal evidence that retaliation may be occurring. These whistle-blowers alleged that managers in their chain of command took several untraceable actions to retaliate against the whistle-blowers, such as being denied access to computer equipment necessary to complete assignments. GAO makes numerous recommendations to VA to help enhance its ability to address misconduct issues (several of the recommendations are detailed on the following page). GAO recommends, among other things, that the Secretary of Veterans Affairs develop and implement guidance to collect complete and reliable misconduct and disciplinary-action data department-wide; such guidance should include direction and procedures on addressing blank fields, lack of personnel identifiers, and standardization among fields; direct applicable facility and program offices to adhere to VA's policies regarding misconduct adjudication documentation; direct the Office of Human Resource Management to routinely assess the extent to which misconduct-related files and documents are retained consistently with applicable requirements; direct the Office of Accountability and Whistleblower Protection (OAWP) to review responses submitted by facility or program offices to ensure evidence produced in senior-official case referrals demonstrates that the required elements have been addressed; direct OAWP to issue written guidance on how OAWP will verify whether appropriate disciplinary action has been implemented; and develop procedures to ensure (1) whistle-blower investigations are reviewed by an official independent of and at least one level above the individual involved in the allegation, and (2) VA employees who report wrongdoing are treated fairly and protected against retaliation. GAO also recommends, among other things, that the VA OIG revise its policy and require verification of evidence produced in senior-official case referrals. VA concurred with nine recommendations and partially concurred with five. In response, GAO modified three of the recommendations. The VA OIG concurred with one recommendation and partially concurred with the other. GAO continues to believe that both are warranted.