Since 1990, we have regularly reported on government operations that we have identified as high risk due to their vulnerability to fraud, waste, abuse, and mismanagement, or the need for transformation to address economy, efficiency, or effectiveness challenges. Our high-risk program— which is intended to help inform the congressional oversight agenda and to guide efforts of the administration and agencies to improve government performance—has brought much-needed focus to problems impeding effective government and costing billions of dollars. In 1990, we designated 14 high-risk areas. Since then, generally coinciding with the start of each new Congress, we have reported on the status of progress to address previously designated high-risk areas, determined whether any areas could be removed or consolidated, and identified new high-risk areas. Since 1990, a total of 60 different areas have appeared on the High-Risk List, 24 areas have been removed, and 2 areas have been consolidated. On average, high-risk areas that have been removed from the list remained on it for 9 years after they were initially added. Our experience has shown that the key elements needed to make progress in high-risk areas are top-level attention by the administration and agency leaders grounded in the five criteria for removal from the High-Risk List, as well as any needed congressional action. The five criteria for removal that we issued in November 2000 are as follows: Leadership Commitment. The agency demonstrates strong commitment and top leadership support. Capacity. The agency has the capacity (i.e., people and resources) to resolve the risk(s). Action Plan. A corrective action plan exists that defines the root cause and solutions, and provides for substantially completing corrective measures, including steps necessary to implement solutions we recommended. Monitoring. A program has been instituted to monitor and independently validate the effectiveness and sustainability of corrective measures. Demonstrated Progress. The agency is able to demonstrate progress in implementing corrective measures and in resolving the high-risk area. These five criteria form a road map for efforts to improve and ultimately address high-risk issues. Addressing some of the criteria leads to progress, while satisfying all of the criteria is central to removal from the list. In our April 2016 report, we provided additional information on how agencies had made progress addressing high-risk issues. Figure 1 shows the five criteria for removal for a designated high-risk area and examples of actions taken by agencies as cited in that report. Importantly, the actions listed are not “stand alone” efforts taken in isolation from other actions to address high-risk issues. That is, actions taken under one criterion may also be important in meeting other criteria. For example, top leadership can demonstrate its commitment by establishing a corrective action plan including long-term priorities and goals to address the high-risk issue and using data to gauge progress— actions which are also vital to monitoring criteria. VA officials have expressed their commitment to addressing the concerns that led to the high-risk designation for VA health care. As part of our work for the 2017 high-risk report, we identified actions VA had taken, such as establishing a task force, working groups, and a governance structure for addressing the five areas of concern contributing to the designation: (1) ambiguous policies and inconsistent processes; (2) inadequate oversight and accountability; (3) information technology (IT) challenges; (4) inadequate training for VA staff; and (5) unclear resource needs and allocation priorities. For example, in July 2016, VA chartered the GAO High Risk List Area Task Force for Managing Risk and Improving VA Health Care to develop and oversee implementation of VA’s plan to address the root causes of the five areas of concern we identified in 2015. VA’s task force and associated working groups are responsible for developing and executing the department’s high-risk mitigation plan for each of the five areas of concern we identified. VA also executed two contracts with a total value of $7.8 million to support its actions to address the concerns behind the high-risk designation. These contracts—with the MITRE Corporation and Atlas Research, LLC—are intended to provide additional support for actions such as developing and executing an action plan, creating a plan to enhance VA’s capacity to manage the five areas, and assisting with establishing the management functions necessary to oversee the five high-risk-area working groups. On August 18, 2016, VA provided us with an action plan that acknowledged the deep-rooted nature of the areas of concern, and stated that these concerns would require substantial time and work to address. Although the action plan outlined some steps VA plans to take over the next several years to address the concerns that led to its high-risk designation, several sections were missing critical actions that would support our criteria for removal from the High-Risk List, such as analyzing the root causes of the issues and measuring progress with clear metrics. In our feedback to VHA on drafts of its action plan, we highlighted these missing actions and also stressed the need for specific timelines and an assessment of needed resources for implementation. For example, VA plans to use staff from various sources, including contractors and temporarily detailed employees, to support its high-risk-area working groups, so it is important for VA to ensure that these efforts are sufficiently resourced. As we reported in the February 2017 high-risk report, when we applied the five criteria for High-Risk List removal to each of the areas of concern, we determined that VA has partially met two of the five criteria: leadership commitment and an action plan. VA has not met the other three criteria for removal: capacity to address the areas of concern, monitoring implementation of corrective actions, and demonstrating progress. It is worth noting that although both criteria were rated as partially met, the department made significantly less progress in developing a viable action plan than it has in demonstrating leadership commitment. Specifically, VA partially met the action plan criterion for only one of the five areas of concern—ambiguous policies and inconsistent processes—whereas VA partially met the leadership commitment criterion for four out of five areas of concern. The following is a summary of the progress VA has made in addressing the five criteria for removal from the High-Risk List for each of the five areas of concern we identified. Summary of concern. When we designated VA health care as a high- risk area in 2015, we reported that ambiguous VA policies led to inconsistent processes at local VA medical facilities, which may have posed risks for veterans’ access to VA health care. Since then, we highlighted the inconsistent application of policies in two recent reports examining mental health and primary care access at VA medical facilities in 2015 and 2016, respectively. In both reports, we found wide variation in the time that veterans waited for primary and mental health care, which was in part caused by a lack of clear, updated policies for appointment scheduling; therefore, we recommended that VA update these policies. These ambiguous policies contributed to errors made by appointment schedulers, which led to inconsistent and unreliable wait-time data. For mental health, we also found that two policies conflicted, leading to confusion among VA medical center staff as to which wait-time policy to follow. In 2015, VA resolved this policy conflict by revising its mental health handbook, but other inconsistent applications of mental health policy have not yet been addressed, such as our recommendation to issue guidance about the definitions used to calculate veteran appointment wait times, and communicate any changes to those definitions within and outside VHA. 2017 assessment of VA’s progress. Based on actions taken since 2015, VA has partially met our criteria for removal from the High-Risk List for this area of concern for leadership commitment and action plan. VA has partially met the leadership commitment criterion because it established a framework for developing and reviewing policies—with the goal of ensuring greater consistency and clarity—and set goals for making the policy-development process more efficient. VA has partially met the action plan criterion for this high-risk area of concern because its action plan described an analysis of the root causes of problems related to ambiguous policies and inconsistent processes, an important aspect of an action plan. However, VA has not met our criteria for removal from the High-Risk List for capacity, monitoring, and demonstrated progress for this area of concern because it has not addressed gaps that exist between its stated goals and available resources, addressed inconsistent application of policies at the local level, or demonstrated that its actions are linked to identified root causes. Summary of concern. In our 2015 high-risk report, we found that VA had problems holding its facilities accountable for their performance because it relied on self-reported data from facilities, its oversight activities were not sufficiently focused on compliance, and it did not routinely assess policy implementation. We continued to find a lack of oversight in our October 2015 review of the efficiency and timeliness of VA’s primary care. For example, we found inaccuracies in VA’s data on primary care panel sizes, which are used to help medical centers manage their workload and ensure that veterans receive timely and efficient care. We found that while VA’s primary care panel management policy required facilities to ensure the reliability of their panel size data, it did not assign responsibility for verifying data reliability to regional- or national-level officials or require them to use the data for monitoring purposes. As a result, VA could not be assured that local panel size data were reliable, or know whether its medical centers had met VA’s goals for efficient, timely, and quality care. We recommended that VA incorporate an oversight process in its primary care panel management policy that assigns responsibility, as appropriate, to regional networks and to VA’s central office for verifying and monitoring panel sizes. 2017 assessment of VA’s progress. VA has partially met the leadership commitment criterion for this area of concern because it established a high-level governance structure and adopted a new model to guide the department’s oversight and accountability activities.