In fiscal year 2007, VHA recorded over $6.9 billion of miscellaneous  obligations for the procurement of mission-related goods and services. Miscellaneous Obligation Control Deficiencies

In September 2008, we reported that VA policies and procedures were not  designed to provide adequate controls over the authorization and use of  miscellaneous obligations with respect to (1) oversight by contracting  officials, (2) segregation of duties, and (3) supporting documentation for  the obligation of funds. Our 2008 case studies also identified a lack of adequate supporting  documentation at the three medical centers we visited. Our report concluded that without basic controls in place over billions of  dollars in miscellaneous obligations, VA is at significant risk of fraud,  waste, and abuse. These recommendations  aimed at reducing the risks associated with the use of miscellaneous  obligations. In response to our recommendations, in January of 2009, VA issued  Volume II, Chapter 6, of VA Financial Policies and Procedures— Miscellaneous Obligations, which outlines detailed policies and  procedures aimed at addressing control deficiencies identified in our  September 2008 report. These noncompliance issues were similar to those we identified in our  September 2008 report on VHA miscellaneous obligations. VA Has Had Long- standing Material Weaknesses in Financial Reporting

In November of 2009, we reported that VA had three long-outstanding  material weaknesses in internal control over financial reporting identified  during VA’s annual financial audits. Financial management oversight—reported as a material weaknesses  since fiscal year 2005. Financial management system functionality—reported since fiscal year  2000—is linked to VA’s outdated legacy financial systems affecting  VA’s ability to prepare, process, and analyze financial information that  is timely, reliable, and consistent. We also found that while VA had corrective action plans in place intended  to result in near-term remediation of its significant deficiencies, many  corrective action plans did not contain the detail needed to provide VA  officials with assurance that the plans could be effectively implemented on  schedule. VA recognized the  need to better oversee and coordinate agencywide oversight activities for  financial reporting material weaknesses, and began to staff a new office  responsible for, in part, assisting VA and the three administrations and  staff offices in executing and monitoring corrective actions plans. Our  report concluded that actions to provide a rigorous framework for the  design and oversight of corrective action plans will be essential to  ensuring the timely remediation of VA’s internal control weaknesses, and  that continued support from senior VA officials and administration CFOs  would be critical to ensure that key corrective actions are developed and  implemented on schedule. We made three recommendations to help  improve corrective action plan development and oversight. VA concurred  with the recommendations and said that it took some actions to address  the recommendations, including developing a manual with guidance on  corrective action planning and monitoring, creating a corrective action  plan repository, and establishing a Senior Assessment Team of senior VA  officials as the coordinating body for corrective action planning,  monitoring, reporting, and validation of deficiencies identified during  financial audits. In the fiscal year  2009 Performance and Accountability Report, VA officials noted that in  fiscal year 2009 they had closed 10 of the underlying significant  deficiencies reported in fiscal year 2008, but that their timetables had  slipped for remediating the IT security controls and financial management  oversight material weaknesses to 2010 and 2012, respectively. In summary, while we have not independently validated the status of VA’s  actions to address our 2008 and 2009 reports’ findings concerning VA’s  controls over miscellaneous obligations and financial reporting, VA’s  recent inspections and financial audit report indicate that the serious,  long-standing deficiencies we identified are continuing.
Why GAO Did This Study

In September 2008, GAO reported internal control weaknesses over the Veteran Health Administration's (VHA) use of $6.9 billion in miscellaneous obligations in fiscal year 2007. In November 2009, GAO reported on deficiencies in corrective action plans to remediate financial reporting control deficiencies. This testimony is based on these previous reports that focused on (1) VHA miscellaneous obligation control deficiencies and (2) Department of Veterans Affairs (VA) financial reporting control deficiencies and VA plans to correct them. For its review of VHA miscellaneous obligations, GAO evaluated VA's policies and procedures and documentation, interviewed cognizant agency officials, and conducted case studies at three VHA medical centers. For its review of financial reporting control deficiencies, GAO evaluated VA financial audit reports from fiscal years 2000 to 2008 and analyzed related corrective action plans.

What GAO Found

In September 2008, we reported that VHA recorded over $6.9 billion of miscellaneous obligations for the procurement of mission-related goods and services in fiscal year 2007. We also reported that VA policies and procedures were not designed to provide adequate controls over the authorization and use of miscellaneous obligations, placing VA at significant risk of fraud, waste, and abuse. We made four recommendations with respect to (1) oversight by contracting officials, (2) segregation of duties, (3) supporting documentation for the obligation of funds, and (4) oversight mechanisms. In January 2009, VA issued new policies and procedures aimed at addressing the deficiencies identified in GAO's September 2008 report. In November of 2009, we reported that VA's independent public auditor had identified two of VA's three fiscal year 2008 material weaknesses--in financial management system functionality and IT security controls--every year since fiscal year 2000 and the third--financial management oversight--each year since fiscal year 2005. While VA had corrective action plans in place that intended to result in near-term remediation of its internal control deficiencies, many of these plans did not contain the detail needed to provide VA officials with assurance that the plans could be effectively implemented on schedule. For example, 8 of 13 plans lacked key information about milestones for steps to achieve the corrective action and how VA would validate that the steps taken had actually corrected the deficiency. While VA began to staff a new office responsible for, in part, assisting VA and the three administrations in executing and monitoring corrective action plans, we made three recommendations to improve corrective action plan development and oversight. VA concurred with our recommendations and took some steps to address them. In fiscal year 2009, VA's own internal VA inspections and financial statement audit determined that the internal control deficiencies identified in our prior reports on miscellaneous obligations and material weaknesses identified in prior financial audits continued to exist. VA conducted 39 inspections, which identified problems with how VHA facilities had implemented VA's new miscellaneous obligation policies and procedures. Similarly, VA's independent auditor reported that VA continued to have material weaknesses in financial management system functionality, IT security controls, and financial management oversight in fiscal year 2009. To the extent that the deficiencies we identified continue, it will be critical that VA have an effective "tone at the top" and mechanisms to monitor corrective actions related to deficient internal controls. In its September 2008 report, GAO made four recommendations to improve VA's internal controls over miscellaneous obligations. In its November 2009 report, GAO made three recommendations to improve VA corrective action plans to remediate financial reporting control deficiencies. VA generally concurred with these recommendations and has since reported taking actions to address the recommendations.