Last month we recommended that the Acting Secretary of Veterans Affairs implement these actions to improve VA’s IT investment decision-making process.VA concurred with these recommendations, and stated that the in-process review plans will include completion dates, post implementation review findings, such as lessons learned, will be provided to investment panel members, and the VAInformationTechnologyCapitalInvestmentGuide,which was printed and distributed to VA’s agencies earlier this month, provides guidance on processes for selecting, controlling, and evaluating IT investments and procurements below the Capital Investment Board threshold. It decided to separate the CIO function from the chief financial officer and established the position of assistant secretary for information and technology to serve as VA’s CIO. This past May,we testified before this Subcommittee that VA no longer planned to develop such a strategy. In contrast to VBA, VHA has a decentralized process for tracking IT expenditures. However, VHA does not have a uniform mechanism for tracking IT expenditures across the administration. Challenges Continue for Two IT Projects

I would now like to discuss the status of VA’s efforts to develop and implement VHA’s Decision Support System and VBA’s compensation and pension replacement project. The May 2000 responses to two questions asked by VHA’s chief network officer also indicate that DSS is not being fully utilized. Specifically, data in the existing VBA system will need to be converted to the new system. In addition, VBA must develop data exchanges to allow the compensation and pension replacement system to share data with other systems. For example, it is critical that changes to veteran information, such as name and address, captured in the compensation and pension replacement system be changed in other VBA systems. Earlier this month, we reported that serious computer security problems persisted throughout the department and VHA because VA had not yet fully implemented an integrated security management program and VHA had not effectively managed computer security at its medical facilities.Consequently, financial transaction data and personal information on veterans’ medical records continued to face increased risk of inadvertent or deliberate misuse, fraudulent use, improper disclosure, or destruction. While it has improved its IT investment decision-making process and plans to fill its department CIO position, VA may encounter problems achieving its “One VA” vision until it develops an overall business process reengineering strategy and a departmentwide, integrated IT architecture. In addition, VA’s lack of departmentwide tracking of IT expenditures makes it difficult for the department to manage the risks of its IT investments.
Why GAO Did This Study

Pursuant to a congressional request, GAO discussed the Department of Veterans Affairs' (VA) information technology (IT) program, focusing on VA's efforts to: (1) improve its process for selecting, controlling, and evaluating IT investments; (2) fill the chief information officer (CIO) position; (3) develop an overall strategy for reengineering its business processes; (4) complete a departmentwide integrated systems architecture; (5) track its IT expenditures; (6) implement the Veterans Health Administration's (VHA) Decision Support System and the Veterans Benefits Administration's (VBA) compensation and pension replacement project; and (7) improve the department's computer security.

What GAO Found

GAO noted that: (1) overall, VA's IT investment decision-making process has improved, and it has started to implement recommendations GAO enumerated in May and August of this year; (2) further, VA is obtaining a full-time CIO now that the Administration has identified a candidate for the position; (3) however, the department no longer plans to develop an overall strategy for reengineering its business process to effectively function as "One VA," nor has it defined the integrated IT architecture needed to efficiently acquire and utilize information systems across VA; (4) in addition, VA lacks a uniform mechanism that readily tracks IT expenditures; (5) instead, VA's different offices use various mechanisms for tracking IT expenditures; (6) VHA's Decision Support System (DSS) and VBA's compensation and pension replacement project continue to face challenges; (7) as demonstrated in a survey to all Veterans Integrated Service Networks and medical centers directors, DSS is not being fully utilized; (8) in addition, while VBA plans to pilot test portions of its compensation and pension replacement system in January 2001, other key issues need to be addressed before the system can be fully implemented; (9) for example, VBA does not have a plan or schedule for converting data from the old system to the new system and exchanging data between the new system and other systems; (10) regarding computer security, VA has begun to address weaknesses identified by GAO and its Office of Inspector General; and (11) until it develops and implements a comprehensive, coordinated security management program, VA will have limited assurance that financial information and sensitive medical records are adequately protected from misuse, unauthorized disclosure, and destruction.