We have categorized our concerns about VA’s ability to ensure the  timeliness, cost-effectiveness, quality, and safety of the health care the  department provides into five broad areas: (1) ambiguous policies and  inconsistent processes, (2) inadequate oversight and accountability, (3)  information technology challenges, (4) inadequate training for VA staff,  and (5) unclear resource needs and allocation priorities. The recently enacted Veterans Access, Choice, and Accountability Act  included a number of provisions intended to help VA address systemic  weaknesses. It is also critical that Congress maintains its focus on oversight of VA  health care. Improving the Management of IT Acquisitions and Operations

Although the executive branch has undertaken numerous initiatives to  better manage the more than $80 billion that is annually invested in  information technology (IT), federal IT investments too frequently fail or  incur cost overruns and schedule slippages while contributing little to  mission-related outcomes. We have previously testified that the federal  government has spent billions of dollars on failed IT investments. These  and other failed IT projects often suffered from a lack of disciplined and  effective management, such as project planning, requirements definition,  and program oversight and governance. As of January  2015, about 23 percent of the 737 recommendations had been fully  implemented. Given current and emerging risks, we are expanding the  Enforcement of Tax Laws area to include IRS’s efforts to address tax  refund fraud due to identity theft (IDT), which occurs when an identity thief  files a fraudulent tax return using a legitimate taxpayer’s identifying  information and claims a refund. However, advances in  technology which have dramatically enhanced the ability of both  government and private sector entities to collect and process extensive  amounts of Personally Identifiable Information (PII) pose challenges to  ensuring the privacy of such information. The number of reported security  incidents involving PII at federal agencies has increased dramatically in  recent years. Capacity. Action plan. Demonstrated progress. Continued Progress

Since our last high-risk update in 2013, there has been solid and steady  progress on the vast majority of the 30 high-risk areas from our 2013 list. Progress has been possible through the concerted actions and efforts of  Congress and the leadership and staff in agencies and OMB. Of the  11 areas that have been on the High Risk List since the 1990s, 7 have at  least met or partially met all of the criteria for removal and 1 area—DOD  Contract Management—is 1 of the 2 areas that has made enough  progress to remove subcategories of the high-risk area. Narrowing High Risk Areas

Since our 2013 update, sufficient progress has been made to narrow the  scope of the following two areas. These actions have addressed this high-risk issue. Progress in Selected High-Risk Areas

In addition to the two areas that we narrowed—Protecting Public Health  through Enhanced Oversight of Medical Products and DOD Contract  Management—nine other areas met at least one of the criteria for  removal from the High Risk List and were rated at least partially met for  all four of the remaining criteria. Ensuring the Security of Federal Information Systems and Cyber Critical Infrastructure and Protecting the Privacy of Personally Identifiable Information

We added this high-risk area in 1997 and expanded it this year to include  protection of PII. CMS made positive strides, but more needs to be done to fully meet our  criteria. CMS should  require a surety bond for certain types of at-risk providers and  suppliers; publish a proposed rule for increased disclosures of prior actions  taken against providers and suppliers enrolling or revalidating  enrollment in Medicare, such as whether the provider or supplier has  been subject to a payment suspension from a federal health care  program; establish core elements of compliance programs for providers and  improve automated edits that identify services billed in medically  unlikely amounts; develop performance measures for the Zone Program Integrity  Contractors who explicitly link their work to the agency’s Medicare  FFS program integrity performance measures and improper payment  reduction goals;  reduce differences between contractor postpayment review  requirements, when possible; monitor the database used to track Recovery Auditors’ activities to  ensure that all postpayment review contractors are submitting  required data and that the data the database contains are accurate  and complete;  require Medicare administrative contractors to share information about  the underlying policies and savings related to their most effective  edits; and efficiently and cost-effectively identify, design, develop, and  implement an information technology solution that addresses the  removal of Social Security numbers from Medicare beneficiaries’  health insurance cards. In support  of Congress and to further progress to address high-risk issues, we  continue to review efforts and make recommendations to address high- risk areas.
Why GAO Did This Study

The federal government is one of the world's largest and most complex entities; about $3.5 trillion in outlays in fiscal year 2014 funded a broad array of programs and operations. GAO maintains a program to focus attention on government operations that it identifies as high risk due to their greater vulnerabilities to fraud, waste, abuse, and mismanagement or the need for transformation to address economy, efficiency, or effectiveness challenges.
Since 1990, more than one-third of the areas previously designated as high risk have been removed from the list because sufficient progress was made in addressing the problems identified. The five criteria for removal are: (1) leadership commitment, (2) agency capacity, (3) an action plan, (4) monitoring efforts, and (5) demonstrated progress.
This biennial update describes the status of high-risk areas listed in 2013 and identifies new high-risk areas needing attention by Congress and the executive branch. Solutions to high-risk problems offer the potential to save billions of dollars, improve service to the public, and strengthen government performance and accountability.

What GAO Found

Solid, steady progress has been made in the vast majority of the high-risk areas. Eighteen of the 30 areas on the 2013 list at least partially met all of the criteria for removal from the high risk list. Of those, 11 met at least one of the criteria for removal and partially met all others. Sufficient progress was made to narrow the scope of two high-risk issues— Protecting Public Health through Enhanced Oversight of Medical Products and DOD Contract Management. Overall, progress has been possible through the concerted actions of Congress, leadership and staff in agencies, and the Office of Management and Budget.
This year GAO is adding 2 areas, bringing the total to 32.
Managing Risks and Improving Veterans Affairs (VA) Health Care. GAO has reported since 2000 about VA facilities' failure to provide timely health care. In some cases, these delays or VA's failure to provide care at all have reportedly harmed veterans. Although VA has taken actions to address some GAO recommendations, more than 100 of GAO's recommendations have not been fully addressed, including recommendations related to the following areas: (1) ambiguous policies and inconsistent processes, (2) inadequate oversight and accountability, (3) information technology challenges, (4) inadequate training for VA staff, and (5) unclear resource needs and allocation priorities. The recently enacted Veterans Access, Choice, and Accountability Act included provisions to help VA address systemic weaknesses. VA must effectively implement the act.
Improving the Management of Information Technology (IT) Acquisitions and Operations. Congress has passed legislation and the administration has undertaken numerous initiatives to better manage IT investments. Nonetheless, federal IT investments too frequently fail to be completed or incur cost overruns and schedule slippages while contributing little to mission-related outcomes. GAO has found that the federal government spent billions of dollars on failed and poorly performing IT investments which often suffered from ineffective management, such as project planning, requirements definition, and program oversight and governance. Over the past 5 years, GAO made more than 730 recommendations; however, only about 23 percent had been fully implemented as of January 2015.
GAO is also expanding two areas due to evolving high-risk issues.
Enforcement of Tax Laws. This area is expanded to include IRS's efforts to address tax refund fraud due to identify theft. IRS estimates it paid out $5.8 billion (the exact number is uncertain) in fraudulent refunds in tax year 2013 due to identity theft. This occurs when a thief files a fraudulent return using a legitimate taxpayer's identifying information and claims a refund.
Ensuring the Security of Federal Information Systems and Cyber Critical Infrastructure and Protecting the Privacy of Personally Identifiable Information (PII). This risk area is expanded because of the challenges to ensuring the privacy of personally identifiable information posed by advances in technology. These advances have allowed both government and private sector entities to collect and process extensive amounts of PII more effectively. The number of reported security incidents involving PII at federal agencies has increased dramatically in recent years.

What GAO Recommends

This report contains GAO's views on progress made and what remains to be done to bring about lasting solutions for each high-risk area. Perseverance by the executive branch in implementing GAO's recommended solutions and continued oversight and action by Congress are essential to achieving greater progress.