As part of providing care to millions of veterans, VA is  expected to provide a safe environment not only for the veterans, but also  for staff and visitors at a diverse makeup of VHA facilities. Each  VISN is responsible for managing and overseeing medical centers within  a defined geographic area. However, the primary operational  responsibility for VA’s physical security program is at the medical centers  themselves, where the medical center directors at each of VHA’s 170  medical centers are responsible for implementing OSLE’s policies and  standards and overseeing VHA police activities. Police at each facility  conduct the key activities involved in this program, including conducting  risk assessments and identifying needed countermeasures. Its mission is to develop standards and best  practices. VA policy calls for police at each of VHA’s medical centers to conduct  vulnerability assessments biennially. However, VA policy does not require the documentation  of risk acceptance. As examples of performance  measures, the ISC Standard suggests that agencies could track the  number of countermeasures in use or the percentage of facility  assessments completed. According to VA officials, VA’s risk management process was developed  before the ISC’s standard for risk management processes was originally  issued in 2013. VA officials we spoke with said as a member of ISC they  utilize it as a forum for exchanging ideas on best practices and  interpreting the standards but it is then up to each agency to determine  how best to apply ISC standards. VA officials said that they are currently  reexamining their policies but have not reached out to the ISC for  assistance. VA Does Not Assess the Effectiveness of Its Risk Management Process

Agencies are expected to manage the effectiveness of program  operations in achieving their missions. Because  VHA lacks an oversight strategy that includes these elements, it cannot  begin to assess the effectiveness of security at its facilities. For example, none of the vulnerability assessments we reviewed included  documentation that all eight of VA’s threat categories were reviewed, and  at three locations, no threat categories were documented as reviewed in  the assessments. In the  absence of system-wide oversight strategy, VA does not know if these  variations in countermeasures are resulting in different levels of security,  which may leave some facilities at risk and not be the most strategic use  of resources at other facilities. In the absence of a VHA- wide strategy and guidance about how to collect data or track  deficiencies, individual sites have established their own processes for  tracking the status of identified security deficiencies. However, until VA reviews its policies against the ISC standards  to explore areas where it differs from these standards, it will not be able to  ensure that its approach to risk management will yield and has yielded  the appropriate security posture relative to the different risks faced by its  diverse set of facilities. But without  a system-wide oversight process, VA cannot assess the overall  performance of its security program and whether medical centers are  adequately protected. Thus, it may be missing opportunities to leverage  resources nationally, or make informed, proactive policy decisions. Recommendations for Executive Action

We are making the following two recommendations to VA:  The Secretary of VA should, in collaboration with ISC, review and revise  VA’s risk management policies for VHA facilities to ensure VA  incorporates ISC standards, as appropriate. (Recommendation 2)

	Agency Comments

We provided a draft of this report to the Department of Veterans Affairs  (VA) and Department of Homeland Security (DHS) for comment. Appendix I: Objectives, Scope, and Methodology

The objectives of our report were to assess (1) the extent that VA’s  policies for physical-security risk management reflect elements of  federally established risk management standards and (2) VA’s oversight  of risk management of physical security at VHA facilities. For example, we reviewed prior reports from GAO on the  security of federal government facilities and effective program  management, as well as documentation from the Department of  Homeland Security’s Interagency Security Committee (ISC), including  physical security standards it has developed by the ISC. To determine how VA policies for physical security risk management  reflect key elements of federally established risk management standards,  we assessed how VA’s methodologies reflect ISC’s risk management  standards. According to the ISC Standard, agencies’  risk management methodologies should determine facility security level (FSL);  identify facility’s baseline countermeasure;  identify and assess risk; determine necessary countermeasures;  implement protective measures and/or accept risk; and  To assess VA’s oversight of risk management of physical security at VHA  facilities, we identified and examined oversight and management  mechanisms at the national, regional, and local levels, including reporting  mechanisms that prioritize or track facility risks or the implementation of  countermeasures at VHA facilities.
Why GAO Did This Study

The Veterans Health Administration (VHA is responsible for providing a safe and secure, yet welcoming environment for staff, patients, and visitors at nearly 170 medical centers. These facilities have been the target of violence, threats, and other security-related incidents. Assessing and managing risks a critical element for ensuring adequate physical security at these facilities.
GAO was asked to review VA's physical security risk-management policies and practices. This report: (1) assesses how VA's policies for risk management reflect prevailing standards, and (2) evaluates VA's oversight of risk management at VHA medical facilities. GAO compared VA policies to ISC standards; reviewed VA documents; interviewed VA and ISC officials; and assessed risk assessment activities at nine medical centers selected based on factors such as patient and security-incident data and geographical diversity. While not generalizable, these nine locations provide illustrative examples of how VA's policies are carried out.

What GAO Found

The Department of Veterans Affairs' (VA) risk management policies include some but not all of the elements of standards set by the Interagency Security Committee (ISC). ISC was established via executive order to develop security standards and best practices that federal agencies are to follow when developing and conducting risk assessments. As part of this process, VA's policy identifies minimum countermeasures as called for in ISC's standards. In other areas, VA policy only partially adheres or does not adhere to ISC's standards, for example:
Of the five factors ISC calls for when calculating a facility's security level, VA considers three but does not consider a facility's population and size.
VA policy does not include performance measures, such as the number of countermeasures in use or the percentage of facility assessments completed; this percentage is a key element of ISC's standards for assessing the effectiveness of an agency's security programs.
Officials at VA said that its risk management program was developed prior to the ISC standards' being issued in 2013 and that it is up to each agency to determine how to best apply the standards. Nevertheless, VA officials said they are currently reexamining their policies. Until VA reviews its policies in accordance with ISC standards, its approach to risk management may not yield the appropriate security posture needed to adequately protect its medical centers.
VA's oversight activities for risk management do not encompass key aspects of the Standards for Internal Control in the Federal Government and Circular A-123 from the Office of Management and Budget that require agencies to conduct oversight activities to ensure the accountability and effectiveness of agency programs. VA has an oversight process to ensure that biennial assessments of individual facilities' security are completed. However, VA:
does not review the quality of medical centers' required risk assessments,
does not identify whether countermeasures were implemented appropriately by the medical centers, and
does not collect system-wide data to gain an understanding of physical security issues across medical centers.
In the absence of a comprehensive VA-wide strategy or guidance that reflects these internal control standards, individual sites have established their own approaches to carrying out VA's risk management policy. For example, the nine sites GAO reviewed conducted their security assessments differently, and none of the assessments indicated that all of the threat categories in VA's policy were reviewed. The lack of a system-wide oversight strategy means that the differences among medical center approaches, along with the security effects of those different approaches, are unknown. Accordingly, VA does not know if its medical centers are adequately protected, and it may be missing opportunities to leverage resources nationally and make better informed, proactive policy decisions.

What GAO Recommends

GAO recommends that the Department of Veterans Affairs review and revise its risk management policies to reflect prevailing standards, and develop an oversight strategy to assess the effectiveness of risk management programs at VHA facilities. VA agreed with GAO's recommendations and identified steps to implement them.