Department Of Veterans Affairs
Improvements Needed in Corrective Action Plans to Remediate Financial Reporting Material Weaknesses Gao ID: GAO-10-65 November 16, 2009In fiscal year 2008, the Department of Veterans Affairs (VA) identified three material internal control weaknesses over financial reporting--financial management system functionality, IT security controls, and financial management oversight. VA is developing a new financial system--FLITE--but full implementation is not expected until 2014. Therefore, the Subcommittee asked us to determine whether VA corrective action plans and oversight are appropriately focused on near-term actions to provide improved financial information. This report addresses (1) the nature of the internal control weaknesses identified in the VA fiscal year 2008 financial audit report and how long they have been outstanding, (2) whether VA had plans appropriately focused on near-term corrective actions, and (3) whether VA had appropriate oversight mechanisms in place to help assure that near-term corrective action plans are implemented on schedule. GAO reviewed corrective action plans for significant deficiencies underlying 2 of the 3 material weaknesses and performed additional analysis for two underlying significant deficiencies.
VA's fiscal year 2008 material weaknesses in financial management system functionality and financial management oversight have been reported since fiscal years 2000 and 2005, respectively. These two material weaknesses are comprised of 16 underlying significant financial reporting control deficiencies. Although VA had eliminated some significant deficiencies in prior years, other deficiencies have emerged. As a result, continuing serious deficiencies in financial reporting leave VA at risk of processing errors and misstatements in its financial statements. Although VA had corrective action plans in place intended to result in near-term remediation of the 16 fiscal year 2008 significant control deficiencies, many of these plans did not contain the detail needed to provide VA officials with assurance that the plans could be effectively implemented on schedule. VA lacked documented policies and procedures needed to assure the consistent and comprehensive design of these corrective action plans, and 8 of 13 of VA's plans for correcting its financial reporting deficiencies lacked key information regarding milestones for action steps and validation activities.As of August 2009, VA had missed milestones in 5 of the 13 corrective action plans. For example, our analysis of plans for remediating deficiencies regarding the capitalization of property, plant, and equipment and inadequate benefit payment reconciliations showed that slipping milestones could jeopardize VA's timely completion of these plans, and consequently may impair VA's ability to obtain improved data reliability within the time frames originally envisioned. VA lacked documented policies and procedures for overseeing implementation of the corrective action plans, but recently took steps intended to better coordinate its oversight activities.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Susan Ragland Team: Government Accountability Office: Financial Management and Assurance Phone: (202) 512-8486GAO-10-65, Department Of Veterans Affairs: Improvements Needed in Corrective Action Plans to Remediate Financial Reporting Material Weaknesses
This is the accessible text file for GAO report number GAO-10-65
entitled 'Department Of Veterans Affairs: Improvements Needed in
Corrective Action Plans to Remediate Financial Reporting Material
Weaknesses' which was released on November 16, 2009.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to the Subcommittee on Oversight and Investigations, Committee
on Veterans' Affairs, House of Representatives:
United States Government Accountability Office:
GAO:
November 2009:
Department Of Veterans Affairs:
Improvements Needed in Corrective Action Plans to Remediate Financial
Reporting Material Weaknesses:
GAO-10-65:
GAO Highlights:
Highlights of GAO-10-65, a report to the Subcommittee on Oversight and
Investigations, Committee on Veterans' Affairs, House of
Representatives.
Why GAO Did This Study:
In fiscal year 2008, the Department of Veterans Affairs (VA) identified
three material internal control weaknesses over financial reporting”
financial management system functionality, IT security controls, and
financial management oversight. VA is developing a new financial system”
FLITE”but full implementation is not expected until 2014. Therefore,
the Subcommittee asked us to determine whether VA corrective action
plans and oversight are appropriately focused on near-term actions to
provide improved financial information.
This report addresses (1) the nature of the internal control weaknesses
identified in the VA fiscal year 2008 financial audit report and how
long they have been outstanding, (2) whether VA had plans appropriately
focused on near-term corrective actions, and (3) whether VA had
appropriate oversight mechanisms in place to help assure that near-term
corrective action plans are implemented on schedule.
GAO reviewed corrective action plans for significant deficiencies
underlying 2 of the 3 material weaknesses and performed additional
analysis for two underlying significant deficiencies.
What GAO Found:
VA‘s fiscal year 2008 material weaknesses in financial management
system functionality and financial management oversight have been
reported since fiscal years 2000 and 2005, respectively. These two
material weaknesses are comprised of 16 underlying significant
financial reporting control deficiencies. Although VA had eliminated
some significant deficiencies in prior years, other deficiencies have
emerged. As a result, continuing serious deficiencies in financial
reporting leave VA at risk of processing errors and misstatements in
its financial statements.
Although VA had corrective action plans in place intended to result in
near-term remediation of the 16 fiscal year 2008 significant control
deficiencies, many of these plans did not contain the detail needed to
provide VA officials with assurance that the plans could be effectively
implemented on schedule. VA lacked documented policies and procedures
needed to assure the consistent and comprehensive design of these
corrective action plans, and 8 of 13 of VA‘s plans for correcting its
financial reporting deficiencies lacked key information regarding
milestones for action steps and validation activities.
Table: Key Elements Missing from VA Financial Reporting Corrective
Action Plans:
Corrective action plan: 1. Fixed Asset Package;
Lack of related milestones: [Empty];
Lack of validation activities: [Empty].
Corrective action plan: 2. Mail Order Pharmacy;
Lack of related milestones: [Check];
Lack of validation activities: [Check].
Corrective action plan: 3. Obligations and Purchases;
Lack of related milestones: [Check];
Lack of validation activities: [Check].
Corrective action plan: 4. Accrued services payable;
Lack of related milestones: [Check];
Lack of validation activities: [Empty].
Corrective action plan: 5. Property, Plant, and Equipment;
Lack of related milestones: [Check];
Lack of validation activities: [Empty].
Corrective action plan: 6. Environmental liabilities;
Lack of related milestones: [Check];
Lack of validation activities: [Empty].
Corrective action plan: 7. Unbilled receivables;
Lack of related milestones: [Check];
Lack of validation activities: [Empty].
Corrective action plan: 8. Benefit payment reconciliation;
Lack of related milestones: [Empty];
Lack of validation activities: [Empty].
Corrective action plan: 9. Portfolio loan servicing;
Lack of related milestones: [Empty];
Lack of validation activities: [Check].
Corrective action plan: 10. Actuarial liability model;
Lack of related milestones: [Check];
Lack of validation activities: [Empty].
Corrective action plan: 11. VBA default model;
Lack of related milestones: [Empty];
Lack of validation activities: [Empty].
Corrective action plan: 12. Software capitalization;
Lack of related milestones: [Empty];
Lack of validation activities: [Empty].
Corrective action plan: 13. Year-end Closing Procedures;
Lack of related milestones: [Empty];
Lack of validation activities: [Empty].
Source: GAO analysis of VA corrective action plans as of August 2009.
[End of table]
As of August 2009, VA had missed milestones in 5 of the 13 corrective
action plans. For example, our analysis of plans for remediating
deficiencies regarding the capitalization of property, plant, and
equipment and inadequate benefit payment reconciliations showed that
slipping milestones could jeopardize VA‘s timely completion of these
plans, and consequently may impair VA‘s ability to obtain improved data
reliability within the time frames originally envisioned. VA lacked
documented policies and procedures for overseeing implementation of the
corrective action plans, but recently took steps intended to better
coordinate its oversight activities.
What GAO Recommends:
GAO makes recommendations to the Secretary of Veterans Affairs to
improve the design and oversight of corrective action plans. VA
generally concurred with GAO‘s recommendations and identified related
actions taken and planned.
View [hyperlink, http://www.gao.gov/products/GAO-10-65] or key
components. For more information, contact Susan Ragland at (202) 512-
9095 or raglands@gao.gov.
[End of section]
Contents:
Letter:
Background:
VA Faces Continuing Financial Reporting Deficiencies as a Result of
Uncorrected Long-Standing Material Weaknesses:
Most VA Corrective Action Plans Lacked Key Information:
Deficient Corrective Action Plans and Ineffective Oversight of
Remediation Efforts Result in Ongoing Risks to VA's Financial
Information:
Conclusion:
Recommendations:
Agency Comments and Our Evaluation:
Appendix I: Scope and Methodology:
Appendix II: Comments from the Department of Veterans Affairs:
Appendix III: GAO Contact and Staff Acknowledgments:
Tables:
Table 1: Planned Completion of Corrective Action Plans:
Table 2: Summary of Key Elements Missing from VA Financial Reporting
Corrective Action Plans:
Table 3: Status of VA Fiscal Year 2008 Financial Reporting Corrective
Action Plans:
[End of section]
United States Government Accountability Office: Washington, DC 20548:
November 16, 2009:
The Honorable Harry E. Mitchell:
Chairman:
The Honorable David P. Roe:
Ranking Member:
Subcommittee on Oversight and Investigations: Committee on Veterans'
Affairs:
House of Representatives:
Each year, the Department of Veterans Affairs (VA) produces financial
statements intended to reflect its results of operations, status of
budgetary resources, and assets and liabilities. Accurate and timely
financial reporting helps provide accountability for billions of
dollars of services and benefits to veterans and their families,
including medical services, disability compensation, vocational
rehabilitation, and burial benefits. However, in VA's fiscal year 2008
financial statement audit report, the independent auditor reported
serious weaknesses in internal control over financial reporting. While
VA has been developing a new financial management system--Financial and
Logistics Integrated Technology Enterprise (FLITE)--intended to help
address these control weaknesses, the system is not expected to be
fully implemented until fiscal year 2014. Further, GAO has reviewed the
FLITE program and reported, among other things, that VA lacked
assurance that the FLITE program would be completed as planned.
[Footnote 1] In light of the seriousness of VA's internal control
weaknesses, and the need to improve the reliability of financial
information on VA programs and activities before FLITE implementation,
the Subcommittee asked us to determine whether VA corrective action
plans and oversight are appropriately focused on near-term actions to
address these internal control weaknesses.
Our objectives for this report were to determine (1) the nature of the
internal control weaknesses identified in the VA fiscal year 2008
financial audit report and how long they have been outstanding, (2)
whether VA had plans appropriately focused on near-term actions to
address financial reporting deficiencies prior to the implementation of
FLITE in fiscal year 2014, and (3) whether VA had appropriate oversight
mechanisms in place to help assure that near-term corrective action
plans to address financial reporting deficiencies are implemented on
schedule.
To determine the nature of the internal control weaknesses identified
in the VA fiscal year 2008 financial audit report and how long they
have been outstanding, we analyzed the financial statement audit
reports for fiscal years 2000 to 2008. We summarized available
information on the extent and nature of the internal control weaknesses
characterized as material weaknesses,[Footnote 2] as well as the
underlying significant deficiencies[Footnote 3] and identified their
evolution over time. We also interviewed VA and Office of Inspector
General (OIG) officials and VA's independent auditor, and reviewed VA
documents, prior GAO and OIG reports, and independent auditor
workpapers to better understand the nature of the control deficiencies
underlying the material weaknesses. We did not perform independent
audit work to test and validate whether the material weaknesses and
related significant deficiencies reported by the independent auditor
were appropriate and comprehensive.
To determine whether VA had plans appropriately focused on near-term
actions to address financial reporting deficiencies prior to the full
implementation of FLITE in fiscal year 2014, we analyzed VA's
corrective action plans for remediating significant deficiencies
underlying two of the three material weaknesses[Footnote 4] impacting
the reliability of financial information integral for helping inform
management decision making--weaknesses in VA's financial management
systems and in its financial management oversight. We interviewed VA
officials, VA's Office of Inspector General (OIG), and independent
auditor officials who completed VA's fiscal year 2008 financial
statement audit about near-term actions in VA plans to correct these
underlying significant deficiencies. We also analyzed related
corrective action plans to determine whether they included key
information specified in the Chief Financial Officers Council's
Implementation Guide for OMB Circular A-123, Management's
Responsibility for Internal Control - Appendix A, Internal Control over
Financial Reporting (CFOC A-123 Guidance): action steps with related
milestones to provide a "road map" for remediation activities,
validation activities, a description of the deficiency to be corrected
in sufficient detail to provide clarity and facilitate a common
understanding of what needs to be done, and clear delineation of
responsible officials for completing the planned actions.
To determine whether VA had appropriate oversight mechanisms in place
to help assure that near-term corrective action plans to address
financial reporting deficiencies are implemented on schedule, we
assessed the status of plan implementation by identifying whether VA
met specific milestones and any slippages that had occurred. We also
evaluated the timeliness of implementation of corrective action plans
for two significant deficiencies--one to address the inadequate
capitalization and accounting for property, plant, and equipment (PP&E)
and another to improve reconciliations of benefit payments. We selected
these plans for further review because the related deficiencies were
not currently being audited or reviewed by other oversight
organizations, their associated account balances exceeded a material
dollar threshold ($12.7 billion),[Footnote 5] and the deficiencies
contributed to the two material weaknesses that we, VA officials, and
the independent auditor considered most integral for developing useful
and reliable information for decision making. We reviewed these plans'
implementation to determine the extent to which delays jeopardized VA's
ability to remediate these control deficiencies prior to FLITE
implementation. In this regard, we reviewed documentation and
transactions concerning 25 projects that had been placed in service
since the start of fiscal year 2008--21 projects at the Albuquerque,
New Mexico Medical Center and 4 projects at the Lyons, New Jersey
Medical Center--to determine how long it took VA to capitalize these
projects after they had been placed in service. We also reviewed VA's
progress in implementing benefit payment reconciliation procedures in a
timely manner. We interviewed VA, OIG, and independent auditor
officials about mechanisms in place to oversee the design and
implementation of near-term corrective action plans to remediate
material financial reporting weaknesses identified through financial
statement audits. We reviewed minutes of oversight meetings involving
senior VA management to determine how VA monitored the status of
remediation efforts related to internal control deficiencies identified
through financial statement audits. We also interviewed agency
officials about VA's overall accountability for timely remediation of
internal control deficiencies in the near term, and reviewed the status
of ongoing VA efforts to staff a new office responsible for
coordination and oversight of the development of corrective action
plans. Appendix I provides a more detailed description of the scope and
methodology for our engagement.
We conducted our audit work from November 2008 to November 2009 in
accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe that
the evidence obtained provides a reasonable basis for our findings and
conclusions based on our audit objectives. We received written comments
on a draft of this report from the Department of Veterans Affairs Chief
of Staff which are reprinted in appendix II.
Background:
VA is responsible for providing federal benefits to veterans. Headed by
the Secretary of Veterans Affairs, VA operates nationwide programs for
health care, financial assistance, and burial benefits. According to
VA, in fiscal year 2009 the department received appropriations of
almost $97 billion, including over $50 billion in discretionary
funding, primarily for health care and approximately $47 billion in
mandatory funding, primarily for disability compensation, pensions, and
education benefit programs.
VA is organized into three administrations to provide health care,
financial, and burial benefits to veterans and their families:
* The Veterans Health Administration (VHA) provides a broad range of
primary health care, specialized care, and related medical and social
support services through its network of more than 1,200 medical
facilities.
* The Veterans Benefit Administration (VBA) distributes financial
benefits to veterans and their families related to compensation and
pension, vocational rehabilitation and employment, home loans, life
insurance, and education.
* The National Cemetery Administration (NCA) maintains national
cemeteries and provides burial and memorial services to veterans.
Legislative and Regulatory Framework for Financial Management,
Reporting, and Internal Control:
The Chief Financial Officers (CFO) of the 24 major departments and
agencies identified in 31 U.S.C. § 901(b) are required to, among other
things, develop and maintain integrated accounting and financial
management systems, including financial reporting and internal
controls, and to direct, manage, and provide policy guidance and
oversight of all agency financial management activities. These CFOs are
also required to assist the heads of their agencies with annually
preparing and submitting to Congress and the Office of Management and
Budget audited financial statements and statements of assurance on the
effectiveness of their agencies' systems of internal control.[Footnote
6]
The Comptroller General's Standards for Internal Control in the Federal
Government[Footnote 7] (the Green Book) provides that federal agencies
should establish policies and procedures to ensure that the findings of
audits and other reviews are promptly resolved. In addition, Office of
Management and Budget (OMB) Circular No. A-123, Management's
Responsibility for Internal Control, requires management to develop
corrective action plans for material weaknesses[Footnote 8]--
identified through management reviews, OIG and GAO reports, program
evaluations, and financial statement audits--and periodically assess
and report on the progress of those plans. Further, the CFOC A-123
Guidance provides that agencies construct a corrective action planning
framework to facilitate plan preparation, accountability, monitoring,
and communication. The guidance provides that agency managers are
responsible for developing and implementing action plans for taking
timely and effective action to correct deficiencies. The CFOC A-123
Guidance is widely viewed as a "best practices" methodology for
executing the requirements of Appendix A of OMB Circular No. A-123.
Material Weaknesses Identified in VA's Internal Control over Financial
Reporting in Fiscal Year 2008:
In the independent auditor's report on VA's fiscal year 2008 financial
statements, the auditor identified the following three material
weaknesses:
* Financial management system functionality--reported since fiscal year
2000, is linked to VA's outdated legacy financial systems impacting
VA's ability to prepare, process, and analyze financial information
that is reliable, timely, and consistent. Legacy system deficiencies
necessitated significant manual processing of financial data and a
large number of adjustments to the balances in the system, thereby
increasing the risk of processing errors and misstatements in the
financial statements.
* IT security controls--also reported as a material weakness since
fiscal year 2000, resulted from the lack of effective implementation
and enforcement of an agencywide information security program. Security
weaknesses in the areas of access control, segregation of duties,
change control, and service continuity continued to place VA's program
and financial data at risk. For example, weaknesses in information
security controls placed sensitive financial and veterans' medical and
benefit information at risk of inadvertent or deliberate misuse,
improper disclosure, theft, or destruction, possibly occurring without
detection.
* Financial management oversight--reported as a material weakness
beginning in fiscal year 2005 and as a significant deficiency in fiscal
years 2000 through 2004. This weakness stemmed from a number of control
deficiencies whose operational causes varied. Common issues included
the recording of financial data without sufficient review and
monitoring, a lack of human resources with the appropriate skills, and
a lack of capacity to effectively process a significant volume of
transactions. When aggregated, the independent auditor found that these
deficiencies suggested a recurring theme of inadequate or ineffective
financial management oversight.
VA Has Established FLITE Program:
To help resolve the financial management system functionality material
weakness, modernize the IT environment, and implement an integrated
financial management system, VA established the Financial and Logistics
Integrated Technology Enterprise (FLITE) program, managed by the FLITE
Program Office,[Footnote 9] to replace its current legacy systems. The
FLITE Program involves a multiple-year phased approach comprised of
three major components: the Strategic Asset Management (SAM) project, a
logistics and asset management system; the Integrated Financial
Accounting System (IFAS), which focuses on financial management; and a
data warehouse that is intended to assist in financial reporting. As of
January 2009, VA planned to complete FLITE implementation in fiscal
year 2014.
VA Faces Continuing Financial Reporting Deficiencies as a Result of
Uncorrected Long-Standing Material Weaknesses:
Although VA had eliminated some significant deficiencies in prior
years, other deficiencies have emerged that require attention. As a
result of its recurring internal control weaknesses in financial
reporting, VA continues to be at risk of processing errors and
misstatements in VA's financial reports.
The financial management system functionality material weakness, which
is linked to VA's outdated financial systems, consists of seven
underlying significant deficiencies. The following four significant
deficiencies were newly reported in fiscal year 2008.
* VBA Benefit Delivery Network (BDN) and Veterans Services Network
(VETSNET) had insufficient audit trail documentation for the transfer
of data to a data warehouse and the storage of such data, increasing
the risk of misstatements in the financial statements and other
financial reports.[Footnote 10]
* VETSNET lacked data mining[Footnote 11] capabilities, thereby
preventing VA financial managers from analyzing transactions at a level
needed to prepare routine reconciliations on billions of dollars in
transactions.[Footnote 12]
* Automated inventory systems at the Consolidated Mail Order Pharmacy
facilities could not provide the data needed to properly record the
cost of inventory, resulting in potential misstatements in the
financial statements and other financial reports.
* VA lacked a system to track obligations and purchases by vendors
resulting in VA relying on vendors to supply operational sales data on
medical center purchases.
Three of the seven significant deficiencies were repeat conditions:
* Inadequate year-end closing procedures for the financial system and
related records, reported since fiscal year 2000, created a significant
risk of error in the annual financial statements.
* Business line system integration problems, reported since fiscal year
2004, resulted in inadequate support for amounts recorded in the
general ledger, such as VETSNET accounts receivables, and the potential
for misstatements in the financial statements and other financial
reports.
* Fixed asset reporting limitations, reported since fiscal year 2007,
prohibited VA from readily identifying all current year PP&E additions
and reclassifications of work in process.
The financial management oversight material weakness, reflecting a
recurring theme of inadequate or ineffective financial management
oversight, consisted of nine underlying significant deficiencies. The
following three were newly reported in fiscal year 2008:
* Missing records in the mortgage loan portfolio maintained by an
outside contractor resulted in unsupported amounts and potential errors
in the general ledger.
* Incorrect formulas for estimating the projected default rate for
guaranteed and direct loans in VA's housing model could lead to
material misstatements of estimated costs of guaranteed and direct
loans in the financial statements and other financial reports.
* Incorrect expensing and capitalization of software development costs
could result in an understatement of PP&E and an overstatement of
operating program costs.
Six of the nine significant deficiencies were repeat conditions:
* A lack of adequate review and follow-up procedures for accrued
services payable and undelivered orders, reported since fiscal year
2007, resulted in invalid balances for obligations and accrued services
payable and potential misstatements in the financial statements and
other financial reports. VA reported a total of $8 billion in
undelivered orders in fiscal year 2008.
* Untimely depreciation, improper recording of disposed assets,
discrepancies in estimated useful life of equipment, and other
inadequate capitalization and accounting for PP&E, reported since
fiscal year 2000, could result in misstated PP&E and related expense
accounts. VA reported a $13 billion PP&E balance in fiscal year 2008.
* Inconsistent methodologies and unsupported estimates for
environmental and disposal liabilities, reported since fiscal year
2004, could lead to misstatements in the financial statements. VA
reported a $928 million balance in environmental and disposal
liabilities in fiscal year 2008.
* Inadequate review of unbilled receivables and contractual
adjustments, reported since fiscal year 2007, could lead to
misstatements of account receivable balances. VA reported over $1.7
billion in accounts receivable for fiscal year 2008.
* Inadequate BDN and VETSNET reconciliations, reported since fiscal
year 2007, increased the likelihood that an error in the financial
statements will occur and go undetected. BDN and VETSNET processed over
$40 billion in compensation, pension, education, and vocational
rehabilitation and employment benefits in fiscal year 2008.
* Inadequate reconciliations of the data input to the compensation and
pension actuarial liability model, reported since fiscal year 2007,
could result in misstatements in the financial statements. VA reported
a $1.4 trillion actuarial liability in fiscal year 2008.
In fiscal year 2008, VA reported successfully eliminating two prior
significant deficiencies concerning insufficient follow-up of accounts
receivable collections and errors in payroll data submissions to the
Office of Personnel Management underlying the financial management
oversight material weakness, as well as a prior material weakness
regarding the retention of computer-generated detail records for
benefit payments.
Most VA Corrective Action Plans Lacked Key Information:
VA has established corrective action plans intended to remediate many
of its 16 significant deficiencies in the near term independent of
FLITE implementation.[Footnote 13] However, although VA had corrective
action plans in place, many of these corrective action plans did not
contain the detail needed to provide VA or congressional oversight
officials with assurance that the plans had near-term actions that
could be effectively implemented on schedule. As shown in the table 1,
VA planned to remediate 9 deficiencies in fiscal year 2009, 3 in fiscal
year 2010, 3 in fiscal year 2012, and 1 in fiscal year 2014.[Footnote
14] However, VA lacked documented policies and procedures to ensure the
consistent and comprehensive design of these plans, and most of VA's
plans for correcting financial reporting deficiencies in the near term
lacked key information suggested in CFOC A-123 Guidance.
Table 1: Planned Completion of Corrective Action Plans:
1; Corrective action plan title: Fixed Asset Package system
limitations;
No. of deficiencies: 1;
Fiscal year targeted for completion: 2010[A].
2; Corrective action plan title: Consolidated Mail Order Pharmacy
inventory pricing;
No. of deficiencies: 1;
Fiscal year targeted for completion: 2010.
3; Corrective action plan title: Inadequate Obligations and Purchases
Tracking System;
No. of deficiencies: 1;
Fiscal year targeted for completion: 2014[B].
4; Corrective action plan title: Accrued services payable/Undelivered
orders not properly monitored;
No. of deficiencies: 1;
Fiscal year targeted for completion: 2009.
5; Corrective action plan title: Inadequate monitoring and accounting
for Property, Plant, and Equipment;
No. of deficiencies: 1;
Fiscal year targeted for completion: 2009.
6; Corrective action plan title: Environmental and disposal liabilities
not properly monitored;
No. of deficiencies: 1;
Fiscal year targeted for completion: 2009.
7; Corrective action plan title: Unbilled receivables and contractual
adjustments not adequately reviewed;
No. of deficiencies: 1;
Fiscal year targeted for completion: 2009.
8; Corrective action plan title: BDN/VETSNET are not being properly
reconciled to the general ledger [C];
No. of deficiencies: 1[D];
Fiscal year targeted for completion: 2009;
No. of deficiencies: 3;
Fiscal year targeted for completion: 2012.
9; Corrective action plan title: Incomplete outsourced portfolio loan
servicing records;
No. of deficiencies: 1;
Fiscal year targeted for completion: 2009.
10; Corrective action plan title: Inadequate consideration of variables
input in the compensation and pension actuarial liability model;
No. of deficiencies: 1;
Fiscal year targeted for completion: 2009.
11; Corrective action plan title: VBA Variable Default Housing Model;
No. of deficiencies: 1;
Fiscal year targeted for completion: 2009.
12; Corrective action plan title: Software expenses not properly
tracked/capitalized;
No. of deficiencies: 1;
Fiscal year targeted for completion: 2009.
13; Corrective action plan title: Year-end Closing Procedures;
No. of deficiencies: 1;
Fiscal year targeted for completion: 2010.
Total deficiencies: 16.
Source: GAO analysis of VA corrective action plans.
[A] According to VA officials, VA provided documentation of new
reconciliation processes to the independent auditor in an effort to
remediate this deficiency ahead of schedule. At the time of our review,
the auditor had not provided VA with feedback regarding the sufficiency
of VA's new procedures.
[B] According to VA officials, VA provided a demonstration to the
independent auditor in July 2009 to illustrate the ability of its
financial system to track obligations and purchases at a vendor level.
At the time of our review, the auditor had not provided VA with
feedback regarding the sufficiency of VA's new procedures.
[C] This plan addresses the four significant deficiencies related to
the lack of BDN and VETSNET data mining capabilities, audit trail
documentation, system integration, and reconciliation procedures.
[D] Te deficiency concerning VBA audit trail documentation was
remediated through a contractor-prepared task work plan which,
according to VA officials, was issued under this corrective action plan
and was to be implemented in fiscal year 2009.
[End of table]
Eight of the 13 plans we reviewed lacked key information as recommended
by the CFOC A-123 Guidance. As shown in table 2, 5 plans lacked
milestone dates for action steps, 1 plan lacked validation activities,
and 2 plans lacked both milestone dates and validation activities.
Table 2: Summary of Key Elements Missing from VA Financial Reporting
Corrective Action Plans:
1; Corrective action plan title: Fixed Asset Package system
limitations;
Lack of related milestones: [Empty];
Lack of validation activities: [Empty].
2; Corrective action plan title: Consolidated Mail Order Pharmacy
inventory pricing;
Lack of related milestones: [Check];
Lack of validation activities: [Check].
3; Corrective action plan title: Inadequate Obligations and Purchases
Tracking System;
Lack of related milestones:[Check];
Lack of validation activities: [Check].
4; Corrective action plan title: Accrued services payable and
Undelivered orders not properly monitored;
Lack of related milestones: [Check];
Lack of validation activities: [Empty].
5; Corrective action plan title: Inadequate monitoring and accounting
for Property, Plant, and Equipment;
Lack of related milestones: [Check];
Lack of validation activities: [Empty].
6; Corrective action plan title: Environmental and disposal liabilities
not properly monitored;
Lack of related milestones: [Check];
Lack of validation activities: [Empty].
7; Corrective action plan title: Unbilled receivables and contractual
adjustments not adequately reviewed;
Lack of related milestones: [Check];
Lack of validation activities: [Empty].
8; Corrective action plan title: BDN/VETSNET are not being properly
reconciled to the general ledger;
Lack of related milestones: [Empty];
Lack of validation activities: [Empty].
9; Corrective action plan title: Incomplete outsourced portfolio loan
servicing records;
Lack of related milestones: [Empty];
Lack of validation activities: [Check].
10; Corrective action plan title: Inadequate consideration of variables
input in the actuarial liability model;
Lack of related milestones: [Check];
Lack of validation activities: [Empty].
11; Corrective action plan title: VBA variable default model formula
errors;
Lack of related milestones: [Empty];
Lack of validation activities: [Empty].
12; Corrective action plan title: Software expenses not properly
tracked and capitalized;
Lack of related milestones: [Empty];
Lack of validation activities: [Empty].
13; Corrective action plan title: Year-end Closing Procedures;
Lack of related milestones: [Empty];
Lack of validation activities: [Empty].
Source: GAO analysis of VA corrective action plans as of August 2009.
[End of table]
In accordance with CFOC A-123 Guidance, agencies should prepare
comprehensive corrective action plans that list action steps with
related monthly milestone dates to help ensure senior VA officials can
monitor progress. Seven of VA's corrective action plans did not include
intermediate milestone dates necessary to gauge whether planned
corrective actions are proceeding according to schedule, thus
increasing the risk that corrective action plans will not be
implemented on schedule. For example,
* In one plan, VA combined several action steps, needed to rewrite the
Consolidated Mail Order Pharmacy inventory management software, into
one 2-year milestone period. For example, VA combined developing a
statement of work, rewriting the software, and developing an inventory
module for each CMOP into one 2-year milestone period. In addition, two
other action steps lacked completion dates. Without interim milestones
and completion dates, it is more difficult for VA officials to identify
whether the necessary activities for remediating weaknesses are
occurring and whether they are on schedule. Without such information,
VA could miss opportunities to address issues that might hamper timely
completion of the remediation.
* VHA's plan for addressing the inadequate monitoring and accounting
for PP&E only specified the fiscal year in which the tasks were to be
completed. The lack of intermediate milestones makes it difficult for
senior management to adequately monitor the progress of implementation
efforts. Because most action steps only had a fiscal year target date,
it was unclear when during the year the steps were to be taken and
whether or not they were sequential. In addition, the plan did not
include any descriptions or related milestones for two action steps.
In accordance with CFOC A-123 Guidance, senior management is
responsible for determining when sufficient action has been taken to
declare that a significant deficiency or a material weakness has been
corrected, and corrective action plans should include activities to
validate the resolution of the deficiency. Without such validation
measures, it is difficult for VA management to provide assurance that
the corrective actions have effectively remediated the deficiency.
Three of VA's corrective action plans did not include activities to
validate that the planned actions would resolve the deficiency. For
example, the corrective action plan to address deficiencies in VA's
automated inventory systems at its Consolidated Mail Order Pharmacy
facilities did not include activities to validate whether action steps
were implemented and the desired results achieved.
Deficient Corrective Action Plans and Ineffective Oversight of
Remediation Efforts Result in Ongoing Risks to VA's Financial
Information:
Deficient corrective action plans (discussed previously) and
ineffective oversight of corrective action plan implementation have
resulted in missed remediation milestones, placing VA at risk of
continued errors and misstatements in financial information. As of
August 2009, VA had missed milestones in 5 of the 13 corrective action
plans to remediate fiscal year 2008 significant deficiencies underlying
the financial management system functionality and financial management
oversight material weaknesses. Our analysis of corrective action plans
for two significant deficiencies--the untimely capitalization of
construction projects and inadequate reconciliations related to benefit
payments--showed that slipping milestones could jeopardize VA's
completion of these plans by fiscal years 2009 and 2012 respectively,
and therefore may impair VA's ability to obtain the improved data
reliability originally envisioned within those time frames. For the
plans lacking interim milestones, it is difficult for VA management to
monitor progress, identify whether there is any slippage, and take
timely steps to keep actions on track. The lack of milestones and the
related accountability for meeting targets could also limit incentives
for staff to ensure actions are implemented on schedule. In addition,
VA lacked documented policies and procedures for overseeing the
implementation of corrective action plans to remediate material
weaknesses identified in financial statement audits. In January 2009,
VA recognized the need to better coordinate these oversight activities
and created an office of Financial Process Improvement and Audit
Readiness (FPIAR).
VA Missed Milestones for Five Plans and Status of Other Plans Was
Unknown:
As shown in table 3, VA missed milestones in 5 of the 13 corrective
action plans that we reviewed, and the status of progress in
implementing 3 other plans was unknown because they lacked sufficient
interim milestones.[Footnote 15] VA missed milestones related to
preparation of detailed procedures for the Fixed Asset Package, PP&E
policies and procedures, benefit payment reconciliations, the
development of reports to support reconciliations of expense accounts
in the actuarial liability model, and year-end closing procedures.
Table 3: Status of VA Fiscal Year 2008 Financial Reporting Corrective
Action Plans:
1; Plan title: Fixed Asset Package system limitations;
On schedule: [Empty];
Slipping milestones: [Check];
Unknown status: [Empty];
Status shown on corrective action plans: Development of work in process
component has been delayed pending the results of further testing by
the independent auditor.
2; Plan title: Consolidated Mail Order Pharmacy inventory pricing;
On schedule: [Empty];
Slipping milestones: [Empty];
Unknown status: [Check};
Status shown on corrective action plans: First milestone completion
date is scheduled for September 2010. Without interim milestones it is
not feasible to determine project status.
3; Plan title: Inadequate Obligations and Purchases Tracking System;
On schedule: [Empty];
Slipping milestones: [Empty];
Unknown status: N/A;
Status shown on corrective action plans: Implementation is scheduled to
begin in October 2009.
4; Plan title: Accrued services payable and Undelivered orders not
properly monitored;
On schedule: [Check};
Slipping milestones: [Empty];
Unknown status: [Empty];
Status shown on corrective action plans: All actions have been
completed as of May 2009.
5; Plan title: Inadequate monitoring and accounting for Property,
Plant, and Equipment;
On schedule: [Empty];
Slipping milestones: [Check};
Unknown status: [Empty];
Status shown on corrective action plans: VA planned to develop policies
and procedures by March 2009. As of August 2009, VA had not completed
this action step (see case study below).
6; Plan title: Environmental and disposal liabilities not properly
monitored;
On schedule: [Empty];
Slipping milestones: [Empty];
Unknown status: [Check};
Status shown on corrective action plans: Milestones listed by fiscal
year, so it is not feasible to determine project status.
7; Plan title: Unbilled receivables and contractual adjustments not
adequately reviewed;
On schedule: [Empty];
Slipping milestones: [Empty];
Unknown status: [Check};
Status shown on corrective action plans: Milestones listed by fiscal
year, so it is not feasible to determine project status.
8; Plan title: BDN/VETSNET are not being properly reconciled to the
general ledger;
On schedule: [Empty];
Slipping milestones: [Check};
Unknown status: [Empty];
Status shown on corrective action plans: Slippage has occurred on
several milestones, and milestones have been shifted back up to 14
months (see case study below).
9; Plan title: Incomplete outsourced portfolio loan servicing records ;
On schedule: [Check};
Slipping milestones: [Empty];
Unknown status: [Empty];
Status shown on corrective action plans: All actions have been
completed as of December 2008.
10; Plan title: Inadequate consideration of variables input in the
actuarial liability model;
On schedule: [Empty];
Slipping milestones: [Check};
Unknown status: [Empty];
Status shown on corrective action plans: Slippage has occurred in the
development of reports to support manual reconciliations of expense
accounts.
11; Plan title: VBA variable default model formula errors;
On schedule: [Check};
Slipping milestones: [Empty];
Unknown status: [Empty];
Status shown on corrective action plans: All actions have been
completed as of April 2009.
12; Plan title: Software expenses not properly tracked and capitalized;
On schedule: [Check};
Slipping milestones: [Empty];
Unknown status: [Empty];
Status shown on corrective action plans: On schedule.
13; Plan title: Year-end Closing Procedures;
On schedule: [Empty];
Slipping milestones: [Check};
Unknown status: [Empty];
Status shown on corrective action plans: Missed milestone for
developing a year-end closing operating plan for each administration.
Source: GAO analysis of VA fiscal year 2008 corrective action plans as
of August 2009.
[End of table]
Missed Milestones for Two Significant Deficiencies Illustrate
Continuing Adverse Impacts on VA's Financial Management:
An analysis of the status of corrective action plans for two
significant deficiencies--the inadequate monitoring and accounting for
PP&E and inadequate reconciliations related to benefit payments--
provided examples of how missed milestones result in continuing risks
of errors in related VA financial reporting. Specifically, VA missed
its milestones for the creation of detailed procedures for capitalizing
PP&E and automated reconciliations to support veteran benefit payments.
Although the PP&E corrective action plan called for procedures related
to timely capitalization of PP&E to be developed by March 2009, they
had not been issued by August 2009. Failing to capitalize construction
projects in a timely manner may lead to misstated financial information
if projects are not capitalized in the same fiscal year they are placed
in service. In addition, related depreciation expenses may also be
misstated as a result of time lags in capitalizing projects. Finally,
if projects are not closed out in a timely fashion, VA is unable to
determine whether funds are available for use on other construction
projects. Our analysis at two VHA medical facilities identified
continuing problems in the timely capitalization of PP&E.
According to federal accounting standards[Footnote 16] and VA policy
issued by VA's Assistant Secretary for Management (the VA CFO),
[Footnote 17] construction projects are to be recorded as work in
process (WIP) until they are placed in service, at which time the WIP
balances are to be transferred to general PP&E. We reviewed the 21
projects at the Albuquerque, New Mexico Medical Center and the 4
projects at the Lyons, New Jersey Medical Center that had been placed
into service since the start of fiscal year 2008 and found continuing
significant delays in the amount of time it took to close out and
capitalize projects after they were placed in service. In Albuquerque,
VA fiscal staff told us their undocumented practice was to capitalize
projects within 30 days of being placed in service. However, while they
had capitalized 11 of 21 projects within 30 days, 6 projects were not
capitalized for 30 to 60 days, and 4 projects were not capitalized for
more than 120 days after they had been placed into service. At Lyons,
VA staff capitalized 3 of 4 projects more than 180 days after they were
placed in service.
VBA also experienced slipping milestones in remediating the benefit
payment reconciliation deficiency. VBA did not perform necessary
reconciliations between the BDN and VETSNET systems and VA's general
ledger on a monthly basis prior to March 2008. Lacking such
reconciliation VA is at continuing risk of improper reporting of
benefit payments. That year, these systems processed over $41.6 billion
in benefits payments related to compensation and pension, as well as a
portion of education benefit programs as authorized by law. This
information is critical to the correct determination of VA's overall
cost of operations.
VBA developed a corrective action plan to correct this deficiency that
contained 43 separate activities with related milestones, including
developing automated reconciliations, documenting processes, and
training end users. According to VBA documents and officials, VBA
missed and pushed back milestones related to the development of reports
supporting veteran education payments and automated reconciliations.
For example, as of August 2009, work on the development of detailed
reports supporting the Vocational Rehabilitation and Employment
education payments was pushed back 5 months from November 2009 to April
2010 and VBA reported slippage ranging from 3 to14 months in the
development of various reconciliations supporting Dependent's Education
Benefits.
VA Lacked Effective Agencywide Oversight for the Correction of Material
Weaknesses:
VA lacked policies and procedures for overseeing the design and
implementation of corrective action plans to correct financial
reporting material weaknesses identified in financial statement audits.
Further, VA did not have an agencywide accountability mechanism in
place to oversee and coordinate the remediation of the material
weaknesses in financial reporting. Rather, VA delegated responsibility
for the design, implementation, and oversight of the corrective action
plans to the various administrations and offices responsible for the
areas in which the deficiencies were identified (e.g., VHA and VBA).
Lacking centralized VA-wide guidance, the administrations
inconsistently defined the parameters for milestone dates in corrective
action plans. For example, VHA corrective action plans provided
milestones by fiscal year, while VBA plans often had monthly milestone
dates. As a result, VA's ability to determine the status of corrective
action plan implementation and identify and address any slippages was
impaired.
In contrast to its financial reporting weaknesses, VA had documented
policies and procedures to identify and correct its programmatic
material weaknesses, specifically those in the areas of accountability
and effectiveness over VA programs and operations. These policies and
procedures, which could also be applied to the remediation of financial
reporting material weaknesses identified through financial statement
audits, are outlined in a manual which includes a detailed template for
developing corrective action plans that specified parameters for
milestone dates and other key information.[Footnote 18] Further, VA had
a Senior Assessment Team (SAT) in place (chaired by the Assistant
Secretary for Management and comprised of other senior management
representatives from VA and its three administrations) to oversee
remediation of programmatic control weaknesses detected through VA's
internal control reviews completed under OMB Circular No. A-123.
[Footnote 19]
In January 2009, VA recognized the need to better oversee and
coordinate agencywide oversight activities for financial reporting
material weaknesses identified through financial statement audits.
Specifically, VA recruited a director to head a new office of Financial
Process Improvement and Audit Readiness (FPIAR) reporting to the VA
Deputy CFO in the Office of Finance under the VA Assistant Secretary
for Management. FPIAR was established with responsibility for:
* coordinating and overseeing comprehensive corrective action plans for
VA's audit-related material weaknesses, in consultation and
coordination with VA's three administrations and applicable staff
offices;
* assisting VA and the three administrations and staff offices in
executing and monitoring the corrective action plans;
* ensuring compliance of VA offices and field stations with VA
policies, plans, procedures, and internal controls; and:
* assisting in updating corrective action plans as needed and
developing recommendations and actions for ensuring completion of
stated objectives and milestones in the event of slippage.
In addition, the FPIAR Director's position description calls for FPIAR
to perform analysis and remediation efforts for any comparable internal
control deficiencies being resolved as part of VA's ongoing OMB
Circular No. A-123 reviews in concert with work to remediate VA's audit-
related material weaknesses. Integrating VA's A-123 review process and
remediation activities for financial reporting material weaknesses
identified in financial statement audits could enhance the efficiency
of VA's corrective actions and the elimination of material weaknesses.
As of September 2009, according to FPIAR's Director, VA had filled
three permanent staff positions and hired six full-time contractors to
assist VA in addressing a variety of financial reporting issues (e.g.,
helping address the IT Security Controls material weakness and
outstanding issues surrounding the capitalization of software
development costs, updating and reformatting corrective action plans,
and developing requirements for an interface between VETSNET and VA's
general ledger). The VA Deputy CFO said that as office operations have
evolved, VA has decided to hire one or two more permanent staff for the
FPIAR and use contractors to fill other positions. He said that
contractors can provide VA with the flexibility to address short-term
staffing needs as well as the necessary technical expertise to
remediate individual significant deficiencies. However, the FPIAR did
not have a workforce plan defining the number of staff and expertise
needed in the office.[Footnote 20]
In fiscal year 2009, while not included in documented policies and
procedures, the FPIAR began practices intended to establish agencywide
procedures for oversight of corrective action plans to remediate
material weaknesses identified in financial statement audits. For
example, the FPIAR Director began participating in monthly SAT meetings
chaired by the Assistant Secretary for Management and attended by other
senior VA officials including the VHA CFO and VBA CFO. These meetings
provide an opportunity for the FPIAR Director to highlight the status
of specific corrective actions underway to address financial reporting
significant deficiencies requiring the attention of key stakeholders
across the agency. Further, the director told us that by the end of
calendar year 2009, the FPIAR intends to begin using a corrective
action plan template consistent with the CFOC A-123 Guidance to
remediate significant deficiencies identified in the fiscal year 2009
financial statement audit. Because VA has developed a corrective action
template for addressing A-123 control deficiencies, the FPIAR Director
told us she is considering whether to adopt this template for
corrective action plans to remediate financial reporting control
weaknesses, which could provide efficiencies and help integrate
resolution of some deficiencies. VA's Deputy CFO also told us that
oversight by the SAT, combined with the use of the corrective action
plan template, will allow for more rigorous oversight of remediation
efforts of weaknesses detected in the financial statement audits.
Conclusion:
VA has had serious, long-standing material weaknesses in financial
reporting that could result in significant misstatements in financial
information reported to Congress and used by VA to manage its
operations. One of the significant deficiencies is not planned for
resolution until FLITE is fully implemented, which will not be until
2014. Other deficiencies can be addressed in the near term. While VA
has corrective action plans for near-term actions intended to provide
more accurate and complete financial data, they often lacked key
information. Consequently, VA managers could not readily identify and
address slippage in remediation activities, exposing VA to continued
risk of errors in financial information and reporting. Immediate
actions to provide a rigorous framework for the design and oversight of
corrective action plans will be essential to ensuring the timely
remediation of internal control weaknesses before FLITE implementation.
Well-defined corrective action plans provide a "road map" for
remediation activities and facilitate effective oversight by senior VA
officials. Continued support from senior VA officials and
administration CFOs will also be critical to ensure that key corrective
actions are developed and implemented on schedule.
Recommendations:
To help focus VA's corrective action plans on more effectively
establishing and completing consistent and comprehensive near-term
actions, we recommend that the Secretary of VA direct the Assistant
Secretary for Management to issue policies and procedures for
identifying and reporting on financial audit weaknesses to include:
* Detailed guidance (such as a set of tools and templates in place to
identify and report on programmatic weaknesses) on required corrective
action plan elements (including milestones for completion of interim
action steps and validation steps).
* Establishing a VA Secretariat-level agency-wide governance structure
for overseeing all OMB Circular No. A-123 and financial statement audit
material weakness remediation activities that provides for (1)
involving key stakeholders in the remediation process (such as the
FPIAR, administration CFO's, and other senior VA officials); (2)
clearly defining stakeholder roles and responsibilities; (3)
establishing and implementing strategic workforce planning for FPIAR;
and (4) regularly assessing and reporting on the status of corrective
action plans and identification of any actions needed to address any
slippages of remediation activities.
To help ensure the timely and complete capitalization of property,
plant, and equipment, we recommend that the Secretary of VA direct the
Assistant Secretary for Management to issue procedures on specific
actions and identify specific reasonable time frames, such as within 30
days, to implement VA policy to capitalize PP&E projects when they are
placed in service.
Agency Comments and Our Evaluation:
In its written comments, VA generally agreed with our findings and
recommendations and identified specific actions it has taken and plans
to take to implement these recommendations. In response to our
recommendation to provide detailed guidance (such as a set of tools and
templates in place to identify and report on programmatic weaknesses)
on required corrective action plan elements (including milestones for
completion of interim action steps and validation steps), VA stated
that the FPIAR has begun integrating its corrective actions for
financial audit weaknesses with VA's OMB Circular No. A-123 processes.
VA also said that FPIAR will migrate to a set of corrective action plan
tools, templates, and documented procedures in fiscal year 2010.
VA partially concurred with our recommendation that VA establish a
Secretariat-level agencywide governance structure for OMB Circular No.
A-123 and financial statement audit remediation activities. In its
comments, VA stated it already established a Senior Assessment Team as
the coordinating body for corrective action planning to address control
deficiencies identified as a result of OMB Circular No. A-123 reviews
and financial statement audits. As discussed in our draft report, we
recognized VA has taken action to establish agencywide accountability
for oversight of its corrective action plans and has begun to establish
related practices. However, these practices had not yet evolved into
the rigorous framework needed to effectively ensure timely control
weakness remediation. VA stated that its Internal Controls Service is
developing a handbook for all stakeholders that will provide detailed
guidance for corrective action planning, monitoring, reporting, and
validation procedures for all financial statement audit and OMB
Circular No. A-123 significant deficiencies and material weaknesses.
Also, VA noted that as FPIAR matures, it will continue to define and
meet staffing requirements.
VA also concurred with our recommendation that VA issue procedures for
specific actions and identify reasonable time frames, such as within 30
days, to implement VA policy to capitalize PP&E projects when they are
placed in service. VA provided a copy of recently issued procedures
which identified specific actions and time frames for the
capitalization of PP&E. These procedures provide guidance for monthly
communications between engineering staffs, program directors, and the
appropriate fiscal activity regarding construction project status,
costs, and useful life. The procedures also provide that property
should be capitalized no later than the end of the fiscal month
following the month that the property is put into use or accepted by
VA. If fully and effectively implemented, the guidance should help
address the problems we found related to timely capitalization of VA's
PP&E.
In its written comments, VA also provided technical comments which we
considered and incorporated as appropriate.
We are sending copies of this report to other interested congressional
committees and to affected federal agencies. In addition, this report
is available at no charge on the GAO Web site at [hyperlink,
http://www.gao.gov].
If you or your staff have any questions regarding this report, please
contact me at (202) 512-9095 or at raglands@gao.gov. Contact points for
our Offices of Congressional Relations and Public Affairs may be found
on the last page of this report. GAO staff who made major contributions
to this report are listed in appendix III.
Signed by:
Susan Ragland:
Director, Financial Management and Assurance:
[End of section]
Appendix I: Scope and Methodology:
To determine the nature of the internal control weaknesses identified
in the Department of Veterans Affairs (VA) fiscal year 2008 financial
audit report and how long they have been outstanding, we obtained and
analyzed the financial statement audit reports for fiscal years 2000 to
2008. We summarized available information on the extent and nature of
the internal control weaknesses characterized as material weaknesses,
[Footnote 21] as well as the underlying significant deficiencies
[Footnote 22] and identified their evolution over time. We also
interviewed VA and Office of Inspector General (OIG) officials and VA's
independent auditor, and reviewed VA documents, prior GAO and OIG
reports, and independent auditor workpapers to better understand
control deficiencies underlying the material weaknesses. We did not
perform independent audit work to test and validate whether the
material weaknesses and related significant deficiencies reported by
the independent auditor were accurate and complete.
To determine whether VA had plans appropriately focused on near-term
actions to address financial reporting deficiencies prior to the
implementation of its Financial and Logistics Integrated Technology
Enterprise (FLITE) system in fiscal year 2014, we analyzed VA's
corrective action plans for remediating significant deficiencies
underlying two of the three material weaknesses impacting the
reliability of financial information integral for helping inform
management decision making--weaknesses in VA's financial management
systems and in its financial management oversight.[Footnote 23] We
interviewed VA officials, VA OIG officials, and independent auditor
officials who completed VA's fiscal year 2008 financial statement audit
about near-term actions in VA plans to correct these underlying
significant deficiencies. We also analyzed related corrective action
plans to remediate 15 of the 16 significant deficiencies underlying two
material weaknesses to determine whether they included key information
specified in the Chief Financial Officers Council's (CFOC)
Implementation Guide for OMB Circular A-123, Management's
Responsibility for Internal Control - Appendix A, Internal Control over
Financial Reporting: action steps with related milestones to provide a
"road map" for remediation activities, validation activities to help
ensure the proposed actions worked as envisioned, a description of the
deficiency to be corrected in sufficient detail to provide clarity and
facilitate a common understanding of what needs to be done, and clear
delineation of responsible officials for completing the planned
actions. We also reviewed VA's task work plan to remediate the final
significant deficiency--the documentation of data transfer from VBA
benefit payment systems to a data warehouse--in fiscal year 2009.
To determine whether VA had appropriate oversight mechanisms in place
to help ensure that near-term corrective action plans to address
financial reporting deficiencies are implemented on schedule, we
assessed the status of plan implementation in July and August 2009 by
identifying whether VA met specific milestones and any slippages that
had occurred. We also evaluated the timeliness of implementation of
corrective action plans for two significant deficiencies--one to
address the inadequate capitalization and accounting for property,
plant, and equipment (PP&E) and another to improve reconciliations of
benefit payments. One plan was designed and implemented by the Veterans
Health Administration, and one by the Veterans Benefit Administration--
the two principal VA administrations. We selected these plans for
further review because the related deficiencies were not currently
being audited or reviewed by other oversight organizations, their
associated account balances exceeded a material dollar threshold ($12.7
billion)[Footnote 24], and the deficiencies contributed to the two
material weaknesses that we, VA officials, and VA's independent auditor
considered most integral for developing useful and reliable information
for decision making. We reviewed these plans' implementation in detail
to determine the extent to which delays jeopardized VA's ability to
remediate these control deficiencies and provide reliable financial
management information to senior VA officials prior to FLITE
implementation. In this regard, we reviewed documentation and
transactions concerning 25 projects that had been placed in service
since the start of fiscal year 2008: 21 projects at the Albuquerque,
New Mexico Medical Center and 4 projects at the Lyons, New Jersey
Medical Center to determine how long it took VA to capitalize these
projects after they had been placed in service. We also reviewed VA's
progress in implementing benefit payment reconciliation procedures in a
timely manner. We interviewed VA, OIG, and independent auditor
officials about mechanisms in place to oversee the design and
implementation of near-term corrective action plans to remediate
material financial reporting weaknesses identified through financial
statement audits. We reviewed minutes of oversight meetings involving
senior VA management to determine how VA monitored the status of
remediation efforts related to internal control deficiencies identified
through financial statement audits. We also interviewed agency
officials about VA's overall accountability for timely remediation of
internal control deficiencies in the near term, and reviewed the status
of ongoing VA efforts to staff a new office responsible for
coordination and oversight of the development of corrective action
plans.
We conducted our audit work from November 2008 to November 2009 in
accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe that
the evidence obtained provides a reasonable basis for our findings and
conclusions based on our audit objectives.
[End of section]
Appendix II: Comments from the Department of Veterans Affairs:
Department Of Veterans Affairs:
Washington DC 20420:
November 2, 2009:
Ms. Susan Ragland:
Director:
Financial Management and Assurance:
U.S. Government Accountability Office:
441 G Street, NW:
Washington, DC 20548:
Dear Ms. Ragland:
The Department of Veterans Affairs (VA) has reviewed the Government
Accountability Office's (GAO) draft report, Department of Veterans
Affairs: Improvements Needed in Corrective Action Plans to Remediate
Financial Reporting Material Weaknesses (GAO-10-65R) and generally
agrees with GAO's findings.
The enclosure specifically addresses each of GAO's recommendations and
provides comments to the draft report. VA appreciates the opportunity
to comment on your draft report.
Sincerely,
Signed by:
John R. Gingrich:
Chief of Staff:
Enclosure:
[End of letter]
Department of Veterans Affairs (VA):
Comments to Government Accountability Office (GAO) Draft Report
"Department Of Veterans Affairs: Improvements Needed in Corrective
Action Plans to Remediate Financial Reporting Material Weaknesses"
(GAO-10-65R):
GAO Recommendations: To help focus VA's corrective action plans on more
effectively establishing and completing consistent and comprehensive
near term actions, we recommend that the Secretary of VA direct the
Assistant Secretary for Management to issue policies and procedures for
identifying and reporting on financial audit weaknesses to include:
Recommendation 1: Detailed guidance (such as a set of tools and
templates in place to identify and report on programmatic weaknesses)
on required corrective action plan elements (including milestones for
completion of interim action steps and validation steps.)
VA comments: Concur with comment. In 2009, the Office of Financial
Process Improvement and Audit Readiness (FPIAR) began to integrate much
of its financial audit weakness corrective action processes with VA's
Senior Assessment Team (SAT)-driven OMB A-123 Appendix A processes
managed by the Office of Business Oversight's (OBO) Internal Controls
Service (ICS). These corrective action processes were very robust and
included corrective action planning, monitoring, reporting and
validation processes that are consistent with the Chief Financial
Officers Council's guidance.
ICS is developing a handbook for all stakeholders that provides
detailed guidance for corrective action planning, monitoring, reporting
and validation procedures for all financial audit and A-123 Appendix A
significant deficiencies and material weaknesses. By joining with ICS,
FPIAR will migrate to a set of tools, templates, and documented
procedures to effectively develop, manage and report on corrective
actions in FY 2010. These tools and templates provide rigidity and
consistency to VA's standardized corrective action plans (CAP) by
requiring development and documentation of detailed milestones,
involvement and approval by key stakeholders, and formal reporting to
the SAT.
ICS provides FPIAR staff a platform to report monthly status to the
SAT, and conduct validation of corrected deficiencies. FPIAR has access
to contracts with audit and accounting firms. developed and maintained
by ICS. to assist stakeholders in development of CAPs and in the
correction and validation of deficiencies.
CAPs in fiscal 2010 will meet all requirements of OMB Circular A-123,
Appendix A, Internal Control over Financial Reporting. CAPs will be
centralized in one repository using a standardized handbook format
across the Department allowing for effective and efficient
documentation, monitoring and reporting.
Recommendation 2: Establishing a VA Secretariat-level agency-wide
governance structure for overseeing all OMB Circular A-123 and
financial statement audit material weakness remediation activities that
provides for (1) involving key stakeholders in the remediation process
(such as the FPIAR, administration CFO's, and other senior VA
officials), (2) clearly defining stakeholder roles and
responsibilities, (3) establishing and implementing strategic workforce
planning for FPIAR, and (4) regularly assessing and reporting on the
status of corrective action plans and identification of any actions
needed to address any slippages of remediation activities.
VA comments: Partially Concur. In 2009, the SAT was established as the
coordinating body for corrective action planning, monitoring, reporting
and validation of deficiencies identified during financial audits. Led
by the Assistant Secretary for Management, the SAT is comprised of
senior business managers from VA's three administrations and relevant
staff offices, such as FLITE, acquisition, finance, general counsel,
IT, and HR.
The FPIAR office was established in January 2009 to oversee and
coordinate agency-wide activities for financial reporting material
weaknesses and help improve financial business processes. As the office
matures, it will continue to define and meet staffing requirements.
Additionally, the FPIAR office uses contractors for necessary support
services to accomplish specific technical goals and objectives and
enhance VA's ability to deliver the highest quality care and support to
our Nation's Veterans. FPIAR, in concert with ICS, will work directly
with individual CAP owners to create plans, identify and commit
resources, monitor progress, and report status to the SAT.
VA's A-123, Appendix A program's CAP processes have annually seen great
improvements because of ICS's use of standardized tools, templates and
processes; engagement of stakeholders in the CAP processes; oversight
by the SAT of the entire CAP process; and formal reporting and
validation processes. FPIAR, 080 and VA's SAT are committed to the use
of even more rigid and consistent tools and templates. These will more
effectively develop, manage and report on audit remediation activities.
GAO Recommendation 3: To help ensure the timely and complete
capitalization of property, plant and equipment, we recommend that the
Secretary of VA direct the Assistant Secretary for Management to issue
procedures on specific actions and identify specific reasonable
timeframes, such as within 30 days, to implement VA policy to
capitalize PP&E projects when they are placed in service.
VA comments: Concur with comment. On August 20, 2009, VA issued new
financial policy and procedures on capitalization of property, plant,
and equipment. A copy of the document is enclosed.
Additional comments:
Page 6, third bullet: Insert "and memorial" before services. The bullet
should read, 'The National Cemetery Administration (NCA) maintains
national cemeteries and provides burial and memorial services to
veterans."
Page 10: VBA Benefit Delivery Network (BDN) and Veterans Services
Network (VETSNET) had insufficient audit trail documentation for the
transfer of data to a data warehouse and the storage of such data,
increasing the risk of misstatements in the financial statements and
other financial reports.
VA comment: The corporate database used by VETSNET contains a "designed
in" audit trail in the business transaction table. Every activity,
whether a payment, proceed, or receivable is traceable to its
originating business transaction record(s) created by an online user or
batch process. The database's inherent referential integrity and
financial accounting system business logic ensures this traceability.
Specific business requirements for a format of the audit trail may not
be available (assuming this is the audit trail documentation
referenced); however, we see no issue with implementing anything
requested from the existing data when known.
Page 10: VETSNET lacks data mining capabilities, thereby preventing VA
financial managers from analyzing transactions at a level needed to
prepare routine reconciliations on billions of dollars in transactions.
VA comment: The VBA Chief Financial Officer has identified a list of
defects and the changes to VETSNET that are needed to improve
operations and address deficiencies noted in the annual financial
statement audits. These items are scheduled to be installed in
production as part of VETSNET release VR6 scheduled for February 2010.
[End of section]
Appendix III: GAO Contact and Staff Acknowledgments:
GAO Contact - Susan Ragland, (202) 512-9095 or raglands@gao.gov.
Staff Acknowledgments - In addition to the contact named above, Glenn
Slocum (Assistant Director), Richard Cambosos, Patrick Frey, W. Stephen
Lowrey, David Ramirez, and George Warnock made key contributions to
this report.
[End of section]
Footnotes:
[1] GAO, Veterans Affairs: Additional Details Are Needed in Key
Planning Documents to Guide the New Financial and Logistics Initiative,
[hyperlink, http://www.gao.gov/products/GAO-08-1097] (Washington, D.C.:
Sept. 22, 2008).
[2] A material weakness is a significant deficiency, or combination of
significant deficiencies, that results in more than a remote likelihood
that a material misstatement of the financial statements will not be
prevented or detected by the entity's internal control.
[3] A significant deficiency is a control deficiency, or combination of
control deficiencies, that adversely affects the entity's ability to
initiate, authorize, record, process, or report financial data reliably
in accordance with generally accepted accounting principles such that
there is more than a remote likelihood that a misstatement of the
entity's financial statements that is more than inconsequential will
not be prevented or detected by the entity's internal control.
[4] VA's third material weakness concerned IT security controls. VA
planned to remediate this material weakness using plans of actions and
milestones as specified by OMB's Guidance for Preparing and Submitting
Security Plans of Action and Milestones.
[5] VA had a net operating cost of about $423 billion in fiscal year
2008. For purposes of conducting this work, we calculated a materiality
threshold of $12.7 billion (or 3 percent of the net operating cost),
and identified those deficiencies related to line items with balances
exceeding that amount.
[6] 31 U.S.C. § 902; see 31 U.S.C. §§ 3512 (d), 3515.
[7] GAO, Standards for Internal Control in the Federal
Government,[hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]
(Washington, D.C.: November 1999).
[8] The circular's use of the term "material weakness" is similar to
the same term used by auditors to identify internal control weaknesses
found during a financial statement audit. This circular's use of the
same term encompasses not only financial reporting, but also
encompasses weaknesses found in program operations and compliance with
applicable laws and regulations. Material weaknesses for the purposes
of this circular are determined by management, whereas material
weaknesses reported as part of a financial statement audit are
determined by independent auditors.
[9] The Director of the FLITE Program Office reports to the VA
Assistant Secretary for Management. The Assistant Secretary for
Management acts as the VA CFO overseeing all resource requirements,
development and implementation of agency performance measures, and
financial management activities relating to VA programs and operations.
[10] In agency comments to the draft report provided on November 2,
2009, VA officials stated that the corporate database used by VETSNET
contains an internal audit trail in the business transaction table,
whereby every activity, whether a payment, proceed, or receivable, is
traceable to its originating business transaction record(s).
[11] Data mining is the automatic extraction of useful, often
previously unknown information from large data sets.
[12] According to VA officials, the VBA CFO has identified changes to
VETSNET needed to improve operations and address deficiencies noted in
the annual financial statement audits. These items are scheduled to be
installed in an update to VETSNET in February 2010.
[13] The scope of our review did not include analysis of plans of
action and milestones to remediate the significant deficiencies
underlying the IT Security material weakness.
[14] The independent auditor will evaluate VA progress in remediating
the deficiencies as part of the fiscal year 2009 financial statement
audit.
[15] VA had not begun implementing one plan that was due to be
completed in 2014 at the time of our review.
[16] Statement of Federal Financial Accounting Standards No. 6 (SFFAS
6), Accounting for Property, Plant, And Equipment, paragraph 26.
[17] Department of Veterans Affairs Handbook 4511, Paragraph 2.
[18] Internal Control Stakeholder Procedures Manual, Internal Controls
Service, Office of Business Oversight, Department of Veterans Affairs,
July 2008.
[19] For example, the November 12, 2008, meeting was chaired by the
Assistant Secretary for Management and attended by 31 other officials
including the Principal Deputy Assistant Secretary for Management, the
Deputy Assistant Secretary for Acquisition and Logistics, the Director
of the Office of Business Oversight, the Director of the Office of
Financial Policy, the Deputy Director of the Financial and Logistics
Integrated Technology Enterprise (FLITE) Program Office, and the Chief
Financial Officers from the VHA, VBA, and NCA.
[20] Strategic workforce planning allows organizations to determine the
critical skills and competencies that will be needed to achieve current
and future programmatic results and develop strategies that are
tailored to address gaps in the number, skills, competencies, and
alignment of staff. See Human Capital: Key Principles for Effective
Strategic Workforce Planning, [hyperlink,
http://www.gao.gov/products/GAO-04-39] (Washington, D.C.: Dec. 11,
2003).
[21] A material weakness is a significant deficiency, or combination of
significant deficiencies, that results in more than a remote likelihood
that a material misstatement of the financial statements will not be
prevented or detected by the entity's internal control.
[22] A significant deficiency is a control deficiency, or combination
of control deficiencies, that adversely affects the entity's ability to
initiate, authorize, record, process, or report financial data reliably
in accordance with generally accepted accounting principles such that
there is more than a remote likelihood that a misstatement of the
entity's financial statements that is more than inconsequential will
not be prevented or detected by the entity's internal control.
[23] VA's third material weakness concerned IT security controls. VA
planned to remediate this material weakness using plans of actions and
milestones as specified by OMB' s Guidance for Preparing and Submitting
Security Plans of Action and Milestones.
[24] VA had a net operating cost of about $423 billion in fiscal year
2008. For purposes of conducting this work, we calculated a materiality
threshold of $12.7 billion (or 3 percent of the net operating cost),
and identified those deficiencies related to line items with balances
exceeding that amount.
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Phone:
The price of each GAO publication reflects GAO‘s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO‘s Web site,
[hyperlink, http://www.gao.gov/ordering.htm].
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional
information.
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
