This is the accessible text file for GAO report number GAO-10-65 entitled 'Department Of Veterans Affairs: Improvements Needed in Corrective Action Plans to Remediate Financial Reporting Material Weaknesses' which was released on November 16, 2009. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to the Subcommittee on Oversight and Investigations, Committee on Veterans' Affairs, House of Representatives: United States Government Accountability Office: GAO: November 2009: Department Of Veterans Affairs: Improvements Needed in Corrective Action Plans to Remediate Financial Reporting Material Weaknesses: GAO-10-65: GAO Highlights: Highlights of GAO-10-65, a report to the Subcommittee on Oversight and Investigations, Committee on Veterans' Affairs, House of Representatives. Why GAO Did This Study: In fiscal year 2008, the Department of Veterans Affairs (VA) identified three material internal control weaknesses over financial reporting— financial management system functionality, IT security controls, and financial management oversight. VA is developing a new financial system— FLITE—but full implementation is not expected until 2014. Therefore, the Subcommittee asked us to determine whether VA corrective action plans and oversight are appropriately focused on near-term actions to provide improved financial information. This report addresses (1) the nature of the internal control weaknesses identified in the VA fiscal year 2008 financial audit report and how long they have been outstanding, (2) whether VA had plans appropriately focused on near-term corrective actions, and (3) whether VA had appropriate oversight mechanisms in place to help assure that near-term corrective action plans are implemented on schedule. GAO reviewed corrective action plans for significant deficiencies underlying 2 of the 3 material weaknesses and performed additional analysis for two underlying significant deficiencies. What GAO Found: VA’s fiscal year 2008 material weaknesses in financial management system functionality and financial management oversight have been reported since fiscal years 2000 and 2005, respectively. These two material weaknesses are comprised of 16 underlying significant financial reporting control deficiencies. Although VA had eliminated some significant deficiencies in prior years, other deficiencies have emerged. As a result, continuing serious deficiencies in financial reporting leave VA at risk of processing errors and misstatements in its financial statements. Although VA had corrective action plans in place intended to result in near-term remediation of the 16 fiscal year 2008 significant control deficiencies, many of these plans did not contain the detail needed to provide VA officials with assurance that the plans could be effectively implemented on schedule. VA lacked documented policies and procedures needed to assure the consistent and comprehensive design of these corrective action plans, and 8 of 13 of VA’s plans for correcting its financial reporting deficiencies lacked key information regarding milestones for action steps and validation activities. Table: Key Elements Missing from VA Financial Reporting Corrective Action Plans: Corrective action plan: 1. Fixed Asset Package; Lack of related milestones: [Empty]; Lack of validation activities: [Empty]. Corrective action plan: 2. Mail Order Pharmacy; Lack of related milestones: [Check]; Lack of validation activities: [Check]. Corrective action plan: 3. Obligations and Purchases; Lack of related milestones: [Check]; Lack of validation activities: [Check]. Corrective action plan: 4. Accrued services payable; Lack of related milestones: [Check]; Lack of validation activities: [Empty]. Corrective action plan: 5. Property, Plant, and Equipment; Lack of related milestones: [Check]; Lack of validation activities: [Empty]. Corrective action plan: 6. Environmental liabilities; Lack of related milestones: [Check]; Lack of validation activities: [Empty]. Corrective action plan: 7. Unbilled receivables; Lack of related milestones: [Check]; Lack of validation activities: [Empty]. Corrective action plan: 8. Benefit payment reconciliation; Lack of related milestones: [Empty]; Lack of validation activities: [Empty]. Corrective action plan: 9. Portfolio loan servicing; Lack of related milestones: [Empty]; Lack of validation activities: [Check]. Corrective action plan: 10. Actuarial liability model; Lack of related milestones: [Check]; Lack of validation activities: [Empty]. Corrective action plan: 11. VBA default model; Lack of related milestones: [Empty]; Lack of validation activities: [Empty]. Corrective action plan: 12. Software capitalization; Lack of related milestones: [Empty]; Lack of validation activities: [Empty]. Corrective action plan: 13. Year-end Closing Procedures; Lack of related milestones: [Empty]; Lack of validation activities: [Empty]. Source: GAO analysis of VA corrective action plans as of August 2009. [End of table] As of August 2009, VA had missed milestones in 5 of the 13 corrective action plans. For example, our analysis of plans for remediating deficiencies regarding the capitalization of property, plant, and equipment and inadequate benefit payment reconciliations showed that slipping milestones could jeopardize VA’s timely completion of these plans, and consequently may impair VA’s ability to obtain improved data reliability within the time frames originally envisioned. VA lacked documented policies and procedures for overseeing implementation of the corrective action plans, but recently took steps intended to better coordinate its oversight activities. What GAO Recommends: GAO makes recommendations to the Secretary of Veterans Affairs to improve the design and oversight of corrective action plans. VA generally concurred with GAO’s recommendations and identified related actions taken and planned. View [hyperlink, http://www.gao.gov/products/GAO-10-65] or key components. For more information, contact Susan Ragland at (202) 512- 9095 or raglands@gao.gov. [End of section] Contents: Letter: Background: VA Faces Continuing Financial Reporting Deficiencies as a Result of Uncorrected Long-Standing Material Weaknesses: Most VA Corrective Action Plans Lacked Key Information: Deficient Corrective Action Plans and Ineffective Oversight of Remediation Efforts Result in Ongoing Risks to VA's Financial Information: Conclusion: Recommendations: Agency Comments and Our Evaluation: Appendix I: Scope and Methodology: Appendix II: Comments from the Department of Veterans Affairs: Appendix III: GAO Contact and Staff Acknowledgments: Tables: Table 1: Planned Completion of Corrective Action Plans: Table 2: Summary of Key Elements Missing from VA Financial Reporting Corrective Action Plans: Table 3: Status of VA Fiscal Year 2008 Financial Reporting Corrective Action Plans: [End of section] United States Government Accountability Office: Washington, DC 20548: November 16, 2009: The Honorable Harry E. Mitchell: Chairman: The Honorable David P. Roe: Ranking Member: Subcommittee on Oversight and Investigations: Committee on Veterans' Affairs: House of Representatives: Each year, the Department of Veterans Affairs (VA) produces financial statements intended to reflect its results of operations, status of budgetary resources, and assets and liabilities. Accurate and timely financial reporting helps provide accountability for billions of dollars of services and benefits to veterans and their families, including medical services, disability compensation, vocational rehabilitation, and burial benefits. However, in VA's fiscal year 2008 financial statement audit report, the independent auditor reported serious weaknesses in internal control over financial reporting. While VA has been developing a new financial management system--Financial and Logistics Integrated Technology Enterprise (FLITE)--intended to help address these control weaknesses, the system is not expected to be fully implemented until fiscal year 2014. Further, GAO has reviewed the FLITE program and reported, among other things, that VA lacked assurance that the FLITE program would be completed as planned. [Footnote 1] In light of the seriousness of VA's internal control weaknesses, and the need to improve the reliability of financial information on VA programs and activities before FLITE implementation, the Subcommittee asked us to determine whether VA corrective action plans and oversight are appropriately focused on near-term actions to address these internal control weaknesses. Our objectives for this report were to determine (1) the nature of the internal control weaknesses identified in the VA fiscal year 2008 financial audit report and how long they have been outstanding, (2) whether VA had plans appropriately focused on near-term actions to address financial reporting deficiencies prior to the implementation of FLITE in fiscal year 2014, and (3) whether VA had appropriate oversight mechanisms in place to help assure that near-term corrective action plans to address financial reporting deficiencies are implemented on schedule. To determine the nature of the internal control weaknesses identified in the VA fiscal year 2008 financial audit report and how long they have been outstanding, we analyzed the financial statement audit reports for fiscal years 2000 to 2008. We summarized available information on the extent and nature of the internal control weaknesses characterized as material weaknesses,[Footnote 2] as well as the underlying significant deficiencies[Footnote 3] and identified their evolution over time. We also interviewed VA and Office of Inspector General (OIG) officials and VA's independent auditor, and reviewed VA documents, prior GAO and OIG reports, and independent auditor workpapers to better understand the nature of the control deficiencies underlying the material weaknesses. We did not perform independent audit work to test and validate whether the material weaknesses and related significant deficiencies reported by the independent auditor were appropriate and comprehensive. To determine whether VA had plans appropriately focused on near-term actions to address financial reporting deficiencies prior to the full implementation of FLITE in fiscal year 2014, we analyzed VA's corrective action plans for remediating significant deficiencies underlying two of the three material weaknesses[Footnote 4] impacting the reliability of financial information integral for helping inform management decision making--weaknesses in VA's financial management systems and in its financial management oversight. We interviewed VA officials, VA's Office of Inspector General (OIG), and independent auditor officials who completed VA's fiscal year 2008 financial statement audit about near-term actions in VA plans to correct these underlying significant deficiencies. We also analyzed related corrective action plans to determine whether they included key information specified in the Chief Financial Officers Council's Implementation Guide for OMB Circular A-123, Management's Responsibility for Internal Control - Appendix A, Internal Control over Financial Reporting (CFOC A-123 Guidance): action steps with related milestones to provide a "road map" for remediation activities, validation activities, a description of the deficiency to be corrected in sufficient detail to provide clarity and facilitate a common understanding of what needs to be done, and clear delineation of responsible officials for completing the planned actions. To determine whether VA had appropriate oversight mechanisms in place to help assure that near-term corrective action plans to address financial reporting deficiencies are implemented on schedule, we assessed the status of plan implementation by identifying whether VA met specific milestones and any slippages that had occurred. We also evaluated the timeliness of implementation of corrective action plans for two significant deficiencies--one to address the inadequate capitalization and accounting for property, plant, and equipment (PP&E) and another to improve reconciliations of benefit payments. We selected these plans for further review because the related deficiencies were not currently being audited or reviewed by other oversight organizations, their associated account balances exceeded a material dollar threshold ($12.7 billion),[Footnote 5] and the deficiencies contributed to the two material weaknesses that we, VA officials, and the independent auditor considered most integral for developing useful and reliable information for decision making. We reviewed these plans' implementation to determine the extent to which delays jeopardized VA's ability to remediate these control deficiencies prior to FLITE implementation. In this regard, we reviewed documentation and transactions concerning 25 projects that had been placed in service since the start of fiscal year 2008--21 projects at the Albuquerque, New Mexico Medical Center and 4 projects at the Lyons, New Jersey Medical Center--to determine how long it took VA to capitalize these projects after they had been placed in service. We also reviewed VA's progress in implementing benefit payment reconciliation procedures in a timely manner. We interviewed VA, OIG, and independent auditor officials about mechanisms in place to oversee the design and implementation of near-term corrective action plans to remediate material financial reporting weaknesses identified through financial statement audits. We reviewed minutes of oversight meetings involving senior VA management to determine how VA monitored the status of remediation efforts related to internal control deficiencies identified through financial statement audits. We also interviewed agency officials about VA's overall accountability for timely remediation of internal control deficiencies in the near term, and reviewed the status of ongoing VA efforts to staff a new office responsible for coordination and oversight of the development of corrective action plans. Appendix I provides a more detailed description of the scope and methodology for our engagement. We conducted our audit work from November 2008 to November 2009 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We received written comments on a draft of this report from the Department of Veterans Affairs Chief of Staff which are reprinted in appendix II. Background: VA is responsible for providing federal benefits to veterans. Headed by the Secretary of Veterans Affairs, VA operates nationwide programs for health care, financial assistance, and burial benefits. According to VA, in fiscal year 2009 the department received appropriations of almost $97 billion, including over $50 billion in discretionary funding, primarily for health care and approximately $47 billion in mandatory funding, primarily for disability compensation, pensions, and education benefit programs. VA is organized into three administrations to provide health care, financial, and burial benefits to veterans and their families: * The Veterans Health Administration (VHA) provides a broad range of primary health care, specialized care, and related medical and social support services through its network of more than 1,200 medical facilities. * The Veterans Benefit Administration (VBA) distributes financial benefits to veterans and their families related to compensation and pension, vocational rehabilitation and employment, home loans, life insurance, and education. * The National Cemetery Administration (NCA) maintains national cemeteries and provides burial and memorial services to veterans. Legislative and Regulatory Framework for Financial Management, Reporting, and Internal Control: The Chief Financial Officers (CFO) of the 24 major departments and agencies identified in 31 U.S.C. § 901(b) are required to, among other things, develop and maintain integrated accounting and financial management systems, including financial reporting and internal controls, and to direct, manage, and provide policy guidance and oversight of all agency financial management activities. These CFOs are also required to assist the heads of their agencies with annually preparing and submitting to Congress and the Office of Management and Budget audited financial statements and statements of assurance on the effectiveness of their agencies' systems of internal control.[Footnote 6] The Comptroller General's Standards for Internal Control in the Federal Government[Footnote 7] (the Green Book) provides that federal agencies should establish policies and procedures to ensure that the findings of audits and other reviews are promptly resolved. In addition, Office of Management and Budget (OMB) Circular No. A-123, Management's Responsibility for Internal Control, requires management to develop corrective action plans for material weaknesses[Footnote 8]-- identified through management reviews, OIG and GAO reports, program evaluations, and financial statement audits--and periodically assess and report on the progress of those plans. Further, the CFOC A-123 Guidance provides that agencies construct a corrective action planning framework to facilitate plan preparation, accountability, monitoring, and communication. The guidance provides that agency managers are responsible for developing and implementing action plans for taking timely and effective action to correct deficiencies. The CFOC A-123 Guidance is widely viewed as a "best practices" methodology for executing the requirements of Appendix A of OMB Circular No. A-123. Material Weaknesses Identified in VA's Internal Control over Financial Reporting in Fiscal Year 2008: In the independent auditor's report on VA's fiscal year 2008 financial statements, the auditor identified the following three material weaknesses: * Financial management system functionality--reported since fiscal year 2000, is linked to VA's outdated legacy financial systems impacting VA's ability to prepare, process, and analyze financial information that is reliable, timely, and consistent. Legacy system deficiencies necessitated significant manual processing of financial data and a large number of adjustments to the balances in the system, thereby increasing the risk of processing errors and misstatements in the financial statements. * IT security controls--also reported as a material weakness since fiscal year 2000, resulted from the lack of effective implementation and enforcement of an agencywide information security program. Security weaknesses in the areas of access control, segregation of duties, change control, and service continuity continued to place VA's program and financial data at risk. For example, weaknesses in information security controls placed sensitive financial and veterans' medical and benefit information at risk of inadvertent or deliberate misuse, improper disclosure, theft, or destruction, possibly occurring without detection. * Financial management oversight--reported as a material weakness beginning in fiscal year 2005 and as a significant deficiency in fiscal years 2000 through 2004. This weakness stemmed from a number of control deficiencies whose operational causes varied. Common issues included the recording of financial data without sufficient review and monitoring, a lack of human resources with the appropriate skills, and a lack of capacity to effectively process a significant volume of transactions. When aggregated, the independent auditor found that these deficiencies suggested a recurring theme of inadequate or ineffective financial management oversight. VA Has Established FLITE Program: To help resolve the financial management system functionality material weakness, modernize the IT environment, and implement an integrated financial management system, VA established the Financial and Logistics Integrated Technology Enterprise (FLITE) program, managed by the FLITE Program Office,[Footnote 9] to replace its current legacy systems. The FLITE Program involves a multiple-year phased approach comprised of three major components: the Strategic Asset Management (SAM) project, a logistics and asset management system; the Integrated Financial Accounting System (IFAS), which focuses on financial management; and a data warehouse that is intended to assist in financial reporting. As of January 2009, VA planned to complete FLITE implementation in fiscal year 2014. VA Faces Continuing Financial Reporting Deficiencies as a Result of Uncorrected Long-Standing Material Weaknesses: Although VA had eliminated some significant deficiencies in prior years, other deficiencies have emerged that require attention. As a result of its recurring internal control weaknesses in financial reporting, VA continues to be at risk of processing errors and misstatements in VA's financial reports. The financial management system functionality material weakness, which is linked to VA's outdated financial systems, consists of seven underlying significant deficiencies. The following four significant deficiencies were newly reported in fiscal year 2008. * VBA Benefit Delivery Network (BDN) and Veterans Services Network (VETSNET) had insufficient audit trail documentation for the transfer of data to a data warehouse and the storage of such data, increasing the risk of misstatements in the financial statements and other financial reports.[Footnote 10] * VETSNET lacked data mining[Footnote 11] capabilities, thereby preventing VA financial managers from analyzing transactions at a level needed to prepare routine reconciliations on billions of dollars in transactions.[Footnote 12] * Automated inventory systems at the Consolidated Mail Order Pharmacy facilities could not provide the data needed to properly record the cost of inventory, resulting in potential misstatements in the financial statements and other financial reports. * VA lacked a system to track obligations and purchases by vendors resulting in VA relying on vendors to supply operational sales data on medical center purchases. Three of the seven significant deficiencies were repeat conditions: * Inadequate year-end closing procedures for the financial system and related records, reported since fiscal year 2000, created a significant risk of error in the annual financial statements. * Business line system integration problems, reported since fiscal year 2004, resulted in inadequate support for amounts recorded in the general ledger, such as VETSNET accounts receivables, and the potential for misstatements in the financial statements and other financial reports. * Fixed asset reporting limitations, reported since fiscal year 2007, prohibited VA from readily identifying all current year PP&E additions and reclassifications of work in process. The financial management oversight material weakness, reflecting a recurring theme of inadequate or ineffective financial management oversight, consisted of nine underlying significant deficiencies. The following three were newly reported in fiscal year 2008: * Missing records in the mortgage loan portfolio maintained by an outside contractor resulted in unsupported amounts and potential errors in the general ledger. * Incorrect formulas for estimating the projected default rate for guaranteed and direct loans in VA's housing model could lead to material misstatements of estimated costs of guaranteed and direct loans in the financial statements and other financial reports. * Incorrect expensing and capitalization of software development costs could result in an understatement of PP&E and an overstatement of operating program costs. Six of the nine significant deficiencies were repeat conditions: * A lack of adequate review and follow-up procedures for accrued services payable and undelivered orders, reported since fiscal year 2007, resulted in invalid balances for obligations and accrued services payable and potential misstatements in the financial statements and other financial reports. VA reported a total of $8 billion in undelivered orders in fiscal year 2008. * Untimely depreciation, improper recording of disposed assets, discrepancies in estimated useful life of equipment, and other inadequate capitalization and accounting for PP&E, reported since fiscal year 2000, could result in misstated PP&E and related expense accounts. VA reported a $13 billion PP&E balance in fiscal year 2008. * Inconsistent methodologies and unsupported estimates for environmental and disposal liabilities, reported since fiscal year 2004, could lead to misstatements in the financial statements. VA reported a $928 million balance in environmental and disposal liabilities in fiscal year 2008. * Inadequate review of unbilled receivables and contractual adjustments, reported since fiscal year 2007, could lead to misstatements of account receivable balances. VA reported over $1.7 billion in accounts receivable for fiscal year 2008. * Inadequate BDN and VETSNET reconciliations, reported since fiscal year 2007, increased the likelihood that an error in the financial statements will occur and go undetected. BDN and VETSNET processed over $40 billion in compensation, pension, education, and vocational rehabilitation and employment benefits in fiscal year 2008. * Inadequate reconciliations of the data input to the compensation and pension actuarial liability model, reported since fiscal year 2007, could result in misstatements in the financial statements. VA reported a $1.4 trillion actuarial liability in fiscal year 2008. In fiscal year 2008, VA reported successfully eliminating two prior significant deficiencies concerning insufficient follow-up of accounts receivable collections and errors in payroll data submissions to the Office of Personnel Management underlying the financial management oversight material weakness, as well as a prior material weakness regarding the retention of computer-generated detail records for benefit payments. Most VA Corrective Action Plans Lacked Key Information: VA has established corrective action plans intended to remediate many of its 16 significant deficiencies in the near term independent of FLITE implementation.[Footnote 13] However, although VA had corrective action plans in place, many of these corrective action plans did not contain the detail needed to provide VA or congressional oversight officials with assurance that the plans had near-term actions that could be effectively implemented on schedule. As shown in the table 1, VA planned to remediate 9 deficiencies in fiscal year 2009, 3 in fiscal year 2010, 3 in fiscal year 2012, and 1 in fiscal year 2014.[Footnote 14] However, VA lacked documented policies and procedures to ensure the consistent and comprehensive design of these plans, and most of VA's plans for correcting financial reporting deficiencies in the near term lacked key information suggested in CFOC A-123 Guidance. Table 1: Planned Completion of Corrective Action Plans: 1; Corrective action plan title: Fixed Asset Package system limitations; No. of deficiencies: 1; Fiscal year targeted for completion: 2010[A]. 2; Corrective action plan title: Consolidated Mail Order Pharmacy inventory pricing; No. of deficiencies: 1; Fiscal year targeted for completion: 2010. 3; Corrective action plan title: Inadequate Obligations and Purchases Tracking System; No. of deficiencies: 1; Fiscal year targeted for completion: 2014[B]. 4; Corrective action plan title: Accrued services payable/Undelivered orders not properly monitored; No. of deficiencies: 1; Fiscal year targeted for completion: 2009. 5; Corrective action plan title: Inadequate monitoring and accounting for Property, Plant, and Equipment; No. of deficiencies: 1; Fiscal year targeted for completion: 2009. 6; Corrective action plan title: Environmental and disposal liabilities not properly monitored; No. of deficiencies: 1; Fiscal year targeted for completion: 2009. 7; Corrective action plan title: Unbilled receivables and contractual adjustments not adequately reviewed; No. of deficiencies: 1; Fiscal year targeted for completion: 2009. 8; Corrective action plan title: BDN/VETSNET are not being properly reconciled to the general ledger [C]; No. of deficiencies: 1[D]; Fiscal year targeted for completion: 2009; No. of deficiencies: 3; Fiscal year targeted for completion: 2012. 9; Corrective action plan title: Incomplete outsourced portfolio loan servicing records; No. of deficiencies: 1; Fiscal year targeted for completion: 2009. 10; Corrective action plan title: Inadequate consideration of variables input in the compensation and pension actuarial liability model; No. of deficiencies: 1; Fiscal year targeted for completion: 2009. 11; Corrective action plan title: VBA Variable Default Housing Model; No. of deficiencies: 1; Fiscal year targeted for completion: 2009. 12; Corrective action plan title: Software expenses not properly tracked/capitalized; No. of deficiencies: 1; Fiscal year targeted for completion: 2009. 13; Corrective action plan title: Year-end Closing Procedures; No. of deficiencies: 1; Fiscal year targeted for completion: 2010. Total deficiencies: 16. Source: GAO analysis of VA corrective action plans. [A] According to VA officials, VA provided documentation of new reconciliation processes to the independent auditor in an effort to remediate this deficiency ahead of schedule. At the time of our review, the auditor had not provided VA with feedback regarding the sufficiency of VA's new procedures. [B] According to VA officials, VA provided a demonstration to the independent auditor in July 2009 to illustrate the ability of its financial system to track obligations and purchases at a vendor level. At the time of our review, the auditor had not provided VA with feedback regarding the sufficiency of VA's new procedures. [C] This plan addresses the four significant deficiencies related to the lack of BDN and VETSNET data mining capabilities, audit trail documentation, system integration, and reconciliation procedures. [D] Te deficiency concerning VBA audit trail documentation was remediated through a contractor-prepared task work plan which, according to VA officials, was issued under this corrective action plan and was to be implemented in fiscal year 2009. [End of table] Eight of the 13 plans we reviewed lacked key information as recommended by the CFOC A-123 Guidance. As shown in table 2, 5 plans lacked milestone dates for action steps, 1 plan lacked validation activities, and 2 plans lacked both milestone dates and validation activities. Table 2: Summary of Key Elements Missing from VA Financial Reporting Corrective Action Plans: 1; Corrective action plan title: Fixed Asset Package system limitations; Lack of related milestones: [Empty]; Lack of validation activities: [Empty]. 2; Corrective action plan title: Consolidated Mail Order Pharmacy inventory pricing; Lack of related milestones: [Check]; Lack of validation activities: [Check]. 3; Corrective action plan title: Inadequate Obligations and Purchases Tracking System; Lack of related milestones:[Check]; Lack of validation activities: [Check]. 4; Corrective action plan title: Accrued services payable and Undelivered orders not properly monitored; Lack of related milestones: [Check]; Lack of validation activities: [Empty]. 5; Corrective action plan title: Inadequate monitoring and accounting for Property, Plant, and Equipment; Lack of related milestones: [Check]; Lack of validation activities: [Empty]. 6; Corrective action plan title: Environmental and disposal liabilities not properly monitored; Lack of related milestones: [Check]; Lack of validation activities: [Empty]. 7; Corrective action plan title: Unbilled receivables and contractual adjustments not adequately reviewed; Lack of related milestones: [Check]; Lack of validation activities: [Empty]. 8; Corrective action plan title: BDN/VETSNET are not being properly reconciled to the general ledger; Lack of related milestones: [Empty]; Lack of validation activities: [Empty]. 9; Corrective action plan title: Incomplete outsourced portfolio loan servicing records; Lack of related milestones: [Empty]; Lack of validation activities: [Check]. 10; Corrective action plan title: Inadequate consideration of variables input in the actuarial liability model; Lack of related milestones: [Check]; Lack of validation activities: [Empty]. 11; Corrective action plan title: VBA variable default model formula errors; Lack of related milestones: [Empty]; Lack of validation activities: [Empty]. 12; Corrective action plan title: Software expenses not properly tracked and capitalized; Lack of related milestones: [Empty]; Lack of validation activities: [Empty]. 13; Corrective action plan title: Year-end Closing Procedures; Lack of related milestones: [Empty]; Lack of validation activities: [Empty]. Source: GAO analysis of VA corrective action plans as of August 2009. [End of table] In accordance with CFOC A-123 Guidance, agencies should prepare comprehensive corrective action plans that list action steps with related monthly milestone dates to help ensure senior VA officials can monitor progress. Seven of VA's corrective action plans did not include intermediate milestone dates necessary to gauge whether planned corrective actions are proceeding according to schedule, thus increasing the risk that corrective action plans will not be implemented on schedule. For example, * In one plan, VA combined several action steps, needed to rewrite the Consolidated Mail Order Pharmacy inventory management software, into one 2-year milestone period. For example, VA combined developing a statement of work, rewriting the software, and developing an inventory module for each CMOP into one 2-year milestone period. In addition, two other action steps lacked completion dates. Without interim milestones and completion dates, it is more difficult for VA officials to identify whether the necessary activities for remediating weaknesses are occurring and whether they are on schedule. Without such information, VA could miss opportunities to address issues that might hamper timely completion of the remediation. * VHA's plan for addressing the inadequate monitoring and accounting for PP&E only specified the fiscal year in which the tasks were to be completed. The lack of intermediate milestones makes it difficult for senior management to adequately monitor the progress of implementation efforts. Because most action steps only had a fiscal year target date, it was unclear when during the year the steps were to be taken and whether or not they were sequential. In addition, the plan did not include any descriptions or related milestones for two action steps. In accordance with CFOC A-123 Guidance, senior management is responsible for determining when sufficient action has been taken to declare that a significant deficiency or a material weakness has been corrected, and corrective action plans should include activities to validate the resolution of the deficiency. Without such validation measures, it is difficult for VA management to provide assurance that the corrective actions have effectively remediated the deficiency. Three of VA's corrective action plans did not include activities to validate that the planned actions would resolve the deficiency. For example, the corrective action plan to address deficiencies in VA's automated inventory systems at its Consolidated Mail Order Pharmacy facilities did not include activities to validate whether action steps were implemented and the desired results achieved. Deficient Corrective Action Plans and Ineffective Oversight of Remediation Efforts Result in Ongoing Risks to VA's Financial Information: Deficient corrective action plans (discussed previously) and ineffective oversight of corrective action plan implementation have resulted in missed remediation milestones, placing VA at risk of continued errors and misstatements in financial information. As of August 2009, VA had missed milestones in 5 of the 13 corrective action plans to remediate fiscal year 2008 significant deficiencies underlying the financial management system functionality and financial management oversight material weaknesses. Our analysis of corrective action plans for two significant deficiencies--the untimely capitalization of construction projects and inadequate reconciliations related to benefit payments--showed that slipping milestones could jeopardize VA's completion of these plans by fiscal years 2009 and 2012 respectively, and therefore may impair VA's ability to obtain the improved data reliability originally envisioned within those time frames. For the plans lacking interim milestones, it is difficult for VA management to monitor progress, identify whether there is any slippage, and take timely steps to keep actions on track. The lack of milestones and the related accountability for meeting targets could also limit incentives for staff to ensure actions are implemented on schedule. In addition, VA lacked documented policies and procedures for overseeing the implementation of corrective action plans to remediate material weaknesses identified in financial statement audits. In January 2009, VA recognized the need to better coordinate these oversight activities and created an office of Financial Process Improvement and Audit Readiness (FPIAR). VA Missed Milestones for Five Plans and Status of Other Plans Was Unknown: As shown in table 3, VA missed milestones in 5 of the 13 corrective action plans that we reviewed, and the status of progress in implementing 3 other plans was unknown because they lacked sufficient interim milestones.[Footnote 15] VA missed milestones related to preparation of detailed procedures for the Fixed Asset Package, PP&E policies and procedures, benefit payment reconciliations, the development of reports to support reconciliations of expense accounts in the actuarial liability model, and year-end closing procedures. Table 3: Status of VA Fiscal Year 2008 Financial Reporting Corrective Action Plans: 1; Plan title: Fixed Asset Package system limitations; On schedule: [Empty]; Slipping milestones: [Check]; Unknown status: [Empty]; Status shown on corrective action plans: Development of work in process component has been delayed pending the results of further testing by the independent auditor. 2; Plan title: Consolidated Mail Order Pharmacy inventory pricing; On schedule: [Empty]; Slipping milestones: [Empty]; Unknown status: [Check}; Status shown on corrective action plans: First milestone completion date is scheduled for September 2010. Without interim milestones it is not feasible to determine project status. 3; Plan title: Inadequate Obligations and Purchases Tracking System; On schedule: [Empty]; Slipping milestones: [Empty]; Unknown status: N/A; Status shown on corrective action plans: Implementation is scheduled to begin in October 2009. 4; Plan title: Accrued services payable and Undelivered orders not properly monitored; On schedule: [Check}; Slipping milestones: [Empty]; Unknown status: [Empty]; Status shown on corrective action plans: All actions have been completed as of May 2009. 5; Plan title: Inadequate monitoring and accounting for Property, Plant, and Equipment; On schedule: [Empty]; Slipping milestones: [Check}; Unknown status: [Empty]; Status shown on corrective action plans: VA planned to develop policies and procedures by March 2009. As of August 2009, VA had not completed this action step (see case study below). 6; Plan title: Environmental and disposal liabilities not properly monitored; On schedule: [Empty]; Slipping milestones: [Empty]; Unknown status: [Check}; Status shown on corrective action plans: Milestones listed by fiscal year, so it is not feasible to determine project status. 7; Plan title: Unbilled receivables and contractual adjustments not adequately reviewed; On schedule: [Empty]; Slipping milestones: [Empty]; Unknown status: [Check}; Status shown on corrective action plans: Milestones listed by fiscal year, so it is not feasible to determine project status. 8; Plan title: BDN/VETSNET are not being properly reconciled to the general ledger; On schedule: [Empty]; Slipping milestones: [Check}; Unknown status: [Empty]; Status shown on corrective action plans: Slippage has occurred on several milestones, and milestones have been shifted back up to 14 months (see case study below). 9; Plan title: Incomplete outsourced portfolio loan servicing records ; On schedule: [Check}; Slipping milestones: [Empty]; Unknown status: [Empty]; Status shown on corrective action plans: All actions have been completed as of December 2008. 10; Plan title: Inadequate consideration of variables input in the actuarial liability model; On schedule: [Empty]; Slipping milestones: [Check}; Unknown status: [Empty]; Status shown on corrective action plans: Slippage has occurred in the development of reports to support manual reconciliations of expense accounts. 11; Plan title: VBA variable default model formula errors; On schedule: [Check}; Slipping milestones: [Empty]; Unknown status: [Empty]; Status shown on corrective action plans: All actions have been completed as of April 2009. 12; Plan title: Software expenses not properly tracked and capitalized; On schedule: [Check}; Slipping milestones: [Empty]; Unknown status: [Empty]; Status shown on corrective action plans: On schedule. 13; Plan title: Year-end Closing Procedures; On schedule: [Empty]; Slipping milestones: [Check}; Unknown status: [Empty]; Status shown on corrective action plans: Missed milestone for developing a year-end closing operating plan for each administration. Source: GAO analysis of VA fiscal year 2008 corrective action plans as of August 2009. [End of table] Missed Milestones for Two Significant Deficiencies Illustrate Continuing Adverse Impacts on VA's Financial Management: An analysis of the status of corrective action plans for two significant deficiencies--the inadequate monitoring and accounting for PP&E and inadequate reconciliations related to benefit payments-- provided examples of how missed milestones result in continuing risks of errors in related VA financial reporting. Specifically, VA missed its milestones for the creation of detailed procedures for capitalizing PP&E and automated reconciliations to support veteran benefit payments. Although the PP&E corrective action plan called for procedures related to timely capitalization of PP&E to be developed by March 2009, they had not been issued by August 2009. Failing to capitalize construction projects in a timely manner may lead to misstated financial information if projects are not capitalized in the same fiscal year they are placed in service. In addition, related depreciation expenses may also be misstated as a result of time lags in capitalizing projects. Finally, if projects are not closed out in a timely fashion, VA is unable to determine whether funds are available for use on other construction projects. Our analysis at two VHA medical facilities identified continuing problems in the timely capitalization of PP&E. According to federal accounting standards[Footnote 16] and VA policy issued by VA's Assistant Secretary for Management (the VA CFO), [Footnote 17] construction projects are to be recorded as work in process (WIP) until they are placed in service, at which time the WIP balances are to be transferred to general PP&E. We reviewed the 21 projects at the Albuquerque, New Mexico Medical Center and the 4 projects at the Lyons, New Jersey Medical Center that had been placed into service since the start of fiscal year 2008 and found continuing significant delays in the amount of time it took to close out and capitalize projects after they were placed in service. In Albuquerque, VA fiscal staff told us their undocumented practice was to capitalize projects within 30 days of being placed in service. However, while they had capitalized 11 of 21 projects within 30 days, 6 projects were not capitalized for 30 to 60 days, and 4 projects were not capitalized for more than 120 days after they had been placed into service. At Lyons, VA staff capitalized 3 of 4 projects more than 180 days after they were placed in service. VBA also experienced slipping milestones in remediating the benefit payment reconciliation deficiency. VBA did not perform necessary reconciliations between the BDN and VETSNET systems and VA's general ledger on a monthly basis prior to March 2008. Lacking such reconciliation VA is at continuing risk of improper reporting of benefit payments. That year, these systems processed over $41.6 billion in benefits payments related to compensation and pension, as well as a portion of education benefit programs as authorized by law. This information is critical to the correct determination of VA's overall cost of operations. VBA developed a corrective action plan to correct this deficiency that contained 43 separate activities with related milestones, including developing automated reconciliations, documenting processes, and training end users. According to VBA documents and officials, VBA missed and pushed back milestones related to the development of reports supporting veteran education payments and automated reconciliations. For example, as of August 2009, work on the development of detailed reports supporting the Vocational Rehabilitation and Employment education payments was pushed back 5 months from November 2009 to April 2010 and VBA reported slippage ranging from 3 to14 months in the development of various reconciliations supporting Dependent's Education Benefits. VA Lacked Effective Agencywide Oversight for the Correction of Material Weaknesses: VA lacked policies and procedures for overseeing the design and implementation of corrective action plans to correct financial reporting material weaknesses identified in financial statement audits. Further, VA did not have an agencywide accountability mechanism in place to oversee and coordinate the remediation of the material weaknesses in financial reporting. Rather, VA delegated responsibility for the design, implementation, and oversight of the corrective action plans to the various administrations and offices responsible for the areas in which the deficiencies were identified (e.g., VHA and VBA). Lacking centralized VA-wide guidance, the administrations inconsistently defined the parameters for milestone dates in corrective action plans. For example, VHA corrective action plans provided milestones by fiscal year, while VBA plans often had monthly milestone dates. As a result, VA's ability to determine the status of corrective action plan implementation and identify and address any slippages was impaired. In contrast to its financial reporting weaknesses, VA had documented policies and procedures to identify and correct its programmatic material weaknesses, specifically those in the areas of accountability and effectiveness over VA programs and operations. These policies and procedures, which could also be applied to the remediation of financial reporting material weaknesses identified through financial statement audits, are outlined in a manual which includes a detailed template for developing corrective action plans that specified parameters for milestone dates and other key information.[Footnote 18] Further, VA had a Senior Assessment Team (SAT) in place (chaired by the Assistant Secretary for Management and comprised of other senior management representatives from VA and its three administrations) to oversee remediation of programmatic control weaknesses detected through VA's internal control reviews completed under OMB Circular No. A-123. [Footnote 19] In January 2009, VA recognized the need to better oversee and coordinate agencywide oversight activities for financial reporting material weaknesses identified through financial statement audits. Specifically, VA recruited a director to head a new office of Financial Process Improvement and Audit Readiness (FPIAR) reporting to the VA Deputy CFO in the Office of Finance under the VA Assistant Secretary for Management. FPIAR was established with responsibility for: * coordinating and overseeing comprehensive corrective action plans for VA's audit-related material weaknesses, in consultation and coordination with VA's three administrations and applicable staff offices; * assisting VA and the three administrations and staff offices in executing and monitoring the corrective action plans; * ensuring compliance of VA offices and field stations with VA policies, plans, procedures, and internal controls; and: * assisting in updating corrective action plans as needed and developing recommendations and actions for ensuring completion of stated objectives and milestones in the event of slippage. In addition, the FPIAR Director's position description calls for FPIAR to perform analysis and remediation efforts for any comparable internal control deficiencies being resolved as part of VA's ongoing OMB Circular No. A-123 reviews in concert with work to remediate VA's audit- related material weaknesses. Integrating VA's A-123 review process and remediation activities for financial reporting material weaknesses identified in financial statement audits could enhance the efficiency of VA's corrective actions and the elimination of material weaknesses. As of September 2009, according to FPIAR's Director, VA had filled three permanent staff positions and hired six full-time contractors to assist VA in addressing a variety of financial reporting issues (e.g., helping address the IT Security Controls material weakness and outstanding issues surrounding the capitalization of software development costs, updating and reformatting corrective action plans, and developing requirements for an interface between VETSNET and VA's general ledger). The VA Deputy CFO said that as office operations have evolved, VA has decided to hire one or two more permanent staff for the FPIAR and use contractors to fill other positions. He said that contractors can provide VA with the flexibility to address short-term staffing needs as well as the necessary technical expertise to remediate individual significant deficiencies. However, the FPIAR did not have a workforce plan defining the number of staff and expertise needed in the office.[Footnote 20] In fiscal year 2009, while not included in documented policies and procedures, the FPIAR began practices intended to establish agencywide procedures for oversight of corrective action plans to remediate material weaknesses identified in financial statement audits. For example, the FPIAR Director began participating in monthly SAT meetings chaired by the Assistant Secretary for Management and attended by other senior VA officials including the VHA CFO and VBA CFO. These meetings provide an opportunity for the FPIAR Director to highlight the status of specific corrective actions underway to address financial reporting significant deficiencies requiring the attention of key stakeholders across the agency. Further, the director told us that by the end of calendar year 2009, the FPIAR intends to begin using a corrective action plan template consistent with the CFOC A-123 Guidance to remediate significant deficiencies identified in the fiscal year 2009 financial statement audit. Because VA has developed a corrective action template for addressing A-123 control deficiencies, the FPIAR Director told us she is considering whether to adopt this template for corrective action plans to remediate financial reporting control weaknesses, which could provide efficiencies and help integrate resolution of some deficiencies. VA's Deputy CFO also told us that oversight by the SAT, combined with the use of the corrective action plan template, will allow for more rigorous oversight of remediation efforts of weaknesses detected in the financial statement audits. Conclusion: VA has had serious, long-standing material weaknesses in financial reporting that could result in significant misstatements in financial information reported to Congress and used by VA to manage its operations. One of the significant deficiencies is not planned for resolution until FLITE is fully implemented, which will not be until 2014. Other deficiencies can be addressed in the near term. While VA has corrective action plans for near-term actions intended to provide more accurate and complete financial data, they often lacked key information. Consequently, VA managers could not readily identify and address slippage in remediation activities, exposing VA to continued risk of errors in financial information and reporting. Immediate actions to provide a rigorous framework for the design and oversight of corrective action plans will be essential to ensuring the timely remediation of internal control weaknesses before FLITE implementation. Well-defined corrective action plans provide a "road map" for remediation activities and facilitate effective oversight by senior VA officials. Continued support from senior VA officials and administration CFOs will also be critical to ensure that key corrective actions are developed and implemented on schedule. Recommendations: To help focus VA's corrective action plans on more effectively establishing and completing consistent and comprehensive near-term actions, we recommend that the Secretary of VA direct the Assistant Secretary for Management to issue policies and procedures for identifying and reporting on financial audit weaknesses to include: * Detailed guidance (such as a set of tools and templates in place to identify and report on programmatic weaknesses) on required corrective action plan elements (including milestones for completion of interim action steps and validation steps). * Establishing a VA Secretariat-level agency-wide governance structure for overseeing all OMB Circular No. A-123 and financial statement audit material weakness remediation activities that provides for (1) involving key stakeholders in the remediation process (such as the FPIAR, administration CFO's, and other senior VA officials); (2) clearly defining stakeholder roles and responsibilities; (3) establishing and implementing strategic workforce planning for FPIAR; and (4) regularly assessing and reporting on the status of corrective action plans and identification of any actions needed to address any slippages of remediation activities. To help ensure the timely and complete capitalization of property, plant, and equipment, we recommend that the Secretary of VA direct the Assistant Secretary for Management to issue procedures on specific actions and identify specific reasonable time frames, such as within 30 days, to implement VA policy to capitalize PP&E projects when they are placed in service. Agency Comments and Our Evaluation: In its written comments, VA generally agreed with our findings and recommendations and identified specific actions it has taken and plans to take to implement these recommendations. In response to our recommendation to provide detailed guidance (such as a set of tools and templates in place to identify and report on programmatic weaknesses) on required corrective action plan elements (including milestones for completion of interim action steps and validation steps), VA stated that the FPIAR has begun integrating its corrective actions for financial audit weaknesses with VA's OMB Circular No. A-123 processes. VA also said that FPIAR will migrate to a set of corrective action plan tools, templates, and documented procedures in fiscal year 2010. VA partially concurred with our recommendation that VA establish a Secretariat-level agencywide governance structure for OMB Circular No. A-123 and financial statement audit remediation activities. In its comments, VA stated it already established a Senior Assessment Team as the coordinating body for corrective action planning to address control deficiencies identified as a result of OMB Circular No. A-123 reviews and financial statement audits. As discussed in our draft report, we recognized VA has taken action to establish agencywide accountability for oversight of its corrective action plans and has begun to establish related practices. However, these practices had not yet evolved into the rigorous framework needed to effectively ensure timely control weakness remediation. VA stated that its Internal Controls Service is developing a handbook for all stakeholders that will provide detailed guidance for corrective action planning, monitoring, reporting, and validation procedures for all financial statement audit and OMB Circular No. A-123 significant deficiencies and material weaknesses. Also, VA noted that as FPIAR matures, it will continue to define and meet staffing requirements. VA also concurred with our recommendation that VA issue procedures for specific actions and identify reasonable time frames, such as within 30 days, to implement VA policy to capitalize PP&E projects when they are placed in service. VA provided a copy of recently issued procedures which identified specific actions and time frames for the capitalization of PP&E. These procedures provide guidance for monthly communications between engineering staffs, program directors, and the appropriate fiscal activity regarding construction project status, costs, and useful life. The procedures also provide that property should be capitalized no later than the end of the fiscal month following the month that the property is put into use or accepted by VA. If fully and effectively implemented, the guidance should help address the problems we found related to timely capitalization of VA's PP&E. In its written comments, VA also provided technical comments which we considered and incorporated as appropriate. We are sending copies of this report to other interested congressional committees and to affected federal agencies. In addition, this report is available at no charge on the GAO Web site at [hyperlink, http://www.gao.gov]. If you or your staff have any questions regarding this report, please contact me at (202) 512-9095 or at raglands@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. Signed by: Susan Ragland: Director, Financial Management and Assurance: [End of section] Appendix I: Scope and Methodology: To determine the nature of the internal control weaknesses identified in the Department of Veterans Affairs (VA) fiscal year 2008 financial audit report and how long they have been outstanding, we obtained and analyzed the financial statement audit reports for fiscal years 2000 to 2008. We summarized available information on the extent and nature of the internal control weaknesses characterized as material weaknesses, [Footnote 21] as well as the underlying significant deficiencies [Footnote 22] and identified their evolution over time. We also interviewed VA and Office of Inspector General (OIG) officials and VA's independent auditor, and reviewed VA documents, prior GAO and OIG reports, and independent auditor workpapers to better understand control deficiencies underlying the material weaknesses. We did not perform independent audit work to test and validate whether the material weaknesses and related significant deficiencies reported by the independent auditor were accurate and complete. To determine whether VA had plans appropriately focused on near-term actions to address financial reporting deficiencies prior to the implementation of its Financial and Logistics Integrated Technology Enterprise (FLITE) system in fiscal year 2014, we analyzed VA's corrective action plans for remediating significant deficiencies underlying two of the three material weaknesses impacting the reliability of financial information integral for helping inform management decision making--weaknesses in VA's financial management systems and in its financial management oversight.[Footnote 23] We interviewed VA officials, VA OIG officials, and independent auditor officials who completed VA's fiscal year 2008 financial statement audit about near-term actions in VA plans to correct these underlying significant deficiencies. We also analyzed related corrective action plans to remediate 15 of the 16 significant deficiencies underlying two material weaknesses to determine whether they included key information specified in the Chief Financial Officers Council's (CFOC) Implementation Guide for OMB Circular A-123, Management's Responsibility for Internal Control - Appendix A, Internal Control over Financial Reporting: action steps with related milestones to provide a "road map" for remediation activities, validation activities to help ensure the proposed actions worked as envisioned, a description of the deficiency to be corrected in sufficient detail to provide clarity and facilitate a common understanding of what needs to be done, and clear delineation of responsible officials for completing the planned actions. We also reviewed VA's task work plan to remediate the final significant deficiency--the documentation of data transfer from VBA benefit payment systems to a data warehouse--in fiscal year 2009. To determine whether VA had appropriate oversight mechanisms in place to help ensure that near-term corrective action plans to address financial reporting deficiencies are implemented on schedule, we assessed the status of plan implementation in July and August 2009 by identifying whether VA met specific milestones and any slippages that had occurred. We also evaluated the timeliness of implementation of corrective action plans for two significant deficiencies--one to address the inadequate capitalization and accounting for property, plant, and equipment (PP&E) and another to improve reconciliations of benefit payments. One plan was designed and implemented by the Veterans Health Administration, and one by the Veterans Benefit Administration-- the two principal VA administrations. We selected these plans for further review because the related deficiencies were not currently being audited or reviewed by other oversight organizations, their associated account balances exceeded a material dollar threshold ($12.7 billion)[Footnote 24], and the deficiencies contributed to the two material weaknesses that we, VA officials, and VA's independent auditor considered most integral for developing useful and reliable information for decision making. We reviewed these plans' implementation in detail to determine the extent to which delays jeopardized VA's ability to remediate these control deficiencies and provide reliable financial management information to senior VA officials prior to FLITE implementation. In this regard, we reviewed documentation and transactions concerning 25 projects that had been placed in service since the start of fiscal year 2008: 21 projects at the Albuquerque, New Mexico Medical Center and 4 projects at the Lyons, New Jersey Medical Center to determine how long it took VA to capitalize these projects after they had been placed in service. We also reviewed VA's progress in implementing benefit payment reconciliation procedures in a timely manner. We interviewed VA, OIG, and independent auditor officials about mechanisms in place to oversee the design and implementation of near-term corrective action plans to remediate material financial reporting weaknesses identified through financial statement audits. We reviewed minutes of oversight meetings involving senior VA management to determine how VA monitored the status of remediation efforts related to internal control deficiencies identified through financial statement audits. We also interviewed agency officials about VA's overall accountability for timely remediation of internal control deficiencies in the near term, and reviewed the status of ongoing VA efforts to staff a new office responsible for coordination and oversight of the development of corrective action plans. We conducted our audit work from November 2008 to November 2009 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. [End of section] Appendix II: Comments from the Department of Veterans Affairs: Department Of Veterans Affairs: Washington DC 20420: November 2, 2009: Ms. Susan Ragland: Director: Financial Management and Assurance: U.S. Government Accountability Office: 441 G Street, NW: Washington, DC 20548: Dear Ms. Ragland: The Department of Veterans Affairs (VA) has reviewed the Government Accountability Office's (GAO) draft report, Department of Veterans Affairs: Improvements Needed in Corrective Action Plans to Remediate Financial Reporting Material Weaknesses (GAO-10-65R) and generally agrees with GAO's findings. The enclosure specifically addresses each of GAO's recommendations and provides comments to the draft report. VA appreciates the opportunity to comment on your draft report. Sincerely, Signed by: John R. Gingrich: Chief of Staff: Enclosure: [End of letter] Department of Veterans Affairs (VA): Comments to Government Accountability Office (GAO) Draft Report "Department Of Veterans Affairs: Improvements Needed in Corrective Action Plans to Remediate Financial Reporting Material Weaknesses" (GAO-10-65R): GAO Recommendations: To help focus VA's corrective action plans on more effectively establishing and completing consistent and comprehensive near term actions, we recommend that the Secretary of VA direct the Assistant Secretary for Management to issue policies and procedures for identifying and reporting on financial audit weaknesses to include: Recommendation 1: Detailed guidance (such as a set of tools and templates in place to identify and report on programmatic weaknesses) on required corrective action plan elements (including milestones for completion of interim action steps and validation steps.) VA comments: Concur with comment. In 2009, the Office of Financial Process Improvement and Audit Readiness (FPIAR) began to integrate much of its financial audit weakness corrective action processes with VA's Senior Assessment Team (SAT)-driven OMB A-123 Appendix A processes managed by the Office of Business Oversight's (OBO) Internal Controls Service (ICS). These corrective action processes were very robust and included corrective action planning, monitoring, reporting and validation processes that are consistent with the Chief Financial Officers Council's guidance. ICS is developing a handbook for all stakeholders that provides detailed guidance for corrective action planning, monitoring, reporting and validation procedures for all financial audit and A-123 Appendix A significant deficiencies and material weaknesses. By joining with ICS, FPIAR will migrate to a set of tools, templates, and documented procedures to effectively develop, manage and report on corrective actions in FY 2010. These tools and templates provide rigidity and consistency to VA's standardized corrective action plans (CAP) by requiring development and documentation of detailed milestones, involvement and approval by key stakeholders, and formal reporting to the SAT. ICS provides FPIAR staff a platform to report monthly status to the SAT, and conduct validation of corrected deficiencies. FPIAR has access to contracts with audit and accounting firms. developed and maintained by ICS. to assist stakeholders in development of CAPs and in the correction and validation of deficiencies. CAPs in fiscal 2010 will meet all requirements of OMB Circular A-123, Appendix A, Internal Control over Financial Reporting. CAPs will be centralized in one repository using a standardized handbook format across the Department allowing for effective and efficient documentation, monitoring and reporting. Recommendation 2: Establishing a VA Secretariat-level agency-wide governance structure for overseeing all OMB Circular A-123 and financial statement audit material weakness remediation activities that provides for (1) involving key stakeholders in the remediation process (such as the FPIAR, administration CFO's, and other senior VA officials), (2) clearly defining stakeholder roles and responsibilities, (3) establishing and implementing strategic workforce planning for FPIAR, and (4) regularly assessing and reporting on the status of corrective action plans and identification of any actions needed to address any slippages of remediation activities. VA comments: Partially Concur. In 2009, the SAT was established as the coordinating body for corrective action planning, monitoring, reporting and validation of deficiencies identified during financial audits. Led by the Assistant Secretary for Management, the SAT is comprised of senior business managers from VA's three administrations and relevant staff offices, such as FLITE, acquisition, finance, general counsel, IT, and HR. The FPIAR office was established in January 2009 to oversee and coordinate agency-wide activities for financial reporting material weaknesses and help improve financial business processes. As the office matures, it will continue to define and meet staffing requirements. Additionally, the FPIAR office uses contractors for necessary support services to accomplish specific technical goals and objectives and enhance VA's ability to deliver the highest quality care and support to our Nation's Veterans. FPIAR, in concert with ICS, will work directly with individual CAP owners to create plans, identify and commit resources, monitor progress, and report status to the SAT. VA's A-123, Appendix A program's CAP processes have annually seen great improvements because of ICS's use of standardized tools, templates and processes; engagement of stakeholders in the CAP processes; oversight by the SAT of the entire CAP process; and formal reporting and validation processes. FPIAR, 080 and VA's SAT are committed to the use of even more rigid and consistent tools and templates. These will more effectively develop, manage and report on audit remediation activities. GAO Recommendation 3: To help ensure the timely and complete capitalization of property, plant and equipment, we recommend that the Secretary of VA direct the Assistant Secretary for Management to issue procedures on specific actions and identify specific reasonable timeframes, such as within 30 days, to implement VA policy to capitalize PP&E projects when they are placed in service. VA comments: Concur with comment. On August 20, 2009, VA issued new financial policy and procedures on capitalization of property, plant, and equipment. A copy of the document is enclosed. Additional comments: Page 6, third bullet: Insert "and memorial" before services. The bullet should read, 'The National Cemetery Administration (NCA) maintains national cemeteries and provides burial and memorial services to veterans." Page 10: VBA Benefit Delivery Network (BDN) and Veterans Services Network (VETSNET) had insufficient audit trail documentation for the transfer of data to a data warehouse and the storage of such data, increasing the risk of misstatements in the financial statements and other financial reports. VA comment: The corporate database used by VETSNET contains a "designed in" audit trail in the business transaction table. Every activity, whether a payment, proceed, or receivable is traceable to its originating business transaction record(s) created by an online user or batch process. The database's inherent referential integrity and financial accounting system business logic ensures this traceability. Specific business requirements for a format of the audit trail may not be available (assuming this is the audit trail documentation referenced); however, we see no issue with implementing anything requested from the existing data when known. Page 10: VETSNET lacks data mining capabilities, thereby preventing VA financial managers from analyzing transactions at a level needed to prepare routine reconciliations on billions of dollars in transactions. VA comment: The VBA Chief Financial Officer has identified a list of defects and the changes to VETSNET that are needed to improve operations and address deficiencies noted in the annual financial statement audits. These items are scheduled to be installed in production as part of VETSNET release VR6 scheduled for February 2010. [End of section] Appendix III: GAO Contact and Staff Acknowledgments: GAO Contact - Susan Ragland, (202) 512-9095 or raglands@gao.gov. Staff Acknowledgments - In addition to the contact named above, Glenn Slocum (Assistant Director), Richard Cambosos, Patrick Frey, W. Stephen Lowrey, David Ramirez, and George Warnock made key contributions to this report. [End of section] Footnotes: [1] GAO, Veterans Affairs: Additional Details Are Needed in Key Planning Documents to Guide the New Financial and Logistics Initiative, [hyperlink, http://www.gao.gov/products/GAO-08-1097] (Washington, D.C.: Sept. 22, 2008). [2] A material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected by the entity's internal control. [3] A significant deficiency is a control deficiency, or combination of control deficiencies, that adversely affects the entity's ability to initiate, authorize, record, process, or report financial data reliably in accordance with generally accepted accounting principles such that there is more than a remote likelihood that a misstatement of the entity's financial statements that is more than inconsequential will not be prevented or detected by the entity's internal control. [4] VA's third material weakness concerned IT security controls. VA planned to remediate this material weakness using plans of actions and milestones as specified by OMB's Guidance for Preparing and Submitting Security Plans of Action and Milestones. [5] VA had a net operating cost of about $423 billion in fiscal year 2008. For purposes of conducting this work, we calculated a materiality threshold of $12.7 billion (or 3 percent of the net operating cost), and identified those deficiencies related to line items with balances exceeding that amount. [6] 31 U.S.C. § 902; see 31 U.S.C. §§ 3512 (d), 3515. [7] GAO, Standards for Internal Control in the Federal Government,[hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] (Washington, D.C.: November 1999). [8] The circular's use of the term "material weakness" is similar to the same term used by auditors to identify internal control weaknesses found during a financial statement audit. This circular's use of the same term encompasses not only financial reporting, but also encompasses weaknesses found in program operations and compliance with applicable laws and regulations. Material weaknesses for the purposes of this circular are determined by management, whereas material weaknesses reported as part of a financial statement audit are determined by independent auditors. [9] The Director of the FLITE Program Office reports to the VA Assistant Secretary for Management. The Assistant Secretary for Management acts as the VA CFO overseeing all resource requirements, development and implementation of agency performance measures, and financial management activities relating to VA programs and operations. [10] In agency comments to the draft report provided on November 2, 2009, VA officials stated that the corporate database used by VETSNET contains an internal audit trail in the business transaction table, whereby every activity, whether a payment, proceed, or receivable, is traceable to its originating business transaction record(s). [11] Data mining is the automatic extraction of useful, often previously unknown information from large data sets. [12] According to VA officials, the VBA CFO has identified changes to VETSNET needed to improve operations and address deficiencies noted in the annual financial statement audits. These items are scheduled to be installed in an update to VETSNET in February 2010. [13] The scope of our review did not include analysis of plans of action and milestones to remediate the significant deficiencies underlying the IT Security material weakness. [14] The independent auditor will evaluate VA progress in remediating the deficiencies as part of the fiscal year 2009 financial statement audit. [15] VA had not begun implementing one plan that was due to be completed in 2014 at the time of our review. [16] Statement of Federal Financial Accounting Standards No. 6 (SFFAS 6), Accounting for Property, Plant, And Equipment, paragraph 26. [17] Department of Veterans Affairs Handbook 4511, Paragraph 2. [18] Internal Control Stakeholder Procedures Manual, Internal Controls Service, Office of Business Oversight, Department of Veterans Affairs, July 2008. [19] For example, the November 12, 2008, meeting was chaired by the Assistant Secretary for Management and attended by 31 other officials including the Principal Deputy Assistant Secretary for Management, the Deputy Assistant Secretary for Acquisition and Logistics, the Director of the Office of Business Oversight, the Director of the Office of Financial Policy, the Deputy Director of the Financial and Logistics Integrated Technology Enterprise (FLITE) Program Office, and the Chief Financial Officers from the VHA, VBA, and NCA. [20] Strategic workforce planning allows organizations to determine the critical skills and competencies that will be needed to achieve current and future programmatic results and develop strategies that are tailored to address gaps in the number, skills, competencies, and alignment of staff. See Human Capital: Key Principles for Effective Strategic Workforce Planning, [hyperlink, http://www.gao.gov/products/GAO-04-39] (Washington, D.C.: Dec. 11, 2003). [21] A material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected by the entity's internal control. [22] A significant deficiency is a control deficiency, or combination of control deficiencies, that adversely affects the entity's ability to initiate, authorize, record, process, or report financial data reliably in accordance with generally accepted accounting principles such that there is more than a remote likelihood that a misstatement of the entity's financial statements that is more than inconsequential will not be prevented or detected by the entity's internal control. [23] VA's third material weakness concerned IT security controls. VA planned to remediate this material weakness using plans of actions and milestones as specified by OMB' s Guidance for Preparing and Submitting Security Plans of Action and Milestones. [24] VA had a net operating cost of about $423 billion in fiscal year 2008. For purposes of conducting this work, we calculated a materiality threshold of $12.7 billion (or 3 percent of the net operating cost), and identified those deficiencies related to line items with balances exceeding that amount. [End of section] GAO's Mission: The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Phone: The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s Web site, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, D.C. 20548: Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, D.C. 20548: