It has been nearly a decade since the U.S. Government Accountability Office added the Veterans Health Administration to its High-Risk List of programs and operations that are vulnerable to waste, fraud, abuse, or mismanagement, or in need of transformation. The GAO’s recent analysis makes several recommendations for improvement and leaves VHA on the High-Risk List.
A GAO report noted that since its high-risk designation, VHA has undergone various organizational changes to the offices responsible for carrying out select oversight functions, with the goal of eliminating fragmentation, overlap, and duplication across oversight offices. “These reorganizations, however, also highlighted the need for a workforce plan to clearly assess the number and type of staff needed to conduct each office’s work and the overall staffing needs of the oversight offices together,” the report said. “With such a plan, VHA would be better positioned to ensure that its oversight offices can effectively conduct the oversight functions that help it understand how well particular aspects of the VHA health care system are working.
The VHA’s Office of Integrity and Compliance has taken steps to provide a more comprehensive picture of clinical and non-clinical risks to VHA’s health care system, instead of considering risks in silos. However, the GAO found that the office is only partially following leading practices for managing risk, which limits its ability to identify, assess, and communicate risks. “By fully meeting the leading practices for managing risk, VHA can better identify and mitigate risks to its delivery of healthcare services,” the report said.
Similarly, the GAO found that the Office of Internal Audit has taken steps to carry out VHA’s internal audit function. However, the office’s policy directive lacks detail on the purpose of the function, in light of VHA’s most recent organizational changes. “By clearly defining the purpose of its internal audit function, including identifying a clear reporting structure and a defined oversight role, VHA has the opportunity to make the function more effective in providing VHA leadership information on trends and emerging issues that may impact its healthcare system,” GAO said.
VHA created its Audit, Risk, and Compliance Committee to guide compliance, risk management, and internal audit functions and is making changes to the committee, consistent with its 2024 reorganization. But the GAO found that the committee has not reviewed relevant oversight findings, such as from medical investigations, and has not provided recommendations for system-wide improvements. “By taking steps to review relevant oversight findings and make such recommendations, as appropriate, the committee can help VHA leverage the work performed by its individual oversight offices and others to provide better strategic direction for its health care system. These steps are particularly important to help address VHA’s historically fragmented oversight approach and to help ensure VHA is able to provide quality healthcare to veterans,” the report said.
Recommendations for Executive Action
GAO made four recommendations to VHA:
• The Under Secretary for Health should develop a workforce plan for its oversight offices based on evaluating the staff needed to effectively conduct compliance, risk management, internal audit, and medical investigations functions. (Recommendation 1)
• The Under Secretary for Health should take steps to fully meet leading practices for managing risk as the Office of Integrity and Compliance implements the agency’s risk management function. (Recommendation 2)
• The Under Secretary for Health should clearly define the purpose of VHA’s internal audit function in an updated policy directive for the Office of Internal Audit. Such a policy should include a clear reporting structure and a defined oversight role with the types of audit activities and priorities for which the office is responsible. (Recommendation 3)
• The Under Secretary for Health should take action to ensure the Audit, Risk, and Compliance Committee’s ability to monitor oversight findings and to provide recommendations to VHA leadership to help inform potential system-wide improvements, as appropriate. (Recommendation 4)
Agency Comments
After reviewing a draft of this report, the VA responded to the recommendation. Regarding the first recommendation, VA stated that the agency will assess the resources and associated workloads for its oversight offices to develop a workforce plan. VHA’s Office of Integrity and Compliance will subsequently report its workforce plan actions to relevant governance bodies, such as the Audit, Risk, and Compliance Committee, on a quarterly basis.
With respect to the second recommendation, VA stated that the Office of Integrity and Compliance is taking a multi-year approach to implementing VHA’s risk management function, consistent with Office of Management and Budget requirements. The office will continue its agencywide collaboration on risk management activities, in addition to monitoring and reporting its progress to relevant governance bodies, such as the Audit, Risk, and Compliance Committee.
Regarding the third recommendation on clearly defining a purpose for VHA’s internal audit function, VA stated that the agency will revise VHA Directive 1370 to include a clear reporting structure and defined oversight role. As part of the revision, the Office of Integrity and Compliance will obtain input from VHA’s internal audit staff and leadership. The office plans to report on its progress on a quarterly basis to relevant governance bodies, such as the Audit, Risk, and Compliance Committee.
Regarding the fourth recommendation on the Audit, Risk, and Compliance Committee, VA stated that the Office of Integrity and Compliance will strengthen the committee’s processes by revising its charter and membership roles and responsibilities. Through this committee or a successor oversight committee, the office will also clarify the committee’s role related to informing system-wide improvements and monitoring oversight findings.
