Veterans Health Administration: Additional Actions Needed to Improve Oversight of Health Care System
Fast Facts
The Veterans Health Administration operates one of the nation's largest health care systems—serving millions of veterans.
In 2024, VHA reorganized to eliminate overlap and fragmentation of responsibilities across its offices that oversee compliance, risk management, internal audits, and medical investigations. Among other things, the reorganization highlighted VHA's need for a workforce plan. Having a plan would help ensure these offices have the staff they need to understand what's working within the health system, and manage any remaining risks.
Our recommendations address this, and more. Veterans' health care is on our High Risk List.
Highlights
What GAO Found
The Department of Veterans Affairs (VA) delivers services to veterans in a vast health care system operated by the Veterans Health Administration (VHA). Three VHA oversight offices are responsible for administering select oversight functions, including compliance, risk management, internal audit, and medical investigations. GAO found that VHA has made various organizational changes to its oversight offices since 2015. Most recently it reorganized them in 2024 with the goal of eliminating fragmentation, overlap, and duplication, according to VHA.
VHA Oversight Offices and Governance Body, as of 2024
VHA's Office of Integrity and Compliance is responsible for managing risks (threats to achieving VHA's mission), by implementing an agencywide approach to understanding the combined impact of risks. GAO's review showed that VHA has partially followed each of GAO's six leading practices for managing risk. For example, the Office of Integrity and Compliance trained employees on its risk management approach through new courses in fiscal year 2023. However, VHA has not fully met these leading practices, such as by comprehensively identifying risks across its health care system. GAO's prior work has shown that comprehensive risk identification is critical even if the agency does not control the source of the risk. By taking additional steps to fully meet leading practices, VHA can better respond to risks that could potentially interfere with the timeliness and quality of veterans' health care.
VHA established the Office of Internal Audit in 2016 to provide objective information to VHA leadership on how well particular aspects of its health care system are working. However, GAO found the office encountered challenges due to its unclear reporting structure and oversight role. VHA did not define a clear purpose for its internal audit function and had not updated its policy directive in light of its 2024 reorganization. By clearly defining its purpose, VHA can better ensure its Office of Internal Audit is used effectively, such as to provide VHA leadership information on trends and emerging issues.
VHA established the Audit, Risk, and Compliance Committee as the governance body that is to guide its oversight and, in turn, make recommendations for system-wide improvements. However, GAO's review of committee documentation from fiscal year 2021 through 2024 found that the committee did not review relevant oversight findings, such as those from its medical investigations, and did not provide recommendations for potential system-wide improvements. Reviewing additional oversight findings and providing such recommendations, as appropriate, may assist the committee in identifying critical opportunities for system-wide improvement.
Why GAO Did This Study
VHA operates one of the nation's largest health care systems, offering services to over 9 million enrolled veterans. VHA has stated that effective oversight is paramount to its ability to deliver quality health care to veterans. However, our prior work found that VHA has faced challenges overseeing veterans' health care. GAO added VA health care to its High-Risk List in 2015, due, in part, to these concerns.
GAO was asked to review how VHA manages selected oversight functions within its central office. This report examines how VHA has (1) organized its oversight offices, (2) followed leading practices for risk management, (3) established an Office of Internal Audit to help meet its oversight needs, and (4) guided select oversight functions through its Audit, Risk, and Compliance Committee.
GAO reviewed VHA documentation on its central office oversight functions, such as policies, organizational structure, and meeting minutes; and assessed VHA's processes against relevant criteria. GAO also interviewed VHA officials from its oversight offices and from four VA medical centers and their regional networks selected for variation in geography, rurality, and type of compliance structure used.
Recommendations
GAO is making four recommendations, including that VHA take steps to fully meet leading practices for managing risk; clearly define the purpose of its internal audit function; and take action to ensure its ability to monitor oversight findings. VA concurred with the recommendations and identified steps VHA will take to implement them.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Veterans Health Administration | The Under Secretary for Health should develop a workforce plan for its oversight offices based on evaluating the staff needed to effectively conduct compliance, risk management, internal audit, and medical investigations functions. (Recommendation 1) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Veterans Health Administration | The Under Secretary for Health should take steps to fully meet leading practices for managing risk as the Office of Integrity and Compliance implements the agency's risk management function. (Recommendation 2) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Veterans Health Administration | The Under Secretary for Health should clearly define the purpose of VHA's internal audit function in an updated policy directive for the Office of Internal Audit. Such a policy should include a clear reporting structure and a defined oversight role with the types of audit activities and priorities for which the office is responsible. (Recommendation 3) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Veterans Health Administration | The Under Secretary for Health should take action to ensure the Audit, Risk, and Compliance Committee's ability to monitor oversight findings and to provide recommendations to VHA leadership to help inform potential system-wide improvements, as appropriate. (Recommendation 4) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|