Veterans Affairs: Addressing IT Management Challenges Is Essential to Effectively Supporting the Department's Mission

The use of IT is crucial to helping VA effectively serve the nation's veterans. Each year the department spends billions of dollars on its information systems and assets. However, VA has experienced challenges in managing its IT programs, raising questions about its ability to deliver intended outcomes needed to help advance the department's mission. To improve federal agencies' IT acquisitions, in December 2014 Congress enacted FITARA. GAO has previously reported on IT management challenges at VA, as well as its progress in implementing FITARA and cybersecurity requirements.

GAO was asked to summarize key results and recommendations from its work at VA that examined systems modernization efforts, FITARA implementation, and cybersecurity efforts.

To do so, GAO reviewed its recently issued reports and incorporated information on the department's actions in response to GAO's recommendations.

The Department of Veterans Affairs (VA) has made limited progress toward addressing information technology (IT) system modernization challenges.

From 2001 through 2018, VA pursued three efforts to modernize its health information system—the Veterans Health Information Systems and Technology Architecture (VistA). However, these efforts experienced high costs, challenges to ensuring interoperability of health data, and ultimately did not result in a modernized VistA. Regarding the department's fourth and most recent effort, the Electronic Health Record Modernization, GAO recently reported that the governance plan for this program was not yet defined. VA has not fully implemented GAO's recommendation calling for the department to define the role of a key office in the governance plans.

The Family Caregiver Program, which was established to support family caregivers of seriously injured post-9/11 veterans, has not been supported by an effective IT system. Specifically, GAO reported that, due to limitations with the system, the program office did not have ready access to the types of workload data that would allow it to routinely monitor workload problems created by the program. GAO recommended that VA expedite the process for identifying and implementing an IT system. Although the department concurred with the recommendation, VA has not yet fully addressed it.

VA had developed the Veterans Benefits Management System—its system that is used for processing disability benefit claims; however, the system did not fully support disability and pension claims, as well as appeals processing. GAO made five recommendations for VA to improve its efforts to effectively complete the development and implementation of the system. The department concurred with the recommendations but has implemented only one thus far.

VA has demonstrated uneven progress toward fully implementing GAO's recommendations related to key Federal Information Technology Acquisition Reform Act (FITARA) provisions. Specifically, VA has implemented all six recommendations in response to GAO's 2014 report on managing software licenses, leading to, among other things, savings of about $65 million over 3 years. However, the department has not fully addressed two recommendations from GAO's 2016 report on managing the risks of major IT investments. Further, the department has not implemented (1) two of four recommendations related to its effort to consolidate data centers and (2) GAO's four recommendations to increase the authority of its Chief Information Officer.

VA's management of cybersecurity has also lacked key elements. For example, GAO reported in May 2016 that VA had established numerous security controls, but had not effectively implemented key elements of its information security program. In addition, as GAO reported in March 2019, the department had not accurately categorized positions to effectively identify critical staffing needs for its cybersecurity workforce. VA has implemented three of six cybersecurity-related recommendations from these two reports.

GAO has made numerous recent recommendations to VA aimed at improving the department's IT management. VA has generally agreed with the recommendations and has taken steps to address them; however, the department has fully implemented less than half of them. Fully implementing all of GAO's recommendations would help VA ensure that its IT effectively supports the department's mission.

Thank you for the opportunity to participate in today’s hearing regarding  the Department of Veterans Affairs’ (VA) Office of Information and  Technology (OI&T). As you know, the use of information technology (IT)  is crucial to helping VA effectively serve the nation’s veterans. The  department annually spends billions of dollars on its information systems  and assets—VA’s budget for IT now exceeds $4 billion annually.

However, over many years, VA has experienced challenges in managing  its IT projects and programs, raising questions about the efficiency and  effectiveness of OI&T and its ability to deliver intended outcomes needed  to help advance the department’s mission. These challenges have  spanned a number of critical initiatives related to modernizing the  department’s (1) health information system, the Veterans Health  Information Systems and Technology Architecture (VistA); (2) program to  support family caregivers; and (3) benefits management system. The  department has also experienced challenges in implementing provisions  of the Federal Information Technology Acquisition Reform Act (commonly  referred to as FITARA), and in appropriately addressing cybersecurity  risks.

We have previously reported on these IT management challenges at VA  and have made recommendations aimed at improving the department’s  system acquisitions and operations. At your request, my testimony today  summarizes results and recommendations from our work at the  department that examined its system modernization efforts, as well as its  efforts toward implementing FITARA and addressing cybersecurity  issues.

In developing this testimony, we relied on our recently issued reports that  addressed IT management issues at VA and our bi-annual high-risk  series. We also incorporated information on the department’s actions in  response to recommendations we made in our previous reports. The  reports cited throughout this statement include detailed information on the  scope and methodology of our prior reviews.

We conducted the work on which this statement is based in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on  our audit objectives.

VA’s mission is to promote the health, welfare, and dignity of all veterans  in recognition of their service to the nation by ensuring that they receive  medical care, benefits, social support, and lasting memorials. In carrying  out this mission, the department operates one of the largest health care  delivery systems in America, providing health care to millions of veterans  and their families at more than 1,500 facilities.

The department’s three major components—the Veterans Health  Administration (VHA), the Veterans Benefits Administration (VBA), and  the National Cemetery Administration (NCA)—are primarily responsible  for carrying out its mission. More specifically, VHA provides health care  services, including primary care and specialized care, and it performs  research and development to address veterans’ needs. VBA provides a  variety of benefits to veterans and their families, including disability  compensation, educational opportunities, assistance with home  ownership, and life insurance. Further, NCA provides burial and memorial  benefits to veterans and their families.

The use of IT is critically important to VA’s efforts to provide benefits and  services to veterans. As such, the department operates and maintains an  IT infrastructure that is intended to provide the backbone necessary to  meet the day-to-day operational needs of its medical centers, veteran- facing systems, benefits delivery systems, memorial services, and all  other systems supporting the department’s mission. The infrastructure is  to provide for data storage, transmission, and communications  requirements necessary to ensure the delivery of reliable, available, and  responsive support to all VA staff offices and administration customers,  as well as veterans.

Toward this end, the department operates approximately 240 information  systems, manages approximately 314,000 desktop computers and  30,000 laptops, and administers nearly 460,000 network user accounts  for employees and contractors to facilitate providing benefits and health  care to veterans. These systems are used for the determination of  benefits, benefits claims processing, patient admission to hospitals and  clinics, and access to health records, among other services.

VHA’s systems provide capabilities to establish and maintain electronic  health records that health care providers and other clinical staff use to  view patient information in inpatient, outpatient, and long-term care  settings. The department’s health information system—VistA—serves an  essential role in helping the department to fulfill its health care delivery  mission.

Specifically, VistA is an integrated medical information system that was  developed in-house by the department’s clinicians and IT personnel, and  has been in operation since the early 1980s. The system consists of 104  separate computer applications, including 56 health provider applications;  19 management and financial applications; eight registration, enrollment,  and eligibility applications; five health data applications; and three  information and education applications. Within VistA, an application called  the Computerized Patient Record System enables the department to  create and manage an individual electronic health record for each VA  patient.

In June 2017, the former VA Secretary announced that the department  planned to acquire the same Cerner electronic health record system that  the Department of Defense (DOD) has acquired. VA’s effort—the  Electronic Health Record Modernization (EHRM) program—calls for the  deployment of a new electronic health record system at three initial sites  in 2020, with a phased implementation of the remaining sites over the  next decade.

In addition, VBA relies on the Veterans Benefits Management System  (VBMS) to collect and store information such as military service records,  medical examinations, and treatment records from VA, DOD, and private  medical service providers. In 2014, VA issued its 6-year strategic plan,  which emphasizes the department’s goal of increasing veterans’ access  to benefits and services, eliminating the disability claims backlog, and  ending veteran homelessness. According to the plan, the department  intends to improve access to benefits and services through the use of  enhanced technology to provide veterans with access to more effective  care management.

The plan also calls for VA to eliminate the disability claims backlog by  fully implementing an electronic claims process that is intended to reduce  processing time and increase accuracy. Further, the department has an  initiative under way that provides services, such as health care, housing  assistance, and job training, to end veteran homelessness. Toward this  end, VA is working with other agencies, such as the Department of Health  and Human Services, to implement more coordinated data entry systems  to streamline and facilitate access to appropriate housing and services.

Since 2007, VA has been operating a centralized organization, OI&T, in  which most key functions intended for effective management of IT are  performed. This office is led by the Assistant Secretary for Information  and Technology—VA’s Chief Information Officer (CIO). The office is  responsible for providing strategy and technical direction, guidance, and  policy related to how IT resources are to be acquired and managed for  the department, and for working closely with its business partners—such  as VHA—to identify and prioritize business needs and requirements for IT  systems. Among other things, OI&T has responsibility for managing the  majority of VA’s IT-related functions, including the maintenance and  modernization of VistA. As of January 2019, OI&T was comprised of  about 15,800 staff, with more than half of these positions filled by  contractors.

VA Is Requesting about $5.9 Billion for IT and a New Electronic Health Record System for Fiscal Year 2020

VA’s fiscal year 2020 budget request includes about $5.9 billion for OI&T  and its new electronic health record system. Of this amount, about $4.3  billion was requested for OI&T, which represents a $240 million increase  over the $4.1 billion enacted for 2019. The request seeks the following  levels of funding: $401 million for new systems development efforts to support current  health care systems platforms, and to replace legacy systems, such  as the Financial Management System; approximately $2.7 billion for the operations and maintenance of  existing systems, which includes $327.3 million for infrastructure  readiness that is to support the transition to the new electronic health  record system; and approximately $1.2 billion for administration.

Additionally, the department requested about $1.6 billion for the EHRM  program. This amount is an increase of $496 million over the $1.1 billion  that was enacted for the program for fiscal year 2019. The request  includes the following: $1.1 billion for the contract with the Cerner Corporation to acquire the $161,800 for program management, and $334,700 for infrastructure support.

VA’s Management of IT Has Contributed to High- Risk Designations

In 2015, we designated VA Health Care as a high-risk area for the federal  government and noted that IT challenges were among the five areas of  concern. In part, we identified limitations in the capacity of VA’s existing  systems, including the outdated, inefficient nature of certain systems and  a lack of system interoperability—that is, the ability to exchange and use  electronic health information—as contributors to the department’s IT  challenges related to health care.

Also, in February 2015, we added Improving the Management of IT  Acquisitions and Operations to our list of high-risk areas. Specifically,  federal IT investments were too frequently failing or incurring cost  overruns and schedule slippages while contributing little to mission- related outcomes. We have previously reported that the federal  government has spent billions of dollars on failed IT investments,  including at VA.

Our 2017 update to the high-risk report noted that VA had partially met  our leadership commitment criterion by involving top leadership in  addressing the IT challenges portion of the VA Health Care high-risk  area; however, it had not met the action plan, monitoring, demonstrated  progress, or capacity criteria.

We have also identified VA as being among a handful of departments  with one or more archaic legacy systems. Specifically, in our May 2016  report on legacy systems used by federal agencies, we identified two of  VA’s systems as being over 50 years old—the Personnel and Accounting  Integrated Data system and the Benefits Delivery Network system.  These systems were among the 10 oldest investments and/or systems  that were reported by 12 selected agencies.

Accordingly, we recommended that the department identify and plan to  modernize or replace its legacy systems. VA addressed the  recommendation in May 2018, when it provided a Comprehensive  Information Technology Plan that showed a detailed roadmap for the key  programs and systems required for modernization. The plan included time  frames, activities to be performed, and functions to be replaced or  enhanced. The plan also indicated that the Personnel and Accounting  Integrated Data system and the Benefits Delivery Network system are to  be decommissioned in quarters 3 and 4 of fiscal year 2019, respectively.

Our March 2019 update to our high-risk series noted that the ratings for  leadership commitment criterion regressed, while the action plan criterion  improved for the IT Challenges portion of the VA Health Care area. The  capacity, monitoring, and demonstrated progress criteria remained  unchanged. Our work continued to indicate that VA was not yet able to  demonstrate progress in this area.

Since its 2015 high-risk designation, we have made 14 new  recommendations in the VA Health Care area, 12 of which were made  since our 2017 high-risk report was issued. For example, in June 2017, to  address deficiencies we recommended that the department take six  actions to provide clinicians and pharmacists with improved tools to  support pharmacy services to veterans and reduce risks to patient safety.  VA generally concurred with these recommendations; however, all of  them remain open.

FITARA Is Intended to Help VA and Other Agencies Improve Their IT Acquisitions

Congress enacted FITARA in December 2014 to improve agencies’  acquisitions of IT and enable Congress to better monitor agencies’  progress and hold them accountable for reducing duplication and  achieving cost savings. The law applies to VA and other covered  agencies. It includes specific requirements related to seven areas,  including agency CIO authority, data center consolidation and  optimization, risk management of IT investments, and government-wide  software purchasing.

Agency CIO authority enhancements. CIOs at covered agencies  are required to (1) approve the IT budget requests of their respective  agencies, (2) certify that IT investments are adequately implementing  incremental development, as defined in capital planning guidance  issued by the Office of Management and Budget (OMB), (3) review  and approve contracts for IT, and (4) approve the appointment of  other agency employees with the title of CIO.

Federal data center consolidation initiative. Agencies are required  to provide OMB with a data center inventory, a strategy for  consolidating and optimizing their data centers (to include planned  cost savings), and quarterly updates on progress made. The law also  requires OMB to develop a goal for how much is to be saved through  this initiative, and provide annual reports on cost savings achieved.

Enhanced transparency and improved risk management in IT  investments. OMB and covered agencies are to make detailed  information on federal IT investments publicly available, and  department-level CIOs are to categorize their major IT investments by  risk. Additionally, in the case of major investments rated as high risk  for 4 consecutive quarters, the act required that the department- level CIO and the investment’s program manager conduct a review  aimed at identifying and addressing the causes of the risk.

Government-wide software purchasing program. The General  Services Administration is to enhance government-wide acquisition  and management of software and allow for the purchase of a software  license agreement that is available for use by all executive branch  agencies as a single user. Additionally, the Making Electronic  Government Accountable by Yielding Tangible Efficiencies Act of  2016, or the “MEGABYTE Act,” further enhanced CIOs’ management  of software licenses by requiring agency CIOs to establish an agency  software licensing policy and a comprehensive software license  inventory to track and maintain licenses, among other requirements.

In June 2015, OMB released guidance describing how agencies are to  implement FITARA. This guidance is intended to, among other things: assist agencies in aligning their IT resources with statutory establish government-wide IT management controls that will meet the  law’s requirements, while providing agencies with flexibility to adapt to  unique agency processes and requirements;  clarify the CIO’s role and strengthen the relationship between agency  CIOs and bureau CIOs; and  strengthen CIO accountability for IT costs, schedules, performance,  and security.

VA and Other Agencies Face Cybersecurity Risks

The federal approach and strategy for securing information systems is  prescribed by federal law and policy. The Federal Information Security  Modernization Act (FISMA) provides a comprehensive framework for  ensuring the effectiveness of information security controls over  information resources that support federal operations and assets. In  addition, the Federal Cybersecurity Enhancement Act of 2015 requires  protecting federal networks through the use of federal intrusion prevention  and detection capabilities. Further, Executive Order 13800, Strengthening  the Cybersecurity of Federal Networks and Critical Infrastructure, directs  agencies to manage cybersecurity risks to the federal enterprise by,  among other things, using the National Institute of Standards and  Technology Framework for Improving Critical Infrastructure  Cybersecurity (cybersecurity framework).

Federal agencies, including VA, and our nation’s critical infrastructures— such as energy, transportation systems, communications, and financial  services—are dependent on IT systems and electronic data to carry out  operations and to process, maintain, and report essential information. The  security of these systems and data is vital to public confidence and  national security, prosperity, and well-being.

Because many of these systems contain vast amounts of personally  identifiable information, agencies must protect the confidentiality, integrity,  and availability of this information. In addition, they must effectively  respond to data breaches and security incidents when they occur.

The risks to IT systems supporting the federal government and the  nation’s critical infrastructure are increasing, including insider threats from  witting or unwitting employees, escalating and emerging threats from  around the globe, and the emergence of new and more destructive  attacks. Cybersecurity incidents continue to impact federal entities and  the information they maintain. According to OMB’s 2018 annual FISMA  report to Congress, agencies reported 35,277 information security  incidents to DHS’s U.S. Computer Emergency Readiness Team in fiscal  year 2017.

VA Has Made Limited Progress toward Addressing IT System Modernization Challenges

VA has made limited progress toward addressing the IT management  challenges for three critical initiatives: VistA, the Family Caregiver  Program, and VBMS. Specifically, the department has recently initiated its  fourth effort to modernize VistA, but uncertainty remains regarding the  program’s governance. In addition, although VA has taken steps to  address our recommendations for the Family Caregiver Program and  VBMS, the department has not fully implemented most of them.

VA Recently Initiated Its Fourth Effort to Modernize VistA

VA has pursued four efforts over nearly 2 decades to modernize VistA.  These efforts—HealtheVet, the integrated Electronic Health Record  (iEHR), VistA Evolution, and EHRM—reflect varying approaches that the  department has considered to achieve a modernized health care system.

Figure 1 shows a timeline of the four efforts that VA has pursued to  modernize VistA since 2001.

In 2001, VA undertook its first VistA modernization project, the  HealtheVet initiative, with the goals of standardizing the department’s  health care system and eliminating the approximately 130 different  systems used by its field locations at that time. HealtheVet was scheduled  to be fully implemented by 2018 at a total estimated development and  deployment cost of about $11 billion. As part of the effort, the department  had planned to develop or enhance specific areas of system functionality  through six projects, which were to be completed between 2006 and  2012.

In June 2008, we reported that the department had made progress on the  HealtheVet initiative, but noted concerns with its project planning and  governance. In June 2009, the Secretary of Veterans Affairs announced  that VA would stop financing failed projects and improve the management  of its IT development projects. Subsequently in August 2010, the  department reported that it had terminated the HealtheVet initiative.

In February 2011, VA began its second VistA modernization initiative, the  iEHR program, in conjunction with DOD. The program was intended to  replace the two separate electronic health record systems used by the  two departments with a single, shared system. In addition, because both  departments would be using the same system, this approach was  expected to largely sidestep the challenges that had been encountered in  trying to achieve interoperability between their two separate systems.

Initial plans called for the development of a single, joint iEHR system  consisting of 54 clinical capabilities to be delivered in six increments  between 2014 and 2017. Among the agreed-upon capabilities to be  delivered were those supporting laboratory, anatomic pathology,  pharmacy, and immunizations. According to VA and DOD, the single  system had an estimated life cycle cost of $29 billion through the end of  fiscal year 2029.

However, in February 2013, the Secretaries of VA and DOD announced  that they would not continue with their joint development of a single  electronic health record system. This decision resulted from an  assessment of the iEHR program that the secretaries had requested in  December 2012 because of their concerns about the program facing  challenges in meeting deadlines, costing too much, and taking too long to  deliver capabilities. In 2013, the departments abandoned their plan to  develop the integrated system and stated that they would again pursue  separate modernization efforts.

In December 2013, VA initiated its VistA Evolution program as a joint  effort of VHA and OI&T. The program was to be comprised of a collection  of projects and efforts focused on improving the efficiency and quality of  veterans’ health care, modernizing the department’s health information  systems, increasing the department’s data exchange and interoperability  with DOD and private sector health care partners, and reducing the time it  takes to deploy new health information management capabilities. Further,  the program was intended to result in lower costs for system upgrades,  maintenance, and sustainment. However, VA ended the VistA Evolution  program in December 2018 to focus on its new electronic health record  system acquisition.

In June 2017, VA’s Secretary announced a significant shift in the  department’s approach to modernizing VistA. Specifically, rather than  continue to use VistA, the Secretary stated that the department would  acquire the same electronic health record system that DOD is  implementing. In this regard, DOD awarded a contract to acquire a new  integrated electronic health record system developed by the Cerner  Corporation. According to the Secretary, VA decided to acquire this same  product because it would allow all of VA’s and DOD’s patient data to  reside in one system, thus enabling seamless care between the  department and DOD without the manual and electronic exchange and  reconciliation of data between two separate systems.

According to the Secretary, this fourth VistA modernization initiative is  intended to minimize customization and system differences that currently  exist within the department’s medical facilities, and ensure the  consistency of processes and practices within VA and DOD. When fully  operational, the system is intended to be a single source for patients to  access their medical history and for clinicians to use that history in real  time at any VA or DOD medical facility, which may result in improved  health care outcomes. According to VA’s Chief Technology Officer,  Cerner is expected to provide integration, configuration, testing,  deployment, hosting, organizational change management, training,  sustainment, and licenses necessary to deploy the system in a manner  that meets the department’s needs.

To expedite the acquisition, in June 2017, the Secretary signed a  “Determination and Findings,” for a public interest exception to the  requirement for full and open competition, and authorized VA to issue a  solicitation directly to Cerner. Accordingly, the department awarded a  contract to Cerner in May 2018 for a maximum of $10 billion over 10  years. Cerner is to replace VistA with a commercial electronic health  record system. This new system is to support a broad range of health  care functions that include, for example, acute care, clinical decision  support, dental care, and emergency medicine. When implemented, the  new system will be expected to provide access to authoritative clinical  data sources and become the authoritative source of clinical data to  support improved health, patient safety, and quality of care provided by  VA.

Further, the department has estimated that, as of November 2018, an  additional $6.1 billion in funding, above the Cerner contract amount, will  be needed to fund additional project management support supplied by  outside contractors, government labor costs, and infrastructure  improvements over a 10-year implementation period.

Deployment of the new electronic health record system at three initial  sites is planned for March 2020, with a phased implementation of the  remaining sites over the next decade. Each VA medical facility is  expected to continue using VistA until the new system has been deployed  at that location.

After VA announced in June 2017 that it planned to acquire the Cerner  electronic health record system, we testified in June 2018 that a  governance structure had been proposed that would be expected to  leverage existing joint governance facilitated by the Interagency Program  Office. At that time, VA’s program officials had stated that the  department’s governance plans for the new program were expected to be  finalized in October 2018. However, the officials had not indicated what  role, if any, the Interagency Program Office was to have in the  governance process. This office has been involved in various approaches  to increase health information interoperability since it was established by  the National Defense Authorization Act for Fiscal Year 2008 to function as  the single point of accountability for DOD’s and VA’s electronic health  record system interoperability efforts.

In September 2018, we recommended that VA clearly define the role and  responsibilities of the Interagency Program Office in the governance  plans for acquisition of the department’s new electronic health record  system. The department concurred with our recommendation and stated  that the Joint Executive Committee, a joint governance body comprised of  leadership from DOD and VA, had approved a role for the Interagency  Program Office that included providing expertise, guidance, and support  for DOD, VA, and joint governance bodies as the departments continue to  acquire and implement interoperable electronic health record systems.

However, the department has not yet provided documentation supporting  these actions and how they relate to VA’s governance structure for the  new acquisition. In addition, the role described does not appear to  position the office to be the single point of accountability originally  identified in the National Defense Authorization Act for Fiscal Year 2008.  We continue to monitor the department’s governance plans for the  acquisition of the new electronic health record system and its relationship  with the Interagency Program Office.

The Family Caregiver Program Has Not Been Supported by an Effective IT System

In May 2010, VA was required by statute to establish a program to  support family caregivers of seriously injured post-9/11 veterans. In May  2011, VHA implemented its Family Caregiver Program at all VA medical  centers across the country, offering caregivers an array of services,  including a monthly stipend, training, counseling, referral services, and  expanded access to mental health and respite care. In fiscal year 2014,  VHA obligated over $263 million for the program.

In September 2014, we reported that the Caregiver Support Program  office, which manages the program, did not have ready access to the  types of workload data that would allow it to routinely monitor the effects  of the Family Caregiver Program on VA medical centers’ resources due to  limitations with the program’s IT system—the Caregiver Application  Tracker. Program officials explained that this system was designed to  manage a much smaller program and, as a result, the system has limited  capabilities. Outside of obtaining basic aggregate program statistics, the  program office was not able to readily retrieve data from the system that  would allow it to better assess the scope and extent of workload problems  at VA medical centers.

Program officials also expressed concern about the reliability of the  system’s data. The lack of ready access to comprehensive workload data  impeded the program office’s ability to monitor the program and identify  workload problems or make modifications as needed. This runs counter  to federal standards for internal control which state that agencies should  monitor their performance over time and use the results to correct  identified deficiencies and make improvements.

We also noted in our report that program officials told us that they had  taken initial steps to obtain another IT system to support the Family  Caregiver Program, but they were not sure how long it would take to  implement. Accordingly, we recommended that VA expedite the process  for identifying and implementing a system that would fully support the  Family Caregiver Program. VA concurred with our recommendation and  subsequently began taking steps to implement a replacement system.  However, the department has encountered challenges related to the  system implementation efforts. We have ongoing work to evaluate VA’s  effort to acquire a new IT system to support the Family Caregiver  Program.

Additional Actions Can Improve Efforts to Develop and Use the Veterans Benefits Management System

In September 2015, we reported that VBA had made progress in  developing and implementing VBMS—its system for processing disability  benefit claims—but also noted that additional actions could improve  efforts to develop and use the system. Specifically, VBA had deployed  the initial version of the system to all of its regional offices as of June  2013. Further, after initial deployment, it continued developing and  implementing additional system functionality and enhancements to  support the electronic processing of disability compensation claims.

Nevertheless, we pointed out that VBMS was not able to fully support  disability and pension claims, as well as appeals processing. While the  Under Secretary for Benefits stated in March 2013 that the development  of the system was expected to be completed in 2015, implementation of  functionality to fully support electronic claims processing was delayed  beyond 2015. In addition, VBA had not produced a plan that identified  when the system would be completed. Accordingly, holding VBA  management accountable for meeting a time frame and demonstrating  progress was difficult.

Our report further noted that, even as VBA continued its efforts to  complete the development and implementation of VBMS, three areas  were in need of increased management attention: cost estimating, system  availability, and system defects. We also noted in our report that VBA had  not conducted a customer satisfaction survey that would allow the  department to compile data on how users viewed the system’s  performance and, ultimately, to develop goals for improving the system.

We made five recommendations to improve VA’s efforts to effectively  complete the development and implementation of VBMS. VA agreed with  four of the recommendations. In addition, the department has addressed  one of the recommendations—that it establish goals for system response  time and use the goals as the basis for reporting system performance.

However, the department has not yet fully addressed our remaining  recommendations to (1) develop a plan with a time frame and a reliable  cost estimate for completing VBMS, (2) reduce the incidence of system  defects present in new releases, (3) assess user satisfaction, and (4)  establish satisfaction goals to promote improvement. Continued attention  to these important areas can improve VA’s efforts to effectively complete  the development and implementation of VBMS and, in turn, more  effectively support the department’s processing of disability benefit  claims.

VA Has Demonstrated Uneven Progress toward Implementing Key FITARA Provisions

FITARA included provisions for federal agencies to, among other things,  enhance government-wide acquisition and management of software,  improve the risk management of IT investments, consolidate data  centers, and enhance CIOs’ authorities. Since its enactment, we have  reported numerous times on VA’s efforts toward implementing FITARA.

VA’s progress toward implementing key FITARA provisions has been  uneven. Specifically, VA issued a software licensing policy and has  generated an inventory of its software licenses to inform future investment  decisions. However, the department did not fully address requirements  related to IT investment risk, data center consolidation, or CIO authority  enhancement.

VA has made progress in addressing federal software licensing  requirements. In May 2014, we reported on federal agencies’  management of software licenses and stressed that better management  was needed to achieve significant savings government-wide.  Specifically regarding VA, we noted that the department did not have  comprehensive policies that included the establishment of clear roles and  central oversight authority for managing enterprise software license  agreements, among other things. We also noted that it had not  established a comprehensive software license inventory, a leading  practice that would help the department to adequately manage its  software licenses.

The inadequate implementation of these and other leading practices in  software license management was partially due to weaknesses in the  department’s policies related to licensing management. Thus, we made  six recommendations to VA to improve its policies and practices for  managing licenses. For example, we recommended that the department  regularly track and maintain a comprehensive inventory of software  licenses and analyze the inventory to identify opportunities to reduce  costs and better inform investment decision making.

Since our 2014 report, VA has taken actions to implement all six  recommendations. For example, the department implemented a solution  to generate and maintain a comprehensive inventory of software licenses  using automated tools for the majority of agency software license  spending and/or enterprise-wide licenses. Additionally, the department  implemented a solution to analyze agency-wide software license data,  including usage and costs; and it subsequently identified approximately  $65 million in cost savings over 3 years due to analyzing one of its  software licenses.

VA has made limited progress in addressing the FITARA requirements  related to managing the risks associated with IT investments. In June  2016, we reported on risk ratings assigned to investments by CIOs. We  noted that the department had reviewed compliance with risk  management practices, but had not assessed active risks when  developing its risk ratings.

VA determined its ratings by quantifying and combining inputs such as  cost and schedule variances, risk exposure values, and compliance with  agency processes. Metrics for compliance with agency processes  included those related to program and project management, project  execution, the quality of investment documentation, and whether the  investment was regularly updating risk management plans and logs.

When developing CIO ratings, VA chose to focus on investments’ risk  management processes, such as whether a process was in place or  whether a risk log was current. Such approaches did not consider  individual risks, such as funding cuts or staffing changes, which detail the  probability and impact of pending threats to success. Instead, VA’s CIO  rating process considered several specific risk management criteria:  whether an investment (1) had a risk management strategy, (2) kept the  risk register current and complete, (3) clearly prioritized risks, and (4) put  mitigation plans in place to address risks. As a result, we recommended  that VA factor active risks into its CIO ratings. We also recommended that  the department ensure that these ratings reflect the level of risk facing an  investment relative to that investment’s ability to accomplish its goals. VA  concurred with the recommendations and cited actions it planned to take  to address them.

VA has reported progress on consolidating and optimizing its data  centers, although this progress has fallen short of targets set by OMB.  Specifically, VA reported a total inventory of 415 data centers, of which 39  had been closed as of August 2017. While the department anticipated  another 10 data centers would be closed by the end of fiscal year 2018,  these closures fell short of the targets set by OMB. Further, while VA  reported $23.61 million in data center-related cost savings and  avoidances from 2012 through August 2017, the department did not  realize further savings from the additional 10 data center closures.

In addition, as of February 2017, VA reported meeting one of OMB’s five  data center optimization metrics related to power usage effectiveness.  Also, the department’s data center optimization strategic plan indicated  that VA planned to meet three of the five metrics by the end of fiscal year  2018. Further, while OMB directed agencies to replace manual collection  and reporting of metrics with automated tools no later than fiscal year  2018, the department had only implemented automated tools at 6 percent  of its data centers.

We have recommended that VA take actions to address data center  savings goals and optimization performance targets identified by OMB.  The department has taken actions to address these recommendations,  including reporting data center consolidation savings and avoidance costs  to OMB and updating its data center optimization strategic plan. However,  the department has yet to address recommendations related to areas that  we reported as not meeting OMB’s established targets, including  implementing automated monitoring tools at its data centers.

VA has made limited progress in addressing the CIO authority  requirements of FITARA. Specifically, in November 2017, we reported on  agencies’ efforts to utilize incremental development practices for selected  major investments. We noted that VA’s CIO had certified the use of  adequate incremental development for all 10 of the department’s major IT  investments. However, VA had not updated the department’s policy and  process for the CIO’s certification of major IT investments’ adequate use  of incremental development, in accordance with OMB’s guidance on the  implementation of FITARA, as we had recommended. As of October  2018, a VA official stated that the department was working to draft a  policy to address our recommendation, but did not identify time frames for  when all activities would be completed.

In January 2018, we reported on the need for agencies to involve CIOs in  reviewing IT acquisition plans and strategies. We noted that VA’s CIO  did not review IT acquisition plans or strategies and that the Chief  Acquisition Officer was not involved in the process of identifying IT  acquisitions.

Accordingly, we recommended that the VA Secretary ensure that the  office of the Chief Acquisition Officer is involved in the process to identify  IT acquisitions. We also recommended that the Secretary ensure that the  acquisition plans or strategies are reviewed and approved in accordance  with OMB guidance. The department concurred with the  recommendations and, in a May 2018 update, provided a draft process  map that depicted its forthcoming acquisition process. However, as of  March 2019, this process had not yet been finalized and implemented.

In August 2018, we reported that the department had only fully addressed  two of the six key areas that we identified—IT Leadership and  Accountability and Information Security. The department had partially  addressed IT Budgeting, minimally addressed IT Investment  Management, and had not at all addressed IT Strategic Planning or IT  Workforce. Thus, we recommended that the VA Secretary ensure that the  department’s IT management policies address the role of the CIO for key  responsibilities in the four areas we identified. The department concurred  with the recommendation and acknowledged that many of the  responsibilities provided to the CIO were not explicitly formalized by VA  policy.

VA’s Cybersecurity Management Lacks Key Elements

In December 2018, we reported on the effectiveness of the government’s  approach and strategy for securing its systems. The federal approach  and strategy for securing information systems is prescribed by federal law  and policy, including FISMA and the presidential executive order on  Strengthening the Cybersecurity of Federal Networks and Critical  Infrastructure.

Accordingly, federal reports describing agency implementation of this law  and policy, and reports of related agency information security activities,  indicated VA’s lack of effectiveness in its efforts to implement the federal  approach and strategy. Our December 2018 report identified that the  department was deficient or had material weaknesses in all four  indicators of departments’ effectiveness in implementing the federal  approach and strategy for securing information systems. Specifically, VA  was not effective in the Inspector General Information Security Program  Ratings, was found to have material weaknesses in the Inspector General  Internal Control Deficiencies over Financial Reporting, did not meet CIO  Cybersecurity Cross-Agency Priority Goal Targets, and had enterprises  that were at risk according to OMB Management Assessment Ratings.

We reported on federal high-impact systems—those that hold sensitive  information, the loss of which could cause individuals, the government, or  the nation catastrophic harm—in May 2016. We noted that VA had  implemented numerous controls, such as completion of risk assessments,  over selected systems. However, the department had not always  effectively implemented access controls, patch management, and  contingency planning to protect the confidentiality, integrity and  availability of these high-impact systems. These weaknesses existed in  part because the department had not effectively implemented elements of  its information security program.

We made five recommendations to VA to improve its information security  program. The department concurred with the recommendations and, as of  March 2019, had implemented three of the five recommendations.

Our March 2019 report on the federal cybersecurity workforce indicated  that VA was not accurately categorizing positions to effectively identify  critical staffing needs. The Federal Cybersecurity Workforce  Assessment Act of 2015 required agencies to assign the appropriate work  role codes to each position with cybersecurity, cyber-related, and IT  functions. Agencies were to assign a code of “000” only to positions that  did not perform IT, cybersecurity, or cyber-related functions.

As we reported, VA had assigned a “000” code to 3,008 (45 percent) of its  6,636 IT positions. Human resources and IT officials from the department  stated that they may have assigned the “000” code in error and that they  had not completed the process to validate the accuracy of their codes.

We recommended that VA take steps to review the assignment of the  “000” code to any of the department’s positions in the IT management  occupational series and assign the appropriate work role codes. VA  concurred with the recommendation and indicated that it was in the  process of conducting a cyber coding review.

In conclusion, VA has long struggled to overcome IT management  challenges, which have resulted in a lack of system capabilities needed to  successfully implement critical initiatives. In this regard, VA is set to begin  deploying its new electronic health record system in less than 1 year and  questions remain regarding the governance structure for the program.  Thus, it is more important than ever for the department to ensure that it is  managing its IT budget in a way that addresses the challenges we have  identified in our previous reports and high-risk updates. If the department  continues to experience the challenges that we have previously identified,  it may jeopardize its fourth attempt to modernize its electronic health  record system.

Additionally, the department has been challenged in fully implementing  provisions of FITARA, which has limited its ability to improve its  management of IT acquisitions. Until the department implements the act’s  provisions, Congress will be unable to effectively monitor VA’s progress  and hold it accountable for reducing duplication and achieving cost  savings. Further, the lack of key cybersecurity management elements at  VA is concerning given that agencies’ systems are increasingly  susceptible to the multitude of cyber-related threats that exist. As VA  continues to pursue modernization efforts, it is critical that the department  take steps to adequately secure its systems.

Chair Lee, Ranking Member Banks, and Members of the Subcommittee,  this completes my prepared statement. I would be pleased to respond to  any questions that you may have.

If you or your staffs have any questions about this testimony, please  contact Carol C. Harris, Director, Information Technology Management  Issues, at (202) 512-4456 or harrisc@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this testimony statement. GAO staff who made key  contributions to this testimony are Mark Bird (Assistant Director), Eric  Trout (Analyst in Charge), Justin Booth, Rebecca Eyler, Katherine Noble,  Scott Pettis, Christy Tyson, and Kevin Walsh.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

This testimony discusses our work on information technology challenges at the Department of Veterans Affairs.

Despite spending over $4 billion annually on IT:

VA still doesn't have IT systems that fully support critical services—e.g., veterans health care, the Family Caregiver Program, and disability benefits.

Some VA IT management processes do not effectively implement federal IT acquisition law, making congressional oversight of IT acquisitions more difficult.

Cybersecurity management has weaknesses, which increase vulnerability to cyber threats.

VA health care and federal IT acquisitions are also on our High Risk List.


VA Health IT: Use of Acquisition Best Practices Can Improve Efforts to Implement a System to Support the Family Caregiver Program

To provide greater support for caregivers of post-9/11 veterans, Congress and the President enacted legislation requiring VA to establish a program to assist caregivers with the rigors of caring for seriously injured veterans. In May 2011, the Veterans Health Administration (VHA), which operates VA's health care system, established the Family Caregiver Program at each of its VA medical centers across the United States. At that time, the department implemented an IT system, called CAT, to help support the program. Subsequently, the VA MISSION Act was enacted in June 2018, requiring VA to implement an IT system to fully support the Family Caregiver Program by October 1, 2018. Further, VA's Secretary is to certify the system by October 1, 2019.

GAO was asked to discuss its September 2014 report that examined how VHA is implementing the Family Caregiver Program. In addition, the statement includes relevant information VA provided on its actions toward addressing GAO's prior recommendation. The statement also discusses critical success factors related to IT acquisitions as identified in GAO's prior work. The reports cited throughout this statement include detailed information on the scope and methodology of GAO's prior reviews.

In September 2014, GAO reported on the Department of Veterans Affairs' (VA) Program of Comprehensive Assistance for Family Caregivers (Family Caregiver Program) and found that the program office had limitations with its information technology (IT) system—the Caregiver Application Tracker (CAT). Specifically, the program did not have ready access to workload data that would allow it to monitor the effects of the program on VA medical centers' resources. VA has initiated various projects since 2015 to implement a new system, but has not yet been successful in its efforts. (See figure.) Specifically, in July 2015 VA initiated a project to improve the reliability of CAT's data, called CAT Rescue. However, the department reported in January 2017 that it had identified numerous defects during system testing. The project ended in April 2018 before any new system capabilities were implemented. A companion project was initiated in September 2015 to develop the Caregivers Tool (CareT), a new system intended to replace CAT. The CareT project was expected to use improved data from CAT Rescue, while also adding new system capabilities. However, the user acceptance testing of CareT identified the need for the department to develop more system capabilities than originally planned. Further, VA reported that implementing a system by October 1, 2018, as specified in the Maintaining Internal Systems and Strengthening Integrated Outside Networks Act of 2018 (MISSION Act), was not feasible. Subsequently, VA terminated CareT in February 2019. The department initiated another project in March 2019 to implement a new system, the Caregiver Record Management Application (CARMA). GAO has ongoing work to evaluate the department's efforts to implement an IT system to support the Family Caregiver Program as required by the MISSION Act.

GAO's prior work has determined that successfully overcoming IT acquisition challenges can best be achieved when critical success factors are applied. These factors can serve as a model of best practices that VA could apply to enhance the likelihood that the acquisition of a replacement IT system for the Family Caregiver Program will be successfully achieved. Examples of these critical success factors include, maintaining active engagement of program officials with stakeholders, involving end users and stakeholders in the development of requirements, and ensuring participation of end users in testing system functionality prior to formal end user acceptance testing.

GAO recommended in 2014 that VA expedite the process for identifying and implementing an IT system that would fully support the Family Caregiver Program. VA concurred with the recommendation and subsequently began taking steps to implement a replacement system. The recommendation remains open.

Thank you for the opportunity to participate in today’s hearing regarding  the Department of Veterans Affairs’ (VA) efforts to implement an  information technology (IT) system to support the management and  execution of its Program of Comprehensive Assistance for Family  Caregivers (Family Caregiver Program).

To provide greater support for caregivers of post-9/11 veterans, Congress  and the President enacted legislation in May 2010 requiring VA to  establish a program to assist caregivers with the rigors of caring for  seriously injured veterans. In May 2011, the Veterans Health  Administration (VHA), which operates VA’s health care system,  established the Family Caregiver Program at each of its VA medical  centers (VAMC) across the United States.

At that time, the department implemented an IT system, called the  Caregiver Application Tracker (CAT), to help support the program.  However, we reported in September 2014 that CAT, which is still in use  today, had limitations and recommended that VA expedite the  implementation of a replacement system.

As you requested, my statement today summarizes findings from our  September 2014 report that discussed VA’s implementation of the Family  Caregiver Program. This statement also includes relevant information that  VA provided on its actions toward addressing our prior recommendation.  Further, my statement discusses critical success factors related to major  IT acquisitions identified in our prior work. We have previously reported  that these success factors could enhance the likelihood that an IT  acquisition will be successful. The reports cited throughout this statement  include detailed information on the scope and methodology of our prior  reviews.

We conducted the work on which this statement is based in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on  our audit objectives.

VHA’s Family Caregiver Program is designed to provide support and  services to family caregivers of post-9/11 veterans who have a serious  injury that was incurred or aggravated in the line of duty. The program  provides approved primary family caregivers with a monthly financial  stipend as well as training and other support services, such as counseling  and respite care.

The Family Caregiver Program has a series of eligibility requirements that  must be satisfied in order for family caregivers to be approved.

To meet the program’s initial eligibility criteria, the veteran seeking  caregiver assistance must have a serious injury that was incurred or  aggravated in the line of duty on or after September 11, 2001.  According to the program’s regulations, a serious injury is any injury,  including traumatic brain injury (TBI), psychological trauma, or other  mental disorder, that has been incurred or aggravated in the line of  duty and renders the veteran or servicemember in need of personal  care services.

The veteran must be in need of personal care services for a minimum  of 6 continuous months based on any one of the following clinical  eligibility criteria: (1) an inability to perform one or more activities of  daily living, such as bathing, dressing, or eating; (2) a need for  supervision or protection based on symptoms or residuals of  neurological or other impairment or injury such as TBI, post-traumatic  stress disorder, or other mental health disorders; (3) the existence of  a psychological trauma or a mental disorder that has been scored by  a licensed mental health professional, with a Global Assessment of  Functioning score of 30 or less, continuously during the 90-day  period immediately preceding the date on which VHA initially received  the application; or (4) the veteran has been rated 100 percent service  connected disabled for a qualifying serious injury and has been  awarded special monthly compensation that includes an aid and  attendance allowance.

To be considered competent to care for the veteran, family caregivers  must meet certain requirements including (1) having the ability to  communicate and follow details of the treatment plan and instructions  related to the care of the veteran; (2) not determined by VA to have  abused or neglected the veteran; (3) being at least 18 years of age;  and (4) either being a family member—such as a spouse, son or  daughter, parent, step-family member, or extended family member— or an unrelated person who lives or will live full-time with the veteran.

Family caregivers must also complete required training before being  approved for the program.

Family Caregiver Program Organizational Structure

VHA’s Caregiver Support Program office is responsible for developing  policy and providing guidance and oversight for the Family Caregiver  Program. It also directly administers the program’s stipend, provides  support services such as a telephone hotline and website, and arranges  coverage through the Civilian Health and Medical Program of the  Department of Veterans Affairs (CHAMPVA) for eligible caregivers if they  have no other coverage.

Further, the office provides funding to VAMCs to cover certain program  costs. These costs may include the salaries of the caregiver support  coordinators (CSC), who implement and administer the Family Caregiver  Program at the local VAMC level, and the costs VAMCs incur for having  their clinical staff, such as nurses, conduct the program’s required in- home visits to approved caregivers and their veterans.

CSCs are generally licensed social workers or registered nurses, and  they have both clinical and administrative responsibilities. Their clinical  responsibilities may include identifying and coordinating appropriate  interventions for caregivers or referrals to other VA or non-VA programs,  such as mental health treatment, respite care, or additional training and  education. Their administrative responsibilities may include responding to  inquiries about the program, overseeing the application process, entering  information about applications and approved caregivers into IT systems,  and facilitating the processing of appeals.

As of May 2014, there were 233 CSCs assigned to 140 VAMCs or health  care systems across the country. Additionally, each regional VISN office  has a VISN CSC lead for the program, who provides guidance to CSCs  and helps address their questions or concerns.

GAO Has Previously Reported on the Family Caregiver Program IT System Limitations

CAT, which was deployed in May 2011, is a web-based system that was  designed to facilitate the exchange of information about approved  caregivers between VAMCs and other VHA entities. Such entities include  the Health Administration Center, which processes the caregiver stipend  payments and administers CHAMPVA.

In 2014, we reported that the Caregiver Support Program office was not  able to easily retrieve data from CAT that would allow officials to better  assess workload trends at individual VAMCs—such as the length of time  applications are delayed or the timeliness of home visits—even though  these data were already captured in the system. Caregiver Support  Program officials only retrieved workload data on an ad hoc, as-needed  basis, which limited their ability to assess the scope and extent of  workload problems comprehensively at individual VAMCs and on a  system-wide basis. Program officials also expressed concern about the  reliability of the system’s data.

As we noted in our report, program officials also identified the need for a  more capable and flexible system that could interface with other  departmental systems. The officials told us that they had taken initial  steps to obtain another IT system to support the Family Caregiver  Program; however, the officials were not sure how long it would take to  implement the system. Accordingly, we recommended that VA expedite  the process for identifying and implementing a system that would fully  support the Family Caregiver Program.

VA concurred with our recommendation and subsequently began taking  actions in 2015 to implement a replacement system. These actions  included taking steps toward implementing short-term improvements to  CAT that were to be followed by the implementation of a long-term  replacement system. The recommendation continues to remain open.

Statute Directs VA to Implement an IT System to Support the Family Caregiver Program

The John S. McCain III, Daniel K. Akaka, and Samuel R. Johnson VA  Maintaining Internal Systems and Strengthening Integrated Outside  Networks Act of 2018 (VA MISSION Act), which was enacted in June  2018, included provisions directing VA to implement an IT system to  support the Family Caregiver Program and the incremental expansion of  program eligibility. Specifically, the act required VA to implement an IT  system to fully support the Family Caregiver Program by October 1, 2018.  According to the act, the system is to allow for data assessment and  comprehensive monitoring of the program. In particular, the system is to  have, among other things, the ability to (1) retrieve data to monitor  workload trends at the medical center and aggregate levels; (2) manage  an increased number of caregivers as the program expands; and (3)  integrate with other relevant IT systems at VHA.

The act also stated that VA was to submit an initial report to Congress  regarding the status of the planning, development, and deployment of this  system within 90 days of enactment of the VA MISSION Act, and that the  department is to submit a final report to Congress by October 1, 2019.  The final report is to include a certification by the VA Secretary that the  system has been implemented, along with a description of how the  Secretary is using the system to monitor the workload of the program.

VA Has Not Yet Implemented an IT System That Effectively Supports the Family Caregiver Program

Although we previously recommended that VA expedite implementation  of a replacement for CAT, and the MISSION Act directed the department  to implement an IT system to support the Family Caregiver Program, VA  has not yet been successful in its multiple efforts to implement such a  system. Specifically, VA has faced a number of difficulties in developing  and implementing short-term improvements as well as a long-term  replacement system for CAT.

In July 2015, VHA and the Office of Information and Technology (OIT)  initiated a joint acquisition project, called CAT Rescue, to update CAT  and improve the system’s data reliability. However, the department  reported in January 2017 that this project had experienced delays and  identified a large number of defects during system testing. VA terminated  the project in April 2018 before any new system capabilities were  implemented.

A companion project to CAT Rescue that VA initiated in September 2015  was to develop the Caregivers Tool (CareT), a new system intended to be  a long-term replacement for CAT. As envisioned, this system was to use  the improved data from CAT Rescue while also adding new system  capabilities. However, the user acceptance testing of CareT identified the  need for the department to develop more system capabilities than  originally planned. Further, the department determined that the time  period needed to perform additional system development would have  extended beyond the term of the development contract, which ended in  April 2017.

VA subsequently awarded a new CareT development contract in July  2017. However, after additional system development, the department  determined during user acceptance testing that the system was not  performing as expected and implementation of CareT was further  delayed. In October 2018, the department reported to congressional  committees that implementing a system to fully support the Family  Caregiver Program by the VA MISSION Act deadline was not feasible.  Subsequently, the department determined that CareT was not a viable  solution and VHA and OIT terminated work on the system in February  2019.

VHA and OIT began a third effort in March 2019 to acquire a replacement  system that is to be based on an existing commercial product. According  to OIT officials, the new IT solution, referred to as the Caregiver Record  Management Application (CARMA), is intended to replace CAT. However,  the department has not yet established a date for completing CARMA.

Thus, VA’s efforts to implement an IT system that supports the Family  Caregiver Program have been continuing with no end in sight. We have  ongoing work to further evaluate the status and progress of the  department’s efforts to implement a system to support the Family  Caregiver Program consistent with the VA MISSION Act requirements.  Figure 1 provides a timeline of the various IT projects that VA has  undertaken to support the program.

Critical Factors Underlying Successful IT Acquisitions

Our prior work has determined that successfully overcoming IT  acquisition challenges can best be achieved when critical success factors  are applied. Specifically, we reported in 2011 on common factors critical  to the success of IT acquisitions, based on seven agencies having each  identified the acquisition that best achieved the agency’s respective cost,  schedule, scope, and performance goals. These factors remain relevant  today and can serve as a model of best practices that agencies can apply  to enhance the likelihood that the acquisition of an IT system such as  CARMA will be successfully achieved.

Among the agencies’ seven IT investments, agency officials identified  nine factors as having been critical to the success of three or more of the  seven investments. These nine critical success factors are consistent with  leading industry practices for IT acquisition. The factors are:

Active engagement of program officials with stakeholders.

Qualified and experienced program staff.

Support of senior department and agency executives.

Involvement of end users and stakeholders in the development of  requirements.

Participation of end users in testing system functionality prior to formal  end user acceptance testing.

Consistency and stability of government and contractor staff.

Prioritization of requirements by program staff.

Regular communication maintained between program officials and the  prime contractor.

Officials for all seven selected investments cited active engagement with  program stakeholders—individuals or groups (including, in some cases,  end users) with an interest in the success of the acquisition—as a critical  factor to the success of those investments. Agency officials stated that  stakeholders, among other things, reviewed contractor proposals during  the procurement process, regularly attended program management office  sponsored meetings, were working members of integrated project  teams, and were notified of problems and concerns as soon as  possible. Further, officials from two investments noted that actively  engaging with stakeholders created transparency and trust, and  increased the support from the stakeholders.

Additionally, officials for six of the seven selected investments indicated  that the knowledge and skills of the program staff were critical to the  success of the program. This included knowledge of acquisitions and  procurement processes, monitoring of contracts, large-scale  organizational transformation, Agile software development concepts,  and areas of program management such as earned value management  and technical monitoring.

Finally, officials for five of the seven selected investments identified  having the end users test and validate the system components prior to  formal end user acceptance testing for deployment as critical to the  success of their program. Similar to this factor, leading guidance  recommends testing selected products and product components  throughout the program life cycle. Testing of functionality by end users  prior to acceptance demonstrates, earlier rather than later in the program  life cycle, that the functionality will fulfill its intended use. If problems are  found during this testing, programs are typically positioned to make  changes that would be less costly and disruptive than ones made later in  the life cycle.

In conclusion, VA has invested considerable time in multiple efforts  toward improving and replacing its IT system to better serve the Family  Caregiver Program. However, even with these efforts, the department has  not yet implemented a system and the program is not prepared for  expansion. Going forward, it is important that VA take steps to improve its  efforts to implement a replacement IT system for the Family Caregiver  Program. In this regard, the department could benefit from applying  critical success factors we previously reported as leading to successful  federal IT acquisitions. These factors can serve as a model of best  practices that the department can apply to enhance the likelihood that its  effort to replace the IT system for the Family Caregiver Program will be  successful.

Chairs Lee and Brownley, Ranking Members Banks and Dunn, and  Members of the Subcommittees, this completes my prepared statement. I  would be pleased to respond to any questions that you may have.

If you or your staffs have any questions about this testimony, please  contact Carol C. Harris, Director, Information Technology Management  Issues, at (202) 512-4456 or harriscc@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this testimony statement. GAO staff who made key  contributions to this testimony are Mark Bird (Assistant Director),  Rebecca Eyler, Jacqueline Mai, Monica Perez-Nelson, Scott Pettis, and  Jennifer Stavros-Turner (Analyst in Charge).

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

The Veterans Administration established the Family Caregiver Program in 2011 to help families provide care to seriously injured veterans. It developed an IT system to help it run this program but the system has many problems.

We reported on these problems in 2014. For example, the system does not provide VA with data that would enable the agency to monitor how the Family Caregiver Program affects its medical centers' resources. We recommended the VA address these problems.

We testified about our prior and ongoing work related to this system. We also testified about steps VA has taken to fix the system and the problems with it that persist.