Auditor blasts VA for poor IT management and oversight

The Veterans Affairs Department does not have the ability to manage and ensure effective oversight of its investments in information technology, which will total about $3.5 billion in fiscal 2010, the department's inspector general said in a report released on May 29.

Until the department's Office of Information and Technology develops procedures to better manage IT projects, VA will have little assurance that it has made the appropriate investment decisions and that it will make the best use of its IT dollars, the IG reported.

The report traced the management and oversight problems to 2006, when Robert McFarland, then the chief information officer at VA, changed the department's management of IT from a decentralized model to a centralized one. VA's IT budget decisions were brought under the leadership of the CIO, who also holds the title of assistant secretary for information and technology.

Under the old system, individual VA hospitals could, for example, change applications used in the Veterans Health Information System and Technology Architecture electronic health record system, making it difficult to build a system that worked across the department. Under the centralized system, changes are made and managed out of the CIO headquarters shop.

But the CIO office managed the transition to a centralized IT management model on an "ad hoc or on a trial-and-error basis, inadvertently creating an environment with relaxed management controls and inadequate oversight," the report said. Although the switch amounted to a "significant undertaking," the IG said the transition lacked a written plan.

But McFarland said the transition was backed up by a written plan developed in-house. IBM developed another plan under contract. The IG's criticism was a "silly, untrue and uninformed statement," he said, adding the auditor did not do adequate research before the release of the report.

The IG also criticized VA's management of individual IT projects. Poor management and oversight "substantially increased the risk" that key systems, such as the $167 million Replacement Scheduling Application, which will manage appointments in VA medical facilities, will not meet cost, schedule or performance goals, according to the report.

IT management is in such disarray that the Office of Information and Technology missed the Sept. 8, 2008, deadline to file a report on its fiscal 2010 IT capital investments and on its business cases for It projects, known as Exhibit 300s, the IG said. The report added that there was a 50 percent chance the department would be late in submitting its Exhibit 300s for fiscal 2011.

The CIO office should develop a written plan that sets measurable goals for centralized management of IT investments and establishes an IT governance plan, the IG recommended. The office also should meet the deadline to file Exhibit 300s.

Stephen Warren., principal deputy assistant secretary at VA, concurred with the recommendations and said the department has instituted an IT capital governance process that includes setting priorities for investments in, for example, health, benefits and financial systems.

Oversight of the Replacement Scheduling Application was not as "timely as it should have been," he said, but the project was finally "flagged as a risk" this January. The assertion that the Office of Information and Technology could miss the deadline for filing fiscal 2011 Exhibit 300s is "purely speculative" and the office wants to meet that deadline, Warren said. The report did not include the fact that the office had negotiated with the Office of Management and Budget an extension on filing of the fiscal 2010 documents.

John Weiler, executive director of the Interoperability Clearinghouse, a nonprofit in Alexandria, Va., that works with VA, said the problems with management and oversight of IT investments are endemic throughout the government and indicative of a disconnect between planning and execution of IT projects.