Internal Controls for the Veterans Administration Computer-Based Compensation and Pension Benefit Payment System
MWD-76-90: Published: Feb 6, 1976. Publicly Released: Feb 6, 1976.
- Full Report:
Limited testing and observation were performed at the Veterans Administration (VA) Data Processing Center at Hines, Illinois, and three VA regional offices to determine whether control methods and procedures used at those facilities were adequate to assure accurate, complete, and valid processing of benefit payments and related transactions. An inquiry was also made into the extent of internal audit coverage of computer processing controls. Findings based on observations at the regional offices were discussed in an earlier report.
The survey raised questions concerning the effectiveness of programming for controls to assure the completeness and accuracy of processing transactions by the VA computer-based compensation and pension (C&P) benefit payment system at the Hines center. GAO found that: (1) data produced by programmed control routines did not assure that transactions and benefit calculations were processed completely and accurately; (2) a project to resolve discrepancies in control data was given a low priority; (3) revision of programs was not routinely accompanied by revision of control routines to insure their continuing effectiveness; (4) alternative control procedures were not adequately documented; and (5) internal processing controls had not been evaluated by the Internal Audit Service. The apparent lack of attention to resolving discrepancies in control data and in documenting control procedures increased the risk of vulnerability of the system to undetected error and misuse.
Recommendation for Executive Action
Comments: Please call 202/512-6100 for additional information.
Recommendation: The Administrator of Veterans Affairs should direct the Chief Data Management Director to evaluate C&P system controls to: (1) resolve the discrepancies in control data reflecting the results of processing; (2) document the existing system of controls relied upon to assure the reliability of processing; and (3) assure that the Internal Audit Service monitors the adequacy of controls in the C&P system and the successor system currently under development.