Medium Rare, Again
On September 29 the VA Office of Inspector General released its fiscal year 2026 risk assessment of the department’s charge card programs, and the headline is one VA has been collecting for years. The purchase card program, which pushed about $6.5 billion through roughly 6.2 million transactions between April 2025 and March 2026, is rated medium risk for illegal, improper, or erroneous purchases. That is a repeat finding. Medium is also where the OIG placed the program in its FY2018, FY2020 and FY2023 assessments, the first two describing it as unchanged from the year before. At this point medium is less a rating than a residence.
The travel card program also rates medium, up from low in 2023, though the OIG cautions that the two assessments used different periods and criteria. The fleet card program stays low at about $17.4 million. The OIG is careful to say that medium does not indicate widespread fraud, and that its team analyzed summary data rather than individual transactions. Fair enough. The more interesting question is not what the cards bought. It is who was supposed to be watching.
Nineteen People and a Very Large Inbox
VA policy generally limits an approving official to 25 purchase card accounts and lets prosthetics approving officials oversee as many as 40. The OIG found 19 prosthetics approving officials over that ceiling. Those 19 were responsible for about 923,000 transactions, 15 percent of the entire program, and about $864 million, 13 percent of spending. A further 115 approving officials exceeded the standard limit of 25 accounts and were responsible for about 772,000 transactions and $660.9 million.
Some arithmetic the report does not do for you. Spread evenly across 19 people, which real caseloads rarely honor, that is roughly 48,600 transactions and $45 million apiece over the year, or about 190 transactions per official per business day. Add the OIG’s counts of standard and prosthetics approving officials and you get 3,871, which means the 134 over-limit officials, about 3.5 percent of the total, sit atop nearly a quarter of the program’s dollars. Whatever reviewing 190 purchases a day looks like, it is not the review the policy has in mind.
The rule itself is oddly built. The OIG notes that VA’s policy caps accounts rather than account holders, while GSA guidance as the OIG describes it calls for a reasonable number of account holders and a volume of transactions an official can review in a timely manner. Meanwhile the ground shifted underneath. Between the prior 12 months and the assessment period, cardholders fell about 14 percent (10,513 to 9,058) and cards fell about 26 percent (18,013 to 13,332), while transactions dipped 4 percent and charges rose 5 percent, from $6.17 billion to $6.45 billion. The OIG ties the decline in cards to a February 2025 executive order and says the concentration does not show improper activity but may raise oversight risk. The number of approving officials actually grew, from 2,989 to 3,083 for standard cards and from 745 to 788 for prosthetics, so headcount alone does not explain why 134 of them are overloaded. The report does not say why.
One caution the OIG’s own numbers demand. The report does not say that any prosthetics purchase in the period was improper. The risk it describes is capacity, and capacity is the kind of problem that stays invisible until someone counts. It is also not a theoretical risk for this account type. In 2019 a Houston VA prosthetics representative pleaded guilty to conspiracy after generating purchase orders for fictitious goods and services and paying them with a government credit card.
A Watchdog Without a Dashboard
The OIG’s central governance finding is that VA lacked an agencywide monitoring control to consolidate oversight results, spot recurring problems across components, and track corrective actions through verified completion. The consequence is that VA leaders had limited ability to tell whether recurring deficiencies were isolated or widespread, or whether the fixes worked. Responsibility is split. The Financial Services Center monitors nationally and flags potential violations, regional and facility officials carry out corrective action and discipline, and reviews by VA’s Office of Business Oversight were not consistently shared or integrated across those entities. A Financial Services Center official told the OIG that the Charge Card Management Plan is used mainly as a reference, not to track compliance. So VA has a plan, and the plan is a book.
The data VA does collect leans the wrong way. VHA’s quarterly quality assurance reviews found more of the same in the first quarter of FY2026 than a year earlier, with late cardholder approvals rising from 2 percent to 3 percent, late approving official authorizations from 3 percent to 4 percent, and missing or incomplete documentation from 5 percent to 7 percent. None of that necessarily means misuse, as the OIG notes. But the Office of Business Oversight’s FY2025 testing of sampled transactions reported only four exceptions, one late reconciliation and three wrong budget object codes, while the OIG’s own statistical sample of November 2025 transactions found violations similar to those in earlier inspections. Different samples, different months, different conclusions. That is precisely why a program needs one place where the results are laid side by side.
What Weak Review Buys
The OIG offers two prosecutions as illustrations of what thin review permits. At the Philadelphia VA Medical Center, a scheme built on a shell company and fabricated invoices for heating and air conditioning work that was never performed produced 22 wire-fraud transactions and more than $565,000 in payments before anyone caught it; the defendant drew 64 months. At the Cleveland VA Medical Center, a logistics employee in the Blind Rehabilitation Unit used a purchase card to buy more than $198,000 in iPads, iPhones, and other electronics, keeping some and reselling the rest. According to the investigating agent, the misconduct continued because purchases stayed under the micropurchase threshold while officials did not check necessity or separate buying from receiving; two defendants were each sentenced to 12 months and a day.
That threshold just moved. On October 1, 2025 the micropurchase limit rose from $10,000 to $15,000 under a federal inflation adjustment, squarely inside the assessment period. The OIG’s analytics flagged 43,931 potential split purchase transactions worth almost $210 million, about 1 percent of transactions and just over 3 percent of dollars. Those are patterns consistent with splitting, not confirmed splits, and the OIG rated the category low. But a higher ceiling changes what “just under” means, and the review capacity described above has not obviously grown to match.
The travel card program shows the same problem in miniature. Cardholders fell from 23,301 to 11,072 and charges from $44.7 million to $22.4 million, yet the rating rose to medium, on the strength of flags such as roughly 30,200 hotel transactions over $2,000 with no other purchases within five days, worth about $13.7 million, a category the OIG rated high. The OIG did not review the individual transactions, so the figure is a tripwire and not a verdict. A tripwire is supposed to be followed by someone walking over to look.
The OIG says its audit and investigations offices will weigh these ratings when planning future work on whether recurring card deficiencies are being addressed. VA acknowledged the results when briefed in August and offered clarifying information, and the report does not say what that information was. Somewhere in the department, 19 people are still holding $864 million in oversight responsibility, and the reassurance on offer is that nothing here proves anything went wrong. That is true, and it is exactly the trouble with a system in which nothing could prove anything either way.
