top of page

Smoke and Mirrors: How No-Assurance Hides in the Federal Government

  • Writer: Natalie Bulger
    Natalie Bulger
  • 3 days ago
  • 24 min read
Part 3 of the Messy Monday Fraud Series

In 2022, in a health system of more than 300,000 employees, there was an oversight job that officially had one person doing it.


Not one team. Not one office. One person whose job it was to coordinate the entire internal controls assessment for Veterans Health Administration. An organization with a budget request of $123 billion in fiscal year 2023. One person, working with volunteers borrowed from other offices, trying to document whether the controls over that money were actually working.


They weren't. We suspected it in 2022. By 2023 it was confirmed. Not because we uncovered something hidden, but because when we went looking for documentation, but found amongst piles of paperwork, there was almost none that answered the ask at hand. Programs may have been doing genuinely good work, but the pieces were like confetti when we tried to put it together. Somehow everywhere and nowhere at once. Knowledge lived in one person's sphere and never traveled beyond it, and may have never made it into formal records at all. When we asked who owned the controls, programs said not us, yet the policies those program wrote stated otherwise. When we found people doing remarkable things, however those nuggets of goodness existed in a vacuum so small they might as well have been invisible to the rest of the organization. There was no agreed-upon risk assessment framework. No reporting structure. No feedback loop. No person or group empowered to look upstream and downstream at the same time, because the infrastructure that would make that possible had never been built.


This is not a story about failures in this administration or the last one. This is a story about what happens when you treat broken bones like paper cuts for long enough that the bones eventually stop being fixable with anything short of surgery.

I know because I eventually helped build the surgical team. I wielded the scalpel. We were mid-procedure — instruments in hand, patient on the table, making real progress — when someone kicked the door open, swung a sledgehammer, and never once stopped to ask what operation was underway. They just told us to sew the patient back up and let him go. He was no longer ours to worry about.


How I Got There

In 2022, the employee coordinating the internal controls assessment resigned. The tasks he had been managing were reassigned to me. I was the best aligned person available to take them on. The assignment came from VHA leadership. It wasn't a formal promotion. It wasn't a new position with resources attached. It was a hand-off of an impossible job to the next person voluntold to hold it.


A formal position would later be developed. I applied and was hired into that role in January 2023. I was authorized to operate under delegation authorities to compile the internal controls assessment on behalf of the Veterans Health Administration. But even that authority was often not honored or understood. This was just another check the box assignment with no teeth behind consequences if not done right. What I was discovering by then, was that the people who needed to hand me information often didn't believe they were responsible for controls in the first place and certainly were not offering up who they thought the responsible party actually was.


There were people across VHA with "risk" in their job titles. But they were not doing enterprise risk management. They were not doing internal controls work, nor were they expected to, they were tasked with clinical risk efforts like tort claim navigation. They had the misfortune of holding title with a word whose definition had taken on new meaning. While Enterprise Risk Management and Internal Controls existed in name, the infrastructure did not.


We would identify programs doing genuinely excellent work — and find that none of it had ever been documented in a way that left the room it was created in. The array of best practice and promising practice presentations looks great on the calendar and in PowerPoints, but often failed to be solidified in a way that could note them as true controls. If the person who built it left, the knowledge left with them. Think of it like putting every step of your recipe on a different piece of paper. Eventually, you're left with just the temperature to bake on and two of the ten ingredients. A literal recipe for failure.


The academic arguments bogged us down too. Financial controls versus operational controls. Who owned what. Battles over whether a control that lived in one office could or should be assessed by another. People protecting their lanes while the overall system had no lane markings at all. The office responsible for deploying the new electronic health record sat on a call and told me and my team that they would report their own information, there was no need to collaborate with VHA leadership and staff who actually were detecting and attempting to report the failures in the mega system being rolled out. That leader soon exited the organization after a disasterous Congressional hearing but the partnership didn't then suddenly appear. It was clear the biggest change we needed wasn't all technical. It was cultural too. And culture change in a $123 billion health system doesn't happen because one person writes a framework.

Sources: VA FY2023 Budget Request; GAO-25-106969


What the Audit Already Told Us

The public record on VHA's internal controls is not ambiguous. It has not been ambiguous for a long time.


The FY2024 independent audit of VA's financial statements which was conducted by CliftonLarsonAllen on behalf of the VA OIG, identified three material weaknesses and three significant deficiencies in internal controls. A material weakness means there is a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected and corrected on a timely basis. That's not a bureaucratic technicality.


That's auditors saying in formal language: the controls are not working well enough to catch problems before they become serious.

The IT security controls material weakness has been reported for more than ten years. The financial systems material weakness, the accounting estimates weakness, has been reported since at least 2016 and came to a head in 2024 during a budget request issue that played out on CSPAN in front of the nation. Noncompliance with the Federal Financial Management Improvement Act has been reported in part for more than ten years. Potential violations of the Antideficiency Act — reported for over ten years.


Every year, someone signed an Assurance Statement. Every year, the auditors documented the same material weaknesses. And every year, VA received its "clean" audit opinion anyway — and celebrated it.

The Secretary's letter in the FY2024 Agency Financial Report opens by announcing VA's 26th consecutive unmodified audit opinion as evidence of financial management excellence. I was inside the building during multiple of those years. I know what we were looking at. A clean opinion on the financial statements and broken internal controls are not mutually exclusive. The auditors will tell you so themselves — in the same document. The question is whether anyone is paying attention to both pages.


GAO confirmed in a 2024-2025 report that over recent years VHA had only partially followed each of its six leading practices for managing risk — including failing to comprehensively identify risks across its health care system. GAO found that VHA officials (I was one of them) acknowledged there needed to be more clarity about how to implement risk management across the agency. In 2024, VHA reorganized specifically to address the overlap and fragmentation of oversight responsibilities — and GAO found the reorganization highlighted the need for a workforce plan because the offices still lacked adequate staff. I helped write the action plan that responded to this report. I was open and honest about where we were and where we hoped to go. I had faith that we would actually close these recommendations if truly empowered to do so.


As was the usual practice, that reorg referenced had been spearheaded behind closed-door by a limited set of leaders. To my knowledge there was no risk assessment to inform the root causes and chronic gap and no clear linkage to strategic goals other than calls for effiency and alignment. It meant longer hiring pauses while people and roles were moved to new divisions. It meant supporting federal employees on their third shuffling of the deck chairs in two years, employees who questioned what they were really doing each day. It meant rebuilding relationships with oversight bodies that had been contentious and adversarial for years over things as simple as how a report title was written.


We knew all of this. We were living all of this. The question was what you did with it. It equated to a bad rip off of a Jackson Pollock painting, people saying "it means something if you just look at it this way" meanwhile it was simply another scattering of duties hoping it would work out.


Sources: VA OIG Audit of VA's Financial Statements for Fiscal Years 2024 and 2023; VA FY2024 Agency Financial Report; GAO-25-106969


The Statement

Under OMB Circular A-123, the federal government's foundational internal controls framework, there is a requirement for the head of each executive branch agency is required to annually certify the state of the agency's internal controls in a Statement of Assurance. Three options.

  • A clean statement: controls are working.

  • A modified statement: controls are working, except for these specific material weaknesses.

  • Or a Statement of No Assurance: the agency cannot certify that its controls are working at all.


The no-assurance option exists because the people who designed this system understood that there would be moments when the honest answer was: we don't know, and what we do know isn't good. They built the mechanism to force that honesty into the public record to Congress, to OMB, to the American people.


Other federal organizations have used it, though it is rare. The Department of the Navy's Statement of Assurance framework explicitly provides for all three options, and the Navy has used them all. I brought that example to leadership. I built presentations. I developed the argument for how VHA could work through a no-assurance statement without resulting in a total catastrophe, but to develop mechanism for forcing the resources, attention, and accountability that we could not get any other way. I talked to peers at the agency level to assess whether there was appetite for the conversation at the Secretary's level.


Nobody really disagreed with me. They were just horribly uncomfortable. No one was willing to put it on a piece of paper.

Until I did. My team lead and I submitted a white paper documenting the risks ahead and the case for the no-assurance statement. We sent it up the chain. I don't know where it landed. I don't know if it landed at all.


Looking at it through today's lens it's especially ironic, considering how many times VA Secretary Doug Collins, his team, and even past Secretaries have implied the no-assurance themselves.


  • Collins told the Senate Veterans' Affairs Committee that when he arrived, he found an agency that was "broken." His own HR department "couldn't hand him a list of employees within his first week" — which he called "bureaucratically challenged."

    Senate VA Committee hearing, May 6, 2025 — WESA/Pittsburgh Public Radio

  • On the $16 billion Oracle EHR project, Collins told senators that Oracle was ready to move — while the VA side "was sort of [saying], 'we're not going to do anything, and we're going to make it all individualized.'"

    Senate VA Committee hearing, May 6, 2025 — Nextgov/FCW

  • Collins described the EHR modernization project as "a cold fish" when he inherited it — and found "eight or nine committees that were all having to touch stuff before they could get back to a decision." He also stated: "There's been no momentum in this project."

    House Appropriations Subcommittee hearing, May 15, 2025

  • Collins said VA had become "the poster child in many ways for bureaucracy," with "a middle layer of bureaucracy that keeps our system slowed down" and "doctors, nurses and others who are not in the clinics, helping patients."

    Scripps News, April 22, 2025

  • "Under President Trump, we are working to solve problems that have persisted at VA for decades."

    Written testimony, Sec. Doug Collins, House Veterans' Affairs Committee, May 15, 2025

  • "Our shared goal needs to be making things better for veterans rather than protecting the department's broken bureaucracy. To simply say that where we came in was okay — everyone knows that was just simply not true."

Sec Doug Collins, Senate VA Committee hearing, May 6, 2025

  • VA Press Secretary Pete Kasperowicz said Collins was working to fix a "broken bureaucracy" that has "long had problems with patient safety and access to care," adding: "Many in the media, government union bosses and some in Congress are fighting to keep in place the broken status quo."

    Statement to ProPublica, May 2025

  • Kasperowicz also said of consolidating payroll functions across 50 VA medical centers that had been running separately: "This is exactly the kind of commonsense reform that should have been done years ago but is only happening now."

    Statement to Federal Times, April 15, 2025

  • VA stated in an interagency agreement with the Office of Personnel Management — in which it paid OPM $726,000 to help oversee its own restructuring — that it "has never undertaken such a large restructuring, and does not have the capabilities, expertise or the internal resources to fulfill the requirement."

    VA interagency agreement with OPM, cited by Federal News Network, July 2025


And this wasn't new under Collins. It wasn't new under McDonough either.


  • Secretary Denis McDonough told The War Horse in 2022 that VA faces a "crisis of confidence" rooted in decades of failures, and that he understood skeptics who ask why they should believe anything will change: "You shouldn't," he said.

    The War Horse, February 2022

  • "This won't be easy. The Department of Veterans Affairs faces great challenges — challenges made even more daunting by the coronavirus pandemic." McDonough said this at his own confirmation hearing in 2021 — acknowledging a "long list of problems that have plagued the department for years."

    NPR, February 8, 2021

  • "Failed leadership at multiple levels within VA put patients and assets at the DC VA Medical Center at unnecessary risk and resulted in a breakdown of core services." — VA Inspector General Michael Missal, describing systemic failures that persisted for years while leaders at multiple levels knew — including during the tenure of then-Undersecretary for Health David Shulkin, who later said he "did not recall" being notified.

    VA OIG report, March 2018

  • The VA OIG's 2014 report on the Phoenix VA wait time scandal found that scheduling failures "became systemic because VHA did not hold senior headquarters and facility leadership responsible and accountable." The OIG launched investigations at 93 sites of care.

    VA OIG Report on Phoenix VA Health Care System, August 2014


Every Secretary. Every party. Every administration. Broken. Systemic. Decades. No momentum. Couldn't get a list of employees. Should have been done years ago.

The words have been the same every time someone walks in the door.


What changed was what they chose to do with that awareness, and who they chose to blame. But despite the chorus of acknowledgment of deep rooted, systemic and chronic failures, what got submitted to Congress was a modified assurance statement. A few noted material weaknesses. Nothing that said what everyone in that building already knew.


Nobody would sign a statement that told the truth.


When I asked about the resistance, the answer was there were legal concerns about what it would trigger. Those concerns were realistic and I'm not dismissing them. A no-assurance statement would have put senior leaders at risk of losing their jobs. It would have subjected programs to funding scrutiny. It would have generated congressional attention and public questions about veteran care that leadership had worked very hard to get ahead of.


But here is what nobody was willing to say out loud: by keeping the statement clean year after year while the material weaknesses compounded, the veterans were already at risk. The choice was never between protecting veterans and filing the honest statement. The choice was between protecting the people at the top of the org chart and telling the truth about what the system actually was.

We treated broken bones like paper cuts. We put bandaids on things that needed major surgery — hoping someone else would be here when the bandaid fell off. We treated slow-growing cancers as if a little rearranging of the cells would help the cancer forget what it was doing.


I was afraid too. I want to be clear about that. I understood the stakes. I understood what filing that statement would trigger. What I could not do was continue to be part of the machine that kept producing clean statements on top of broken controls and calling it assurance.


Sources: OMB Circular A-123 (2026 revision); Department of the Navy Statement of Assurance framework (secnav.navy.mil); VA OIG audit report FY2024


When the Dam Broke

Between 2022 and early 2025, due to those reorganization efforts, my team did have a chance to grow. It expanded from one person with volunteers to a named enterprise risk management team supporting over 200 programs at the central office level with actual risk assessments, mitigation plans, controls development, and monitoring. I had an additional five team members working with the 170-plus medical centers — helping front-line staff learn the premise and practice of risk management where it actually happens: in the facilities, with the patients, at the point of care. We were striving to connect the two. We had buy-in. People were connecting the dots. The momentum was there. Keep in mind, many of these team members already had the know how and skills, but they had been scattered in different places over time with no central facilitation. We worked with what we had and re-sculpted it to have impact.


We were not perfect. We were not finished. We were not anywhere close to where a $123 billion health system's internal control function should be. But we were building something real, with people who understood what they were doing and why it mattered.


Then January 2025 hit. The contractor support that helped us coordinate and supplement the administrative capacity we still lacked was slashed. Some contracts cut entirely overnight. Others significantly reduced. The people we worked with across the took massive hits. Functions that had been stabilizing through that supplemental support scrambled to continue. The Secretary failed to see the value of a contractor building the PowerPoint decks that leadership required. Now, a GS-15 at $160,000 a year would have to take that on while trying to continue operations in half-staffed offices with no one else there to help. What had been a genuine effort to build a controls system became, overnight, something shoved to the back burner.


Our overall office sat 30% unstaffed before any of this happened. Positions had been frozen and unfrozen and frozen again through multiple leadership changes. Long-standing issues now appearing to be injected with steroids and becoming significantly worse.


The hiring freeze hit differently in VHA than many can understand. In one week, thousands of job offers, like those for physicians and nurses, were rescinded across VHA, then re-offered the following week, by which point many candidates had moved on. Medical centers couldn't hire because the freeze had been so poorly communicated that the hiring machinery and technology had seized. Contracts for services suddenly required multiple layers of approval that hadn't existed before.


In an effort to try and boost moral, leadership applauded themselves for correcting the cataclismic failures. They cheered the ability to develop a streamlined contract approval process. It was easier to acknowledge righting the ship than to ask why the ship was cannonballed in the first place. It was implied that we shouldn't lament the damage done in the gap, the talent lost when offers rescinded, or things like the clinicians who had been working efficiently from home who were now resigning when return-to-office mandates arrived. Their jobs were in demand, they didn't need VHA the way VHA needed them. Now medical centers had critical staffing needs they could not fill, again a long standing issue now exasperated tenfold. We won't even get into the employees who found themselves under such moral injury it was all they could do to show up to a shared cube and treat telehealth patients while trying to explain why other conversations could be overheard through the headsets. Oh, and make sure to leave anything remotely rainbow colored at home, for risk of being confiscated.


In March 2026, the nonpartisan Partnership for Public Service released its Public Service Viewpoint Survey — developed after the Trump administration cancelled the Federal Employee Viewpoint Survey in August 2025. The results were stark. The government-wide Employee Engagement and Satisfaction Index Score was 32 out of 100. Only 7.5% of federal employees agreed that political leaders generate high levels of motivation in the workforce. Only 22.5% were confident they could report a suspected violation of law, rule, or regulation without facing retribution.


At HHS — the department that sits directly over the programs documented throughout this series — only 2.6% of employees felt their political leadership motivated the workforce, and 57.8% said their work units had gotten worse at meeting stakeholder demands. More than twice as many federal employees reported that agency performance and service delivery had gotten worse rather than better over the past year. [Partnership for Public Service, Public Service Viewpoint Survey, March 2026]


This is what happens when a workforce is actively dismantled and their voices silenced.

When I asked about return-to-office metrics, meaning the things being measured that would validate success or failure, the response, in writing, was that leadership had decided not to track metrics associated with return to office. Months of staff time. Entire positions at facilities dedicated to implementation of the executive order. Hundreds of thousands of capital and IT dollars spent outfitting spaces for computers and desks and fiberoptic lines, and no one measured a thing. Now we cannot prove whether it worked or didn't. Though we all know the answer.


And if you think this pattern is unique to the VA, or to federal healthcare, or to the people I worked alongside, I want to point you somewhere else for a moment.

In early 2026, depositions were released in a federal lawsuit against DOGE. Two political appointees in their 20s, with no government experience, no grant administration background, and no expertise in the programs they were cutting, used ChatGPT to cancel more than $100 million in National Endowment for the Humanities grants in 22 days. They flagged keywords. They didn't define the terms they were searching for. They admitted the cuts never reduced the deficit. They said they had no regrets. Even the most niave in AI use know the power is in the prompt. These guys just didn't care, they were on a joy ride.


It is the same premise as canceled VA "consulting" contracts that ended up cutting patient care consult support.

A handful of people who believe they know best, armed with confidence, a spreadsheet, and no institutional memory, is not a reform strategy. It is a recurring pattern. And it deserves its own conversation. One we'll have here soon, as we wrap up this first series.


Sources: GAO-25-106969; VA OIG Semiannual Report to Congress, Issue 92; VA OIG community care reports FY2023–2024; Partnership for Public Service, Public Service Viewpoint Survey, March 2026


The Contracts Nobody Is Talking About

Back to what started this series. The March 2026 executive order establishing the Task Force to Eliminate Fraud targets housing, food, medical care, and cash assistance. Things it failes to include, the community care contracts that have cost VHA billions in documented overpayments, inadequate oversight, and provider network failures, the EHR mega contract with Oracle Cerner.


Community care

The program allowing veterans to see private-sector providers outside VA facilities grew from $8 billion in 2014 to $31 billion in 2024. Roughly one-third of VA's entire medical care budget, flowing through a network administered by two third-party administrators: Optum and TriWest.


The OIG found that VA's Office of Integrated Veteran Care provided ineffective oversight of those contracts. It did not ensure Optum and TriWest maintained provider networks that accepted VA patients — a basic contractual requirement. When the OIG asked the TPAs why they hadn't added more providers, both cited the cost. They cited the cost of meeting the terms of their own contract. And the oversight office had no mechanism to enforce compliance.


VA medical center staff reported spending hours trying to find community providers willing to see veteran patients. Hours. Per referral. While the administrators of a $31 billion program cited cost as a reason for not building the network they were paid to build.


TriWest settled with the DOJ for $179.7 million in 2020 to resolve overpayments from VA programs dating back to 2014 — including instances where VA paid TriWest twice for the same services. Despite that record, TriWest was subsequently hired to run the MISSION Act's outsourcing program.

GAO found that the program manager position defined in the Quality Assurance Surveillance Plans for the community care contracts — the human being whose job it was to watch what Optum and TriWest were doing — had not been assigned to or performed by anyone in the oversight office since May 2022. The chair was empty. Billions flowed. Nobody was watching.

[Sources: VA OIG report on Community Care Network adequacy; GAO-24-106390; DOJ press release, TriWest settlement, December 2020; U.S. Medicine, June 2024]


Electronic Health Record Modernization

And then there is Oracle.


The EHR contract began in 2018, a no-bid award to Cerner, later acquired by Oracle, was employed to replace VA's legacy health record system. The initial estimate was $10 billion. It is now projected to cost as much as $37 billion. As of early 2026, the system has gone live at six of VA's 170 medical centers. Six. In eight years. With a documented trail of patient safety concerns, technical failures, and congressional oversight hearings that changed nothing about the trajectory of the contract or the confidence placed in the contractor holding it.


From the start, there were signs. Some, now officially coming to light as seen with the March 28, 2026 indictment of John H. Windom, the Senior Executive Service official who served as Executive Director of the VA's Office of Electronic Health Record Modernization from 2017 to 2021. The indictment include three federal counts: concealment of material facts, making false statements, and falsification of a record or document. Prosecutors allege that while overseeing the Oracle EHR contract, Windom accepted and sometimes demanded cash, casino chips, Louis Vuitton gift cards, and other gifts from a group of contractors he called "the Power Group" — then lied to federal investigators about it, first denying any gifts at all, then significantly understating them. He allegedly used his position to steer contracting and subcontracting opportunities to Power Group members, told them to maintain confidentiality and remain loyal, and in one message reminded them that "loose lips sink ships." The indictment is an allegation, not a finding of guilt. But it is a federal grand jury's finding that there is probable cause to believe that the senior official responsible for the largest IT contract in VA's history was personally benefiting from the contractors he was supposed to be overseeing.

[DOJ press release, March 26, 2026 (justice.gov); VA OIG Criminal Investigative Update, March 2026 (vaoig.gov)]


And then there is what happened on the morning of March 31, 2026, just four days after the Windom indictment. Employees across Oracle's global workforce opened their inboxes to a five-line email from "Oracle Leadership." No warning. No call from HR. No conversation with a manager. Just a message informing them their role had been eliminated and that day was their last. Access to systems was cut immediately.


Investment bank TD Cowen estimates the cuts affected between 20,000 and 30,000 employees — roughly 18% of Oracle's global workforce — making it what analysts are calling the largest layoff in the company's 48-year history. Oracle disclosed a $2.1 billion restructuring plan in its March 2026 SEC filing. The financial logic: Oracle has taken on $58 billion in new debt to fund AI data center infrastructure, its stock has lost more than half its value since September 2025, and eliminating tens of thousands of positions frees up an estimated $8 to $10 billion in cash flow.


This is the company holding the VA's $16 billion EHR contract — a contract now estimated to cost as much as $37 billion over its lifetime, administered by an organization that just eliminated a fifth of its workforce with a cold email and no advance notice. The government's ability to oversee what Oracle is doing inside VA systems was already limited. It just got more complicated.


[CNBC, March 31, 2026; The Next Web, March 31, 2026; TD Cowen analyst estimates, March 2026; Oracle 10-Q SEC filing, March 2026; Federal News Network, March 2026]


All while four VA Medical Centers, Ann Arbor, Battle Creek, Detroit, and Saginaw, are scheduled to go live with this system this month. Ohio, Indiana, Kentucky, and Alaska follow later this year. GAO has not fully received the updated cost estimate. Sixteen of eighteen GAO recommendations remain unimplemented.


This is what monster contracts create when oversight is underfunded, understaffed, and structurally fragmented. Not fraud in the simple sense of someone lying on a form. Something more insidious: a system so large, so complex, and so dependent on the contractors themselves for operational information that meaningful oversight becomes almost impossible. The contractors know more about what's happening in the program than the government does. That imbalance is not accidental. It is the predictable result of building oversight capacity that is a fraction of what the contract complexity demands.


I'm looking at Optum, Oracle, and TriWest — not as accusation, but as a case study in what happens when contracts grow to a scale that only a handful of organizations can fulfill, when those organizations become embedded in the operational fabric of the program, and when the internal control function that might catch problems early is one person with volunteers trying to document a $123 billion health system.


The fraud task force is looking at whether a veteran's self-reported income was $50 too high. It is not looking at the empty chair where the community care contract oversight manager was supposed to be sitting.

The People Who Stayed

In July, I left. I want to be honest about why. I had taken a temporary leadership position as so many do during administration changes. I thought I knew what I would be facing during the transition, I also knew I had one of the most amazing set of leaders in my program to support me.


I walked into rooms saying: you know what, you're right, it is broken, but what are you measuring that can even tell me you fixed it? I was asking questions that made people uncomfortable and I wasn’t getting rattled by the raised voices. Parental trauma comes in handy sometimes. I was refusing to endorse assessments I didn't believe. I had reached the point where I could not remain quiet and also stay employed, and I feared that if I stayed, the people around me — the team I had built, the people doing the actual work — would be at risk too. As the Acting Integrity and Compliance Officer, I had no choice but to continue voicing what was going unsaid. I ended up in such physical pain from trying to handle the stress I had to undergo cervical epidurals to keep up with the travel schedule. I couldn’t keep going the way I was.


So, I left. And I left everything behind. Every document, every framework, every draft. Gone. I respected the practice of not emailing federal documents to a personal device, unlike the DOGE gentlemen who admitted otherwise in their depositions. I disclosed through formal channels instead of running to the news. No one in Congress, no one in OIG, ever responded. It made me wonder if I was making more of it than I should. Through writing this series, I'm validated that the evidence backs me up. I didn't imagine the severity of any of it.


But they stayed. My team stayed. The people who had learned this work, who understood why it mattered, who had built relationships across 170-plus medical centers and 200-plus central office programs, they kept charging forward. Through deferred resignations. Through employees who experienced recurrences of PTSD and moral injury from the chaos of the transition. Through cramped shared offices after ten years of remote work arrangements that had actually functioned. Through all of it.


Last month, I heard that one of my former teams fixed a chronically broken control that everyone had sworn was unfixable. They did that in the midst of everyone telling them they weren’t needed, the corporate functions shouldn’t exist, that they were drains on the system. They did it through their relationships, their knowledge, and their perseverance, with no help from any new realignments, resources, or technology.


I grieve the people I left. I grieve the veterans I know my work supported. I grieve the team who stayed and kept going when any reasonable person would have understood walking away. That grief is real and it does not go away.

There is no other healthcare institution like the VA. It has faltered under Democrats and Republicans alike. But what has kept it running — through every system failure, every technology disaster, every leadership implosion — has been the nurses, the janitors, the IT technicians, the analysts, the food service staff, the medical assistants, and the doctors.


When every system around them threatened to fail structurally, technologically, and culturally, their mission kept them going.

They showed up. They did everything they could to serve those who served us.

In the conference rooms, I was told we were an organized resistance to change. That we were maliciously compliant. That we didn't understand the necessity of what was happening. I was called defiant, defensive, and disruptive by those who claimed they were doing what was needed. None of them asked what already existed that they could support. They simply wanted their name on the press release that claimed the magic medicine that fixed it all. They wanted the clout that will never come, because to be actually respected, you have to care.


We built the frameworks. We wrote the white papers. We asked for change and we created systems that would have supported it. We were not resistant to making things better. We were resistant to destruction dressed up as reform.


Text on a black background reads, "We were not resistant to making things better. We were resistant to destruction dressed up as reform." Mood is reflective.

What Integrity Actually Looks Like

In two years, four years, or six years, as the political climate changes, the handful of people wielding the power may look different. But do any of them truly have this thing called integrity that seems so lost right now?


Those with the most integrity are often the ones embedded in the day-to-day work of the world. The ones nobody names in press releases. The ones who show up anyway. As far back as we can look in this country, in this society, life has favored those with money and power via backroom handshakes. That will not change unless the masses — those embedded humans with integrity — rise up and put a crack in the porcelain facade of what we have accepted for too long.

The leaders above me were not all bad people. Some of them genuinely didn't know how to lead through something like this. What do you do when the Secretary tells you the buck stops with him — that if we fail it's his fault and if we succeed the credit belongs to us — but everything he does embodies the exact opposite? No one knew how to truly lead through this. And that's not entirely their fault either. Because for all the time leading up to this pivot point, we were professional rug sweepers — stopping an immediate bleed but never assessing the internal damage.


This system was built in a way that made it apt to shatter. The warning signs were there. No one had the integrity to sound the alarm where it needed to be sounded. I tried. I know others tried. We submitted the white paper into the silence and we don't know where it went.


The heart of the VA will not let it collapse. Not because of the new and sweeping changes. But in spite of them.

The fraud task force is auditing benefit recipients. Meanwhile the program manager chair for a $31 billion community care contract sat empty for years. The tool that was supposed to catch billing fraud in community care was broken, paused, and left unrepaired long enough to delay $2 billion in claims. The internal controls assessment for a $123 billion health system had one person and a hope.

That's the fraud and waste nobody is talking about. Not the kind where someone who served our country may make a mistake on an overly complex form. The kind where an institution lies to itself, year after year, about whether the machine is working — and nobody will sign the statement that says it isn't.


Primary Sources

  • VA OIG, Audit of VA's Financial Statements for Fiscal Years 2024 and 2023 (vaoig.gov, December 2024)

  • VA FY2024 Agency Financial Report, including Secretary's Statement of Assurance (va.gov, November 2024)

  • GAO-25-106969, Veterans Health Administration: Additional Actions Needed to Improve Oversight of Health Care System (gao.gov)

  • GAO-24-106390, Veterans Community Care Program: VA Needs to Strengthen Contract Oversight (gao.gov)

  • VA OIG, Management Advisory Memorandum on the Pause of the Program Integrity Tool (vaoig.gov, July 2024)

  • VA OIG, Congressional Testimony on Community Care, February 2025 (vaoig.gov)

  • VA OIG, Improved Oversight Needed to Evaluate Network Adequacy and Contractor Performance (vaoig.gov)

  • DOJ press release, TriWest Healthcare Alliance settlement, December 2020 (justice.gov)

  • OMB Circular A-123, Management's Responsibility for Internal Control (2026 revision)

  • Department of the Navy Statement of Assurance framework (secnav.navy.mil)

  • U.S. Medicine, Critical OIG Report Raises Key Questions About VA's Community Care Program, June 2024

  • Senate Veterans' Affairs Committee, Senators' letter to VA Secretary on community care oversight, May 2024

  • Partnership for Public Service, Public Service Viewpoint Survey, March 19, 2026 (ourpublicservice.org)

  • Federal News Network, February 2026 (federalnewsnetwork.com)

  • Healthcare Dive, December 17, 2025 (healthcaredive.com)

  • Government Executive, December 16, 2025 (govexec.com)

  • VA EHR Modernization Office press release, April 2025 (digital.va.gov)

  • GAO EHR recommendations tracker, March 2025 (gao.gov)

  • CNBC, March 31, 2026 (cnbc.com)


These statements and opinions are my own, based on my experience as a GS-15 director-level federal employee embedded within the Veterans Health Administration from 2020 to 2025. Where I describe internal experiences, I am describing my own observations and the documented public record. The problems started far before they exploded into mainstream awareness. The cleanup will fall to me and my peers. So yes, I'm still angry. And so should you be.

Comments


NC Bulger Solutions, LLC

NC Bulger Solutions, LLC serves healthcare organizations, nonprofits, and corporate teams across the Greater Pittsburgh region and nationwide. Specializing in healthcare compliance consulting, enterprise risk management, interim CCO services, and leadership training. Founded by Natalie Bulger, CHC, FACHE — Pittsburgh's 40 Under 40 honoree and former VHA Director of Risk Management.

 

© 2026 by NC Bulger Solutions, LLC. Powered and secured by Wix 

 

bottom of page