The Department of Veterans Affairs Office of Inspector General, or OIG, has found the department’s Benefits Enterprise Platform modernization at risk of delays, higher costs and security vulnerabilities.
According to a report the OIG published Tuesday, those risks stem from inadequate oversight and program management within the Office of Information and Technology, or OIT.
The Benefits Enterprise Platform, or BEP, moves information between the Veterans Benefits Administration database and business line systems covering compensation and pension, education, vocational rehabilitation and employment, and loan guaranty.
The audit team conducted its work from February 2025 through March 2026 and issued five recommendations.
Modernizing the systems that deliver veterans’ benefits sits alongside the broader technology questions facing federal health agencies. The Potomac Officers Club will host its 2026 Healthcare Summit on Dec. 3, convening government and industry leaders on the priorities shaping federal health delivery. Register now to join the conversation.
How Far Has the BEP Modernization Timeline Slipped?
VA’s initial five-year plan, issued in March 2023, called for decommissioning BEP in fiscal 2026. A later addendum dropped that date without setting a new one.
OIT’s PACT Act Dashboard now projects the modernization finishing in the second quarter of fiscal 2034. The dashboard provides no timeframe for retiring the legacy system.
The OIG said the legacy platform will have to run alongside the modernized system during that period, which may raise operating costs.
VA awarded a $1.1 billion contract in May 2021 covering modernization of benefits delivery systems, including BEP. That contract was estimated to finish in August 2026. As of February 2026, the BEP portion was not complete.
What Did the VA OIG Find on BEP Program Scheduling?
OIT has not developed a program schedule meeting the Government Accountability Office standard of comprehensive, well-constructed, credible and controlled, the OIG found.
OIT instead relies on an agile project management tool that captures planned actions in three-month increments. That tool omits requirements, dependencies, milestones and deliverables for the full project.
The OIT Software Product Management executive director for Benefits and Memorial Services told the audit team that differing interpretations of scheduling requirements contribute to the gap and described difficulty reconciling agile practice with Office of Management and Budget policy and GAO guidance.
Why Do VA’s BEP Cost Figures Conflict?
Cost totals for fiscal 2023 through fiscal 2027 differ across VA’s own documents. The five-year plan estimates about $150.3 million. The addendum lists roughly $117 million. The OIT financial summary and multiyear plan total about $161.9 million.
OIT could not supply documentation supporting the planned costs in the plan or the addendum. The audit team found no evidence that the Veterans Benefits Administration performed a risk and uncertainty analysis on either the actual or planned estimates.
The OIG also found that OIT did not record all BEP cost and schedule information in VA’s Product (Line) Accountability and Reporting System.
What Security Gap Did the VA OIG Identify?
OIT hosted certain minor applications without approved security assessments, potentially exposing veterans’ sensitive personal information. It assessed the security of the applications on its network, following the audit team’s notification in March 2025, and resolved the issues.
How Did VA Respond to the OIG Recommendations?
The VA deputy secretary, performing the delegable duties of the assistant secretary for OIT, concurred with the first four recommendations and, in principle, with the fifth. Corrective action plans for the first four carry target dates of Oct. 31.
Regarding scheduling, the response stated that OIT maintains a detailed BEP schedule that captures both agile and nonagile activities. VA added that modernization requirements change continuously, which it said limits the value of a traditional fixed program schedule.
On cost estimates, the response stated that OIT’s life cycle estimates are already reliable and credible while committing to further process work. On the dashboard, VA said the tool was a six-month pilot that did not carry financial data, and that OIT decided against full adoption because existing reporting mechanisms were sufficient.
VA said minor applications are governed under the parent system’s authority to operate and do not require separate authorization decisions, and requested closure of the fifth recommendation.
The OIG will keep that recommendation open. Documentation VA supplied showed BEP holds an authorization to operate but did not demonstrate that minor applications received security assessment approval, the OIG said.
