During the May 2025 meeting of the AICPA’s Government Performance and Accountability Committee, April Cassada, CPA/CITP, CISA, presented a comprehensive report titled Fraud in Virginia. The report shed light on financial discrepancies and systemic concerns within the Virginia Department of Health (VDH) and particularly focused on the Office of Emergency Medical Services. The following contains highlights from the presentation.
Reporting to the General Assembly through the Joint Legislative Audit and Review Commission (JLARC), the APA serves as the external auditor for higher education institutions and government agencies in Virginia.
Critical failures in governance and compliance occurred from 2019 to 2023 within the VDH’s Office of Emergency Medical Services (OEMS). The APA’s investigation revealed financial mismanagement, disregard for centralized administrative protocols, and weak internal controls.
Missing money casts a spotlight on the state’s Department of Health.
Encompassing 15 divisions and a broad array of public health programs, including immunizations, environmental health, and epidemiology, the VDH oversees OEMS. OEMS is responsible for statewide emergency medical response coordination and equipment procurement, and operates with no federal funding, relying instead on vehicle registration fees.
The APA’s annual workplan is approved by JLARC; the workplan supports both the Annual Comprehensive Financial Report (ACFR) and the statewide single audit process, with materiality thresholds ranging from $33.2 million to $91.7 million for fiscal year 2024.
Problems surfaced following a mandated transfer of $12.5 million to the state’s general fund in FY 22 — the transfer was meant to reflect increased revenue from vehicle registration fees. However, by the end of June 2023, VDH’s finance department and OEMS identified a shortfall in available funds, prompting VDH’S Office of Internal Audit (OIA) to launch an investigation on July 6, 2023.
An investigative review exposed fraud dating back to 2019.
OIA conducted a thorough probe, reviewing financial records from FY 18 to FY 23; interviewing staff from OEMS, VDH Central, and regional EMS councils; and analyzing budgets, procedures, and audit reports.
In 2019, VDH attempted to centralize its administrative functions through a shared services model. OEMS leadership, however, resisted the centralization and failed to comply with both state financial and human resources policies. This noncompliance created confusion among regional EMS councils regarding whether state policies applied to them.
Matters became more complicated when, in late 2020, the OEMS associate director created a fake technology company, STI, which he registered in his own name. The OEMS associate director arranged for legitimate vendors to perform work and invoice the Western Virginia EMS Council, to which he added a 20% markup before billing OEMS. This fraudulent structure allowed the associate director to funnel payments through the Western Virginia EMS, avoid standard vendor approvals, and conceal the fraud. Between January 2021 and May 2023, staff at Western Virginia EMS unknowingly processed STI’s invoices, which were reimbursed by OEMS without question.
In 2021, when oversight of a data system upgrade was reassigned from a departing OEMS division director to the Western Virginia EMS Council, the problems continued. The Western Virginia EMS Council organized the annual EMS symposium but did not create formal documentation outlining roles or responsibilities. It was under this informal structure that the fraud thrived.
After the resignation of the OEMS business manager in 2022, budget oversight became further fragmented. OEMS staff ceased participating in regular budget meetings with the shared services teams, and communication breakdowns prevented staff from understanding funding limitations. Though the shared services team shared monthly updates, OEMS teams failed to fully grasp or act upon the financial restrictions.
Fraud ballooned through unauthorized journal entries, hidden deficits, and manipulated transfers across fiscal years 2019–2022. And, in FY 23, an attempted $11 million journal entry was blocked by VDH administrators. Additionally, OEMS staff had no tracking of fixed assets and made excessive purchases, including hundreds of laptops and telepresence robots that were used briefly before being stored.
The investigation underscored the need for centralized administrative protocols, oversight, better communication, and adherence to established financial procedures across all VDH divisions.
Financial mismanagement and weak internal controls can have significant consequences.
The 2021 EMS symposium suffered from gross mismanagement — budgets were not formally established, and contractors were hired without clear authorization. Agreements regarding intellectual property were inconsistent, and expenses were approved without oversight. The Western Virginia EMS Council covered expenses, including travel for OEMS staff, in ways that skirted state policy. Alcoholic beverage packages from hotels were among the questionable expenditures.
Financial controls were alarmingly weak. VDH’s Office of Emergency Medical Services paid five non-OEMS VDH employees, and contractor payroll more than doubled since FY 21. Required funding allocations were ignored annually from FY 19 to FY 23, and OEMS accrued $33 million in unpaid debts and could not account for $3.1 million paid to regional councils.
The OEMS associate director resigned in August 2023 and was later investigated by the Virginia State Police and FBI. Investigators discovered luxury purchases — real estate, vehicles, firearms, and jewelry — funded by stolen money. In November 2024, he pled guilty to multiple federal charges, including mail fraud and tax evasion for not reporting $1.9 million in income from STI; he received a six-year prison sentence.
The Virginia Auditor of Public Accounts’ 2024 report findings are a stark reminder of the importance of integrated systems and leadership accountability in public sector operations.
About the experts
Ross Baldwin, CPA, CGMA, CFE, CIA, is Senior Auditor for Arkansas Legislative Audit, with years of experience auditing numerous entities, including institutions of higher education, school districts, counties, and municipalities. In 2017, Ross graduated from the AICPA Leadership Academy and is involved with the Arkansas Society of CPAs, where he currently serves on the board of directors as well as the finance and policy committees. In addition to being a CPA and having earned the Chartered Global Management Accountant® designation, he is a Certified Fraud Examiner and Certified Internal Auditor.
April Cassada, CPA/CITP, CISA is the director of the data analysis specialty team at the Virginia Office of the Auditor of Public Accounts. For the data analysis team, she is responsible for overseeing a team of 15 members who perform data retrievals, verification, and analysis for agency audits. She is also the director of Commonwealth Data Point, the agency’s public database of statewide data. Cassada served on the AICPA’s Information Management and Technology Assurance Committee as well as the Young Professionals Advisory Council. She is a member of the AICPA and the Virginia Society of Certified Public Accountants, where she currently serves on the Innovation Advisory Council.
About the AICPA’s Government Performance and Accountability Committee
Comprising 12 volunteer committee members, and in collaboration with staff at the Association of International Certified Professional Accountants®, the Government Performance and Accountability Committee advises government officials, regulators, and stakeholders, advocating issues that matter to the accounting and finance profession. If you’d like to learn more about GPAC, please email Lori Sexton.