Foreign Military Sales
Improved Air Force Controls Could Prevent Unauthorized Shipments of Classified and Controlled Spare Parts to Foreign Countries Gao ID: GAO-03-664 July 29, 2003From 1990 through 2001, the Department of Defense delivered over $138 billion in services and defense articles--including classified and controlled parts--to foreign governments through its foreign military sales programs. Classified spare parts are restricted for national security reasons, while controlled parts contain technology that the military does not want to release. GAO was asked to review the Air Force's internal controls aimed at preventing countries from requisitioning and receiving classified or controlled spare parts that they are ineligible to receive.
The Air Force's internal controls for its foreign military sales program using blanket orders are not adequate, placing classified and controlled spare parts at risk of being shipped to countries not authorized to receive them. The Air Force's system has erroneously approved foreign country requisitions for classified and controlled spare parts based on incorrect federal supply classes. The system approves items for shipment based in part on an item's federal supply class--not the item's entire national stock number, which is a combination of the supply class number and a part number unique to the item. GAO found that because the system was not properly programmed and countries used unrestricted supply class numbers, the system erroneously approved 35 of 123 selected requisitions reviewed. For example, one country ordered a controlled outline sequencer used on various aircraft by using a supply class that was unrestricted, but incorrect for the part it requisitioned. Because supply class 1680 was not restricted and the system did not verify that 1680 was the correct supply class for national item identification number 010539320, the system approved the requisition. Had the system validated the entire 13-digit national stock number, it would have found that the number was incorrect and would not have approved the requisition. In addition, the Air Force has no written policies or procedures in place for recovering items that have been shipped in error. The Air Force has not validated modifications to the Security Assistance Management Information System that restrict parts available to foreign countries and has not tested the system since 1998 to ensure that it is working properly. Because modifications were not validated, the Air Force did not detect improperly made modifications to the system, and foreign countries were able to requisition and obtain controlled spare parts that, at the time, the Air Force was trying to restrict. GAO identified 18 instances in which countries requisitioned and received a controlled part for which they were not eligible because programmers had entered the restrictions in the wrong area of the system. Although Air Force officials subsequently told us that the part was improperly restricted, this example nevertheless demonstrates the need to validate system changes. Air Force command country managers did not always document reasons for overriding the recommendations of the system or the foreign military sales case manager. For 19 of the 123 requisitions GAO reviewed, command country managers overrode the system recommendations and shipped classified and controlled spare parts without documenting the reasons for overriding the system. For example, a command country manager overrode the system and shipped four classified target-detecting devices without documenting the reasons for overriding the system.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-03-664, Foreign Military Sales: Improved Air Force Controls Could Prevent Unauthorized Shipments of Classified and Controlled Spare Parts to Foreign Countries
This is the accessible text file for GAO report number GAO-03-664
entitled 'Foreign Military Sales: Improved Air Force Controls Could
Prevent Unauthorized Shipments of Classified and Controlled Spare Parts
to Foreign Countries' which was released on August 28, 2003.
This text file was formatted by the U.S. General Accounting Office
(GAO) to be accessible to users with visual impairments, as part of a
longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
On January 8, 2004, this document was revised to add various
footnote references missing in the text of the body of the document.
Report to the Honorable Tom Harkin, U.S. Senate:
United States General Accounting Office:
GAO:
July 2003:
Foreign Military Sales:
Improved Air Force Controls Could Prevent Unauthorized Shipments of
Classified and Controlled Spare Parts to Foreign Countries:
GAO-03-664:
GAO Highlights:
Highlights of GAO-03-664, a report to the Honorable Tom Harkin, U.S.
Senate
Why GAO Did This Study:
From 1990 through 2001, the Department of Defense delivered over $138
billion in services and defense articles”including classified and
controlled parts”to foreign governments through its foreign military
sales programs. Classified spare parts are restricted for national
security reasons, while controlled parts contain technology that the
military does not want to release. GAO was asked to review the Air
Force‘s internal controls aimed at preventing countries from
requisitioning and receiving classified or controlled spare parts that
they are ineligible to receive.
What GAO Found:
The Air Force‘s internal controls for its foreign military sales
program using blanket orders are not adequate, placing classified and
controlled spare parts at risk of being shipped to countries not
authorized to receive them.
* The Air Force‘s system has erroneously approved foreign country
requisitions for classified and controlled spare parts based on
incorrect federal supply classes. The system approves items for
shipment based in part on an item‘s federal supply class”not the
item‘s entire national stock number, which is a combination of the
supply class number and a part number unique to the item. GAO found
that because that system was not properly programmed, it erroneously
approved 35 of 123 selected requisitions reviewed, because countries
used unrestricted supply class numbers. For example, one country
ordered a controlled outline sequencer used on various aircraft by
using a supply class that was unrestricted, but incorrect for the part
it requisitioned. Because supply class 1680 was not restricted and the
system did not verify that 1680 was the correct supply class for
national item identification number 010539320, the system approved the
requisition. Had the system validated the entire 13-digit national
stock number, it would have found that the number was incorrect and
would not have approved the requisition. In addition, the Air Force
has no written policies or procedures in place for recovering items
that have been shipped in error.
* The Air Force has not validated modifications to the Security
Assistance Management Information System that restrict parts available
to foreign countries and has not tested the system since 1998 to
ensure that it is working properly. Because modifications were not
validated, the Air Force did not detect improperly made modifications
to the system, and foreign countries were able to requisition and
obtain controlled spare parts that, at the time, the Air Force was
trying to restrict. GAO identified 18 instances in which countries
requisitioned and received a controlled part for which they were not
eligible because programmers had entered the restrictions in the wrong
area of the system. Although Air Force officials subsequently told us
that the part was improperly restricted, this example nevertheless
demonstrates the need to validate system changes.
* Air Force command country managers did not always document reasons
for overriding the recommendations of the system or the foreign
military sales case manager. For 19 of the 123 requisitions GAO
reviewed, command country managers overrode the system recommendations
and shipped classified and controlled spare parts without documenting
the reasons for overriding the system. For example, a command country
manager overrode the system and shipped four classified target-
detecting devices without documenting the reasons for overriding the
system.
What GAO Recommends:
To improve internal controls, GAO recommends modifying the Security
Assistance Management Information System so that it validates country
requisitions based on the requisitioned item‘s national stock number,
establishing policies for recovering classified or controlled parts
that are shipped erroneously, establishing policies for validating
modifications made to the system, periodically testing the system‘s
logic, and establishing a policy to document decisions to override the
system.
The department fully concurred with four recommendations and partially
with our recommendation to periodically test the system‘s logic,
citing a program being implemented that will test system
modifications. However, we do not believe this program will address
system logic flaws.
www.gao.gov/cgi-bin/getrpt?GAO-03-664.
To view the full report, including the scope and methodology, click on
the link above. For more information, contact William M. Solis, (202)
512-8365, solisw@gao.gov.
[End of section]
Contents:
Letter:
Results in Brief:
Background:
Internal Controls over Foreign Military Sales Are Not Adequate:
Conclusions:
Recommendations for Executive Action:
Agency Comments and Our Evaluation:
Scope and Methodology:
Appendix I: Comments from the Department of Defense:
Figures:
Figure 1: The Foreign Military Sales Process for Air Force Classified
and Controlled Spare Parts:
Figure 2: Example of a National Stock Number Showing Federal Supply
Class and National Item Identification Number:
Figure 3: Example of How a Restricted Item Was Requisitioned and
Shipped:
United States General Accounting Office:
Washington, DC 20548:
July 29, 2003:
The Honorable Tom Harkin
United States Senate:
Dear Senator Harkin:
From 1990 through 2001, the Department of Defense (DOD) delivered over
$138 billion in services and defense articles--including classified and
controlled spare parts[Footnote 1]--to foreign governments through the
foreign military sales programs administered by the military services.
The management of classified and controlled spare parts is critical
given their potential to be used against U.S. interests if the parts
should fall into the hands of countries or terrorist organizations that
are ineligible to receive them.
You asked us to review the adequacy of key internal control activities
aimed at preventing countries from requisitioning and receiving
classified spare parts that they are ineligible to receive. Internal
control activities include the policies, procedures, and processes that
are essential for the proper stewardship of and accountability for
government resources and for achieving effective and efficient program
results. In our review, the key internal control activities we reviewed
were in the areas of:
* restricting access to classified and controlled spare parts to
countries that are eligible to receive them,
* validating restrictions loaded into the Air Force's Security
Assistance Management Information System[Footnote 2] and testing the
system's logic, and:
* maintaining proper documentation for overriding system restrictions.
We focused our efforts on the Air Force because it sold 53 million
items, valued at over $1.7 billion, to foreign countries during fiscal
years 2001 and 2002. The 53 million items included 1.4 million spare
parts, valued at $299 million, that were classified or controlled spare
parts. We plan to address Army and Navy policies, processes, and
procedures relating to these sales in separate reviews.
To accomplish our review, we concentrated our efforts on classified and
controlled spare parts that foreign countries requisitioned from the
Air Force under blanket order cases,[Footnote 3] which define a
country's eligibility to requisition spare parts. We obtained records
from the Air Force Security Assistance Center on all classified and
controlled spare parts that were purchased under blanket orders and,
according to Air Force records, were shipped to foreign countries for
the period October 1, 1997, through July 31, 2002. A preliminary test
of 72,057 requisitions, valued at $679.5 million, identified 525
requisitions, valued at $9.7 million, that appeared to violate Security
Assistance Management Information System restrictions. We obtained
satisfactory explanations from Air Force Security Assistance Center
officials for all except 200 of the requisitions, valued at $ 5.6
million. We reviewed 123 of these requisitions,[Footnote 4] valued at
over $4.4 million, to determine the reasons classified and controlled
items were released for shipment. Further details are in the Scope and
Methodology section of this report.
Results in Brief:
The Air Force's internal controls for its foreign military sales
program using blanket orders are not adequate, placing classified and
controlled spare parts at risk of being shipped to countries not
authorized to receive them. The internal control inadequacies we
identified are as follows:
* Foreign country requisitions for classified and controlled spare
parts were erroneously approved by the Air Force's Security Assistance
Management Information System based on an incorrect federal supply
class.[Footnote 5] The Security Assistance Management Information
System approves items for shipment based in part on an item's federal
supply class--not the item's entire national stock number. Thus, a
country can obtain restricted spare parts by using an incorrect, but
unrestricted, supply class with an item's correct national item
identification number. We found that because the Security Assistance
Management Information System was not properly programmed, it
erroneously validated 35 of the 123 selected requisitions we reviewed
because although countries used incorrect supply classes for the
requisitioned items, they used unrestricted supply class numbers. For
example, one country ordered a controlled outline sequencer used on
various aircraft by using a supply class that was incorrect, but
unrestricted, for the part it requisitioned. After the system validated
the erroneous federal supply class, the item manager[Footnote 6]
changed the supply class so that it was consistent with the
requisitioned part, and the restricted part was shipped. Although Air
Force Security Assistance Center officials were able to describe the
actions they would take to recover a classified or controlled item that
was erroneously shipped, neither the Air Force nor the center had
written policies or procedures in place for recovering the items that
had been shipped in error.
* The Air Force has not validated modifications to the Security
Assistance Management Information System that restrict the parts that
countries can requisition and has not tested the system since 1998 to
ensure that it is working properly. GAO, Office of Management and
Budget, and DOD internal control standards require that systems such as
the Air Force's be periodically validated and tested to ensure that
they are working as intended. Because modifications were not validated,
the Air Force did not detect improperly made modifications to the
system, and foreign countries were able to requisition and obtain
controlled spare parts that, at the time, the Air Force was trying to
restrict. For example, Air Force programmers were instructed to enter
restrictions into the information system that would prevent countries
from using blanket orders to requisition controlled bushings.[Footnote
7] Of the 123 cases we reviewed, we found 18 instances in which
countries requisitioned and received controlled bushings because
managers had entered the restrictions in the wrong area of the system.
Although Air Force officials subsequently told us that the bushings had
been improperly restricted, this example demonstrates the need to
verify that system modifications are made correctly. Because the
system's logic has not been tested since 1998, the Air Force cannot be
assured that the system accurately reviews current requisitions for
compliance with restrictions.
* Command country managers did not always document reasons for
overriding Security Assistance Management Information System or foreign
military sales case manager[Footnote 8] recommendations in case files.
For 19 of the 123 requisitions we reviewed, command country managers
overrode the system recommendations and shipped classified and
controlled spare parts without documenting the reasons for overriding
the system. For example, a command country manager overrode the system
and shipped four classified target-detecting devices without
documenting the reasons for overriding the system. In another example,
a command country manager authorized the shipment of a controlled
communications security part that the system and the foreign military
sales case manager had indicated should not be shipped. The case file
contained no documentation explaining why the spare part was
nevertheless shipped.
We are recommending that the Secretary of Defense instruct the
Secretary of the Air Force to require responsible officials to (1)
modify the Security Assistance Management Information System so that it
validates country requisitions based on the requisitioned item's entire
national stock number, (2) establish policies and procedures for
recovering classified or controlled items that are erroneously shipped,
(3) verify restriction changes made to the system to ensure that the
changes were properly made, (4) periodically test the system's logic
for restricting requisitions to ensure that it is working correctly,
and (5) establish a policy for command country managers to document the
basis for their decisions to override the system or recommendations
made by foreign military sales case managers.
In commenting on a draft of this report, DOD fully concurred with four
of our recommendations and cited corrective actions that had been taken
or were planned. However, with regard to our recommendation to
periodically test the system to ensure that its logic for restricting
requisitions is working correctly, the department partially concurred,
stating that a program is being implemented to test new and old
modifications placed in the system to ensure that they are accurate. We
believe that just testing the accuracy of the modification will not
ensure that the system's logic for restricting requisitions is
operating correctly. We therefore continue to believe that the system's
logic for restricting requisitions should be periodically tested to
ensure that it is working correctly. Otherwise, classified and
controlled spare parts that are requisitioned may continue to be
erroneously released.
Background:
The transfer of defense items to friendly nations and allies is an
integral component in both U.S. national security and foreign policy.
The U.S. government authorizes the sale or transfer of military
equipment, including spare parts, to foreign nations either through
government-to-government agreements or through direct sales from U.S.
manufacturers. The Arms Export Control Act[Footnote 9] and Foreign
Assistance Act of 1961,[Footnote 10] as amended, authorize the DOD
foreign military sales program.
The Department of State sets the overall policy concerning which
countries are eligible to participate in the foreign military sales
program. DOD, through the military services, enters into foreign
military sales agreements with individual countries. The Air Force
Security Assistance Center, which is an activity of the Air Force
Materiel Command, is responsible for the administration of the Air
Force's foreign military sales program.
The center's responsibilities start with the initial negotiation of the
foreign military sale and end with the delivery of parts and completion
of all financial aspects of the agreements. The center uses an
automated management information system, the Security Assistance
Management Information System, to support its management of the program
with accurate and timely information. For blanket order cases, the
system uses criteria such as an item's national item identification
number, a federal supply class, or a federal supply group[Footnote 11]
to restrict the parts available to foreign military sales customers.
Once the system has verified a country's eligibility and approved a
requisition, the requisition is sent to a supply center to be filled
and shipped. The overall foreign military sales process, as it applies
to the Air Force, is shown in figure 1.
Figure 1: The Foreign Military Sales Process for Air Force Classified
and Controlled Spare Parts:
[See PDF for image]
[End of figure]
This report addresses the portion of the process relating to the Air
Force's approval or disapproval of foreign countries' requisitions for
classified and controlled spare parts under blanket order
cases.[Footnote 12] Blanket orders are for a specific dollar value and
generally cover classes of parts that a country may need rather than a
specific item within a class. Under blanket orders, the Air Force
restricts classes of items, such as munitions and nuclear spare parts,
from being requisitioned.
Internal Controls over Foreign Military Sales Are Not Adequate:
The Air Force's internal controls for foreign military sales using
blanket orders are not adequate to prevent countries from ordering and
receiving classified and controlled spare parts that they are not
eligible to receive. We found that (1) controls based on supply class
restrictions were ineffective and resulted in erroneously approved
requisitions for shipment, and that written policies for recovering the
erroneously shipped items did not exist; (2) the Air Force did not
validate modifications to its Security Assistance Management
Information System related to blanket orders or test the system's logic
for restricting requisitions, and (3) command country managers did not
always document reasons for overriding either the Security Assistance
Management Information System or foreign military sales case manager
recommendations not to ship classified spare parts. As a result of
these inadequate internal controls, classified and controlled spare
parts were shipped to countries not authorized to receive them. The Air
Force Security Assistance Center has taken or plans to take actions to
correct these issues.
Use of the Federal Supply Class Resulted in Erroneously Approved
Requisitions:
Foreign country requisitions for classified and controlled spare parts
were erroneously validated, as a result of an incorrect federal supply
class, by the Air Force's Security Assistance Management Information
System. The Air Force attempts to prevent countries from obtaining
classified and controlled spare parts by restricting them from
receiving spare parts that belong to selected federal supply classes.
Included in the national stock number is a four-digit federal supply
class (see fig. 2), which may be shared by thousands of items. The
national stock number also contains a nine-digit national item
identification number that is unique for each item in the supply
system. A country can obtain a classified or controlled spare part by
using an incorrect, but unrestricted, supply class with an item's
correct national item identification number.
Figure 2: Example of a National Stock Number Showing Federal Supply
Class and National Item Identification Number:
[See PDF for image]
[End of figure]
We found that because the Security Assistance Management Information
System was not properly programmed, it erroneously validated 35 blanket
order requisitions (of the 123 in our review), even though an incorrect
supply class number was used, because the countries used supply classes
that were not restricted. For example, in one case, the Air Force
restricted countries from requisitioning parts belonging to the 1377
federal supply class (cartridge-and propellant-actuated devices and
components) on blanket orders. The restriction included an outline
sequencer (national stock number -1377010539320) used on ejection seats
for various aircraft. The country ordered the sequencer using national
stock number 1680010539320. Because supply class 1680 (miscellaneous
aircraft accessories and components) was not restricted and the
Security Assistance Management Information System did not verify that
1680 was the correct supply class for national item identification
number 010539320, the system approved the requisition. Had the system
validated the entire 13-digit national stock number, it would have
found that the number was incorrect and would not have approved the
requisition. Subsequently, the item manager recognized that 1680 was
not the correct federal supply class and corrected the supply class to
1377 before the part was shipped. This example is summarized in figure
3. Air Force officials were unaware of this situation until our review
identified the problem.
Figure 3: Example of How a Restricted Item Was Requisitioned and
Shipped:
[See PDF for image]
[End of figure]
In another case, involving the restricted 1377 federal supply class, a
country ordered a restricted battery power supply for the F-16 aircraft
using national stock number 6130013123511. Because supply class 6130
(nonrotating electrical converters) was not restricted and the Security
Assistance Management Information System did not verify the entire 13-
digit national stock number, the requisition was approved. The Air
Force shipped the restricted battery power supply to the country.
Neither the Air Force nor the center had written policies or procedures
in place for recovering the items erroneously shipped. Without these
types of policies and procedures, the Air Force cannot be assured that
appropriate steps will be taken to recover the parts. Air Force
Security Assistance Center officials agreed that the supply class
restrictions alone were ineffective and could be bypassed by use of
inaccurate supply class information.
Failure to Validate the System Could Allow Unauthorized Shipments of
Classified Spare Parts:
The Air Force has not validated modifications to the Security
Assistance Management Information System that restrict parts that
countries can requisition, and has not tested the system's logic for
restricting requisitions since 1998 to ensure that it is working
properly. As a result, modifications that were not properly made went
undetected, and foreign countries were able to requisition and obtain
controlled spare parts that the Air Force was trying to restrict.
For example, the Air Force instructed programmers to modify a table of
restrictions in the Security Assistance Management Information System
to prevent certain countries from using blanket orders to requisition
controlled bushings in the 5365 supply class. Although Air Force
Security Assistance Center officials subsequently told us that the
bushings had been improperly restricted, we found that, for 18 of the
123 requisitions we reviewed, countries had ordered and received the
bushings, because the Security Assistance Management Information System
was incorrectly programmed and did not identify the requisitions as
requiring a review by command country managers. After we brought the
transactions to the attention of Air Force Security Assistance Center
officials, they investigated and found that programmers had entered the
restrictions in the wrong area of the system. Because the Air Force had
not validated that system modifications were properly made, the system
had approved the requisitions. Although the Air Force later determined
that the bushings should not have been restricted, this example
nevertheless demonstrates the need to validate system changes.
The Air Force does not periodically test the Security Assistance
Management Information System to ensure that it accurately reviews
requisitions for compliance with restrictions. For example, when the
system is working correctly, it will identify restrictions relating to
parts, such as ammunition or nuclear spare parts, and will disapprove
requisitions from countries that are ineligible to order these parts.
Air Force Security Assistance Command officials said that the system
had not been tested since 1998 to ensure that it accurately reviews
requisitions for compliance with restrictions. When we tested the
system's ability to restrict items based on their federal supply class,
we found that the system did not always perform as intended. As
discussed earlier, the system did not perform as intended because
countries could requisition and obtain classified and controlled spare
parts using an incorrect, but unrestricted, federal supply class with
an item's correct national item identification number.
In the Federal Information System Controls Audit Manual,[Footnote 13]
which lists internal control activities for information systems, one of
the control activities listed involves the testing of new and revised
software to ensure that it is working correctly. In addition,
management of federal information resources[Footnote 14] rules require
agencies to establish information system management oversight
mechanisms that provide for periodic reviews to determine how mission
requirements might have changed and whether the information system
continues to fulfill ongoing and anticipated mission requirements.
Further, DOD's ADP Internal Control Guideline[Footnote 15]at the time
stated that periodic reviews of systems should be conducted to
determine if they operate as intended.
According to Air Force Security Assistance Center officials, there have
been few changes to the table of restrictions in the system. However,
they did agree that existing changes need to be validated and were
working to accomplish this. Based on our observations, the Air Force's
failure to validate modifications and test model logic is in part due
to an unquestioning confidence in the Security Assistance Management
Information System's ability to correctly restrict the requisitioning
of classified and controlled spare parts.
Documentation for Overriding System and Item Manager Recommendations Is
Inadequate:
Command country managers did not always document reasons for overriding
Security Assistance Management Information System or foreign military
sales case manager recommendations not to ship classified spare parts.
According to the Standards for Internal Control in the Federal
Government,[Footnote 16] all transactions and other significant events
need to be clearly documented. The standards state that such
documentation should be properly managed and maintained and should be
readily available for examination.
Of the 123 requisitions we reviewed, the Security Assistance Management
Information System identified 36 requisitions for command country
manager review. For 19 of the requisitions, command country managers
overrode the system recommendations and shipped classified and
controlled spare parts without documenting the reasons for overriding
the system. For example, the command country manager overrode the
system and shipped four classified target-detecting devices, but the
case file did not contain any documentation explaining why the command
country manager did so, and managers we queried could not provide an
explanation for the override. Similarly, a command country manager
authorized the shipment of a controlled communications security part
that the Security Assistance Management Information System and foreign
military sales case manager recommended not be shipped. The case file
contained no documentation explaining why the spare part was shipped.
According to Air Force officials, there were no written policies or
procedures for documenting decisions to override the system or foreign
military sales case manager recommendations. The Air Force Security
Assistance Center plans to issue guidance to command country managers
to document system bypass authorizations.
Conclusions:
The Air Force has not established nor does it maintain effective
internal controls over foreign military sales sold under blanket
orders. Specifically, internal controls involving use of the federal
supply class to restrict requisitions, the modification of tables
restricting the access to classified and controlled spare parts in the
Air Force's system, testing of the system, and documentation of system
overrides were inadequate. Without adequate internal controls,
classified and controlled spare parts may be released to countries that
are ineligible to receive them, thereby providing military technology
to countries that might use it against U.S. national interests.
Further, without written policies detailing the steps to be taken when
the Air Force becomes aware of an erroneous shipment, the Air Force's
ability to recover erroneously shipped classified or controlled parts
is lessened.
Recommendations for Executive Action:
To improve internal controls over the Air Force's foreign military
sales program and to minimize countries' abilities to obtain classified
or controlled spare parts under blanket orders for which they are not
eligible,
we are recommending that the Secretary of Defense instruct the
Secretary of the Air Force to require the appropriate officials to take
the following steps:
* Modify the Security Assistance Management Information System so that
it validates country requisitions based on the requisitioned item's
complete national stock number.
* Establish policies and procedures for recovering classified or
controlled items that are erroneously shipped.
* Establish polices and procedures for validating modifications made to
the Security Assistance Management Information System to ensure that
the changes were properly made.
* Periodically test the Security Assistance Management Information
System to ensure that the system's logic for restricting requisitions
is working correctly.
* Establish a policy for command country managers to document the basis
for their decisions to override Security Assistance Management
Information System or foreign military sales case manager
recommendations.
Agency Comments and Our Evaluation:
In commenting on a draft of this report, DOD fully concurred with four
of our recommendations and cited corrective actions that had been taken
or were planned, and it partially concurred with another
recommendation. Specifically, with regard to our recommendation to
modify the Security Assistance Management Information System to
validate country requisitions based on the requisitioned item's
national stock number, the department said that it has had a change in
place since January 2003 to validate requisitions based on an item's
national stock number. We believe that the department's change is
responsive to findings that we brought to the Air Force's attention in
December 2002. However, because our audit work was completed when the
Air Force brought this change to our attention, we did not have an
opportunity to validate the change. The department also stated that the
Air Force (1) will write a policy memorandum on procedures for
recovering classified or controlled items that are erroneously shipped,
(2) will issue a policy memorandum directing that all modifications to
the system be validated in accordance with existing policies and
procedures, and (3) has issued a policy memorandum specifying those
staff who can input transactions for overriding restrictions and
requiring that waiver approvals for using the bypasses be documented.
With regard to our recommendation to periodically test the system to
ensure that its logic for restricting requisitions is working
correctly, DOD partially concurred. The department said that a program
is being implemented to test new modifications placed in the system and
that the testing of old modifications would be an ongoing effort.
Testing the modifications placed in the system will ensure that they
were made correctly. However, just testing the modifications will not
ensure that the system is correctly applying its logic to the
modifications in order to restrict requisitions for items that
countries are not eligible to receive. For example, testing
modifications may not identify logic problems, such as the one we
identified involving the approval of requisitions based on an item's
federal supply class. Thus, we continue to believe that the system's
logic for restricting requisitions should be periodically tested to
ensure that it is working correctly. Otherwise, classified and
controlled spare parts that are requisitioned may continue to be
erroneously released.
DOD's comments appear in appendix I.
Scope and Methodology:
To determine the adequacy of the Department of the Air Force's key
internal control activities aimed at preventing countries from
requisitioning and receiving classified and controlled spare parts that
they are ineligible to receive, we held discussions with officials from
the Under Secretary of Defense (Policy Support) International Security
Program Directorate; Deputy Under Secretary of the Air Force
(International Affairs); and the Air Force Materiel Command's Security
Assistance Center, Dayton, Ohio. We discussed the officials' roles and
responsibilities, the criteria and guidance they used in performing
their duties, and the controls used to restrict countries from
receiving parts that they are not eligible to requisition. At the Air
Force Security Assistance Center and Air Logistics Centers at Warner
Robins Air Force Base, Macon, Georgia, and Tinker Air Force Base,
Oklahoma City, Oklahoma, we interviewed military and civilian officials
to obtain an overview of the requisitioning and approval processes
applicable to classified and controlled spare parts.
To test the adequacy of the internal controls, we obtained records from
the Air Force Security Assistance Center on all classified and
controlled spare parts that were purchased under blanket orders and
approved for shipment to foreign countries for the period October 1,
1997, through July 31, 2002. We limited our study to blanket orders
because defined orders and Cooperative Logistics Supply Support
Agreements specified the parts that countries were entitled to
requisition by national stock number. In contrast, only Security
Assistance Management Information System restrictions limited the parts
that countries were entitled to order under blanket orders. The records
covered 444 blanket orders that resulted in 72,057 requisitions for
classified and controlled spare parts. Specifically, we took the
following steps:
* We tested the Security Assistance Management Information System by
applying the system's restrictions that applied to classified and
controlled spare parts that were shipped under blanket orders, and
identified 525 requisitions that appeared to violate the restrictions.
We obtained satisfactory explanations from the Air Force Security
Assistance Command for all except 200 of the requisitions, which were
shipped despite restrictions.
* We reviewed case files for 123 requisitions,[Footnote 17] including
87 requisitions for which the Security Assistance Management
Information System had approved the shipment of classified and
controlled spare parts without referring the requisitions to command
country managers to determine if the requisitions should be approved.
We followed up on these requisitions by consulting with command country
managers.
* The case files that we reviewed included 36 requisitions that the
Security Assistance Management Information System had referred to
command country managers for review to determine if they had documented
their decisions to override the system's decisions. We followed up on
these reviews through discussions with command country managers.
We conducted our review from May 2002 through May 2003 in accordance
with generally accepted government auditing standards.
As arranged with your office, unless you publicly announce its contents
earlier, we plan no further distribution of this report until 30 days
from the date of this letter. At that time, we will send copies of this
report to the Secretary of Defense; the Secretary of the Air Force; the
Director, Office of Management and Budget; and interested congressional
committees. We will also make copies available to others upon request.
In addition, the report will be available at no charge on the GAO Web
site at http://www.gao.gov.
Please contact me on (202) 512-8365, if you or your staff have any
questions concerning this report. Key contributors to this report were
Lawson (Rick) Gist, Jr.; Jennifer Thomas; Arthur James, Jr.; Lou
Modliszewski; Susan Woodward; John Lee; and Kristy Lehmann.
Sincerely yours,
William M. Solis, Director
Defense Capabilities and Management:
Signed by William M. Solis:
[End of section]
Appendix I: Comments from the Department of Defense:
DEFENSE SECURITY COOPERATION AGENCY:
WASHINGTON, DC 20301-2800:
JUL 11 2003:
In reply refer to: I-03/007485:
Mr. William M. Solis, Director Defense Capabilities and Management U.S.
General Accounting Office:
441 G Street, N.W. Washington, D.C. 20548:
Dear Mr. Solis:
This is the Department of Defense (DoD) response to the GAO Draft
report, "Foreign Military Sales: Improved Air Force Controls Could
Prevent Unauthorized Shipments of Classified and Controlled Spare Parts
to Foreign Countries" dated May 23, 2003 (GAO Code 350223/GAO-03-664).
The Department reviewed the draft report and concurs in principle with
the recommendation that the Secretary of Defense instruct the Secretary
of the Air Force to require the appropriate officials to take
corrective measures that ensure adequate controls are in place to
prevent future unauthorized shipments of classified and/or controlled
spare parts to foreign countries.
Comments addressing each of the five GAO draft report recommendations
are included in the enclosure. We also provided the GAO with technical
comments regarding the draft report under separate cover.
The Department appreciates the opportunity to comment on the draft
report. My point of contact on this matter is Ms. Kathy Robinson. She
may be contacted by email: kathy.robinson@dsca.tnil or by telephone at
(703) 601-4368.
Sincerely,
TOME H. WALTERS, JR. LIEUTENANT GENERAL, USAF DIRECTOR:
Signed by TOME H. WALTERS, JR.:
Attachment As stated:
GAO DRAFT REPORT - DATED MAY 23, 2003 GAO CODE 350223/GAO-03-664:
"FOREIGN MILITARY SALES: IMPROVED AIR FORCE CONTROLS COULD PREVENT
UNAUTHORIZED SHIPMENTS OF CLASSIFIED AND CONTROLLED SPARE PARTS TO
FOREIGN COUNTRIES":
DEPARTMENT OF DEFENSE COMMENTS TO THE GAO RECOMMENDATIONS:
RECOMMENDATION 1: The GAO recommended that the Secretary of Defense
instruct the Secretary of the Air Force to require that the appropriate
officials modify the Security Assistance Management Information System
(SAMIS) so that it validates country requisitions based on the
requisitioned item's complete national stock number. (p. 15/GAO Draft
Report):
DOD RESPONSE Concur. A change has been in place since 29 Jan 03 whereby
there is a check for supply class updates prior to requisition
screening against edits in SAMIS table 105. It was tested in accordance
with SAMIS procedures (SAMIS 01 10-3). This system modification
accomplishes validation of country requisitions based on the
requisitioned item's national stock number. The final audit report
should reflect that AFSAC has accomplished this change and that the
requirement for modifying the system is no longer an issue. In
addition, the new Case Execution Management Information System (CEMIS)
being developed by DSCA and the Military Departments has built in
numerous requisition validation edits that will reject unauthorized
orders from further processing, and thus preclude these types of
occurrences in the future. Anticipate CEMIS will be ready for initial
deployment in FY 07 timeframe.
RECOMMENDATION 2: The GAO recommended that the Secretary of Defense
instruct the Secretary of the Air Force to require that the appropriate
officials establish policies and procedures for recovering classified
or controlled items that are erroneously shipped. (p. 15/GAO Draft
Report):
DOD RESPONSE: Concur. Recovery of a classified or controlled item that
was erroneously released and shipped to an unauthorized customer should
be on an exception basis that is to apply when benefits to national
security exceed financial and other costs of recovery. The AF can
request the Purchaser submit a Supply Discrepancy Report for a
misdirected shipment (per DLAI 4140.55, enclosure 7) for the item and
then have the established processes for item return and customer
reimbursement apply. If the customer refuses to return the item, then
the possibility of seeking DSCA suspension of the customer's FMS
program may be considered. SAF/IAPX will write a policy memorandum and
coordinate with DSCA and the legal offices as required. Estimated
completion date is 15 July 2003.
RECOMMENDATION 3: The GAO recommended that the Secretary of Defense
instruct the Secretary of the Air Force to require that the appropriate
officials establish policies and procedures for validating
modifications made to the Security Assistance Management Information
System to ensure that the changes were properly made. (p. 15/GAO Draft
Report):
DOD RESPONSE: Concur. There have been few, if any, policy directives
that have generated modifications to SAMIS table 105 (which was the
focus of the audit) in recent years. There is a lack of narrative
documentation for edits in the table and some of the existing edits
need to be validated and necessary narrative entries made. This is an
ongoing effort and testing will be done if changes are required.
Policies and procedures are in place for all modifications to SAMIS
(per 01 10-1 - SAMIS Programming Requirements Processing and Input, and
01 10-3 - SAMIS Testing Procedures). Narrative rationale will be
required for new entries to Table 105. The AFSAC Security Assistance
Policy Office will be sending a policy memorandum directing applicable
process owners and Offices of Primary Responsibility to adhere to this
requirement. The estimated completion date for the policy memorandum is
15 July 2003.
RECOMMENDATION 4: The GAO recommended that the Secretary of Defense
instruct the Secretary of the Air Force to periodically test the
Security Assistance Management Information System to ensure that the
system's logic for restricting requisitions is working correctly. (p.
15/GAO Draft Report):
DOD RESPONSE: Partially Concur. To help prevent unauthorized release of
classified and controlled spare parts to foreign countries, testing for
SAMIS table 105 will take place. The testing will occur when 1) there
are changes to the SAMIS requisition logic, 2) there is a change in the
system logic of SAMIS table 105 itself, and 3) there are modifications
to SAMIS table 105 as a consequence of on-going verification of SAMIS
table 105 entries. Prevention of unauthorized asset releases is
accomplished via the SAMIS table 105 edits in conjunction with proper
control of the transactions that allow these edits to be bypassed.
Until recently, access to bypass transactions was only partially
restricted. We have since established bypass oversight control whereby
only designated process owners may input bypasses, and only upon
obtaining waiver approval. Guidance for mandatory formal releasability
reviews of bypass candidate items is expected to be signed out by 31
July 03. A change is in place now is to check the Federal Stock Class
of a requisition for currency prior to screening against the edits in
SAMIS table 105 (the logic for this has been tested), and it is updated
prior to the screening if necessary. A program that will verify
accuracy of all new entries in SAMIS Table 105 is estimated to be
operational by 14 July 03.
RECOMMENDATION 5: The GAO recommended that the Secretary of Defense
instruct the Secretary of the Air Force to require that the appropriate
officials establish a policy for command country managers to document
the basis for their decisions to override Security Assistance
Management Information System or foreign military sales case manager
recommendations. (p. 15/GAO Draft Report):
DOD RESPONSE: Concur. AFSACAA policy memorandum written 13 May 03
restricts who can input bypass transactions for over-riding edit
restrictions in SAMIS Table 105 and
requires that waiver approvals for using the bypasses be documented
both electronically in SAMIS requisition narratives, and as hard copy
(by the waiver request initiator) in the case files. The final audit
report should reflect that AFSAC has accomplished this change and that
establishing documentation policy is no longer an issue.
[End of section]
FOOTNOTES
[1] Classified spare parts are restricted for national security
reasons; controlled parts are not classified but contain military
technology/applications or are controlled cryptographic parts.
[2] The Security Assistance Management Information System is the Air
Force's information system used to verify that countries are eligible
to requisition and receive spare parts.
[3] Hereafter referred to as blanket orders.
[4] We initially reviewed 2 requisitions involving controlled
communications security items and subsequently added 119 controlled and
2 confidential requisitions to the review.
[5] The federal supply classification is a 4-digit number that
designates a general commodity grouping, such as communications
security equipment and components. Each part within a supply class has
a unique 9-digit number--called the national item identification
number--that differentiates each individual item in the department's
inventory system. Together, the two numbers form a 13-digit national
stock number.
[6] Item managers at the Air Force's air logistics centers are
responsible for managing items in the Air Force's supply system.
[7] A bushing is cylindrical metal sleeve used to reduce friction.
[8] Command country managers and foreign military sales case managers
at the Air Force Security Assistance Center are respectively
responsible for managing the sale of items to countries and for
monitoring a particular type of case, such as a blanket order.
[9] Public Law 90-629.
[10] Public Law 87-195.
[11] The first two digits of the federal supply class are called a
supply group and include several similar federal supply classes.
[12] Under the foreign military sales program, the Air Force also uses
defined order cases (which cover specific items and quantities) and
Cooperative Logistics Supply Support Agreements (which allow foreign
countries to become partners in the military service's logistics
system). The service purchases items for use of the foreign governments
and monitors the foreign governments' demand for those items to ensure
that an adequate level of support is available.
[13] U.S. General Accounting Office, Federal Information System
Controls Audit Manual, GAO/AIMD-12.19.6 (Washington, D.C.: Jan. 1999).
[14] Office of Management and Budget, Management of Federal Information
Resources (Washington, D.C.: Nov. 2000).
[15] Department of Defense, ADP Internal Control Guideline (July 1988).
[16] U.S. General Accounting Office, Standards for Internal Control in
the Federal Government, GAO/AIMD-00.21.3.1 (Washington, D.C.: Nov.
1999).
[17] We initially reviewed 2 requisitions involving controlled
communications security items and subsequently selected 121 additional
requisitions to review. We selected requisitions from Bahrain, Egypt,
Greece, Israel, Italy, Jordan, Morocco, Saudi Arabia, South Korea,
Taiwan, Thailand, Tunisia, and Turkey and for specific types of
equipment. Two of the requisitions were for confidential items; the
remaining 121 requisitions were for controlled items.
GAO's Mission:
The General Accounting Office, the investigative arm of Congress,
exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability
of the federal government for the American people. GAO examines the use
of public funds; evaluates federal programs and policies; and provides
analyses, recommendations, and other assistance to help Congress make
informed oversight, policy, and funding decisions. GAO's commitment to
good government is reflected in its core values of accountability,
integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains
abstracts and full-text files of current reports and testimony and an
expanding archive of older products. The Web site features a search
engine to help you locate documents using key words and phrases. You
can print these documents in their entirety, including charts and other
graphics.
Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as "Today's Reports," on its
Web site daily. The list contains links to the full-text document
files. To have GAO e-mail this list to you every afternoon, go to
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order
GAO Products" heading.
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. General Accounting Office
441 G Street NW,
Room LM Washington,
D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov
Automated answering system: (800) 424-5454 or (202) 512-7470:
Public Affairs:
Jeff Nelligan, managing director, NelliganJ@gao.gov (202) 512-4800 U.S.
General Accounting Office, 441 G Street NW, Room 7149 Washington, D.C.
20548:
