This is the accessible text file for GAO report number GAO-03-664 entitled 'Foreign Military Sales: Improved Air Force Controls Could Prevent Unauthorized Shipments of Classified and Controlled Spare Parts to Foreign Countries' which was released on August 28, 2003. This text file was formatted by the U.S. General Accounting Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. On January 8, 2004, this document was revised to add various footnote references missing in the text of the body of the document. Report to the Honorable Tom Harkin, U.S. Senate: United States General Accounting Office: GAO: July 2003: Foreign Military Sales: Improved Air Force Controls Could Prevent Unauthorized Shipments of Classified and Controlled Spare Parts to Foreign Countries: GAO-03-664: GAO Highlights: Highlights of GAO-03-664, a report to the Honorable Tom Harkin, U.S. Senate Why GAO Did This Study: From 1990 through 2001, the Department of Defense delivered over $138 billion in services and defense articles—including classified and controlled parts—to foreign governments through its foreign military sales programs. Classified spare parts are restricted for national security reasons, while controlled parts contain technology that the military does not want to release. GAO was asked to review the Air Force’s internal controls aimed at preventing countries from requisitioning and receiving classified or controlled spare parts that they are ineligible to receive. What GAO Found: The Air Force’s internal controls for its foreign military sales program using blanket orders are not adequate, placing classified and controlled spare parts at risk of being shipped to countries not authorized to receive them. * The Air Force’s system has erroneously approved foreign country requisitions for classified and controlled spare parts based on incorrect federal supply classes. The system approves items for shipment based in part on an item’s federal supply class—not the item’s entire national stock number, which is a combination of the supply class number and a part number unique to the item. GAO found that because that system was not properly programmed, it erroneously approved 35 of 123 selected requisitions reviewed, because countries used unrestricted supply class numbers. For example, one country ordered a controlled outline sequencer used on various aircraft by using a supply class that was unrestricted, but incorrect for the part it requisitioned. Because supply class 1680 was not restricted and the system did not verify that 1680 was the correct supply class for national item identification number 010539320, the system approved the requisition. Had the system validated the entire 13-digit national stock number, it would have found that the number was incorrect and would not have approved the requisition. In addition, the Air Force has no written policies or procedures in place for recovering items that have been shipped in error. * The Air Force has not validated modifications to the Security Assistance Management Information System that restrict parts available to foreign countries and has not tested the system since 1998 to ensure that it is working properly. Because modifications were not validated, the Air Force did not detect improperly made modifications to the system, and foreign countries were able to requisition and obtain controlled spare parts that, at the time, the Air Force was trying to restrict. GAO identified 18 instances in which countries requisitioned and received a controlled part for which they were not eligible because programmers had entered the restrictions in the wrong area of the system. Although Air Force officials subsequently told us that the part was improperly restricted, this example nevertheless demonstrates the need to validate system changes. * Air Force command country managers did not always document reasons for overriding the recommendations of the system or the foreign military sales case manager. For 19 of the 123 requisitions GAO reviewed, command country managers overrode the system recommendations and shipped classified and controlled spare parts without documenting the reasons for overriding the system. For example, a command country manager overrode the system and shipped four classified target- detecting devices without documenting the reasons for overriding the system. What GAO Recommends: To improve internal controls, GAO recommends modifying the Security Assistance Management Information System so that it validates country requisitions based on the requisitioned item’s national stock number, establishing policies for recovering classified or controlled parts that are shipped erroneously, establishing policies for validating modifications made to the system, periodically testing the system’s logic, and establishing a policy to document decisions to override the system. The department fully concurred with four recommendations and partially with our recommendation to periodically test the system’s logic, citing a program being implemented that will test system modifications. However, we do not believe this program will address system logic flaws. www.gao.gov/cgi-bin/getrpt?GAO-03-664. To view the full report, including the scope and methodology, click on the link above. For more information, contact William M. Solis, (202) 512-8365, solisw@gao.gov. [End of section] Contents: Letter: Results in Brief: Background: Internal Controls over Foreign Military Sales Are Not Adequate: Conclusions: Recommendations for Executive Action: Agency Comments and Our Evaluation: Scope and Methodology: Appendix I: Comments from the Department of Defense: Figures: Figure 1: The Foreign Military Sales Process for Air Force Classified and Controlled Spare Parts: Figure 2: Example of a National Stock Number Showing Federal Supply Class and National Item Identification Number: Figure 3: Example of How a Restricted Item Was Requisitioned and Shipped: United States General Accounting Office: Washington, DC 20548: July 29, 2003: The Honorable Tom Harkin United States Senate: Dear Senator Harkin: From 1990 through 2001, the Department of Defense (DOD) delivered over $138 billion in services and defense articles--including classified and controlled spare parts[Footnote 1]--to foreign governments through the foreign military sales programs administered by the military services. The management of classified and controlled spare parts is critical given their potential to be used against U.S. interests if the parts should fall into the hands of countries or terrorist organizations that are ineligible to receive them. You asked us to review the adequacy of key internal control activities aimed at preventing countries from requisitioning and receiving classified spare parts that they are ineligible to receive. Internal control activities include the policies, procedures, and processes that are essential for the proper stewardship of and accountability for government resources and for achieving effective and efficient program results. In our review, the key internal control activities we reviewed were in the areas of: * restricting access to classified and controlled spare parts to countries that are eligible to receive them, * validating restrictions loaded into the Air Force's Security Assistance Management Information System[Footnote 2] and testing the system's logic, and: * maintaining proper documentation for overriding system restrictions. We focused our efforts on the Air Force because it sold 53 million items, valued at over $1.7 billion, to foreign countries during fiscal years 2001 and 2002. The 53 million items included 1.4 million spare parts, valued at $299 million, that were classified or controlled spare parts. We plan to address Army and Navy policies, processes, and procedures relating to these sales in separate reviews. To accomplish our review, we concentrated our efforts on classified and controlled spare parts that foreign countries requisitioned from the Air Force under blanket order cases,[Footnote 3] which define a country's eligibility to requisition spare parts. We obtained records from the Air Force Security Assistance Center on all classified and controlled spare parts that were purchased under blanket orders and, according to Air Force records, were shipped to foreign countries for the period October 1, 1997, through July 31, 2002. A preliminary test of 72,057 requisitions, valued at $679.5 million, identified 525 requisitions, valued at $9.7 million, that appeared to violate Security Assistance Management Information System restrictions. We obtained satisfactory explanations from Air Force Security Assistance Center officials for all except 200 of the requisitions, valued at $ 5.6 million. We reviewed 123 of these requisitions,[Footnote 4] valued at over $4.4 million, to determine the reasons classified and controlled items were released for shipment. Further details are in the Scope and Methodology section of this report. Results in Brief: The Air Force's internal controls for its foreign military sales program using blanket orders are not adequate, placing classified and controlled spare parts at risk of being shipped to countries not authorized to receive them. The internal control inadequacies we identified are as follows: * Foreign country requisitions for classified and controlled spare parts were erroneously approved by the Air Force's Security Assistance Management Information System based on an incorrect federal supply class.[Footnote 5] The Security Assistance Management Information System approves items for shipment based in part on an item's federal supply class--not the item's entire national stock number. Thus, a country can obtain restricted spare parts by using an incorrect, but unrestricted, supply class with an item's correct national item identification number. We found that because the Security Assistance Management Information System was not properly programmed, it erroneously validated 35 of the 123 selected requisitions we reviewed because although countries used incorrect supply classes for the requisitioned items, they used unrestricted supply class numbers. For example, one country ordered a controlled outline sequencer used on various aircraft by using a supply class that was incorrect, but unrestricted, for the part it requisitioned. After the system validated the erroneous federal supply class, the item manager[Footnote 6] changed the supply class so that it was consistent with the requisitioned part, and the restricted part was shipped. Although Air Force Security Assistance Center officials were able to describe the actions they would take to recover a classified or controlled item that was erroneously shipped, neither the Air Force nor the center had written policies or procedures in place for recovering the items that had been shipped in error. * The Air Force has not validated modifications to the Security Assistance Management Information System that restrict the parts that countries can requisition and has not tested the system since 1998 to ensure that it is working properly. GAO, Office of Management and Budget, and DOD internal control standards require that systems such as the Air Force's be periodically validated and tested to ensure that they are working as intended. Because modifications were not validated, the Air Force did not detect improperly made modifications to the system, and foreign countries were able to requisition and obtain controlled spare parts that, at the time, the Air Force was trying to restrict. For example, Air Force programmers were instructed to enter restrictions into the information system that would prevent countries from using blanket orders to requisition controlled bushings.[Footnote 7] Of the 123 cases we reviewed, we found 18 instances in which countries requisitioned and received controlled bushings because managers had entered the restrictions in the wrong area of the system. Although Air Force officials subsequently told us that the bushings had been improperly restricted, this example demonstrates the need to verify that system modifications are made correctly. Because the system's logic has not been tested since 1998, the Air Force cannot be assured that the system accurately reviews current requisitions for compliance with restrictions. * Command country managers did not always document reasons for overriding Security Assistance Management Information System or foreign military sales case manager[Footnote 8] recommendations in case files. For 19 of the 123 requisitions we reviewed, command country managers overrode the system recommendations and shipped classified and controlled spare parts without documenting the reasons for overriding the system. For example, a command country manager overrode the system and shipped four classified target-detecting devices without documenting the reasons for overriding the system. In another example, a command country manager authorized the shipment of a controlled communications security part that the system and the foreign military sales case manager had indicated should not be shipped. The case file contained no documentation explaining why the spare part was nevertheless shipped. We are recommending that the Secretary of Defense instruct the Secretary of the Air Force to require responsible officials to (1) modify the Security Assistance Management Information System so that it validates country requisitions based on the requisitioned item's entire national stock number, (2) establish policies and procedures for recovering classified or controlled items that are erroneously shipped, (3) verify restriction changes made to the system to ensure that the changes were properly made, (4) periodically test the system's logic for restricting requisitions to ensure that it is working correctly, and (5) establish a policy for command country managers to document the basis for their decisions to override the system or recommendations made by foreign military sales case managers. In commenting on a draft of this report, DOD fully concurred with four of our recommendations and cited corrective actions that had been taken or were planned. However, with regard to our recommendation to periodically test the system to ensure that its logic for restricting requisitions is working correctly, the department partially concurred, stating that a program is being implemented to test new and old modifications placed in the system to ensure that they are accurate. We believe that just testing the accuracy of the modification will not ensure that the system's logic for restricting requisitions is operating correctly. We therefore continue to believe that the system's logic for restricting requisitions should be periodically tested to ensure that it is working correctly. Otherwise, classified and controlled spare parts that are requisitioned may continue to be erroneously released. Background: The transfer of defense items to friendly nations and allies is an integral component in both U.S. national security and foreign policy. The U.S. government authorizes the sale or transfer of military equipment, including spare parts, to foreign nations either through government-to-government agreements or through direct sales from U.S. manufacturers. The Arms Export Control Act[Footnote 9] and Foreign Assistance Act of 1961,[Footnote 10] as amended, authorize the DOD foreign military sales program. The Department of State sets the overall policy concerning which countries are eligible to participate in the foreign military sales program. DOD, through the military services, enters into foreign military sales agreements with individual countries. The Air Force Security Assistance Center, which is an activity of the Air Force Materiel Command, is responsible for the administration of the Air Force's foreign military sales program. The center's responsibilities start with the initial negotiation of the foreign military sale and end with the delivery of parts and completion of all financial aspects of the agreements. The center uses an automated management information system, the Security Assistance Management Information System, to support its management of the program with accurate and timely information. For blanket order cases, the system uses criteria such as an item's national item identification number, a federal supply class, or a federal supply group[Footnote 11] to restrict the parts available to foreign military sales customers. Once the system has verified a country's eligibility and approved a requisition, the requisition is sent to a supply center to be filled and shipped. The overall foreign military sales process, as it applies to the Air Force, is shown in figure 1. Figure 1: The Foreign Military Sales Process for Air Force Classified and Controlled Spare Parts: [See PDF for image] [End of figure] This report addresses the portion of the process relating to the Air Force's approval or disapproval of foreign countries' requisitions for classified and controlled spare parts under blanket order cases.[Footnote 12] Blanket orders are for a specific dollar value and generally cover classes of parts that a country may need rather than a specific item within a class. Under blanket orders, the Air Force restricts classes of items, such as munitions and nuclear spare parts, from being requisitioned. Internal Controls over Foreign Military Sales Are Not Adequate: The Air Force's internal controls for foreign military sales using blanket orders are not adequate to prevent countries from ordering and receiving classified and controlled spare parts that they are not eligible to receive. We found that (1) controls based on supply class restrictions were ineffective and resulted in erroneously approved requisitions for shipment, and that written policies for recovering the erroneously shipped items did not exist; (2) the Air Force did not validate modifications to its Security Assistance Management Information System related to blanket orders or test the system's logic for restricting requisitions, and (3) command country managers did not always document reasons for overriding either the Security Assistance Management Information System or foreign military sales case manager recommendations not to ship classified spare parts. As a result of these inadequate internal controls, classified and controlled spare parts were shipped to countries not authorized to receive them. The Air Force Security Assistance Center has taken or plans to take actions to correct these issues. Use of the Federal Supply Class Resulted in Erroneously Approved Requisitions: Foreign country requisitions for classified and controlled spare parts were erroneously validated, as a result of an incorrect federal supply class, by the Air Force's Security Assistance Management Information System. The Air Force attempts to prevent countries from obtaining classified and controlled spare parts by restricting them from receiving spare parts that belong to selected federal supply classes. Included in the national stock number is a four-digit federal supply class (see fig. 2), which may be shared by thousands of items. The national stock number also contains a nine-digit national item identification number that is unique for each item in the supply system. A country can obtain a classified or controlled spare part by using an incorrect, but unrestricted, supply class with an item's correct national item identification number. Figure 2: Example of a National Stock Number Showing Federal Supply Class and National Item Identification Number: [See PDF for image] [End of figure] We found that because the Security Assistance Management Information System was not properly programmed, it erroneously validated 35 blanket order requisitions (of the 123 in our review), even though an incorrect supply class number was used, because the countries used supply classes that were not restricted. For example, in one case, the Air Force restricted countries from requisitioning parts belonging to the 1377 federal supply class (cartridge-and propellant-actuated devices and components) on blanket orders. The restriction included an outline sequencer (national stock number -1377010539320) used on ejection seats for various aircraft. The country ordered the sequencer using national stock number 1680010539320. Because supply class 1680 (miscellaneous aircraft accessories and components) was not restricted and the Security Assistance Management Information System did not verify that 1680 was the correct supply class for national item identification number 010539320, the system approved the requisition. Had the system validated the entire 13-digit national stock number, it would have found that the number was incorrect and would not have approved the requisition. Subsequently, the item manager recognized that 1680 was not the correct federal supply class and corrected the supply class to 1377 before the part was shipped. This example is summarized in figure 3. Air Force officials were unaware of this situation until our review identified the problem. Figure 3: Example of How a Restricted Item Was Requisitioned and Shipped: [See PDF for image] [End of figure] In another case, involving the restricted 1377 federal supply class, a country ordered a restricted battery power supply for the F-16 aircraft using national stock number 6130013123511. Because supply class 6130 (nonrotating electrical converters) was not restricted and the Security Assistance Management Information System did not verify the entire 13- digit national stock number, the requisition was approved. The Air Force shipped the restricted battery power supply to the country. Neither the Air Force nor the center had written policies or procedures in place for recovering the items erroneously shipped. Without these types of policies and procedures, the Air Force cannot be assured that appropriate steps will be taken to recover the parts. Air Force Security Assistance Center officials agreed that the supply class restrictions alone were ineffective and could be bypassed by use of inaccurate supply class information. Failure to Validate the System Could Allow Unauthorized Shipments of Classified Spare Parts: The Air Force has not validated modifications to the Security Assistance Management Information System that restrict parts that countries can requisition, and has not tested the system's logic for restricting requisitions since 1998 to ensure that it is working properly. As a result, modifications that were not properly made went undetected, and foreign countries were able to requisition and obtain controlled spare parts that the Air Force was trying to restrict. For example, the Air Force instructed programmers to modify a table of restrictions in the Security Assistance Management Information System to prevent certain countries from using blanket orders to requisition controlled bushings in the 5365 supply class. Although Air Force Security Assistance Center officials subsequently told us that the bushings had been improperly restricted, we found that, for 18 of the 123 requisitions we reviewed, countries had ordered and received the bushings, because the Security Assistance Management Information System was incorrectly programmed and did not identify the requisitions as requiring a review by command country managers. After we brought the transactions to the attention of Air Force Security Assistance Center officials, they investigated and found that programmers had entered the restrictions in the wrong area of the system. Because the Air Force had not validated that system modifications were properly made, the system had approved the requisitions. Although the Air Force later determined that the bushings should not have been restricted, this example nevertheless demonstrates the need to validate system changes. The Air Force does not periodically test the Security Assistance Management Information System to ensure that it accurately reviews requisitions for compliance with restrictions. For example, when the system is working correctly, it will identify restrictions relating to parts, such as ammunition or nuclear spare parts, and will disapprove requisitions from countries that are ineligible to order these parts. Air Force Security Assistance Command officials said that the system had not been tested since 1998 to ensure that it accurately reviews requisitions for compliance with restrictions. When we tested the system's ability to restrict items based on their federal supply class, we found that the system did not always perform as intended. As discussed earlier, the system did not perform as intended because countries could requisition and obtain classified and controlled spare parts using an incorrect, but unrestricted, federal supply class with an item's correct national item identification number. In the Federal Information System Controls Audit Manual,[Footnote 13] which lists internal control activities for information systems, one of the control activities listed involves the testing of new and revised software to ensure that it is working correctly. In addition, management of federal information resources[Footnote 14] rules require agencies to establish information system management oversight mechanisms that provide for periodic reviews to determine how mission requirements might have changed and whether the information system continues to fulfill ongoing and anticipated mission requirements. Further, DOD's ADP Internal Control Guideline[Footnote 15]at the time stated that periodic reviews of systems should be conducted to determine if they operate as intended. According to Air Force Security Assistance Center officials, there have been few changes to the table of restrictions in the system. However, they did agree that existing changes need to be validated and were working to accomplish this. Based on our observations, the Air Force's failure to validate modifications and test model logic is in part due to an unquestioning confidence in the Security Assistance Management Information System's ability to correctly restrict the requisitioning of classified and controlled spare parts. Documentation for Overriding System and Item Manager Recommendations Is Inadequate: Command country managers did not always document reasons for overriding Security Assistance Management Information System or foreign military sales case manager recommendations not to ship classified spare parts. According to the Standards for Internal Control in the Federal Government,[Footnote 16] all transactions and other significant events need to be clearly documented. The standards state that such documentation should be properly managed and maintained and should be readily available for examination. Of the 123 requisitions we reviewed, the Security Assistance Management Information System identified 36 requisitions for command country manager review. For 19 of the requisitions, command country managers overrode the system recommendations and shipped classified and controlled spare parts without documenting the reasons for overriding the system. For example, the command country manager overrode the system and shipped four classified target-detecting devices, but the case file did not contain any documentation explaining why the command country manager did so, and managers we queried could not provide an explanation for the override. Similarly, a command country manager authorized the shipment of a controlled communications security part that the Security Assistance Management Information System and foreign military sales case manager recommended not be shipped. The case file contained no documentation explaining why the spare part was shipped. According to Air Force officials, there were no written policies or procedures for documenting decisions to override the system or foreign military sales case manager recommendations. The Air Force Security Assistance Center plans to issue guidance to command country managers to document system bypass authorizations. Conclusions: The Air Force has not established nor does it maintain effective internal controls over foreign military sales sold under blanket orders. Specifically, internal controls involving use of the federal supply class to restrict requisitions, the modification of tables restricting the access to classified and controlled spare parts in the Air Force's system, testing of the system, and documentation of system overrides were inadequate. Without adequate internal controls, classified and controlled spare parts may be released to countries that are ineligible to receive them, thereby providing military technology to countries that might use it against U.S. national interests. Further, without written policies detailing the steps to be taken when the Air Force becomes aware of an erroneous shipment, the Air Force's ability to recover erroneously shipped classified or controlled parts is lessened. Recommendations for Executive Action: To improve internal controls over the Air Force's foreign military sales program and to minimize countries' abilities to obtain classified or controlled spare parts under blanket orders for which they are not eligible, we are recommending that the Secretary of Defense instruct the Secretary of the Air Force to require the appropriate officials to take the following steps: * Modify the Security Assistance Management Information System so that it validates country requisitions based on the requisitioned item's complete national stock number. * Establish policies and procedures for recovering classified or controlled items that are erroneously shipped. * Establish polices and procedures for validating modifications made to the Security Assistance Management Information System to ensure that the changes were properly made. * Periodically test the Security Assistance Management Information System to ensure that the system's logic for restricting requisitions is working correctly. * Establish a policy for command country managers to document the basis for their decisions to override Security Assistance Management Information System or foreign military sales case manager recommendations. Agency Comments and Our Evaluation: In commenting on a draft of this report, DOD fully concurred with four of our recommendations and cited corrective actions that had been taken or were planned, and it partially concurred with another recommendation. Specifically, with regard to our recommendation to modify the Security Assistance Management Information System to validate country requisitions based on the requisitioned item's national stock number, the department said that it has had a change in place since January 2003 to validate requisitions based on an item's national stock number. We believe that the department's change is responsive to findings that we brought to the Air Force's attention in December 2002. However, because our audit work was completed when the Air Force brought this change to our attention, we did not have an opportunity to validate the change. The department also stated that the Air Force (1) will write a policy memorandum on procedures for recovering classified or controlled items that are erroneously shipped, (2) will issue a policy memorandum directing that all modifications to the system be validated in accordance with existing policies and procedures, and (3) has issued a policy memorandum specifying those staff who can input transactions for overriding restrictions and requiring that waiver approvals for using the bypasses be documented. With regard to our recommendation to periodically test the system to ensure that its logic for restricting requisitions is working correctly, DOD partially concurred. The department said that a program is being implemented to test new modifications placed in the system and that the testing of old modifications would be an ongoing effort. Testing the modifications placed in the system will ensure that they were made correctly. However, just testing the modifications will not ensure that the system is correctly applying its logic to the modifications in order to restrict requisitions for items that countries are not eligible to receive. For example, testing modifications may not identify logic problems, such as the one we identified involving the approval of requisitions based on an item's federal supply class. Thus, we continue to believe that the system's logic for restricting requisitions should be periodically tested to ensure that it is working correctly. Otherwise, classified and controlled spare parts that are requisitioned may continue to be erroneously released. DOD's comments appear in appendix I. Scope and Methodology: To determine the adequacy of the Department of the Air Force's key internal control activities aimed at preventing countries from requisitioning and receiving classified and controlled spare parts that they are ineligible to receive, we held discussions with officials from the Under Secretary of Defense (Policy Support) International Security Program Directorate; Deputy Under Secretary of the Air Force (International Affairs); and the Air Force Materiel Command's Security Assistance Center, Dayton, Ohio. We discussed the officials' roles and responsibilities, the criteria and guidance they used in performing their duties, and the controls used to restrict countries from receiving parts that they are not eligible to requisition. At the Air Force Security Assistance Center and Air Logistics Centers at Warner Robins Air Force Base, Macon, Georgia, and Tinker Air Force Base, Oklahoma City, Oklahoma, we interviewed military and civilian officials to obtain an overview of the requisitioning and approval processes applicable to classified and controlled spare parts. To test the adequacy of the internal controls, we obtained records from the Air Force Security Assistance Center on all classified and controlled spare parts that were purchased under blanket orders and approved for shipment to foreign countries for the period October 1, 1997, through July 31, 2002. We limited our study to blanket orders because defined orders and Cooperative Logistics Supply Support Agreements specified the parts that countries were entitled to requisition by national stock number. In contrast, only Security Assistance Management Information System restrictions limited the parts that countries were entitled to order under blanket orders. The records covered 444 blanket orders that resulted in 72,057 requisitions for classified and controlled spare parts. Specifically, we took the following steps: * We tested the Security Assistance Management Information System by applying the system's restrictions that applied to classified and controlled spare parts that were shipped under blanket orders, and identified 525 requisitions that appeared to violate the restrictions. We obtained satisfactory explanations from the Air Force Security Assistance Command for all except 200 of the requisitions, which were shipped despite restrictions. * We reviewed case files for 123 requisitions,[Footnote 17] including 87 requisitions for which the Security Assistance Management Information System had approved the shipment of classified and controlled spare parts without referring the requisitions to command country managers to determine if the requisitions should be approved. We followed up on these requisitions by consulting with command country managers. * The case files that we reviewed included 36 requisitions that the Security Assistance Management Information System had referred to command country managers for review to determine if they had documented their decisions to override the system's decisions. We followed up on these reviews through discussions with command country managers. We conducted our review from May 2002 through May 2003 in accordance with generally accepted government auditing standards. As arranged with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from the date of this letter. At that time, we will send copies of this report to the Secretary of Defense; the Secretary of the Air Force; the Director, Office of Management and Budget; and interested congressional committees. We will also make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. Please contact me on (202) 512-8365, if you or your staff have any questions concerning this report. Key contributors to this report were Lawson (Rick) Gist, Jr.; Jennifer Thomas; Arthur James, Jr.; Lou Modliszewski; Susan Woodward; John Lee; and Kristy Lehmann. Sincerely yours, William M. Solis, Director Defense Capabilities and Management: Signed by William M. Solis: [End of section] Appendix I: Comments from the Department of Defense: DEFENSE SECURITY COOPERATION AGENCY: WASHINGTON, DC 20301-2800: JUL 11 2003: In reply refer to: I-03/007485: Mr. William M. Solis, Director Defense Capabilities and Management U.S. General Accounting Office: 441 G Street, N.W. Washington, D.C. 20548: Dear Mr. Solis: This is the Department of Defense (DoD) response to the GAO Draft report, "Foreign Military Sales: Improved Air Force Controls Could Prevent Unauthorized Shipments of Classified and Controlled Spare Parts to Foreign Countries" dated May 23, 2003 (GAO Code 350223/GAO-03-664). The Department reviewed the draft report and concurs in principle with the recommendation that the Secretary of Defense instruct the Secretary of the Air Force to require the appropriate officials to take corrective measures that ensure adequate controls are in place to prevent future unauthorized shipments of classified and/or controlled spare parts to foreign countries. Comments addressing each of the five GAO draft report recommendations are included in the enclosure. We also provided the GAO with technical comments regarding the draft report under separate cover. The Department appreciates the opportunity to comment on the draft report. My point of contact on this matter is Ms. Kathy Robinson. She may be contacted by email: kathy.robinson@dsca.tnil or by telephone at (703) 601-4368. Sincerely, TOME H. WALTERS, JR. LIEUTENANT GENERAL, USAF DIRECTOR: Signed by TOME H. WALTERS, JR.: Attachment As stated: GAO DRAFT REPORT - DATED MAY 23, 2003 GAO CODE 350223/GAO-03-664: "FOREIGN MILITARY SALES: IMPROVED AIR FORCE CONTROLS COULD PREVENT UNAUTHORIZED SHIPMENTS OF CLASSIFIED AND CONTROLLED SPARE PARTS TO FOREIGN COUNTRIES": DEPARTMENT OF DEFENSE COMMENTS TO THE GAO RECOMMENDATIONS: RECOMMENDATION 1: The GAO recommended that the Secretary of Defense instruct the Secretary of the Air Force to require that the appropriate officials modify the Security Assistance Management Information System (SAMIS) so that it validates country requisitions based on the requisitioned item's complete national stock number. (p. 15/GAO Draft Report): DOD RESPONSE Concur. A change has been in place since 29 Jan 03 whereby there is a check for supply class updates prior to requisition screening against edits in SAMIS table 105. It was tested in accordance with SAMIS procedures (SAMIS 01 10-3). This system modification accomplishes validation of country requisitions based on the requisitioned item's national stock number. The final audit report should reflect that AFSAC has accomplished this change and that the requirement for modifying the system is no longer an issue. In addition, the new Case Execution Management Information System (CEMIS) being developed by DSCA and the Military Departments has built in numerous requisition validation edits that will reject unauthorized orders from further processing, and thus preclude these types of occurrences in the future. Anticipate CEMIS will be ready for initial deployment in FY 07 timeframe. RECOMMENDATION 2: The GAO recommended that the Secretary of Defense instruct the Secretary of the Air Force to require that the appropriate officials establish policies and procedures for recovering classified or controlled items that are erroneously shipped. (p. 15/GAO Draft Report): DOD RESPONSE: Concur. Recovery of a classified or controlled item that was erroneously released and shipped to an unauthorized customer should be on an exception basis that is to apply when benefits to national security exceed financial and other costs of recovery. The AF can request the Purchaser submit a Supply Discrepancy Report for a misdirected shipment (per DLAI 4140.55, enclosure 7) for the item and then have the established processes for item return and customer reimbursement apply. If the customer refuses to return the item, then the possibility of seeking DSCA suspension of the customer's FMS program may be considered. SAF/IAPX will write a policy memorandum and coordinate with DSCA and the legal offices as required. Estimated completion date is 15 July 2003. RECOMMENDATION 3: The GAO recommended that the Secretary of Defense instruct the Secretary of the Air Force to require that the appropriate officials establish policies and procedures for validating modifications made to the Security Assistance Management Information System to ensure that the changes were properly made. (p. 15/GAO Draft Report): DOD RESPONSE: Concur. There have been few, if any, policy directives that have generated modifications to SAMIS table 105 (which was the focus of the audit) in recent years. There is a lack of narrative documentation for edits in the table and some of the existing edits need to be validated and necessary narrative entries made. This is an ongoing effort and testing will be done if changes are required. Policies and procedures are in place for all modifications to SAMIS (per 01 10-1 - SAMIS Programming Requirements Processing and Input, and 01 10-3 - SAMIS Testing Procedures). Narrative rationale will be required for new entries to Table 105. The AFSAC Security Assistance Policy Office will be sending a policy memorandum directing applicable process owners and Offices of Primary Responsibility to adhere to this requirement. The estimated completion date for the policy memorandum is 15 July 2003. RECOMMENDATION 4: The GAO recommended that the Secretary of Defense instruct the Secretary of the Air Force to periodically test the Security Assistance Management Information System to ensure that the system's logic for restricting requisitions is working correctly. (p. 15/GAO Draft Report): DOD RESPONSE: Partially Concur. To help prevent unauthorized release of classified and controlled spare parts to foreign countries, testing for SAMIS table 105 will take place. The testing will occur when 1) there are changes to the SAMIS requisition logic, 2) there is a change in the system logic of SAMIS table 105 itself, and 3) there are modifications to SAMIS table 105 as a consequence of on-going verification of SAMIS table 105 entries. Prevention of unauthorized asset releases is accomplished via the SAMIS table 105 edits in conjunction with proper control of the transactions that allow these edits to be bypassed. Until recently, access to bypass transactions was only partially restricted. We have since established bypass oversight control whereby only designated process owners may input bypasses, and only upon obtaining waiver approval. Guidance for mandatory formal releasability reviews of bypass candidate items is expected to be signed out by 31 July 03. A change is in place now is to check the Federal Stock Class of a requisition for currency prior to screening against the edits in SAMIS table 105 (the logic for this has been tested), and it is updated prior to the screening if necessary. A program that will verify accuracy of all new entries in SAMIS Table 105 is estimated to be operational by 14 July 03. RECOMMENDATION 5: The GAO recommended that the Secretary of Defense instruct the Secretary of the Air Force to require that the appropriate officials establish a policy for command country managers to document the basis for their decisions to override Security Assistance Management Information System or foreign military sales case manager recommendations. (p. 15/GAO Draft Report): DOD RESPONSE: Concur. AFSACAA policy memorandum written 13 May 03 restricts who can input bypass transactions for over-riding edit restrictions in SAMIS Table 105 and requires that waiver approvals for using the bypasses be documented both electronically in SAMIS requisition narratives, and as hard copy (by the waiver request initiator) in the case files. The final audit report should reflect that AFSAC has accomplished this change and that establishing documentation policy is no longer an issue. [End of section] FOOTNOTES [1] Classified spare parts are restricted for national security reasons; controlled parts are not classified but contain military technology/applications or are controlled cryptographic parts. [2] The Security Assistance Management Information System is the Air Force's information system used to verify that countries are eligible to requisition and receive spare parts. [3] Hereafter referred to as blanket orders. [4] We initially reviewed 2 requisitions involving controlled communications security items and subsequently added 119 controlled and 2 confidential requisitions to the review. [5] The federal supply classification is a 4-digit number that designates a general commodity grouping, such as communications security equipment and components. Each part within a supply class has a unique 9-digit number--called the national item identification number--that differentiates each individual item in the department's inventory system. Together, the two numbers form a 13-digit national stock number. [6] Item managers at the Air Force's air logistics centers are responsible for managing items in the Air Force's supply system. [7] A bushing is cylindrical metal sleeve used to reduce friction. [8] Command country managers and foreign military sales case managers at the Air Force Security Assistance Center are respectively responsible for managing the sale of items to countries and for monitoring a particular type of case, such as a blanket order. [9] Public Law 90-629. [10] Public Law 87-195. [11] The first two digits of the federal supply class are called a supply group and include several similar federal supply classes. [12] Under the foreign military sales program, the Air Force also uses defined order cases (which cover specific items and quantities) and Cooperative Logistics Supply Support Agreements (which allow foreign countries to become partners in the military service's logistics system). The service purchases items for use of the foreign governments and monitors the foreign governments' demand for those items to ensure that an adequate level of support is available. [13] U.S. General Accounting Office, Federal Information System Controls Audit Manual, GAO/AIMD-12.19.6 (Washington, D.C.: Jan. 1999). [14] Office of Management and Budget, Management of Federal Information Resources (Washington, D.C.: Nov. 2000). [15] Department of Defense, ADP Internal Control Guideline (July 1988). [16] U.S. General Accounting Office, Standards for Internal Control in the Federal Government, GAO/AIMD-00.21.3.1 (Washington, D.C.: Nov. 1999). [17] We initially reviewed 2 requisitions involving controlled communications security items and subsequently selected 121 additional requisitions to review. We selected requisitions from Bahrain, Egypt, Greece, Israel, Italy, Jordan, Morocco, Saudi Arabia, South Korea, Taiwan, Thailand, Tunisia, and Turkey and for specific types of equipment. Two of the requisitions were for confidential items; the remaining 121 requisitions were for controlled items. GAO's Mission: The General Accounting Office, the investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO's Web site ( www.gao.gov ) contains abstracts and full-text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as "Today's Reports," on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select "Subscribe to e-mail alerts" under the "Order GAO Products" heading. Order by Mail or Phone: The first copy of each printed report is free. Additional copies are $2 each. A check or money order should be made out to the Superintendent of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single address are discounted 25 percent. Orders should be sent to: U.S. General Accounting Office 441 G Street NW, Room LM Washington, D.C. 20548: To order by Phone: Voice: (202) 512-6000: TDD: (202) 512-2537: Fax: (202) 512-6061: To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov Automated answering system: (800) 424-5454 or (202) 512-7470: Public Affairs: Jeff Nelligan, managing director, NelliganJ@gao.gov (202) 512-4800 U.S. General Accounting Office, 441 G Street NW, Room 7149 Washington, D.C. 20548: