This is the accessible text file for GAO report number GAO-04-327 entitled 'Foreign Military Sales: Improved Army Controls Could Prevent Unauthorized Shipments of Classified Spare Parts and Items Containing Military Technology to Foreign Countries' which was released on May 17, 2004. This text file was formatted by the U.S. General Accounting Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to the Honorable Tom Harkin, U.S. Senate: United States General Accounting Office: GAO: April 2004: Foreign Military Sales: Improved Army Controls Could Prevent Unauthorized Shipments of Classified Spare Parts and Items Containing Military Technology to Foreign Countries: GAO-04-327: GAO Highlights: Highlights of GAO-04-327, a report to the Honorable Tom Harkin, U.S. Senate Why GAO Did This Study: From 1993 through 2002, the Department of Defense (DOD) delivered over $150 billion in services and defense articles—including classified spare parts and unclassified items containing military technology—to countries through foreign military sales programs. GAO was asked to review whether the Army’s key internal controls adequately restricted blanket orders for (1) classified spare parts and (2) unclassified items containing military technology. GAO was also asked to determine if periodic tests were conducted to validate the Army’s system and its logic. What GAO Found: The Army’s internal controls over foreign military sales are not adequate, placing classified spare parts and unclassified items containing military technology at risk of being shipped to foreign countries that may not be entitled to receive such items under blanket orders. Foreign countries may request items using blanket orders, which are for a specific dollar value and are used to simplify supply actions on certain categories of items. The internal control inadequacies follow: * The Army lacked control edits in its system and allowed the substitution and release of classified spare parts under blanket orders for shipment to foreign countries. The Army and DOD policies prohibit the release of classified items, under blanket orders, to foreign countries. GAO identified 3 requisitions in its review, where the item manager released 11 classified digital processors to foreign countries under blanket orders. Because the Army’s system did not have control edits in place to validate the substituted parts, classified items were released to foreign countries. Also, the Army has no written policy to determine the actions needed to recover classified items that have been shipped to countries not eligible to receive them. Army officials indicated that the countries were not entitled to receive these items under blanket orders but they could obtain them under a different process; so there is no need to retrieve them, and GAO agreed with their decision. Also, the Army has modified the system to validate substituted parts selected by item managers. * The Army lacks control edits in its system to prevent the release of some unclassified items containing military technology requisitioned under blanket orders. Within the 21,663 requisitions that were shipped without a review, GAO found that 387 requisitions were for 2,267 restricted items that foreign countries are prohibited from requesting using blanket orders because the parts require release authority from inventory control points. Also, the Army has no written policies to recover items that have been shipped to countries not eligible to receive them. Army officials said the countries were entitled to request these items, so there is no need to recover the items. The Army has not conducted periodic tests, as required, to validate that its system is accurately reviewing and approving blanket order requisitions. GAO’s and the Office of Management and Budget’s internal control standards require that a system such as the Army’s be periodically tested to ensure that it is working as intended. According to DOD and Army officials, they have not tested the system’s logic for restricting requisitions since 1999. Also, the officials stated that the Defense Security Cooperation Agency, in October 1998, directed that no additional funds be used to expand the current system. However, according to the agency, the Army is not prohibited from periodically testing the system. What GAO Recommends: GAO recommends modifications to policies to ensure the recovery of items shipped to foreign countries that are not eligible to receive them under blanket orders. Also, GAO recommends the Army modify its system to identify for review unclassified items containing military technology before they are released, and periodically test its system. DOD concurred with two recommendations and did not concur with two others on actions to recover items shipped in error, citing existing procedures. Following up with DOD officials, they agreed with the need to modify these policies. GAO also clarified its recommendations. www.gao.gov/cgi-bin/getrpt?GAO-04-327. To view the full product, including the scope and methodology, click on the link above. For more information, contact William M. Solis at (202) 512-8365 or solisw@gao.gov. [End of section] Contents: Letter: Results in Brief: Background: Internal Controls over the Army's Foreign Military Sales Are Not Adequate: Conclusion: Recommendations for Executive Action: Agency Comments and Our Evaluation: Scope and Methodology: Appendix I: Comments from the Department of Defense: Figure: Figure 1: The Army's Requisition Process for Foreign Military Sales of Parts and Other Items: United States General Accounting Office: Washington, DC 20548: April 15, 2004: The Honorable Tom Harkin: United States Senate: Dear Senator Harkin: From 1993 through 2002, the Department of Defense (DOD) delivered over $150 billion in services and defense articles--including classified[Footnote 1] spare parts and unclassified items containing military technology[Footnote 2]--to foreign countries through foreign military sales programs administered by the military services. Some sales occurred using blanket orders, which are requisitions for a specific dollar value and are designed to simplify supply actions on certain categories of items for which foreign military sales customers will have a recurring need, such as unclassified spare parts, repair parts, minor components, training films, and publications. According to DOD policy,[Footnote 3] the management of classified spare parts and unclassified items containing military technology is particularly important given their potential to be released to foreign countries that may use them against U.S. interests. Under blanket orders, the Army's policy is intended to restrict the categories of items including classified materials. This report focuses on whether the Army has adequate key internal controls in place to prevent foreign countries from requisitioning and receiving, under blanket orders, classified and unclassified items containing military technology that they are not eligible to receive. Internal control activities[Footnote 4] include policies, procedures, and processes that are essential for the proper stewardship of and accountability for government resources and for achieving effective and efficient program results. Our overall objective was to determine the adequacy of the Army's internal controls for foreign military sales under blanket orders. Our specific objectives were to assess and test whether key internal controls adequately restricted blanket orders for classified spare parts sold to foreign countries and restricted access to certain unclassified items containing military technology. We also determined whether periodic tests were conducted to validate that the Army's Centralized Integrated System for International Logistics[Footnote 5] was working as intended. This report is one in a series on DOD's foreign military sales program administered by the military services. This particular report focuses on the Army because it processed 21,703 blanket order requisitions for classified spare parts and unclassified items containing military technology to foreign countries, valued at about $138 million for the most recent 5-year time period, October 1, 1997, through April 30, 2003. We plan to address the Navy's internal controls relating to foreign military sales in a separate review. In July 2003, we reported on the adequacy of the Air Force's internal controls over shipments of classified and controlled spare parts to foreign countries.[Footnote 6] Also, in September 2003, we reported on the adequacy of the Air Force's internal controls over shipments of spare parts containing military technology to foreign countries.[Footnote 7] To accomplish our review, we concentrated our efforts on classified spare parts and unclassified items containing military technology that the Army had shipped to foreign countries under blanket orders. We obtained data on a total of 21,703 requisitions from the system on all classified spare parts, as well as unclassified items containing military technology that were purchased using blanket orders, and according to Army records, were shipped to foreign countries from October 1, 1997, through April 30, 2003. In our sample, classified spare parts were shipped against 40 requisitions, and items containing military technology were shipped against the balance of 21,663 requisitions. We conducted our review in accordance with generally accepted government auditing standards. Further details are in the scope and methodology section of this report. Results in Brief: The Army's internal controls over foreign military sales using blanket orders are not adequate, placing classified spare parts and unclassified items containing military technology at risk of being shipped to foreign countries. The internal control inadequacies we identified are as follows: * The Army lacked control edits in its system and allowed the substitution and release of classified spare parts under blanket orders for shipment to foreign countries. The Army and DOD policies prohibit the release of classified spare parts, under blanket orders, to foreign countries. We identified 3 requisitions in our review, where the item manager had released 11 classified digital processors to foreign countries under blanket orders. Until we identified the problem, Army officials at the United States Army Security Assistance Command were not aware that these 11 classified spare parts had been substituted for the originally requisitioned unclassified parts. Because the Army's system did not have control edits in place to validate the substituted spare parts, classified spare parts were released to foreign countries. In addition, the Army has no written policy to determine the actions needed to recover classified items that have been shipped to foreign countries not eligible to receive them. Based on our review, the Army has modified its system to validate substituted spare parts selected by item managers. * The Army lacks control edits in its system to prevent the release of some unclassified items containing military technology requisitioned under blanket orders. As a result, the Army has shipped some unclassified items containing military technology to foreign countries. Officials from DOD's Office of the Deputy Under Secretary of Defense Technology Security Policy and Counterproliferation, who represent DOD in technology security matters before several interagency committees, indicated that the Army should have control over unclassified items containing military technology. Within the 21,663 requisitions for unclassified items containing military technology, we found the following requisitions were not identified and reviewed before they were released: (1) 17,175 requisitions were for 381,245 items and other items such as circuit card assemblies, fire control units, and electron tubes that require their inherent military capability to be destroyed or demilitarized prior to their release to the public; and (2) 387 requisitions were for 2,267 restricted items that foreign countries are prohibited from requesting using blanket orders because the spare parts require release authority from inventory control points.[Footnote 8] In addition, the Army has no written policy to determine the actions needed to recover unclassified items containing military technology that have been shipped to foreign countries not eligible to receive them. * The Army has not conducted periodic tests, as required by federal internal control standards, to validate that its system is accurately reviewing and approving blanket order requisitions. GAO's and the Office of Management and Budget's internal control standards require that a system such as the Army's be periodically validated and tested to ensure that it is working as intended and the ability to accurately review and approve requisitions is not compromised. According to Defense Security Assistance Development Center officials, who are responsible for managing the Army's foreign military sales automated system, periodic tests of the Army's system have not been conducted recently because, in October 1998, the Defense Security Cooperation Agency directed that no additional funds be used to expand the current system. However, Defense Security Cooperation Agency officials stated that this directive does not preclude the Army from periodically testing the system and its logic. According to DOD and Army officials, they have not tested the system's logic for restricting requisitions since 1999 when they initially modified the system to cancel requisitions for classified spare parts using blanket orders. Since the Army has modified its system to validate substituted spare parts under blanket orders, we are not making a recommendation in this area. We are recommending, however, that the Secretary of Defense instruct the Secretary of the Army to modify existing policies and procedures, after consultation with appropriate government officials, to cover items shipped in lieu of items ordered to also ensure the recovery of classified spare parts and unclassified items containing military technology that have been shipped to foreign countries that may not be eligible to receive them. We are also recommending that the Secretary of Defense instruct the Under Secretary of Defense for Policy to require the appropriate officials to (1) modify the Army's Centralized Integrated System for International Logistics system so that it identifies for review blanket order requisitions for unclassified items containing military technology before they are released and (2) periodically test the Army's system and its logic for restricting requisitions to ensure that it is accurately reviewing and approving blanket order requisitions. In commenting on a draft of this report, DOD concurred with two of our recommendations and citied specific actions to be taken that respond to them. However, the department did not concur with our two draft recommendations to consult with appropriate agencies to determine what actions the Army needs to initiate to recover classified spare parts and unclassified items containing military technology that have been shipped in error, i.e., shipped in lieu of items ordered, under blanket orders. The department cited current Army procedures as being sufficient; however, those procedures do not address the intent of our recommendations to recover classified spare parts and unclassified items containing military technology shipped to foreign countries that are not eligible to receive them. Based on discussions with DOD officials, we modified our two recommendations concerning consultation with appropriate agencies. We now recommend that the Army modify existing policies and procedures, after consultation with the appropriate government officials, to cover items shipped in lieu of items ordered to also ensure the recovery of classified spare parts and unclassified items containing military technology that have been shipped to foreign countries that may not be eligible to receive them. Background: The sale or transfer of U.S. defense items to friendly nations and allies is an integral component in both U.S. national security and foreign policy. The U.S. government authorizes the sale or transfer of military equipment, including spare parts, to foreign countries either through government-to-government agreements or through direct sales from U.S. manufacturers. The Arms Export Control Ac[Footnote 9]t and the Foreign Assistance Act of 196[Footnote 10]1, as amended, authorize the DOD foreign military sales program. The Department of State sets overall policy concerning which countries are eligible to participate in the DOD foreign military sales program. DOD identifies military technology that requires control when its transfer to potential adversaries could significantly enhance a foreign country's military or war-making capability. The transfer or release of military technology to foreign countries involves various agencies such as the Department of State and DOD, which are responsible for controlling, in part, the transfer of such technology. The Defense Security Cooperation Agency, under the direction of the Under Secretary of Defense for Policy, has overall responsibility for administering the foreign military sales program, and the military services generally execute the sales agreements with the individual countries. A foreign country representative initiates a request by sending a letter to DOD asking for such information as the price and availability of goods and services, training, technical assistance, and follow-on support. Once the foreign customer decides to proceed with the purchase, DOD prepares a Letter of Offer and Acceptance stating the terms of the sale for the items and services to be provided. After this letter has been accepted, the foreign customer is generally required to pay, in advance, the amounts necessary to cover costs associated with the services or items to be purchased from DOD and then is allowed to request spare parts through DOD's supply system. The foreign military sales policy and oversight for the Department of the Army are the responsibility of the Deputy Assistant Secretary of the Army for Defense Exports and Cooperation. The Commander, U.S. Army Materiel Command, is the Army's executive agent for implementing, administrating, and managing the foreign military sales program. The U.S. Army Security Assistance Command performs the executive agent's functions for the U.S. Army Materiel Command. The United States Army Security Assistance Command's responsibilities start with the initial negotiation of a foreign military sale and end with the transfer of items and completion of all financial aspects of the sales agreement. The command uses an automated system called the Centralized Integrated System for International Logistics to support the U.S. Army's management of the foreign military sales program. The command originally developed the system in 1976, and in October 1997, the Defense Security Cooperation Agency transferred the Army's system to the Defense Security Assistance Development Center. The command retained responsibility for defining system-user requirements, designing new processes, and directing programming modifications to the system's applications. However, the overall responsibility for providing system information technology maintenance support, such as writing and testing the programs and coordinating infrastructure support, was transferred to the Defense Security Assistance Development Center. Foreign military sales requisitions for Army spare parts and other items initially are processed through the system. For blanket orders, the system uses the security classification code[Footnote 11] to restrict the spare parts available to foreign military sales customers. Once the system validates a requisition, the requisition is sent to a supply center to be filled and shipped. The Army's requisition process for foreign military sales of parts and other items is shown in figure 1. Figure 1: The Army's Requisition Process for Foreign Military Sales of Parts and Other Items: [See PDF for image] [A] The Army places items' restrictions in its Centralized Integrated System for International Logistics system. [End of figure] Internal Controls over the Army's Foreign Military Sales Are Not Adequate: The Army's internal controls over foreign military sales using blanket orders are not adequate, placing classified spare parts, as well as unclassified items containing military technology, at risk of being shipped to foreign countries, who are not eligible to receive them. We found that the Army (1) lacked control edits in its system and allowed the substitution and release of classified spare parts under blanket orders for shipment to foreign countries, and that a written policy does not exist to determine the actions needed to recover these items; (2) lacks adequate control edits in its system to prevent the release of some unclassified spare parts and other items containing military technology, and that a written policy does not exist to determine the actions needed to recover these items; and (3) has not conducted periodic tests to validate that its system is accurately reviewing and approving blanket orders. As a result of these inadequate internal controls, classified spare parts, as well as unclassified items containing military technology, were shipped to foreign countries that may not be eligible to receive them under blanket orders. Army Lacked Control Edits in Its System and Allowed the Substitution and Release of Classified Spare Parts under Blanket Orders: The Army lacked control edits in its system and allowed the substitution and release of classified spare parts under blanket orders for shipment to foreign countries. The Army and DOD policies prohibit the release of classified spare parts, under blanket orders, to foreign countries. We identified 3 of the 40 requisitions in our review for the period between October 1, 1997, and April 30, 2003, where the Army item manager had released classified parts under 3 separate blanket orders. For these 3 requisitions, the original parts requested were unclassified but not in stock. The item manager substituted 11 classified digital processors for the unavailable parts and then released these parts under blanket orders for shipment to a foreign country. According to Army officials, the foreign countries were not entitled to receive these items under blanket orders. However, according to Army officials, the foreign countries would be entitled to these items because they have the equipment that these classified spare parts support and that these countries could obtain the parts under a different process such as a defined order.[Footnote 12] Therefore, according to the officials, in this particular case there is no need to retrieve the items. Based on the Army officials' response, we agree with their decision. Until we identified the problem, Army officials at the United States Army Security Assistance Command, who are responsible for implementing, administrating, and managing the Army's foreign military sales program, were not aware that these classified parts had been substituted for the originally requisitioned unclassified parts. Based on our review, the Army has modified the system to validate substituted parts selected by item managers. According to United States Army Security Assistance Command officials, they have no written policy to determine the actions the Army needs to take to recover classified spare parts or unclassified items containing military technology that were shipped to foreign countries that are not eligible to receive them. Army officials indicated that they have procedures to recover items shipped in lieu of the items ordered; however, the procedures do not address the recovery of items shipped that the foreign country was not eligible to receive. During our review, the officials did not agree with us that they should have written procedures in place to recover these items indicating that this responsibility belongs in the foreign military sales end-using monitoring[Footnote 13] program. They suggested we contact the Department of State and the Defense Security Cooperation Agency for additional information on recovering these items. While the Army may not be responsible for recovering these items, the Army would initially be aware that these items were shipped to foreign countries that may not be eligible to receive them, and could initiate recovery of these items. However, in discussions with officials on a draft of this report, officials indicated their current policies and procedures to recover items shipped in lieu of items ordered need to be modified to include items shipped to foreign countries that may not be eligible to receive them. Army Lacks Control Edits in Its System to Prevent the Release of Some Unclassified Items Containing Military Technology: The Army lacks control edits in its system to prevent the release of some unclassified items containing military technology to foreign countries under blanket orders. As a result, the Army has shipped some unclassified items containing military technology to foreign countries that may not be eligible to receive them. Officials from DOD's Office of the Deputy Under Secretary of Defense Technology Security Policy and Counterproliferation indicated that the Army should have control over unclassified items containing military technology. In addition, the Defense Security Cooperation Agency indicated criteria for releasing these items should be considered on a country-by-country basis prior to releasing any items to a foreign country. The agency also stated that the military departments should use the applicable codes available as a means to help identify spare parts that contain military technology to ensure that the appropriate means are taken and adequate controls are in place to prevent unauthorized releases. Within the 21,663 requisitions for unclassified items containing military technology that were shipped, we found the following requisitions were not identified and reviewed before they were released: (1) 17,175 requisitions were for 381,245 items such as circuit card assemblies, fire control units, and electron tubes that require their inherent military capability to be destroyed or demilitarized prior to their release to the public; and (2) 387 requisitions were for 2,267 items that foreign countries are prohibited from requesting using blanket orders because the spare parts require release authority from inventory control points. Based on our review, the Army had initiated action to modify its system to cancel blanket orders for parts that require release authority from inventory control points. With such a modification, these 387 requests would be canceled. However, the action to modify the system is pending based on the official interpretation of the Army regulation on spare parts that requires release authority from inventory control points. In addition, as previously mentioned, according to United States Army Security Assistance Command officials, the Army has no written policy for recovering classified spare parts and unclassified items containing military technology that were shipped to foreign countries not eligible to receive them. According to Army officials, the foreign countries were entitled to receive these items. Therefore, according to the officials, in these particular cases there is no need to retrieve the items. Based on the Army officials' response, we agree with their decision. In 1991, the Army had a control edit installed in its system that identified requisitions for parts containing military technology for manual review. This control edit caused thousands of requisitions to be referred for manual review. Army documents indicate that it removed the control edit because according to guidance from the U.S. Army Defense Systems Command and System Integration and Management Activity, the parts containing military technology do not require protected storage. Army documents also indicate that removing the control edit that identified requisitions for unclassified items containing military technology would eliminate an enormous number of labor hours required to research these parts. The system does not refer for review those requisitions for items containing military technology because Army officials stated that DOD has determined that these items are not classified, sensitive, or pilferable; consequently, the items should not be subjected to controlled physical inventory requirements. In 1992, DOD changed selected stock numbers from unclassified to a classification indicating unclassified stock containing military technology to ensure that parts requiring demilitarization could be researched if shortages were reported during depot inventory reviews and do not require protected storage. In our earlier review of the Air Force, we reported[Footnote 14] that the Air Force did not use control edits to prevent spare parts containing sensitive military technology from being released to foreign countries. The Air Force plans to develop criteria for identifying spare parts containing sensitive military technology and establish appropriate control edits in its automated system so that requisitions for spare parts containing sensitive military technology are identified and referred for review. Also, the Air Force uses criteria, such as federal supply class, to restrict the parts available to foreign military sales customers. For example, we reported[Footnote 15] that the Air Force restricts countries from requisitioning parts belonging to the 1377 federal supply class (cartridge and propellant actuated devices and components) using blanket orders. There are three codes the Army could use to identify spare parts that contain military technology. These codes are (1) the controlled inventory item code, which indicates the security classification and security risk for storage and transportation of DOD assets; (2) the demilitarization codes assigned by the item manager identifying how to dispose items; and (3) the federal supply class code. Demilitarization codes are assigned to spare parts for new aircraft, ships, weapons, supplies, and other equipment. The demilitarization codes also determine whether the items contain military technology and establish what must be done to the items before they are sold. Army Has Not Conducted Periodic Tests to Validate Its System: The Army has not conducted periodic tests to validate that its system is accurately reviewing and approving blanket order requisitions and operating in accordance with the Army's foreign military sales policies. GAO's and the Office of Management and Budget's internal control standards require that a system such as the Army's be periodically validated and tested to ensure that it is working as intended and the ability to accurately review and approve requisitions is not compromised. In the Federal Information Systems Controls Audit Manual,[Footnote 16] which lists control activities for information systems, one of the control activities listed involves the testing of new and revised software to ensure that it is working correctly. Also, in the Management of Federal Information Resources,[Footnote 17] the manual requires that each agency establish an information system management oversight mechanism that provides for periodic reviews to determine how mission requirements might have changed and whether the information system continues to fulfill ongoing and anticipated mission requirements. Furthermore, the Internal Control Management and Evaluation Tool [Footnote 18]--a tool that assists managers and evaluators in determining how well an agency's internal control is designed and functioning --lists monitoring as one of five standards of internal controls. Internal control monitoring should assess the quality of performance over time and ensure findings from reviews are promptly resolved. Ongoing monitoring occurs during normal operations and includes regular management and supervisory activities, comparisons, reconciliations, and other actions people take in performing their duties. In our review, we found that a foreign country had requested unclassified parts using blanket orders for which the item manager substituted and shipped classified spare parts. According to DOD officials, had the system validated the substituted classified spare parts, the system would have canceled the orders. United States Army Security Assistance Command officials were unaware of this situation until we identified the problem. Also, we found spare parts where the security classification had been changed from unclassified to classified without Army officials being notified of the change. Based on our review, the Army initiated actions to add control edits to its system to (1) validate substituted spare parts before they are released to foreign countries and (2) review monthly supply catalog updates and cancel open blanket orders when spare parts' security classification changes from unclassified to classified. Defense Security Assistance Development Center officials indicated that periodic tests of the Army's system have not been conducted because, in October 1998, the Defense Security Cooperation Agency directed that no additional funds be used to expand the current system. However, Defense Security Cooperation Agency officials stated that this directive does not preclude the Army from periodically testing the system and its logic. According to DOD and Army officials, they have not tested the system's logic for restricting requisitions since 1999 when they initially modified the system to cancel requisitions for classified spare parts under blanket orders. As part of our review, we tested the system by reviewing Army restrictions applied to historical requisitions on classified spare parts and unclassified items containing military technology and found that the system did not always perform as intended. According to Army officials, there have not been any reviews to assess whether the foreign military sales requisition process for items ordered are processed correctly. The Centralized Integrated System for International Logistics system creates daily reports that identify problems with requisitions, which are then reviewed by Army case managers before continuing through the system. While officials indicated several external audits with GAO and the Army Audit Agency have been recently completed, these audits focused on the overall foreign military sales program and not the requisition process. Based on our observations, these audits do not replace a system test to determine whether the current system is in compliance with existing requisitioning policies and procedures. Conclusion: The Army has not maintained effective internal controls over foreign military sales sold under blanket orders. Specifically, the Army lacked control edits in its system and allowed the substitution and release of classified spare parts under blanket orders for shipment to foreign countries that may not be eligible to receive them. Also, the Army lacks control edits in its system to prevent the release of some unclassified items containing military technology to foreign countries. Moreover, the Army has no written policies to determine the actions needed to recover classified spare parts and unclassified items containing military technology that have been shipped to foreign countries not eligible to receive them. Further, the Army failed to periodically test the Centralized Integrated System for International Logistics system. If the Army had conducted tests to determine whether its system was in compliance with requisitioning policies and procedures, some classified spare parts--as well as unclassified items containing military technology--may not have been released to foreign countries under blanket orders. Without adequate internal controls, classified spare parts and unclassified items containing military technology may be released to foreign countries under blanket orders, thereby providing military technology to countries that might use it against U.S. interests. Recommendations for Executive Action: To improve internal controls over the Army's foreign military sales program and to prevent foreign countries from being able to obtain classified spare parts or unclassified items containing military technology that they are not eligible to receive under blanket orders, we are recommending that the Secretary of Defense instruct the Secretary of the Army to take the following two actions: * Modify existing policies and procedures, after consultation with the appropriate government officials, to cover items shipped in lieu of items ordered to also ensure the recovery of classified spare parts that have been shipped to foreign countries that may not be eligible to receive them under blanket orders. * Modify existing policies and procedures covering items, after consultation with the appropriate government officials, to cover items shipped in lieu of items ordered to also ensure the recovery of unclassified items containing military technology that have been shipped to foreign countries that may not be eligible to receive them under blanket orders. To improve the Army system's internal controls aimed at preventing foreign countries from obtaining classified spare parts or unclassified items containing military technology under blanket orders, we are recommending that the Secretary of Defense direct the Under Secretary of Defense for Policy to require the appropriate officials to take the following two actions: * Modify the system so that it identifies blanket order requisitions for unclassified items containing military technology that should be reviewed before they are released. * Periodically test the system and its logic for restricting requisitions to ensure that the system is accurately reviewing and approving blanket order requisitions. Agency Comments and Our Evaluation: In commenting on a draft of this report, DOD concurred with two of our recommendations and did not concur with the two other recommendations. First, with regard to our recommendation to modify the system so that it identifies blanket order requisitions for unclassified items containing military technology that should be reviewed before they are released, the department concurred. DOD's comments indicated that the Army will comply with making the specific changes to the system that the Defense Security Cooperation Agency identified as required or that the Army would conduct its own study, given the funding and guidance necessary, to identify items that should be reviewed before they are released. Second, with regard to our recommendation to periodically test the Centralized Integrated System for International Logistics, the department stated that the Army will conduct periodic testing of the system and its logic for restricting requisitions, given the funding and guidance necessary to do so. We also received technical comments and we incorporated them wherever appropriate. With regard to our two recommendations to consult with the appropriate agencies to determine what actions the Army needs to initiate in order to recover (1) classified spare parts and (2) unclassified items containing military technology that have been shipped in error, i.e., shipped in lieu of items ordered, under blanket orders, DOD did not concur. The department said that the Army already has procedures in place to recover classified spare parts and unclassified items containing military technology that have been shipped in error, i.e., shipped in lieu of items, ordered under blanket orders. The procedures include (1) systemic status codes that will advise the case manager that an incorrect item is being shipped by the supply center, at which time the error can be corrected; (2) if the item is still shipped, the case manager can begin retrieval actions by contacting the Security Assistance Office in country; and (3) the customer can initiate a Supply Discrepancy Report upon receipt of the incorrect item to return the item. We acknowledge that these procedures might address wrong items shipped. However, they do not address the intent of our recommendations to recover classified spare parts and unclassified items containing military technology shipped to foreign countries that are not eligible to receive them. If the country requested classified spare parts or unclassified items containing military technology that it is not eligible to receive under blanket orders, it will not likely submit a Supply Discrepancy Report if it had intended to order the items. In addition, we interviewed Defense Security Cooperation Agency and Army officials to determine if the procedures they cited in the agency comments are referring to items shipped in lieu of items ordered instead of shipment of items that foreign countries are not eligible to receive. According to the officials, the procedures are for items shipped in lieu of items ordered and not for the recovery of items that the foreign countries are not eligible to receive. As stated in our report, Army officials told us that they had no written procedures in place to recover classified spare parts or unclassified items containing military technology, because it is not within their responsibility to recover these items. These officials stated that this responsibility belongs to the foreign military sales end-use monitoring program, which includes the Department of State and the Defense Security Cooperation Agency. In following-up with officials on their written comments on the draft of this report, they agreed that they need to modify existing policies and procedures covering items, after consultation with the appropriate government officials, to cover items shipped in lieu of items ordered to also ensure the recovery of classified spare parts and unclassified items containing military technology that have been shipped to foreign countries that may not be eligible to receive them. As a result, we have modified our two recommendations accordingly. Scope and Methodology: To assess and test whether the Army's internal controls adequately restricted blanket orders for classified spare parts sold to foreign countries, we obtained current DOD and Army guidance on the foreign military sales programs. We also held discussions with key officials from the United States Army Security Assistance Command, New Cumberland, Pennsylvania, to discuss the officials' roles and responsibilities, as well as the criteria and guidance they used in performing their duties to restrict foreign countries from requisitioning classified spare parts and other items containing military technology under blanket orders. Also, we interviewed the officials on the requisitioning and approval processes applicable to classified spare parts. In addition, we obtained written responses from officials at the Defense Security Cooperation Agency, Washington, D.C., to identify the agency's roles and responsibilities regarding the policies and procedures relevant to the foreign military sales programs. We also interviewed officials from the Defense Security Assistance Development Center, Mechanicsburg, Pennsylvania, to discuss their roles and responsibilities, as well as the criteria and the guidance they used to maintain and oversee the Army's Centralized Integrated System for International Logistics system to restrict foreign countries from requisitioning classified spare parts and other items containing military technology under blanket orders. Furthermore, we interviewed officials to determine the functional and operational controls that are used to validate requisitions entered into the system. To test the adequacy of the Army's internal controls to restrict access to certain unclassified items containing military technology, we obtained DOD and Army guidance on the foreign military sales program. We also reviewed requisitions for unclassified items containing military technology for which the system had approved the shipments under blanket orders. In addition, we interviewed Army officials to obtain their reasons for releasing these items. Also, we obtained records from the United States Army Security Assistance Command on all classified spare parts and unclassified items containing military technology that were purchased using blanket orders and approved for shipment to foreign countries from October 1, 1997, through April 30, 2003. We limited our review to blanket orders because defined orders and Cooperative Logistics Supply Support Agreements specified the parts that countries were entitled to requisition by the national stock number. The records covered 21,703 requisitions for classified spare parts and unclassified spare parts and other items that contain military technology. We tested the system by identifying the 40 requisitions for classified spare parts that were shipped under blanket orders and reviewed the restrictions applied to determine if the system was operating as intended. To assess the Army's internal controls on the release of unclassified items containing military technology, we reviewed 21,663 requisitions for which the system had approved the shipments under blanket orders. Further, we obtained written responses from DOD officials concerning whether unclassified items containing military technology should be reviewed prior to being released to foreign countries. While we identified some issues concerning the appropriate procedures for such items, in all the cases we reviewed, we found that the items had been ordered and shipped from the Army's system. To determine whether the Army periodically conducted tests to validate the system to ensure that it accurately identified for review and approval blanket order requisitions to support foreign military sales, we obtained and reviewed documentation identifying the system tests to determine how often they were conducted. Also, we interviewed Army and DOD officials to determine how periodic reviews and tests were performed on the system. We conducted our review from May 2003 through December 2003 in accordance with generally accepted government auditing standards. As arranged with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from the date of this report. At that time, we will send copies of this report to the Secretary of Defense; the Secretary of the Army; the Director, Office of Management and Budget; and interested congressional committees. We will also make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. Please contact me on (202) 512-8365 if you or your staff have any questions concerning this report. Key contributors to this report were Lawson (Rick) Gist, Jr.; Carleen Bennett; Latrealle Lee; Elisah Matvay; Arthur James, Jr.; and Ann DuBois. Sincerely yours, Signed by: William M. Solis, Director Defense Capabilities and Management: [End of section] Appendix I: Comments from the Department of Defense: DEFENSE SECURITY COOPERATION AGENCY: WASHINGTON, DC 20301-2800: JAN 29 2004: In reply refer to: I-03/017392: Mr. William M. Solis, Director Defense Capabilities and Management U.S. General Accounting Office: 441 G Street, N.W. Washington, D.C. 20548: Dear Mr. Solis: This is the Department of Defense (DoD) response to the GAO Draft report, "Foreign Military Sales: Improved Army Controls Could Prevent Unauthorized Shipments of Classified Spare Parts and Items Containing Military Technology to Foreign Countries" dated 19 December 2003 (GAO Code 350374/GAO-04-327). The Department has reviewed the draft report and concurs with two of the four recommendations directed to the Secretary of Defense by the GAO. Comments addressing the GAO draft report recommendations are included in the enclosure. The Department appreciates the opportunity to comment on the draft report. My point of contact on this matter is Ms. Kathy Robinson. She may be contacted by email: kathy.robinson @dsca.mil or by telephone at (703) 601-4368. Sincerely, Signed by: TOME H. WALTERS, JR.: LIEUTENANT GENERAL, USAF: DIRECTOR: DRAFT REPORT - DATED DECEMBER 19, 2003 GAO CODE 350374/GAO-04-327: "FOREIGN MILITARY SALES: IMPROVED ARMY CONTROLS COULD PREVENT UNAUTHORIZED SHIPMENTS OF CLASSIFIED SPARE PARTS AND ITEMS CONTAINING MILITARY TECHNOLOGY TO FOREIGN COUNTRIES": DEPARTMENT OF THE DEFENSE COMMENTS TO THE RECOMMENDATIONS: RECOMMENDATION 1: The GAO recommended that the Secretary of Defense direct the Secretary of the Army to consult with the appropriate agencies to determine what actions the Army needs to initiate to recover classified spare parts that have been shipped in error under blanket orders. (p. 20/GAO Draft Report): DOD RESPONSE: Non-Concur. Procedures are already in place to recover classified spare parts that have been shipped in error under blanket orders. Examples of these procedures are: 1) systemic status codes will advise the case manager that an incorrect item is being shipped by the source of supply, at which time the error can be corrected; 2) if the item is still shipped, the case manager can begin retrieval actions by contacting the Security Assistance Office in country; or 3) the customer can initiate a Supply Discrepancy Report upon receipt of the incorrect item to return the item. RECOMMENDATION 2: The GAO recommended that the Secretary of Defense direct the Secretary of the Army to consult with appropriate agencies to determine what actions the Army needs to initiate to recover unclassified spare parts items containing military technology that have been shipped in error under blanket orders. (p. 20/GAO Draft Report): DOD RESPONSE: Non-Concur for the same reason shown in Recommendation 1. RECOMMENDATION 3: The GAO recommended that the Secretary of Defense direct the Under Secretary of Defense (Policy) to require the appropriate officials to modify the system so that it identifies blanket order requisitions for unclassified items containing military technology that should be reviewed before they are released. (p. 20/GAO Draft Report): DOD RESPONSE: Concur. The Army will comply with DSCA's identification of specific changes required to the system or for the Army to conduct its own study, given the funding and guidance required, to identify blanket order requisitions for unclassified items containing military technology that should be reviewed before they are released. The Army is already in the process of tightening CISIL's edits to check the Controlled Item Inventory Code (CIIC) if the system receives notification that the supply source has made an item substitution (e.g., if the originally requisitioned item is not available). If the CIIC is classified or sensitive, CISIL will generate a reject transaction. The Army is also modifying CISIL to notify if CIICs change to a classified or sensitive code. RECOMMENDATION 4: The GAO recommended that the Secretary of Defense direct the Under Secretary of Defense (Policy) to require the appropriate officials to periodically test the system and its logic for restricting requisitions to ensure that the system is accurately reviewing and approving blanket order requisitions. (P. 20/GAO Draft Report): DOD RESPONSE: Concur. The Army will conduct periodic testing of the system and its logic for restricting requisitions, given the funding and guidance required to do so. [End of section] FOOTNOTES [1] Classified parts are restricted for national security reasons. [2] DOD defines military technology as military critical technology that would reveal or give insight into the design and manufacture of U.S. military systems and materials and, if exported, would permit significant advance in the military potential of any country. Some of these items require demilitarization prior to release to the public. [3] Security Assistance Management Manual, DOD 5105.38-M (Oct. 3, 2003). [4] U.S. General Accounting Office, Standards for Internal Control in the Federal Government, GAO/AMID-00-21.3.1 (Washington, D.C.: November 1999). Internal control activities help ensure that management directives are carried out. The control activities should be effective and efficient in accomplishing the agency's control objectives. [5] The Centralized Integrated System for International Logistics, hereafter referred to as the system, is the Army's logistics information and tracking system that validates foreign customers' requisitions and determines if authorized items are requested based on foreign military sales cases. [6] U.S. General Accounting Office, Foreign Military Sales: Improved Air Force Controls Could Prevent Unauthorized Shipments of Classified and Controlled Spare Parts to Foreign Countries, GA0-03-664 (Washington, D.C.: July 29, 2003). [7] U.S. General Accounting Office, Foreign Military Sales: Air Force Does Not Use Controls to Prevent Spare Parts Containing Sensitive Military Technology from Being Released to Foreign Countries, GAO-03- 939R (Washington, D.C.: Sept. 10, 2003). [8] The inventory control point is an organizational element within a DOD system, which is assigned responsibility for material management of a group of items including such management functions as the initiation of procurement or disposal actions and distribution management. [9] P.L. No. 90-629. [10] P.L. No. 87-195. [11] The code is called controlled inventory item code and indicates the security classification and security risk or controls for storage and transportation of DOD assets. [12] Defined orders are foreign military sales cases used to specify defense articles and services that are identified and approved in the letter of agreement. [13] End-use monitoring refers to the procedures used to verify that foreign governments are using and controlling U.S. defense articles and services in accordance with U.S. terms and conditions of the transfer. [14] GAO-03-939R. [15] GAO-03-664. [16] U.S. General Accounting Office, Federal Information System Controls Audit Manual, GAO/AIMD-12.19.6 (Washington, D.C.: January 1999). [17] Office of Management and Budget, Management of Federal Information Resources (Washington, D.C.: November 2000). [18] U.S. General Accounting Office, Internal Control Management and Evaluation Tool, GAO-01-1008G (Washington, D.C.: August 2001). GAO's Mission: The General Accounting Office, the investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO's Web site ( www.gao.gov ) contains abstracts and full-text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as "Today's Reports," on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select "Subscribe to e-mail alerts" under the "Order GAO Products" heading. Order by Mail or Phone: The first copy of each printed report is free. Additional copies are $2 each. A check or money order should be made out to the Superintendent of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single address are discounted 25 percent. Orders should be sent to: U.S. General Accounting Office 441 G Street NW, Room LM Washington, D.C. 20548: To order by Phone: Voice: (202) 512-6000: TDD: (202) 512-2537: Fax: (202) 512-6061: To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov Automated answering system: (800) 424-5454 or (202) 512-7470: Public Affairs: Jeff Nelligan, managing director, NelliganJ@gao.gov (202) 512-4800 U.S. General Accounting Office, 441 G Street NW, Room 7149 Washington, D.C. 20548: