oversight

Combating Terrorism: Chemical and Biological Medical Supplies Are Poorly Managed

Published by the Government Accountability Office on 1999-10-29.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                      United States General Accounting Office

GAO                   Report to Congressional Committees




October 1999
                      COMBATING
                      TERRORISM
                      Chemical and
                      Biological Medical
                      Supplies Are Poorly
                      Managed




GAO/HEHS/AIMD-00-36
      United States
GAO   General Accounting Office
      Washington, D.C. 20548

      Health, Education, and
      Human Services Division

      B-282839

      October 29, 1999

      The Honorable Arlen Specter, Chairman
      Committee on Veterans’ Affairs
      United States Senate

      The Honorable John Rockefeller
      Ranking Minority Member
      Committee on Veterans’ Affairs
      United States Senate

      The Honorable Christopher Shays, Chairman
      Subcommittee on National Security, Veterans’ Affairs,
        and International Affairs
      Committee on Government Reform
      House of Representatives

      The Honorable Ike Skelton
      Ranking Minority Member
      Armed Services Committee
      House of Representatives

      The threat of chemical or biological terrorist attacks against U.S. citizens
      is a high-priority, national concern. The March 1995 terrorist attack in the
      Tokyo subway system using the nerve agent sarin, and other more recent
      national and international terrorist incidents have raised concerns about
      whether the United States can effectively respond to incidents involving
      chemical or biological agents. Reflecting these concerns, the federal
      government has established several stockpiles of antidotes and other
      medical supplies and plans to develop a larger national
      stockpile—referred to as the National Pharmaceutical Stockpile
      Program—to be used in the event of domestic chemical and biological
      attacks.

      This report responds to your concerns about the adequacy of the
      stockpiles. Our objectives were to (1) review the accuracy and currency of
      the inventory tracking systems for federal medical stockpiles that would
      be used to treat the civilian population following a chemical or biological
      terrorist attack and (2) examine the internal controls in place to manage
      the stockpiles. We conducted a 100 percent inventory of the existing
      domestic federal stockpiles managed by the Department of Veterans
      Affairs (VA) for the Department of Health and Human Services’ (HHS) Office




      Page 1                                 GAO/HEHS/AIMD-00-36 Combating Terrorism
                   B-282839




                   of Emergency Preparedness (OEP). We also conducted a 100 percent
                   inventory of the medical supplies kept by the Marine Corps Chemical
                   Biological Incident Response Force (CBIRF), whose mission includes
                   responding to domestic terrorist events. We also reviewed the inventories
                   taken and procedures followed by the vendor storing the Centers for
                   Disease Control and Prevention’s (CDC) smallpox vaccine, although we did
                   not count the stockpile. Consistent with our review objectives, we did not
                   assess the effectiveness and appropriateness of medical preparedness. In
                   addition, the threat of chemical and biological terrorism is the subject of
                   another study we recently published.1 We conducted our review from
                   May 1999 through September 1999 in accordance with generally accepted
                   government auditing standards. Details of our scope and methodology are
                   in appendix I.


                   The U.S. ability to effectively respond to chemical or biological terrorist
Results in Brief   incidents is compromised by poor management controls and the lack of
                   required items. Our physical inventory of OEP’s stockpiles, which VA
                   manages, compared with OEP’s required list showed a discrepancy of more
                   than 12 percent. Although most discrepancies were overages, we also
                   found shortages. For example, we found 3,400 excess gloves at one
                   location and 400 extra diazepam vials (a controlled substance) at another.
                   We also found that the inventory was short of 1,000 required diazepam
                   injectors at one location and at another location had 500 fewer vials of
                   diazepam than required. In addition, when we compared our inventory
                   with VA’s inventory records, we found expired items. At one location, the
                   entire amount of amyl nitrate listed in VA’s records (2,000 vials) had
                   expired 8 months before our visit, and at another location we found more
                   than 400 vials of pralidoxime whose expiration date was recorded
                   incorrectly. In comparing CBIRF’s medical supplies with the records in its
                   inventory tracking system, for approximately 26 percent of the inventory
                   items we found either discrepancies between the inventory records and
                   the amount in stock or errors in the recording of lot numbers and
                   expiration dates.

                   The principal cause of problems we identified is that the responsible
                   federal agencies did not implement basic internal controls that would
                   reasonably assure that all medical supplies and pharmaceuticals are
                   current, accounted for, and available for use. Consistent with the Federal
                   Managers’ Financial Integrity Act of 1982 (FMFIA), agencies should have


                   1
                   Combating Terrorism: Need for Comprehensive Threat and Risk Assessments of Chemical and
                   Biological Attacks (GAO/NSIAD-99-163, Sept. 7, 1999).



                   Page 2                                         GAO/HEHS/AIMD-00-36 Combating Terrorism
             B-282839




             efficient and effective internal controls over their operations and
             programs. Neither OEP nor CBIRF explained its lack of compliance, and we
             identified problems in all major aspects of internal controls—control
             environment, risk assessment, control activities, information and
             communications, and monitoring. For example, their systems lacked basic
             information required for good recordkeeping, such as documentation of
             back orders, replacements, and shipment and receipt of all pharmaceutical
             and medical supplies. They also did not conduct periodic inventories,
             maintain program policies and procedures, or provide adequate security of
             the stockpiles. As a result, these systems cannot be relied upon to
             consistently and accurately account for the items required to be in the
             stockpiles.

             Even more will be at stake in the future as CDC establishes the National
             Pharmaceutical Stockpile Program. Although CDC is still in the early
             phases of developing this program, its current plan does not include
             comprehensive internal controls to prevent the types of problems we
             found at the other agencies. To reasonably assure the proper management
             of this new stockpile, as well as to correct deficiencies in the others, we
             are recommending actions to improve the internal control programs for
             the federal chemical and biological medical stockpiles.


             The United States has established national policy for combating chemical
Background   and biological terrorism and managing the consequences of terrorist
             attacks. The Federal Emergency Management Agency (FEMA) is the lead
             agency for managing the consequences of terrorist attacks, with the
             authority to assign missions to any federal agency in the event of a disaster
             or emergency declared by the president.2 FEMA coordinates the federal
             response through a contingency plan, known as the Federal Response
             Plan, that details the roles and responsibilities of federal agencies during
             natural or manmade emergencies. The plan also categorizes types of
             federal assistance into specific emergency support functions (for example,
             information and planning, health and medical services, urban search and
             rescue).

             As we reported earlier, “If the consequences of a terrorist threat become
             imminent or actually occur, state and local authorities would initiate
             consequence management actions, while FEMA would monitor the situation
             in consultation with the President and the governor. If state and local
             capabilities are overwhelmed, the President could then direct FEMA, with

             2
              Under the Robert T. Stafford Disaster Relief and Emergency Assistance Act (P.L. 93-288), as amended.



             Page 3                                             GAO/HEHS/AIMD-00-36 Combating Terrorism
B-282839




the support of appropriate federal agencies, to assist.”3 FEMA, through the
Federal Response Plan, has designated HHS as the lead agency to
coordinate medical assistance in the event of a federally declared natural
or manmade disaster, including chemical or biological terrorist incidents.
Within HHS, OEP is responsible for implementing and coordinating this
medical assistance, and in 1997 it established four National Medical
Response Teams, each with a medical stockpile containing antidotes,
antibiotics, and medical supplies for responding to chemical terrorist
attacks. OEP also maintains one smaller stockpile that contains only
antidotes for chemical incidents; this stockpile can be loaned to local
governments or predeployed for special events, such as the Olympics.
OEP’s stockpiles are positioned throughout the United States, and all but
one are located at federally owned facilities. While OEP is responsible for
these stockpiles, through an interagency agreement, it has delegated
day-to-day management to VA.

CBIRF, created in 1996 by the Commandant of the Marine Corps, maintains
a working stock of medical supplies to respond to chemical and biological
incidents.4 CBIRF is the only Department of Defense (DOD) unit whose
mission includes responding to and treating civilian victims of chemical or
biological terrorist attacks. Its staff includes a medical unit of 27 Navy
personnel who manage the working stock of pharmaceuticals and medical
supplies. CBIRF also uses local government stockpiles where available to
treat civilians.

In 1998, the Congress appropriated $51 million for CDC to acquire a
pharmaceutical and vaccine stockpile to counter potential biological,
disease, and chemical threats to civilian populations.5 Currently, CDC is
developing its plans to accumulate these medical supplies, and it has also
recently transferred $1.4 million of the $51 million to OEP to augment its
supply of antidotes for chemical attacks. For the past 26 years, CDC has
also maintained the nation’s stockpile of smallpox vaccine through a
contract with the manufacturer. This vaccine can be used against a
terrorist release of smallpox.

3
 Combating Terrorism: Federal Agencies’ Efforts to Implement National Policy and Strategy
(GAO/NSIAD-97-254, Sept. 26, 1997). In 1997, under section 1417 of title XIX of the Defense Against
Weapons of Mass Destruction Act of 1996, FEMA developed and implemented a Rapid Response
Information System (RRIS), which can be accessed on the Internet. The RRIS contains data on federal
assets, such as decontamination units, and training programs available to assist terrorist response
operations of state and local governments. It does not contain information on the contents of the
existing federal stockpiles for responding to chemical or biological terrorist incidents.
4
 CBIRF officials refer to the medical supplies they maintain as a working stock. To simplify our
presentation, we refer to CBIRF’s medical supplies as a stockpile.
5
 The Omnibus Consolidated and Emergency Supplemental Appropriations Act (P.L. 105-277).



Page 4                                              GAO/HEHS/AIMD-00-36 Combating Terrorism
                       B-282839




                       In addition to federal efforts, state and local agencies have the
                       responsibility for providing “first response” medical assistance to the
                       civilian population in natural and manmade disasters, including chemical
                       or biological terrorist attacks. If state and local capacities are
                       overwhelmed by a disaster, federal assets such as the chemical and
                       biological medical supplies that CDC, CBIRF, and OEP stockpile could be
                       deployed to augment local responses.

                       FMFIA requires GAO to issue standards for internal control in government.
                       The standards provide the overall framework for internal control, and the
                       Office of Management and Budget (OMB) Circular A-123, Management
                       Accountability and Control, revised June 21, 1995, provides the specific
                       requirements for assessing and reporting on controls.


                       Our complete inventory of the OEP and CBIRF stockpiles showed that
Inventory Tracking     neither inventory control system accurately tracks federal medical
Systems Are Neither    supplies. Our comparison of OEP’s list of required items with our physical
Current Nor Accurate   inventory revealed discrepancies for about 23,000 items, or more than
                       12 percent, across the five sites.6 Although most discrepancies were
                       overages, others involved items that were stocked in a smaller quantity
                       than required or were not in stock at all. For instance, some of the
                       overages at individual sites included about 600 extra amyl nitrate
                       inhalants; a total of 3,400 small, medium, and large pairs of gloves; about
                       1,000 potassium iodide tablets; and 1,000 diazepam injectors. Shortages
                       included about 300 pralidoxime vials, 100 diazepam vials, and at two
                       locations almost 300 potassium iodide tablets at each site. In addition,
                       OEP’s list required 1,000 diazepam injectors in the stockpile; however, at
                       one location, we found none, and none were recorded in VA’s inventory
                       record. At another location, we found 500 fewer vials of diazepam than
                       required.

                       Our comparison of OEP’s stockpiles with VA’s computerized inventory
                       records revealed a discrepancy of more than 11 percent. For the most part,
                       discrepancies occurred in three categories—overages, shortages, and
                       items for which lot numbers and expiration dates were recorded
                       incorrectly. At one location, we found about 600 more amyl nitrate
                       inhalants than recorded; we found 1,600 extra pairs of gloves at another
                       location and 250 extra doxycycline tablets at another. Some shortages

                       6
                        When we compared our physical inventory with OEP’s required list, we identified overages and
                       shortages. We were also able to identify other incorrectly recorded items when we compared our
                       physical inventory with VA’s inventory records. See appendix I for an explanation of how we
                       calculated the discrepancy rates.



                       Page 5                                            GAO/HEHS/AIMD-00-36 Combating Terrorism
                         B-282839




                         included 100 vials of diazepam, 100 Mark I injectors (a chemical antidote),
                         and 250 doxycycline tablets. Items recorded incorrectly included 2,000
                         amyl nitrate inhalants, which had expired 8 months before our visit, and
                         about 440 pralidoxime vials, 250 doxycycline tablets, and 100 ciprofloxacin
                         tablets, whose expiration dates and lot numbers were recorded
                         incorrectly.

                         The Marine Corps CBIRF stockpile had similar problems. Specifically, we
                         determined that about 2,300 items of the 38,000-item inventory list were
                         not in stock. These items included about 1,500 doses of an antidote. In
                         addition, CBIRF’s computerized inventory system did not identify and track
                         5,700 items that we found in the inventory, such as oral and nasal airways
                         that would be deployed in response to a chemical or biological terrorist
                         attack. However, the computerized inventory system recorded and tracked
                         other CBIRF medical materials that would not be used in a chemical or
                         biological incident, such as training equipment and pharmaceuticals for
                         the general use of the unit. Additional details of the results of our
                         inventories are in appendix II.


                         The root cause of the inventory problems we identified was a fundamental
Lack of Controls Is      lack of internal controls, although the agencies did not explain their lack
the Principal Cause of   of compliance with our internal control standards. Internal controls, as
Poor Inventory           outlined by our standards for internal control, provide reasonable
                         assurance that program objectives for effective and efficient operations,
Management               reliable financial reporting, and compliance with applicable laws and
                         regulations are met.7 OEP, VA, and CBIRF did not implement the following
                         five internal control standards for managing their stockpile programs:
                         (1) effective control environment, (2) risk assessments, (3) control
                         activities, (4) information and communications, and (5) monitoring.


Control Environment      OEP, VA,and CBIRF did not provide sufficient leadership and supervision to
                         their own personnel to reasonably assure an adequate control
                         environment for the stockpiles. While OEP has overall responsibility for
                         managing the stockpiles, it has chosen to delegate day-to-day
                         responsibility for stockpile management to VA through an interagency
                         agreement. In delegating its responsibilities for the stockpiles, OEP did not
                         provide clear guidance to VA on the requirements and standards that VA
                         should follow to effectively manage and maintain OEP’s stockpiles.

                         7
                         See our exposure draft entitled Internal Control: Standards for Internal Control in the Federal
                         Government (GAO/AIMD-99-21.3.1, May 1999).



                         Page 6                                              GAO/HEHS/AIMD-00-36 Combating Terrorism
                     B-282839




                     Moreover, VA did not provide formal guidance or clearly define activities,
                     key duties, and responsibilities for personnel charged with managing OEP’s
                     stockpiles. Similarly, the Marine Corps did not provide adequate guidance
                     to CBIRF concerning the composition of its medical supply inventory or
                     how to manage it.


Risk Assessment      OEP, VA,and CBIRF did not determine the hazards and risks that their
                     stockpiles faced, assess the likelihood of each risk’s occurrence, and
                     establish plans to detect or mitigate them. For example, neither OEP nor VA
                     assessed the possibility of the theft of stockpile items and, therefore, did
                     not have a plan in case a theft occurred. When VA personnel counted items
                     at one of OEP’s stockpile locations, in anticipation of our visit, they found
                     that 48 amyl nitrate inhalants were missing and presumed stolen. VA
                     replaced the missing items, waited 30 days before reporting the missing
                     amyl nitrate to OEP, and then raised concerns about its limited control over
                     the secured storage and the security of the stockpile. OEP had neither
                     addressed nor improved the storage situation at this site by
                     September 1999. The location of the missing drugs at this site remains a
                     mystery and is unresolved between OEP and VA.


Control Activities   OEP, VA, and CBIRF did not establish procedures to carry out control
                     activities and manage the medical stockpiles. For example, key duties
                     need to be segregated among different people to reduce the risk of error
                     and fraud. However, the same individual who ordered supplies for OEP’s
                     stockpiles also replaced and disposed of items and recorded all changes in
                     the computerized tracking system. At CBIRF, staff entering data into the
                     computer tracking system also participated in physical inventory counts.
                     In addition, CBIRF staff stated that some items are consumed and some are
                     lost during exercises and are replaced from the warehouse stock, but
                     records of such consumption and loss are not included in the computer
                     tracking system. Both agencies’ systems also lacked basic information
                     required for adequate recordkeeping. For example, they did not document
                     back orders, replacements, or the shipment and receipt of all
                     pharmaceutical and medical supplies.

                     We found that all three agencies had not implemented adequate security
                     measures for their medical stockpiles. For example, at three of OEP’s five
                     stockpile locations, we found that VA had comingled OEP’s refrigerated
                     supplies in unsecured refrigerators, in violation of a general maintenance
                     and storage policy established by VA. Comingling supplies puts the



                     Page 7                                 GAO/HEHS/AIMD-00-36 Combating Terrorism
                  B-282839




                  stockpile items at risk because more people have access to the items,
                  making them more susceptible to waste, loss, unauthorized use, and
                  misappropriation. At one site, a supply of amyl nitrate—which is a
                  pharmaceutical with a street value—was stored in a large refrigerator in
                  the VA Inpatient Pharmacy, comingled with other VA medical center
                  pharmaceuticals. At another site, we found that amyl nitrate and an
                  antidote were stored in an unsecured staff refrigerator along with
                  employees’ lunches. And at a third site, OEP’s refrigerated supplies were
                  stored with other non-OEP supplies in an unlocked refrigerator outside the
                  secure area. VA officials explained that sometimes the secured areas where
                  OEP’s stockpiles are kept do not include electrical outlets needed to store
                  refrigerated items.


Information and   OEP, VA,and the Marine Corps did not require periodic reporting on
Communications    program status to agency management. Communication about stockpile
                  matters between OEP and VA was infrequent and irregular. For example,
                  both OEP and VA officials told us that they had originally planned to have
                  quarterly teleconferences or meetings about stockpile-related issues but
                  could demonstrate that only one meeting had taken place. Although VA has
                  managed OEP’s stockpiles since April 1997, OEP never requested that VA
                  produce (and VA has not provided) any regular, formal, written progress or
                  status reports on the stockpiles.

                  We found that the exchange of information on stockpile inventory status
                  and managerial activities between CBIRF, the Marine Corps, and the Navy
                  was also lacking. Marine Corps officials did not communicate clear
                  expectations about the type, extent, and frequency of reports they
                  expected CBIRF to produce on the status of its stockpile or about the type
                  and frequency of oversight the Marine Corps would exert. Neither the
                  Navy Medical Command nor the Marine Corps had ever requested that
                  CBIRF regularly produce written progress reports, inventory status, or fiscal
                  reports on its stockpile.


Monitoring        Neither OEP nor VA required or conducted periodic inventories of the
                  stockpiles to determine whether stockpiled items were current, accounted
                  for, and available for use. Although CBIRF periodically counted items in the
                  stockpile, it does not have an approved inventory list. As a result, it cannot
                  determine whether the stockpile contains all supplies needed to respond
                  to a chemical or biological terrorist attack. In contrast, we determined that




                  Page 8                                 GAO/HEHS/AIMD-00-36 Combating Terrorism
                    B-282839




                    the vendor storing the nation’s smallpox vaccine for CDC follows standards
                    for internal control.


                    CDC  received $51 million in fiscal year 1999 to establish the nation’s
CDC Is Managing a   National Pharmaceutical Stockpile Program. It has requested $52 million
New Stockpile       for fiscal year 2000 to continue establishing this stockpile. Under the
Program             program, CDC will stockpile medical supplies to be used in a biological or
                    chemical attack. Like OEP, CDC has selected VA to procure, oversee, and
                    store the national stockpile. As the program is currently envisioned, CDC
                    plans to require VA to begin stockpiling items 14 days after the interagency
                    agreement is signed. However, CDC’s draft National Pharmaceutical
                    Stockpile Program plan lacks information on how CDC will review and
                    assess the stockpile and contractor, what security measures it has to
                    safeguard the stockpile, and which CDC personnel will manage the
                    stockpile, stockpile operations, and command, control, and
                    communication functions.


                    Sound management of the chemical and biological stockpiles is critical to
Conclusion          the protection of public health in the event of a terrorist attack. However,
                    OEP, VA, and the Marine Corps did not explain why they have not followed
                    the basic standards of internal control we have set forth. The poor
                    management controls and lack of required items in their stockpiles lead us
                    to conclude that they cannot provide reasonable assurance that the
                    required medical supplies will be available if needed.

                    As the federal agency primarily responsible for emergency preparedness,
                    OEP did not provide leadership to reasonably assure that the necessary
                    medical supplies will be current, accounted for, and available for use. In
                    the absence of explicit requirements or oversight from OEP, VA has
                    developed a stockpile management program without adequate internal
                    control. CBIRF’s inventory management and tracking system also did not
                    meet basic federal standards for internal control. The inventory systems
                    that are supposed to track and account for the stockpiles of medical
                    supplies to be used in a chemical or biological attack are inaccurate and
                    unreliable.

                    While the current stockpiles are not well managed and lack required items,
                    even more will be at stake in the future as CDC expands its new stockpile.
                    Developing and implementing internal controls needs to be a fundamental




                    Page 9                                 GAO/HEHS/AIMD-00-36 Combating Terrorism
                      B-282839




                      aspect of managing this stockpile to avoid repeating problems we found at
                      OEP and CBIRF.



                      To address the internal control weaknesses identified in this report, we
Recommendations       recommend that the Department of Health and Human Services’ Office of
                      Emergency Preparedness, the HHS Centers for Disease Control and
                      Prevention, the Marine Corps Chemical and Biological Incident Response
                      Force, and the Department of Veterans Affairs establish sufficient systems
                      of internal control over their chemical and biological stockpile
                      management. The agencies need to reasonably assure that personnel carry
                      out the following specific control activities:

                  •   conduct risk assessments and organize program activities to identify and
                      mitigate risks;
                  •   arrange for periodic, independent inventories;
                  •   implement a tracking system that retains complete documentation for all
                      supplies that have been ordered, received, and destroyed; and
                  •   rotate supplies properly.


                      We sent a draft of this report to VA, HHS, and DOD for their review and
Agency Comments       comment.

                      While VA indicated that this is an important issue, it wanted additional time
                      to review the results of our inventory and to respond to us later.

                      HHS generally agreed with our findings and recommendations and reported
                      that it is redefining and adjusting its management oversight of OEP’s
                      stockpiles by drafting a new memorandum of agreement between VA and
                      OEP. In addition, it said that CDC has relied on our work to develop such a
                      memorandum with VA for the National Pharmaceutical Stockpile Program.
                      HHS’s comments are reproduced in appendix III.


                      The Special Assistant to the Assistant to the Secretary of Defense for Civil
                      Support as well as CBIRF officials acknowledged weaknesses in CBIRF’s
                      inventory management controls and described corrective actions that DOD
                      intends to take. For example, CBIRF is in the process of defining its medical
                      inventory, will institute a risk assessment and mitigation activities, and
                      will conduct independent inventories. DOD officials also told us that CBIRF’s
                      primary mission is to support war fighters, although it also supports
                      civilian agencies. For this reason, CBIRF officials asked that we delete their



                      Page 10                                GAO/HEHS/AIMD-00-36 Combating Terrorism
B-282839




agency from the report. However, we believe we appropriately included
CBIRF for two reasons. First, a Marine Corp document entitled The
Chemical/Biological Incident Response Force states CBIRF’s mission is to
respond to chemical or biological incidents worldwide and, when directed,
to assist local civilian and military agencies. CBIRF officials also told us that
responding to civilian incidents is a part of their mission. Second, OEP’s
plan reflects its intention to rely on CBIRF to assist in the treatment of
civilian victims. We have made technical clarifications in response to other
CBIRF comments where appropriate.



As we agreed with your offices, unless you publicly announce the contents
of this report earlier, we plan no further distribution of it until 30 days
after its date. We will then send copies to appropriate congressional
committees and the federal agencies discussed in this report. We will also
make copies available to others who are interested.

Please contact me at (202) 512-7101 or Ronald Guthrie, Assistant Director,
at (303) 572-7332 if you have any questions. Other major contributors to
this report were Martin Eble, Lesia Mandzia, Lawrence Moore, Carolina
Morgan, and Thomas Yatsco.




Cynthia A. Bascetta
Associate Director, Veterans Affairs
  and Military Health Care Issues




Page 11                                  GAO/HEHS/AIMD-00-36 Combating Terrorism
Contents



Letter                                                                                        1


Appendix I                                                                                   14

Scope and
Methodology
Appendix II                                                                                  16

Stockpile Tracking
System Control
Deficiencies
Appendix III                                                                                 23

Comments From the
Department of Health
and Human Services
Glossary                                                                                     25




                       Abbreviations

                       CBIRF     Chemical Biological Incident Response Force
                       CDC       Centers for Disease Control and Prevention
                       DOD       Department of Defense
                       EMSHG     Emergency Management Strategic Healthcare Group
                       EPS       Emergency Pharmacy Services
                       FEMA      Federal Emergency Management Agency
                       FMFIA     Federal Managers’ Financial Integrity Act of 1982
                       HHS       Department of Health and Human Services
                       OEP       Office of Emergency Preparedness
                       OMB       Office of Management and Budget
                       RRIS      Rapid Response Information System
                       SAMS      Ships Automated Management System
                       VA        Department of Veterans Affairs


                       Page 12                           GAO/HEHS/AIMD-00-36 Combating Terrorism
Page 13   GAO/HEHS/AIMD-00-36 Combating Terrorism
Appendix I

Scope and Methodology


             Our objectives were to (1) review the accuracy and currency of the
             inventory tracking systems for federal medical stockpiles that would be
             used to treat the civilian population following a chemical or biological
             terrorist attack and (2) examine the internal controls in place to manage
             the stockpiles. We obtained documents and interviewed officials at the
             Centers for Disease Control and Prevention (CDC) and the Office of
             Emergency Preparedness (OEP) at the Department of Health and Human
             Services (HHS), the vendor storing the smallpox vaccine for CDC, the Marine
             Corps Chemical Biological Incident Response Force (CBIRF) at the
             Department of Defense (DOD), the Department of Veterans Affairs (VA), and
             the Federal Emergency Management Agency (FEMA).

             To assess the accuracy and currency of the inventory tracking systems
             that monitor OEP’s medical stockpiles, we (1) obtained OEP’s required list of
             medical supplies, (2) obtained VA’s computerized inventory tracking
             records of OEP’s stockpiles, and (3) conducted a 100 percent inventory of
             each of OEP’s stockpiles. We then conducted three analyses. Our first
             analysis compared the findings of our 100 percent inventory with VA’s
             computerized inventory records to test their accuracy. Our second
             analysis compared OEP’s list of required items with VA’s computerized
             inventory records. Our third analysis compared OEP’s required list of items
             with our inventory count. A discrepancy was recorded if (1) an item
             specified on VA’s inventory record was not found in the specified container
             (shortage), (2) an item not on the record was found in the container
             (overage), or (3) an item had incorrect recordkeeping for either the lot
             number or the expiration date. We calculated the discrepancy rate by
             dividing the number of discrepancies we found by the total number of
             items recorded on the inventory. Therefore, in some cases, multiple
             discrepancies were assessed for a single item. For instance, an item
             located in the wrong container was counted as both a shortage in the
             container it belonged in and an overage in the container it was found in.

             Since CBIRF did not have an approved inventory list, we compared the
             results of our inventory of CBIRF’s stockpile with its computerized
             inventory records. We also reviewed the inventories taken and procedures
             followed by the vendor storing the smallpox vaccine for CDC.

             We reviewed the unclassified version of Presidential Decision Directive 39,
             the fact sheet available on Presidential Decision Directive 62, and the
             Stafford Act to determine U.S. policy on chemical and biological terrorism.
             Also, to assess the adequacy of internal controls, we applied criteria from
             our exposure draft entitled Internal Control: Standards for Internal



             Page 14                                GAO/HEHS/AIMD-00-36 Combating Terrorism
Appendix I
Scope and Methodology




Control in the Federal Government (GAO/AIMD-99-21.3.1, May 1999). We also
considered the Federal Managers’ Financial Integrity Act of 1982 (FMFIA);
Office of Management and Budget (OMB) Circular A-123, Management
Accountability and Control, revised June 21, 1995; and Federal Financial
Management System Requirements of the Joint Financial Management
Improvement Program.

We did not examine stockpiles and inventories for noncivilian use used by
U.S. military forces and managed by the Defense Logistics Agency. We also
excluded from our scope stockpiles that are maintained by Metropolitan
Medical Response System teams in several U.S. cities to prepare for
chemical and biological terrorist incidents.




Page 15                               GAO/HEHS/AIMD-00-36 Combating Terrorism
Appendix II

Stockpile Tracking System Control
Deficiencies

                      Our exposure draft entitled Internal Control: Standards for Internal
                      Control in the Federal Government requires that agencies

                      1. have an effective control environment,

                      2. conduct risk assessments,

                      3. implement control activities that are linked to the results of a mission
                      risk assessment,

                      4. properly record information and communicate with management, and

                      5. ensure monitoring.8

                      The purpose of the standards issued pursuant to FMFIA is to provide
                      reasonable assurance that key objectives are met, including effective and
                      efficient operations, reliable financial and other reporting, and compliance
                      with applicable regulations and other laws. Agencies are to view these
                      standards as elements of an ongoing internal control process that must be
                      constantly maintained.


                      Our Standards for Internal Control in the Federal Government states that
Control Environment   “Management and employees should establish and maintain an
                      environment throughout the organization that sets a positive and
                      supportive attitude toward internal control and conscientious
                      management.” OEP, VA, and CBIRF did not establish an adequate control
                      environment to effectively carry out their medical stockpile management
                      responsibilities. According to OEP officials, VA’s management of its
                      stockpiles is based completely on the interagency agreement and on trust.
                      OEP also did not require regular reports from VA, including inventories and
                      financial reports (although it has been receiving financial reports since
                      May 1999), and did not require or arrange for periodic, independent
                      inventories of its stockpiles. OEP officials told us that they presumed that
                      VA would perform inventory control functions as part of its stockpile
                      maintenance responsibilities, as outlined in the interagency agreement.
                      However, the agreement is silent about these requirements. The
                      responsibility for managing OEP’s stockpiles is fragmented within the VA
                      organization. Because of the lack of clear lines of command, the
                      employees who manage OEP’s stockpiles from day to day receive little

                      8
                       GAO/AIMD-99-21.3.1. We quote this source throughout this appendix as we discuss each of the five
                      standards for internal control.



                      Page 16                                            GAO/HEHS/AIMD-00-36 Combating Terrorism
                  Appendix II
                  Stockpile Tracking System Control
                  Deficiencies




                  supervision from upper-level VA management. For example, although the
                  interagency agreement with OEP was negotiated with and signed by VA’s
                  Emergency Management Strategic Healthcare Group (EMSHG), the group
                  plays no role in the management of OEP’s stockpiles. Another group within
                  VA—the Emergency Pharmacy Services (EPS)—actually manages OEP’s
                  stockpiles. The director of a VA Consolidated Mail-Out Pharmacy that is
                  independent of EMSHG heads the EPS group. The director of EPS divides his
                  time between managing OEP’s stockpiles and directing this pharmacy. He
                  acknowledged that no clear chain of command exists. In the absence of
                  adequate internal supervision and oversight, employees of EPS have not
                  appropriately managed OEP’s stockpiles.

                  Marine Corps managers also did not provide leadership for CBIRF’s
                  activities adequate to establish an environment to support internal control.
                  Specifically, the Marine Corps did not provide written standards and
                  expectations to CBIRF’s personnel on stockpile control activities; did not
                  request regular reports from CBIRF on the status of its medical stockpile,
                  including inventories and financial reports; and did not arrange for
                  periodic, independent inventories of CBIRF’s stockpile.


                  Our Standards for Internal Control in the Federal Government states that
Risk Assessment   “Internal control should provide for an assessment of the risks the agency
                  faces from both external and internal sources.” Risk management is the
                  deliberate process of understanding risk—the likelihood that a threat will
                  harm an asset with some severity of consequences—and then deciding on
                  and implementing actions to create a certain level of protection or
                  preparedness. Agencies should conduct risk assessment to (1) identify all
                  potential internal and external risks, (2) prioritize the risks by assessing
                  their likelihood and their effect on mission needs, and (3) take steps to
                  mitigate those risks.

                  While required to do so by our standards for internal control, OEP, VA, and
                  CBIRF have not performed mission risk assessments for their stockpiles.
                  These agencies have not identified the risks that could threaten the
                  availability and usefulness of their medical stockpiles, and they have not
                  prioritized the risks according to their likelihood or their severity. As a
                  result, the agencies have not taken steps to prevent, detect, or provide
                  contingency plans if those threats were realized.




                  Page 17                                GAO/HEHS/AIMD-00-36 Combating Terrorism
                             Appendix II
                             Stockpile Tracking System Control
                             Deficiencies




                             Our Standards for Internal Control in the Federal Government states that
Control Activities           “Internal control activities help ensure that management’s directives are
                             carried out. The control activities should be effective and efficient in
                             accomplishing the agency’s control activities.” OEP, VA, and CBIRF did not
                             establish clear policies and procedures that allow them to carry out
                             control activities and appropriately manage drugs and medical supplies.
                             We found a lack of (1) controls over computerized inventory systems,
                             (2) periodic inventories, and (3) inventory security.


Computerized Inventory       The agencies’ computerized inventory systems should include controls
Systems Are Inadequate       over the hardware, operating system, and database management systems
                             that ensure that all transactions affecting their stockpiles are recorded and
                             that all data in these systems are complete and accurate. However, VA’s
                             and CBIRF’s systems lack fundamental controls, which impedes their ability
                             to comprehensively track medical supplies. This, in turn, places at risk
                             their ability to fulfill their missions. Both agencies’ systems lack basic
                             information, such as

                         •   documentation of back orders, replacements, and shipment and receipt of
                             all pharmaceuticals and medical supplies;
                         •   the identity of all individuals who entered and made changes to the
                             databases, the changes they made, and the dates and times they made
                             them; and
                         •   detailed, verifiable historical records on all replaced and discarded
                             pharmaceuticals and medical supplies or a history of additions, deletions,
                             and changes to the physical stock.

                             CBIRF’s computer system has additional problems that make it unreliable
                             for accurately tracking the medical supplies in the stockpile. According to
                             CBIRF’s personnel, the computer system they use to track their
                             inventory—known as the Ships Automated Management System
                             (SAMS)—was originally developed for use in remote locations such as on
                             ships at sea and is not suitable for CBIRF’s mission. They noted that many
                             of the supplies in the stockpile have not been assigned permanent Navy
                             supply numbers in SAMS. These numbers are needed to order stockpile
                             replacements through the Navy’s procurement system, and SAMS does not
                             record a supply item without an assigned number. As a result, CBIRF staff
                             had to create ad hoc (or dummy) numbers for many stockpile items so
                             that SAMS can record them in the database.




                             Page 18                                GAO/HEHS/AIMD-00-36 Combating Terrorism
                           Appendix II
                           Stockpile Tracking System Control
                           Deficiencies




                           CBIRF’s computer system has also shown serious instability in recent
                           months, including a complete computer system failure just before our
                           visit. The system failure reportedly destroyed all CBIRF’s inventory
                           information and forced unit personnel to recreate their entire database by
                           physically counting each item in their stockpile and reentering all
                           inventory data back into the computer system.


Periodic Inventories Are   Medical supply inventories should be periodically counted and compared
Not Conducted              with records to ensure physical control over assets. However, before our
                           audit, neither OEP nor VA had ever conducted a complete physical
                           inventory of OEP’s stockpiles. While VA possessed the required list of items
                           that OEP wanted in the stockpile, after initially acquiring the medical
                           supplies for the stockpile, VA never again compared OEP’s required
                           stockpile list with the actual items in each stockpile. When we compared
                           OEP’s required list with VA’s inventory records from its computer tracking
                           system, we found 17,000 discrepancies (9 percent). When we conducted
                           our inventory of the items in the five stockpiles, we found that out of
                           approximately 195,000 total items, there were about 22,000 discrepancies
                           between VA’s computerized inventory tracking system and the actual items
                           maintained in the stockpiles—a discrepancy of about 11 percent. And
                           when we compared OEP’s required list with our inventory results, we found
                           a discrepancy rate of more than 12 percent, or 23,000 discrepancies.

                           Discrepancies included overages, shortages, and incorrectly recorded
                           items. Stockpile overages included both pharmaceuticals and general
                           medical supplies, but most were general medical supplies such as gloves,
                           bandages, and needles. For example, at one stockpile location, when we
                           compared both VA’s inventory list and our inventory results with the OEP
                           list of required items, we found that VA purchased and maintained an
                           excess of 2,400 pairs of gloves. The OEP list required 2,400 pairs of the
                           nonlatex gloves; VA’s inventory list showed 3,200 pairs in the stockpile; we
                           found 4,800 pairs. At another location, we found 159 injector devices in the
                           stockpile that were not on OEP’s required list. VA’s inventory system
                           showed the amount although OEP had not required it.

                           Other discrepancies included shortages and incorrectly recorded items.
                           Some of the shortages included controlled substances and antidotes. At
                           two locations, the entire amount of diazepam, a controlled substance, was
                           not in the stockpile. That is, it did not appear on VA’s inventory list and we
                           did not find it during our inventory, even though OEP required it. At one
                           location, we found more than 1,000 additional potassium iodide tablets



                           Page 19                                 GAO/HEHS/AIMD-00-36 Combating Terrorism
Appendix II
Stockpile Tracking System Control
Deficiencies




than OEP required. Yet VA’s inventory spreadsheet showed that it stored the
same amount that OEP required. And at another location, when we
compared our inventory results with VA’s computerized inventory records,
we found that the lot numbers of 438 vials of pralidoxime were recorded
incorrectly.

CBIRF  did not have an approved list of what should be in its inventory.
Consequently, we were unable to determine whether any discrepancies
existed between the actual stockpile of medical supplies and an approved
list of medical supplies. Neither CBIRF personnel nor we could determine
whether the correct medical supplies and quantities were on hand. Instead
of physically counting the items in the stockpile and comparing the results
with an approved list, CBIRF officials told us that they periodically count
their medical supplies and then adjust their computer records to reflect
the results of that most recent count. Nonetheless, when we compared our
100 percent inventory count with CBIRF’s computer records of the
stockpile, we found shortages and overages in CBIRF’s stockpile.
Specifically, we found that out of approximately 38,000 total items listed
on CBIRF’s computerized inventory record, there were about 10,000
discrepancies between CBIRF’s inventory record and the actual items in the
stockpiles—a discrepancy rate of about 26 percent.

Discrepancies in CBIRF’s stockpile included overages, shortages, incorrect
expiration dates, and incorrect lot numbers. We found about 5,700 items
that were not recorded in the SAMS database but were in CBIRF’s stockpile,
accounting for excesses in the stockpile of approximately 15 percent. In
total, we also found that about 2,300 items were not in CBIRF’s
stockpile—an antidote accounted for 65 percent of these items. CBIRF staff
explained that 967 of the atropine injectors we identified actually
constituted a data entry error—the contents of one container were entered
into the database twice, using two different names for the same container.
Finally, CBIRF’s database comingles more than 3,000 training and unit
medical supplies in the same database with the CBIRF stockpile supplies,
making it difficult to place special emphasis on and track mission-critical
items.9 CBIRF officials are unable to determine whether the necessary items
are in its inventory because of inaccuracies in the computerized inventory
system and the lack of an authorized list of medical supplies.




9
Small quantities of medical supplies and pharmaceuticals that are used for the general medical care of
CBIRF members.



Page 20                                             GAO/HEHS/AIMD-00-36 Combating Terrorism
                            Appendix II
                            Stockpile Tracking System Control
                            Deficiencies




Inventories Lack Security   In managing medical supply inventories that are vulnerable to risk of loss
                            or unauthorized use, agencies should establish physical security
                            procedures to reasonably assure that stockpiles remain intact and are
                            available for use. Four of OEP’s five stockpiles are located at VA facilities,
                            and one is at a local nonfederal facility. The physical security at the
                            various sites differs, but most stockpiles were stored in caged and locked
                            areas. However, at one location, the windows in the building housing the
                            stockpile had padlocked fencing material covering them, but the windows
                            were open and the fencing material was loose, posing a risk of
                            unauthorized access. Further, neither VA nor CBIRF had implemented
                            sign-in sheets or logs to record entry and exit from the stockpiles that
                            would allow management to review the security of and frequency of visits
                            to the stockpiles.

                            Like OEP, the Marine Corps has not communicated clear expectations to
                            CBIRF medical personnel about how their medial stockpile should be
                            secured. CBIRF had no sign-in procedures or logs for recording access to its
                            warehouse and trucks where its supplies are stored. Therefore, it cannot
                            ensure that proper access is maintained at those locations. We found that
                            antidotes were stored in an unsecured office inside the warehouse—an
                            area that many CBIRF staff can gain access to. The office was kept at a cool
                            temperature to accommodate the antidotes but was not always monitored.
                            In contrast, CBIRF’s physical security for its controlled substances was
                            adequate. CBIRF maintains these items in a separate building, in a secured
                            safe that had a sign-in book and was inventoried quarterly.


                            Our Standards for Internal Control in the Federal Government states that
Effective                   “Information should be recorded and communicated to management and
Communication and           others within the entity who need it and in a form and within a time frame
Information Exchange        that enables them to carry out their management control and other
                            responsibilities.” The exchange of information on stockpile inventory
                            status and managerial activities among management within and across
                            agencies was lacking. OEP officials did not communicate clear expectations
                            about the type, extent, and frequency of reports they expected VA to
                            produce on the status of OEP’s stockpile. Their expectations regarding the
                            type and frequency of oversight they would exert were also not clear. OEP
                            intermittently requested fiscal reports from VA, which provided
                            expenditure and financial reports for April, November, and December 1997
                            and October 1998. The reports varied significantly in the amount of
                            information they offered and did not provide a clear and consistent picture
                            of stockpile status and the program’s financial status.



                            Page 21                                 GAO/HEHS/AIMD-00-36 Combating Terrorism
             Appendix II
             Stockpile Tracking System Control
             Deficiencies




             Our Standards for Internal Control in the Federal Government states that
Monitoring   “Internal control monitoring should assess the quality of performance
             over time and ensure that the findings of audits and other reviews are
             promptly resolved.” All organizations that depend on a stockpile of assets
             to meet their mission must assure themselves that these assets are current,
             accounted for, and available for use. However, OEP, VA, and CBIRF have not
             implemented adequate systems to monitor their medical stockpiles and
             the activities of the staff who manage them. OEP did not require and VA did
             not perform regular audits or other reviews of the design and
             implementation of the stockpile program. Because no inventories had ever
             been conducted, neither VA nor OEP management could identify overages
             and shortages in supplies, correct deficiencies, implement improvements,
             or demonstrate that the program stockpiles were controlled in accordance
             with existing laws and standards.




             Page 22                               GAO/HEHS/AIMD-00-36 Combating Terrorism
Appendix III

Comments From the Department of Health
and Human Services




               Page 23     GAO/HEHS/AIMD-00-36 Combating Terrorism
Appendix III
Comments From the Department of Health
and Human Services




Page 24                                  GAO/HEHS/AIMD-00-36 Combating Terrorism
Glossary


                       The pharmaceuticals listed here may have alternative uses in a chemical or
                       biological incident. We have described their primary purposes.


Amyl Nitrate           An inhalation drug that is used as an antidote for cyanide poisoning. It is
                       also a common recreational stimulant known as a popper.


Atropine               A cardiac drug that is also used to reverse the effects of organophosphate
                       poisoning.


Ciprofloxacin          A drug, also known as Cipro, that is used to treat infections, including
                       anthrax.


Controlled Substance   A substance that has a high potential for abuse, as classified by the
                       Controlled Substances Act, title II of the Comprehensive Drug Abuse
                       Prevention and Control Act of 1970.


Diazepam               A drug that is used to treat the symptoms of anxiety, convulsions, and
                       muscle spasms. Its brand name is Valium.


Doxycycline            A drug that can be used to treat bacterial infections, including anthrax.

Mark I                 An injection kit that contains an atropine auto-injector and a pralidoxime
                       chloride auto-injector. Together, the drugs are used as an antidote for
                       nerve gas poisoning.


Nasal Airway           A device that is inserted into an unobstructed pharynx through the nose to
                       provide an airway.


Oral Airway            A device that is inserted into an unobstructed pharynx through the mouth
                       to provide an airway.


Potassium Iodide       A drug that is used to help relieve breathing and lung problems.




                       Page 25                                GAO/HEHS/AIMD-00-36 Combating Terrorism
              Glossary




Pralidoxime   A drug that is used as an antidote for organophosphate poisoning.




(406169)      Page 26                              GAO/HEHS/AIMD-00-36 Combating Terrorism
Ordering Information

The first copy of each GAO report and testimony is free.
Additional copies are $2 each. Orders should be sent to the
following address, accompanied by a check or money order
made out to the Superintendent of Documents, when
necessary. VISA and MasterCard credit cards are accepted, also.
Orders for 100 or more copies to be mailed to a single address
are discounted 25 percent.

Orders by mail:

U.S. General Accounting Office
P.O. Box 37050
Washington, DC 20013

or visit:

Room 1100
700 4th St. NW (corner of 4th and G Sts. NW)
U.S. General Accounting Office
Washington, DC

Orders may also be placed by calling (202) 512-6000
or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and
testimony. To receive facsimile copies of the daily list or any
list from the past 30 days, please call (202) 512-6000 using a
touchtone phone. A recorded menu will provide information on
how to obtain these lists.

For information on how to access GAO reports on the INTERNET,
send an e-mail message with "info" in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov




PRINTED ON    RECYCLED PAPER
United States                       Bulk Rate
General Accounting Office      Postage & Fees Paid
Washington, D.C. 20548-0001           GAO
                                 Permit No. G100
Official Business
Penalty for Private Use $300

Address Correction Requested