oversight

Foreign Military Sales: Improved Air Force Controls Could Prevent Unauthorized Shipments of Classified and Controlled Spare Parts to Foreign Countries

Published by the Government Accountability Office on 2003-07-29.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

             United States General Accounting Office

GAO          Report to the Honorable Tom Harkin,
             U.S. Senate



July 2003
             FOREIGN MILITARY
             SALES
             Improved Air Force
             Controls Could
             Prevent Unauthorized
             Shipments of
             Classified and
             Controlled Spare Parts
             to Foreign Countries




GAO-03-664
                                               July 2003


                                               FOREIGN MILITARY SALES

                                               Improved Air Force Controls Could
Highlights of GAO-03-664, a report to the      Prevent Unauthorized Shipments of
Honorable Tom Harkin, U.S. Senate
                                               Classified and Controlled Spare Parts to
                                               Foreign Countries


From 1990 through 2001, the                    The Air Force’s internal controls for its foreign military sales program using
Department of Defense delivered                blanket orders are not adequate, placing classified and controlled spare parts
over $138 billion in services and              at risk of being shipped to countries not authorized to receive them.
defense articles—including
classified and controlled parts—to             •   The Air Force’s system has erroneously approved foreign country
foreign governments through its
                                                   requisitions for classified and controlled spare parts based on incorrect
foreign military sales programs.
Classified spare parts are restricted              federal supply classes. The system approves items for shipment based in
for national security reasons, while               part on an item’s federal supply class—not the item’s entire national
controlled parts contain technology                stock number, which is a combination of the supply class number and a
that the military does not want to                 part number unique to the item. GAO found that because the system was
release. GAO was asked to review                   not properly programmed and countries used unrestricted supply class
the Air Force’s internal controls                  numbers, the system erroneously approved 35 of 123 selected
aimed at preventing countries from                 requisitions reviewed. For example, one country ordered a controlled
requisitioning and receiving                       outline sequencer used on various aircraft by using a supply class that
classified or controlled spare parts               was unrestricted, but incorrect for the part it requisitioned. Because
that they are ineligible to receive.               supply class 1680 was not restricted and the system did not verify that
                                                   1680 was the correct supply class for national item identification number
                                                   010539320, the system approved the requisition. Had the system
To improve internal controls, GAO                  validated the entire 13-digit national stock number, it would have found
recommends modifying the                           that the number was incorrect and would not have approved the
Security Assistance Management                     requisition. In addition, the Air Force has no written policies or
Information System so that it                      procedures in place for recovering items that have been shipped in error.
validates country requisitions
based on the requisitioned item’s              •   The Air Force has not validated modifications to the Security Assistance
national stock number, establishing                Management Information System that restrict parts available to foreign
policies for recovering classified or
                                                   countries and has not tested the system since 1998 to ensure that it is
controlled parts that are shipped
erroneously, establishing policies                 working properly. Because modifications were not validated, the Air
for validating modifications made                  Force did not detect improperly made modifications to the system, and
to the system, periodically testing                foreign countries were able to requisition and obtain controlled spare
the system’s logic, and establishing               parts that, at the time, the Air Force was trying to restrict. GAO
a policy to document decisions to                  identified 18 instances in which countries requisitioned and received a
override the system.                               controlled part for which they were not eligible because programmers
                                                   had entered the restrictions in the wrong area of the system. Although
The department fully concurred                     Air Force officials subsequently told us that the part was improperly
with four recommendations and                      restricted, this example nevertheless demonstrates the need to validate
partially with our recommendation                  system changes.
to periodically test the system’s
logic, citing a program being
implemented that will test system              •   Air Force command country managers did not always document reasons
modifications. However, we do not                  for overriding the recommendations of the system or the foreign military
believe this program will address                  sales case manager. For 19 of the 123 requisitions GAO reviewed,
system logic flaws.                                command country managers overrode the system recommendations and
                                                   shipped classified and controlled spare parts without documenting the
www.gao.gov/cgi-bin/getrpt?GAO-03-664.             reasons for overriding the system. For example, a command country
To view the full report, including the scope       manager overrode the system and shipped four classified target-
and methodology, click on the link above.          detecting devices without documenting the reasons for overriding the
For more information, contact William M.           system.
Solis, (202) 512-8365, solisw@gao.gov.
Contents


Letter                                                                                                  1
             Results in Brief                                                                           2
             Background                                                                                 5
             Internal Controls over Foreign Military Sales Are Not Adequate                             7
             Conclusions                                                                               12
             Recommendations for Executive Action                                                      12
             Agency Comments and Our Evaluation                                                        13
             Scope and Methodology                                                                     14

Appendix I   Comments from the Department of Defense                                                   17



Figures
             Figure 1: The Foreign Military Sales Process for Air Force
                      Classified and Controlled Spare Parts                                            6
             Figure 2: Example of a National Stock Number Showing Federal
                      Supply Class and National Item Identification Number                             8
             Figure 3: Example of How a Restricted Item Was Requisitioned and
                      Shipped                                                                          9




             This is a work of the U.S. Government and is not subject to copyright protection in the
             United States. It may be reproduced and distributed in its entirety without further
             permission from GAO. It may contain copyrighted graphics, images or other materials.
             Permission from the copyright holder may be necessary should you wish to reproduce
             copyrighted materials separately from GAO’s product.




             Page i                                                 GAO-03-664 Foreign Military Sales
United States General Accounting Office
Washington, DC 20548




                                   July 29, 2003

                                   The Honorable Tom Harkin
                                   United States Senate

                                   Dear Senator Harkin:

                                   From 1990 through 2001, the Department of Defense (DOD) delivered over
                                   $138 billion in services and defense articles—including classified and
                                   controlled spare parts1— to foreign governments through the foreign
                                   military sales programs administered by the military services. The
                                   management of classified and controlled spare parts is critical given their
                                   potential to be used against U.S. interests if the parts should fall into the
                                   hands of countries or terrorist organizations that are ineligible to receive
                                   them.

                                   You asked us to review the adequacy of key internal control activities
                                   aimed at preventing countries from requisitioning and receiving classified
                                   spare parts that they are ineligible to receive. Internal control activities
                                   include the policies, procedures, and processes that are essential for the
                                   proper stewardship of and accountability for government resources and
                                   for achieving effective and efficient program results. In our review, the key
                                   internal control activities we reviewed were in the areas of

                                   •   restricting access to classified and controlled spare parts to countries
                                       that are eligible to receive them,
                                   •   validating restrictions loaded into the Air Force’s Security Assistance
                                       Management Information System2 and testing the system’s logic, and
                                   •   maintaining proper documentation for overriding system restrictions.

                                   We focused our efforts on the Air Force because it sold 53 million items,
                                   valued at over $1.7 billion, to foreign countries during fiscal years 2001 and
                                   2002. The 53 million items included 1.4 million spare parts, valued at $299



                                   1
                                    Classified spare parts are restricted for national security reasons; controlled parts are not
                                   classified but contain military technology/applications or are controlled cryptographic
                                   parts.
                                   2
                                    The Security Assistance Management Information System is the Air Force’s information
                                   system used to verify that countries are eligible to requisition and receive spare parts.



                                   Page 1                                                   GAO-03-664 Foreign Military Sales
                   million, that were classified or controlled spare parts. We plan to address
                   Army and Navy policies, processes, and procedures relating to these sales
                   in separate reviews.

                   To accomplish our review, we concentrated our efforts on classified and
                   controlled spare parts that foreign countries requisitioned from the Air
                   Force under blanket order cases,3 which define a country’s eligibility to
                   requisition spare parts. We obtained records from the Air Force Security
                   Assistance Center on all classified and controlled spare parts that were
                   purchased under blanket orders and, according to Air Force records, were
                   shipped to foreign countries for the period October 1, 1997, through July
                   31, 2002. A preliminary test of 72,057 requisitions, valued at $679.5 million,
                   identified 525 requisitions, valued at $9.7 million, that appeared to violate
                   Security Assistance Management Information System restrictions. We
                   obtained satisfactory explanations from Air Force Security Assistance
                   Center officials for all except 200 of the requisitions, valued at $ 5.6
                   million. We reviewed 123 of these requisitions,4 valued at over $4.4 million,
                   to determine the reasons classified and controlled items were released for
                   shipment. Further details are in the Scope and Methodology section of this
                   report.


                   The Air Force’s internal controls for its foreign military sales program
Results in Brief   using blanket orders are not adequate, placing classified and controlled
                   spare parts at risk of being shipped to countries not authorized to receive
                   them. The internal control inadequacies we identified are as follows:

                   •     Foreign country requisitions for classified and controlled spare parts
                         were erroneously approved by the Air Force’s Security Assistance
                         Management Information System based on an incorrect federal supply
                         class.5 The Security Assistance Management Information System
                         approves items for shipment based in part on an item’s federal supply



                   3
                       Hereafter referred to as blanket orders.
                   4
                    We initially reviewed 2 requisitions involving controlled communications security items
                   and subsequently added 119 controlled and 2 confidential requisitions to the review.
                   5
                     The federal supply classification is a 4-digit number that designates a general commodity
                   grouping, such as communications security equipment and components. Each part within a
                   supply class has a unique 9-digit number—called the national item identification number—
                   that differentiates each individual item in the department’s inventory system. Together, the
                   two numbers form a 13-digit national stock number.




                   Page 2                                                  GAO-03-664 Foreign Military Sales
      class—not the item’s entire national stock number. Thus, a country can
      obtain restricted spare parts by using an incorrect, but unrestricted,
      supply class with an item’s correct national item identification number.
      We found that because the Security Assistance Management
      Information System was not properly programmed, it erroneously
      validated 35 of the 123 selected requisitions we reviewed because
      although countries used incorrect supply classes for the requisitioned
      items, they used unrestricted supply class numbers. For example, one
      country ordered a controlled outline sequencer used on various aircraft
      by using a supply class that was incorrect, but unrestricted, for the part
      it requisitioned. After the system validated the erroneous federal supply
      class, the item manager6 changed the supply class so that it was
      consistent with the requisitioned part, and the restricted part was
      shipped. Although Air Force Security Assistance Center officials were
      able to describe the actions they would take to recover a classified or
      controlled item that was erroneously shipped, neither the Air Force nor
      the center had written policies or procedures in place for recovering
      the items that had been shipped in error.

•     The Air Force has not validated modifications to the Security
      Assistance Management Information System that restrict the parts that
      countries can requisition and has not tested the system since 1998 to
      ensure that it is working properly. GAO, Office of Management and
      Budget, and DOD internal control standards require that systems such
      as the Air Force’s be periodically validated and tested to ensure that
      they are working as intended. Because modifications were not
      validated, the Air Force did not detect improperly made modifications
      to the system, and foreign countries were able to requisition and obtain
      controlled spare parts that, at the time, the Air Force was trying to
      restrict. For example, Air Force programmers were instructed to enter
      restrictions into the information system that would prevent countries
      from using blanket orders to requisition controlled bushings.7 Of the
      123 cases we reviewed, we found 18 instances in which countries
      requisitioned and received controlled bushings because managers had
      entered the restrictions in the wrong area of the system. Although Air
      Force officials subsequently told us that the bushings had been
      improperly restricted, this example demonstrates the need to verify
      that system modifications are made correctly. Because the system’s


6
 Item managers at the Air Force’s air logistics centers are responsible for managing items
in the Air Force’s supply system.
7
    A bushing is a cylindrical metal sleeve used to reduce friction.




Page 3                                                      GAO-03-664 Foreign Military Sales
    logic has not been tested since 1998, the Air Force cannot be assured
    that the system accurately reviews current requisitions for compliance
    with restrictions.

•   Command country managers did not always document reasons for
    overriding Security Assistance Management Information System or
    foreign military sales case manager8 recommendations in case files. For
    19 of the 123 requisitions we reviewed, command country managers
    overrode the system recommendations and shipped classified and
    controlled spare parts without documenting the reasons for overriding
    the system. For example, a command country manager overrode the
    system and shipped four classified target-detecting devices without
    documenting the reasons for overriding the system. In another
    example, a command country manager authorized the shipment of a
    controlled communications security part that the system and the
    foreign military sales case manager had indicated should not be
    shipped. The case file contained no documentation explaining why the
    spare part was nevertheless shipped.

We are recommending that the Secretary of Defense instruct the Secretary
of the Air Force to require responsible officials to (1) modify the Security
Assistance Management Information System so that it validates country
requisitions based on the requisitioned item’s entire national stock
number, (2) establish policies and procedures for recovering classified or
controlled items that are erroneously shipped, (3) verify restriction
changes made to the system to ensure that the changes were properly
made, (4) periodically test the system’s logic for restricting requisitions to
ensure that it is working correctly, and (5) establish a policy for command
country managers to document the basis for their decisions to override the
system or recommendations made by foreign military sales case managers.

In commenting on a draft of this report, DOD fully concurred with four of
our recommendations and cited corrective actions that had been taken or
were planned. However, with regard to our recommendation to
periodically test the system to ensure that its logic for restricting
requisitions is working correctly, the department partially concurred,
stating that a program is being implemented to test new and old
modifications placed in the system to ensure that they are accurate. We


8
 Command country managers and foreign military sales case managers at the Air Force
Security Assistance Center are respectively responsible for managing the sale of items to
countries and for monitoring a particular type of case, such as a blanket order.




Page 4                                                 GAO-03-664 Foreign Military Sales
             believe that just testing the accuracy of the modification will not ensure
             that the system’s logic for restricting requisitions is operating correctly.
             We therefore continue to believe that the system’s logic for restricting
             requisitions should be periodically tested to ensure that it is working
             correctly. Otherwise, classified and controlled spare parts that are
             requisitioned may continue to be erroneously released.

             The transfer of defense items to friendly nations and allies is an integral
Background   component in both U.S. national security and foreign policy. The U.S.
             government authorizes the sale or transfer of military equipment, including
             spare parts, to foreign nations either through government-to-government
             agreements or through direct sales from U.S. manufacturers. The Arms
             Export Control Act9 and Foreign Assistance Act of 1961,10 as amended,
             authorize the DOD foreign military sales program.

             The Department of State sets the overall policy concerning which
             countries are eligible to participate in the foreign military sales program.
             DOD, through the military services, enters into foreign military sales
             agreements with individual countries. The Air Force Security Assistance
             Center, which is an activity of the Air Force Materiel Command, is
             responsible for the administration of the Air Force’s foreign military sales
             program.

             The center’s responsibilities start with the initial negotiation of the foreign
             military sale and end with the delivery of parts and completion of all
             financial aspects of the agreements. The center uses an automated
             management information system, the Security Assistance Management
             Information System, to support its management of the program with
             accurate and timely information. For blanket order cases, the system uses
             criteria such as an item’s national item identification number, a federal
             supply class, or a federal supply group11 to restrict the parts available to
             foreign military sales customers. Once the system has verified a country’s
             eligibility and approved a requisition, the requisition is sent to a supply
             center to be filled and shipped. The overall foreign military sales process,
             as it applies to the Air Force, is shown in figure 1.



             9
                 Public Law 90-629.
             10
                  Public Law 87-195.
             11
               The first two digits of the federal supply class are called a supply group and include
             several similar federal supply classes.




             Page 5                                                   GAO-03-664 Foreign Military Sales
Figure 1: The Foreign Military Sales Process for Air Force Classified and Controlled Spare Parts




                                          Page 6                                             GAO-03-664 Foreign Military Sales
                            This report addresses the portion of the process relating to the Air Force’s
                            approval or disapproval of foreign countries’ requisitions for classified and
                            controlled spare parts under blanket order cases.12 Blanket orders are for a
                            specific dollar value and generally cover classes of parts that a country
                            may need rather than a specific item within a class. Under blanket orders,
                            the Air Force restricts classes of items, such as munitions and nuclear
                            spare parts, from being requisitioned.


                            The Air Force’s internal controls for foreign military sales using blanket
Internal Controls over      orders are not adequate to prevent countries from ordering and receiving
Foreign Military Sales      classified and controlled spare parts that they are not eligible to receive.
                            We found that (1) controls based on supply class restrictions were
Are Not Adequate            ineffective and resulted in erroneously approved requisitions for shipment,
                            and that written policies for recovering the erroneously shipped items did
                            not exist; (2) the Air Force did not validate modifications to its Security
                            Assistance Management Information System related to blanket orders or
                            test the system’s logic for restricting requisitions, and (3) command
                            country managers did not always document reasons for overriding either
                            the Security Assistance Management Information System or foreign
                            military sales case manager recommendations not to ship classified spare
                            parts. As a result of these inadequate internal controls, classified and
                            controlled spare parts were shipped to countries not authorized to receive
                            them. The Air Force Security Assistance Center has taken or plans to take
                            actions to correct these issues.


Use of the Federal Supply   Foreign country requisitions for classified and controlled spare parts were
Class Resulted in           erroneously validated, as a result of an incorrect federal supply class, by
Erroneously Approved        the Air Force’s Security Assistance Management Information System. The
                            Air Force attempts to prevent countries from obtaining classified and
Requisitions                controlled spare parts by restricting them from receiving spare parts that
                            belong to selected federal supply classes. Included in the national stock
                            number is a four-digit federal supply class (see fig. 2), which may be
                            shared by thousands of items. The national stock number also contains a



                            12
                              Under the foreign military sales program, the Air Force also uses defined order cases
                            (which cover specific items and quantities) and Cooperative Logistics Supply Support
                            Agreements (which allow foreign countries to become partners in the military service’s
                            logistics system). The service purchases items for use of the foreign governments and
                            monitors the foreign governments’ demand for those items to ensure that an adequate level
                            of support is available.




                            Page 7                                                GAO-03-664 Foreign Military Sales
nine-digit national item identification number that is unique for each item
in the supply system. A country can obtain a classified or controlled spare
part by using an incorrect, but unrestricted, supply class with an item’s
correct national item identification number.

Figure 2: Example of a National Stock Number Showing Federal Supply Class and
National Item Identification Number




We found that because the Security Assistance Management Information
System was not properly programmed, it erroneously validated 35 blanket
order requisitions (of the 123 in our review), even though an incorrect
supply class number was used, because the countries used supply classes
that were not restricted. For example, in one case, the Air Force restricted
countries from requisitioning parts belonging to the 1377 federal supply
class (cartridge- and propellant-actuated devices and components) on
blanket orders. The restriction included an outline sequencer (national
stock number –1377010539320) used on ejection seats for various aircraft.
The country ordered the sequencer using national stock number
1680010539320. Because supply class 1680 (miscellaneous aircraft
accessories and components) was not restricted and the Security
Assistance Management Information System did not verify that 1680 was
the correct supply class for national item identification number 010539320,
the system approved the requisition. Had the system validated the entire
13-digit national stock number, it would have found that the number was
incorrect and would not have approved the requisition. Subsequently, the
item manager recognized that 1680 was not the correct federal supply
class and corrected the supply class to 1377 before the part was shipped.
This example is summarized in figure 3. Air Force officials were unaware
of this situation until our review identified the problem.




Page 8                                          GAO-03-664 Foreign Military Sales
Figure 3: Example of How a Restricted Item Was Requisitioned and Shipped




In another case, involving the restricted 1377 federal supply class, a
country ordered a restricted battery power supply for the F-16 aircraft
using national stock number 6130013123511. Because supply class 6130
(nonrotating electrical converters) was not restricted and the Security
Assistance Management Information System did not verify the entire 13-
digit national stock number, the requisition was approved. The Air Force
shipped the restricted battery power supply to the country. Neither the Air
Force nor the center had written policies or procedures in place for
recovering the items erroneously shipped. Without these types of policies
and procedures, the Air Force cannot be assured that appropriate steps
will be taken to recover the parts. Air Force Security Assistance Center
officials agreed that the supply class restrictions alone were ineffective
and could be bypassed by use of inaccurate supply class information.




Page 9                                          GAO-03-664 Foreign Military Sales
Failure to Validate the     The Air Force has not validated modifications to the Security Assistance
System Could Allow          Management Information System that restrict parts that countries can
Unauthorized Shipments      requisition, and has not tested the system’s logic for restricting
                            requisitions since 1998 to ensure that it is working properly. As a result,
of Classified Spare Parts   modifications that were not properly made went undetected, and foreign
                            countries were able to requisition and obtain controlled spare parts that
                            the Air Force was trying to restrict.

                            For example, the Air Force instructed programmers to modify a table of
                            restrictions in the Security Assistance Management Information System to
                            prevent certain countries from using blanket orders to requisition
                            controlled bushings in the 5365 supply class. Although Air Force Security
                            Assistance Center officials subsequently told us that the bushings had
                            been improperly restricted, we found that, for 18 of the 123 requisitions we
                            reviewed, countries had ordered and received the bushings, because the
                            Security Assistance Management Information System was incorrectly
                            programmed and did not identify the requisitions as requiring a review by
                            command country managers. After we brought the transactions to the
                            attention of Air Force Security Assistance Center officials, they
                            investigated and found that programmers had entered the restrictions in
                            the wrong area of the system. Because the Air Force had not validated that
                            system modifications were properly made, the system had approved the
                            requisitions. Although the Air Force later determined that the bushings
                            should not have been restricted, this example nevertheless demonstrates
                            the need to validate system changes.

                            The Air Force does not periodically test the Security Assistance
                            Management Information System to ensure that it accurately reviews
                            requisitions for compliance with restrictions. For example, when the
                            system is working correctly, it will identify restrictions relating to parts,
                            such as ammunition or nuclear spare parts, and will disapprove
                            requisitions from countries that are ineligible to order these parts. Air
                            Force Security Assistance Command officials said that the system had not
                            been tested since 1998 to ensure that it accurately reviews requisitions for
                            compliance with restrictions. When we tested the system’s ability to
                            restrict items based on their federal supply class, we found that the system
                            did not always perform as intended. As discussed earlier, the system did
                            not perform as intended because countries could requisition and obtain
                            classified and controlled spare parts using an incorrect, but unrestricted,
                            federal supply class with an item’s correct national item identification
                            number.




                            Page 10                                       GAO-03-664 Foreign Military Sales
                        In the Federal Information System Controls Audit Manual,13 which lists
                        internal control activities for information systems, one of the control
                        activities listed involves the testing of new and revised software to ensure
                        that it is working correctly. In addition, management of federal
                        information resources14 rules require agencies to establish information
                        system management oversight mechanisms that provide for periodic
                        reviews to determine how mission requirements might have changed and
                        whether the information system continues to fulfill ongoing and
                        anticipated mission requirements. Further, DOD’s ADP Internal Control
                        Guideline15at the time stated that periodic reviews of systems should be
                        conducted to determine if they operate as intended.

                        According to Air Force Security Assistance Center officials, there have
                        been few changes to the table of restrictions in the system. However, they
                        did agree that existing changes need to be validated and were working to
                        accomplish this. Based on our observations, the Air Force’s failure to
                        validate modifications and test model logic is in part due to an
                        unquestioning confidence in the Security Assistance Management
                        Information System’s ability to correctly restrict the requisitioning of
                        classified and controlled spare parts.


Documentation for       Command country managers did not always document reasons for
Overriding System and   overriding Security Assistance Management Information System or foreign
Item Manager            military sales case manager recommendations not to ship classified spare
                        parts. According to the Standards for Internal Control in the Federal
Recommendations Is      Government,16 all transactions and other significant events need to be
Inadequate              clearly documented. The standards state that such documentation should
                        be properly managed and maintained and should be readily available for
                        examination.




                        13
                         U.S. General Accounting Office, Federal Information System Controls Audit Manual,
                        GAO/AIMD-12.19.6 (Washington, D.C.: Jan. 1999).
                        14
                          Office of Management and Budget, Management of Federal Information Resources
                        (Washington, D.C.: Nov. 2000).
                        15
                             Department of Defense, ADP Internal Control Guideline (July 1988).
                        16
                         U.S. General Accounting Office, Standards for Internal Control in the Federal
                        Government, GAO/AIMD-00.21.3.1 (Washington, D.C.: Nov. 1999).




                        Page 11                                                GAO-03-664 Foreign Military Sales
                      Of the 123 requisitions we reviewed, the Security Assistance Management
                      Information System identified 36 requisitions for command country
                      manager review. For 19 of the requisitions, command country managers
                      overrode the system recommendations and shipped classified and
                      controlled spare parts without documenting the reasons for overriding the
                      system. For example, the command country manager overrode the system
                      and shipped four classified target-detecting devices, but the case file did
                      not contain any documentation explaining why the command country
                      manager did so, and managers we queried could not provide an
                      explanation for the override. Similarly, a command country manager
                      authorized the shipment of a controlled communications security part that
                      the Security Assistance Management Information System and foreign
                      military sales case manager recommended not be shipped. The case file
                      contained no documentation explaining why the spare part was shipped.
                      According to Air Force officials, there were no written policies or
                      procedures for documenting decisions to override the system or foreign
                      military sales case manager recommendations. The Air Force Security
                      Assistance Center plans to issue guidance to command country managers
                      to document system bypass authorizations.


                      The Air Force has not established nor does it maintain effective internal
Conclusions           controls over foreign military sales sold under blanket orders. Specifically,
                      internal controls involving use of the federal supply class to restrict
                      requisitions, the modification of tables restricting the access to classified
                      and controlled spare parts in the Air Force’s system, testing of the system,
                      and documentation of system overrides were inadequate. Without
                      adequate internal controls, classified and controlled spare parts may be
                      released to countries that are ineligible to receive them, thereby providing
                      military technology to countries that might use it against U.S. national
                      interests. Further, without written policies detailing the steps to be taken
                      when the Air Force becomes aware of an erroneous shipment, the Air
                      Force’s ability to recover erroneously shipped classified or controlled
                      parts is lessened.


                      To improve internal controls over the Air Force’s foreign military sales
Recommendations for   program and to minimize countries’ abilities to obtain classified or
Executive Action      controlled spare parts under blanket orders for which they are not eligible,




                      Page 12                                       GAO-03-664 Foreign Military Sales
                     we are recommending that the Secretary of Defense instruct the Secretary
                     of the Air Force to require the appropriate officials to take the following
                     steps:

                     •   Modify the Security Assistance Management Information System so
                         that it validates country requisitions based on the requisitioned item’s
                         complete national stock number.

                     •   Establish policies and procedures for recovering classified or
                         controlled items that are erroneously shipped.

                     •   Establish polices and procedures for validating modifications made to
                         the Security Assistance Management Information System to ensure that
                         the changes were properly made.

                     •   Periodically test the Security Assistance Management Information
                         System to ensure that the system’s logic for restricting requisitions is
                         working correctly.

                     •   Establish a policy for command country managers to document the
                         basis for their decisions to override Security Assistance Management
                         Information System or foreign military sales case manager
                         recommendations.


                     In commenting on a draft of this report, DOD fully concurred with four of
Agency Comments      our recommendations and cited corrective actions that had been taken or
and Our Evaluation   were planned, and it partially concurred with another recommendation.
                     Specifically, with regard to our recommendation to modify the Security
                     Assistance Management Information System to validate country
                     requisitions based on the requisitioned item’s national stock number, the
                     department said that it has had a change in place since January 2003 to
                     validate requisitions based on an item’s national stock number. We
                     believe that the department’s change is responsive to findings that we
                     brought to the Air Force’s attention in December 2002. However, because
                     our audit work was completed when the Air Force brought this change to
                     our attention, we did not have an opportunity to validate the change. The
                     department also stated that the Air Force (1) will write a policy
                     memorandum on procedures for recovering classified or controlled items
                     that are erroneously shipped, (2) will issue a policy memorandum
                     directing that all modifications to the system be validated in accordance
                     with existing policies and procedures, and (3) has issued a policy
                     memorandum specifying those staff who can input transactions for



                     Page 13                                         GAO-03-664 Foreign Military Sales
              overriding restrictions and requiring that waiver approvals for using the
              bypasses be documented.

              With regard to our recommendation to periodically test the system to
              ensure that its logic for restricting requisitions is working correctly, DOD
              partially concurred. The department said that a program is being
              implemented to test new modifications placed in the system and that the
              testing of old modifications would be an ongoing effort. Testing the
              modifications placed in the system will ensure that they were made
              correctly. However, just testing the modifications will not ensure that the
              system is correctly applying its logic to the modifications in order to
              restrict requisitions for items that countries are not eligible to receive. For
              example, testing modifications may not identify logic problems, such as
              the one we identified involving the approval of requisitions based on an
              item’s federal supply class. Thus, we continue to believe that the system’s
              logic for restricting requisitions should be periodically tested to ensure
              that it is working correctly. Otherwise, classified and controlled spare
              parts that are requisitioned may continue to be erroneously released.

              DOD’s comments appear in appendix I.


              To determine the adequacy of the Department of the Air Force’s key
Scope and     internal control activities aimed at preventing countries from
Methodology   requisitioning and receiving classified and controlled spare parts that they
              are ineligible to receive, we held discussions with officials from the Under
              Secretary of Defense (Policy Support) International Security Program
              Directorate; Deputy Under Secretary of the Air Force (International
              Affairs); and the Air Force Materiel Command’s Security Assistance
              Center, Dayton, Ohio. We discussed the officials’ roles and responsibilities,
              the criteria and guidance they used in performing their duties, and the
              controls used to restrict countries from receiving parts that they are not
              eligible to requisition. At the Air Force Security Assistance Center and Air
              Logistics Centers at Warner Robins Air Force Base, Macon, Georgia, and
              Tinker Air Force Base, Oklahoma City, Oklahoma, we interviewed military
              and civilian officials to obtain an overview of the requisitioning and
              approval processes applicable to classified and controlled spare parts.

              To test the adequacy of the internal controls, we obtained records from
              the Air Force Security Assistance Center on all classified and controlled
              spare parts that were purchased under blanket orders and approved for
              shipment to foreign countries for the period October 1, 1997, through July
              31, 2002. We limited our study to blanket orders because defined orders


              Page 14                                         GAO-03-664 Foreign Military Sales
and Cooperative Logistics Supply Support Agreements specified the parts
that countries were entitled to requisition by national stock number. In
contrast, only Security Assistance Management Information System
restrictions limited the parts that countries were entitled to order under
blanket orders. The records covered 444 blanket orders that resulted in
72,057 requisitions for classified and controlled spare parts. Specifically,
we took the following steps:

•    We tested the Security Assistance Management Information System by
     applying the system’s restrictions that applied to classified and
     controlled spare parts that were shipped under blanket orders, and
     identified 525 requisitions that appeared to violate the restrictions. We
     obtained satisfactory explanations from the Air Force Security
     Assistance Command for all except 200 of the requisitions, which were
     shipped despite restrictions.

•    We reviewed case files for 123 requisitions,17 including 87 requisitions
     for which the Security Assistance Management Information System had
     approved the shipment of classified and controlled spare parts without
     referring the requisitions to command country managers to determine
     if the requisitions should be approved. We followed up on these
     requisitions by consulting with command country managers.

•    The case files that we reviewed included 36 requisitions that the
     Security Assistance Management Information System had referred to
     command country managers for review to determine if they had
     documented their decisions to override the system’s decisions. We
     followed up on these reviews through discussions with command
     country managers.

We conducted our review from May 2002 through May 2003 in accordance
with generally accepted government auditing standards.


As arranged with your office, unless you publicly announce its contents
earlier, we plan no further distribution of this report until 30 days from the


17
  We initially reviewed 2 requisitions involving controlled communications security items
and subsequently selected 121 additional requisitions to review. We selected requisitions
from Bahrain, Egypt, Greece, Israel, Italy, Jordan, Morocco, Saudi Arabia, South Korea,
Taiwan, Thailand, Tunisia, and Turkey and for specific types of equipment. Two of the
requisitions were for confidential items; the remaining 121 requisitions were for controlled
items.




Page 15                                                 GAO-03-664 Foreign Military Sales
date of this letter. At that time, we will send copies of this report to the
Secretary of Defense; the Secretary of the Air Force; the Director, Office of
Management and Budget; and interested congressional committees. We
will also make copies available to others upon request. In addition, the
report will be available at no charge on the GAO Web site at
http://www.gao.gov.

Please contact me on (202) 512-8365, if you or your staff have any
questions concerning this report. Key contributors to this report were
Lawson (Rick) Gist, Jr.; Jennifer Thomas; Arthur James, Jr.; Lou
Modliszewski; Susan Woodward; John Lee; and Kristy Lehmann.

Sincerely yours,




William M. Solis, Director
Defense Capabilities and Management




Page 16                                       GAO-03-664 Foreign Military Sales
             Appendix I: Comments from the Department
Appendix I: Comments from the Department
             of Defense



of Defense




             Page 17                                    GAO-03-664 Foreign Military Sales
                          Appendix I: Comments from the Department
                          of Defense




Now on pages 12 and 13.




Now on pages 12 and 13.




                          Page 18                                    GAO-03-664 Foreign Military Sales
                          Appendix I: Comments from the Department
                          of Defense




Now on pages 12 and 13.




Now on pages 12 and 13.




Now on pages 12 and 13.




                          Page 19                                    GAO-03-664 Foreign Military Sales
           Appendix I: Comments from the Department
           of Defense




(350223)
           Page 20                                    GAO-03-664 Foreign Military Sales
                         The General Accounting Office, the audit, evaluation and investigative arm of
GAO’s Mission            Congress, exists to support Congress in meeting its constitutional responsibilities
                         and to help improve the performance and accountability of the federal
                         government for the American people. GAO examines the use of public funds;
                         evaluates federal programs and policies; and provides analyses,
                         recommendations, and other assistance to help Congress make informed
                         oversight, policy, and funding decisions. GAO’s commitment to good government
                         is reflected in its core values of accountability, integrity, and reliability.


                         The fastest and easiest way to obtain copies of GAO documents at no cost is
Obtaining Copies of      through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full-
GAO Reports and          text files of current reports and testimony and an expanding archive of older
                         products. The Web site features a search engine to help you locate documents
Testimony                using key words and phrases. You can print these documents in their entirety,
                         including charts and other graphics.
                         Each day, GAO issues a list of newly released reports, testimony, and
                         correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site
                         daily. The list contains links to the full-text document files. To have GAO e-mail
                         this list to you every afternoon, go to www.gao.gov and select “Subscribe to e-mail
                         alerts” under the “Order GAO Products” heading.


Order by Mail or Phone   The first copy of each printed report is free. Additional copies are $2 each. A
                         check or money order should be made out to the Superintendent of Documents.
                         GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a
                         single address are discounted 25 percent. Orders should be sent to:
                         U.S. General Accounting Office
                         441 G Street NW, Room LM
                         Washington, D.C. 20548
                         To order by Phone:     Voice:    (202) 512-6000
                                                TDD:      (202) 512-2537
                                                Fax:      (202) 512-6061


                         Contact:
To Report Fraud,
                         Web site: www.gao.gov/fraudnet/fraudnet.htm
Waste, and Abuse in      E-mail: fraudnet@gao.gov
Federal Programs         Automated answering system: (800) 424-5454 or (202) 512-7470


                         Jeff Nelligan, Managing Director, NelliganJ@gao.gov (202) 512-4800
Public Affairs           U.S. General Accounting Office, 441 G Street NW, Room 7149
                         Washington, D.C. 20548