Testing of the Requisition- Processing Systems Is Needed to Improve Internal Controls for Foreign Military Sales

Our reviews showed that the Army, the Navy, and the Air Force were not  testing their automated systems to ensure that the systems were  accurately reviewing and approving blanket order requisitions for  compliance with restrictions and operating in accordance with foreign  military sales policies. Our tests of the services’ automated systems used  to manage foreign countries’ requisitions for spare parts made through  blanket orders showed that classified and controlled spare parts that the  services did not want released were being released to countries. GAO’s internal control standards require periodic testing of new and  revised software to ensure that it is working correctly, while the Office of  Management and Budget’s internal control standards require periodic  reviews to determine how mission requirements might have changed and  whether the information systems continue to fulfill ongoing and  anticipated mission requirements. In commenting on our prior reports, DOD either concurred or partially  concurred with our recommendations for testing the services’ requisition- processing systems. The department, however, does not have a plan  specifying the remedial actions to be taken to implement these  recommendations. The Defense Security Cooperation Agency and the military services are  developing a new automated system, the Case Execution Management  Information System, to process foreign military sales requisitions. Internal control standards requiring testing will be applicable to the new  system. Army’s Practice Provides More Stringent Protection against the Improper Release of Parts to Foreign Countries

Our reviews showed that the Navy’s and the Air Force’s systems allowed  country managers, who are responsible for managing the sale of items to  foreign countries, to override system decisions not to release to foreign  countries classified or controlled parts that are requisitioned under  blanket orders. We identified instances where Navy and Air Force country  managers overrode the systems’ decisions without documenting their  reasons for doing so. For 19 of the requisitions, the managers overrode the  system’s decisions and shipped classified and controlled spare parts  without documenting their reasons for overriding the system. Compared with the Navy’s and the Air Force’s systems,  the Army’s system provides more stringent protection against releasing  classified or controlled parts that are not authorized for release under  blanket orders to foreign countries. However, modifying systems, as the Army did, to reject  requisitions that are made under blanket orders for classified or controlled  parts and to preclude country managers from manually overriding system  decisions would provide more stringent protection against releasing  classified or controlled parts that are not authorized for release under  blanket orders to a foreign country. Recommendations for Executive Action

To reduce the likelihood of releasing classified and controlled spare parts  that DOD does not want to be released to foreign countries, we  recommend that you take the following three actions:    Direct the Under Secretary of Defense for Policy, in conjunction with the  Secretaries of the Army and the Navy, and direct the Secretary of the Air  Force to develop an implementation plan, such as a Plan of Actions &  Milestones, specifying the remedial actions to be taken to ensure that  applicable testing and review of the existing requisition-processing  systems are conducted on a periodic basis.
Why GAO Did This Study

Under Department of Defense (DOD) policy, the export of classified and controlled spare parts must be managed to prevent their release to foreign countries that may use them against U.S. interests. GAO has issued a series of reports on the foreign military sales program in which weaknesses in the military services' internal controls were identified. This report highlights (1) a systemic problem that GAO identified in the internal controls of the military services' requisition-processing systems and (2) a potential best practice that GAO identified in one service that provides an additional safeguard over foreign military sales of classified and controlled parts.

What GAO Found

At the time GAO conducted its reviews, the Army, the Navy, and the Air Force were not testing their automated requisition-processing systems to ensure that the systems were accurately reviewing and approving blanket order requisitions for compliance with restrictions on the sale of classified and controlled spare parts and operating in accordance with foreign military sales policies. Blanket order requisitions are based on agreements between the U.S. government and a foreign country for a specific category of items for which foreign military sales customers will have a recurring need. GAO's tests of the services' requisition-processing systems showed that classified and controlled spare parts that the services did not want to be released to foreign countries under blanket orders were being released. GAO's internal control standards require periodic testing of new and revised software to ensure that it is working correctly, while the Office of Management and Budget's internal control standards require periodic reviews to determine how mission requirements might have changed and whether the information systems continue to fulfill ongoing and anticipated mission requirements. DOD either concurred or partially concurred with GAO's recommendations for testing the requisition-processing systems. The department, however, does not have a plan specifying the remedial actions to be taken to implement these recommendations. Internal control standards requiring testing also will be applicable to the Case Execution Management Information System, an automated requisition-processing system that DOD and the military services are developing to replace the existing individual military service systems. The Army's automated requisition-processing system incorporates a potential best practice that helps to prevent the release of classified or controlled parts that are not authorized under blanket orders to foreign countries. The automated systems used by the Navy and the Air Force allow country managers to override system decisions not to release to foreign countries classified or controlled parts that are requisitioned under blanket orders. GAO found instances where Navy and Air Force country managers overrode the systems' decisions without documenting their reasons for doing so. In contrast, the Army's system automatically cancels requisitions that are made under blanket orders for classified or controlled parts. Because the requisitions are automatically canceled, country managers do not have an opportunity to override the system's decisions. Compared with the Navy's and the Air Force's systems, the Army's system provides more stringent protection against releasing classified or controlled parts that are not authorized under blanket orders to foreign countries.