And while CENTCOM Contracting Command officials have stated that  vetting additional prospective vendors would more fully address potential  risks, they have expressed concern that available vetting cell capacity may  not be able to accommodate a large increase should vendors below the  threshold be included. As with the dollar threshold, CENTCOM officials stated that while the  vendor vetting cell contract does not specifically preclude officials from  submitting subcontractors to be vetted, the cell was not designed, in terms  of its number of staff, to vet subcontractors. As of April 2011 CENTCOM Contracting Command has not determined  how many of the remaining non-U.S. vendors that have already been  awarded contracts valued above $100,000 will be vetted in the future, a  timeline for when it will begin vetting vendors prior to award, or an  estimate number of anticipated prospective vendors that will be vetted for  the remainder of the fiscal year. Implementing Partners in Afghanistan, Though Details of the Process Have Not Been Finalized

In January 2011, in order to counter potential risks of U.S. funds being  diverted to support criminal or insurgent activity, USAID created a process  for vetting prospective non-U.S. contract and assistance recipients (i.e.,  implementing partners) in Afghanistan, which is similar to a vetting  process it has used in the West Bank and Gaza since 2006. However,  USAID officials indicated that the agency’s vendor vetting process was still  in the early stages, and it is expected to be an iterative implementation  process—aspects of which could change, such as the vetting threshold and  expanding vetting to other non-U.S. partners. While State does not have a vendor vetting program, in 2008 State issued a  cable that applies to both State and USAID, requiring personnel to  complete a terrorist financing risk assessment for any new program or  activity prior to requesting or obligating program funds. Periodic updates  to the risk assessment are also completed for ongoing programs and  activities, though these do not examine vendors against the same  information as the CENTCOM or USAID vetting cells. Further, according to  USAID officials, sharing vendor vetting results would greatly assist the  agency’s efforts to ensure that it is not conducting business with known  malign actors in Afghanistan. Without documented,  formalized procedures, DOD and USAID cannot ensure that their current  information-sharing practices will endure. While State has not yet developed a specific vendor vetting  process, given the number of non-U.S. vendors it currently uses, and as it  goes forward with implementing Afghan First, the need to vet these  vendors may become more acute in order to mitigate the risk of  contracting with these vendors. Recommendations for Executive Action

To safeguard U.S. personnel against security risks and help ensure that  resources are not used to support insurgent or criminal groups, we  recommend that the Commander of U.S. Central Command direct  CENTCOM Contracting Command to    consider formalizing a risk-based approach to enable the department to  identify and vet the highest-risk vendors—including those vendors with  contracts below the $100,000 threshold—as well as subcontractors and    work with the vendor vetting cell to clearly identify the resources and  personnel needed to meet the demand for vendor vetting in Afghanistan  using a risk-based approach. State partially concurred with our recommendation that the Secretary  direct the appropriate bureaus to assess the need and develop possible  options to vet non-U.S. vendors. GAO staff who made major contributions to this report are  listed in appendix V.

Appendix I: Scope and Methodology

Under the authority of the Comptroller General of the United States, we  initiated a review to identify what efforts, if any, are under way to ensure  that U.S. contracting funds or resources are not diverted to support  corruption or insurgent organizations. Specifically, we examined (1) the  extent to which the Department of Defense (DOD) has established a  process to vet non-U.S. vendors in Afghanistan, both to ensure that  resources are not used to support insurgent or criminal groups and to  safeguard U.S. personnel and assets against security risks; (2) the extent to  which the Department of State (State) and the United States Agency for  International Development (USAID) have established processes to vet  non-U.S. vendors and other assistance recipients in Afghanistan; and   (3) the extent to which vetting information is shared among DOD, State,  and USAID. To identify and examine the efforts DOD has taken to vet non-U.S vendors  in Afghanistan and the extent to which State and USAID have established  processes to vet non-U.S. vendors in Afghanistan and to share this vetting  information, we reviewed recent DOD, State, and USAID policies and  procedures, including fragmentary orders; the recently updated November  2010 U.S. Central Command (CENTCOM) Contracting Command’s  Acquisition Instruction as well as a previous version USAID’s Mission  Order for Afghanistan 201.03; and an April 2010 memorandum of  understanding between DOD, State, and USAID relating to contracting in  Iraq and Afghanistan.
Why GAO Did This Study

The Departments of Defense (DOD) and State (State) and the United States Agency for International Development (USAID) have collectively obligated billions of dollars for contracts and assistance to support U.S. efforts in Afghanistan. There are concerns that U.S. funds are being diverted to fund insurgent and criminal activity in Afghanistan. In light of these concerns, under the authority of the Comptroller General of the United States, we initiated a review to identify DOD, State, and USAID efforts to vet non-U.S. contractors and assistance recipients in Afghanistan. GAO examined (1) the extent to which DOD has established a process to vet non-U.S. vendors to ensure that resources are not used to support insurgents; (2) the extent to which State and USAID have established processes to vet vendors and assistance recipients; and (3) the extent to which vetting information is shared among DOD, State, and USAID. GAO reviewed documents and met with a variety of agency officials to address the report's objectives.

What GAO Found

While DOD's U.S. Central Command (CENTCOM) has established a vetting cell to vet non-U.S. vendors in Afghanistan to minimize the risk of insurgents or criminal groups using contracts to fund their operations, its current approach for selecting vendors to vet has gaps. For example, vendors with contracts below $100,000 are not routinely vetted. In fiscal year 2010 around three-quarters of the command's new contracts with non-U.S. vendors were below $100,000. Subcontractors are also not routinely vetted. Command officials stated that CENTCOM uses other risk factors to prioritize vendors to vet, such as contracts performed in Taliban strongholds, but these factors have not been documented. While officials stated that the vetting cell was created to vet vendors prior to award, CENTCOM is largely vetting vendors with existing contracts, which means it is likely that there are a large number of new vendors that have not been vetted prior to award and may have to be vetted in the future. Also, the vetting effort now includes some U.S. Army Corps of Engineers vendors. However, the vetting cell was not staffed to accommodate this workload, so it is uncertain how its existing resources will be able to vet vendors in a timely manner. Without accurately defining the universe of contracts that may need to be vetted, adopting a formal risk-based approach that incorporates other risk factors to identify non-U.S. vendors that pose the highest risk, and identifying the resources needed to accomplish this, it is uncertain how the vetting cell will be able to meet the additional workload and achieve its goals. In January 2011, USAID created a process intended to vet non-U.S. implementing partners in Afghanistan; however, this process may face similar limitations as CENTCOM's. According to USAID officials, this decision was based on the urgent need to mitigate the risks of USAID funds being diverted to insurgent groups. While USAID's process is in the early stages, it proposes to vet non-U.S. implementing partners and at least first-tier subcontractors with contracts valued at $150,000 or more. USAID officials said that they are considering changing the dollar threshold or vetting other potential assistance recipients based on risk; however, the available documentation does not include other risk factors. As of March 2011, State had not developed a process to vet contractor firms in Afghanistan. Since 2008, State has required that a terrorist financing risk assessment be completed for any new program or activity prior to a request for or obligation of funding. However, it does not use the same information as the CENTCOM or USAID vetting cells. Additionally, its use of Afghan vendors may increase under the Afghan First policy. Absent a way to consider the risk posed by non-U.S. vendors, State may not be well prepared to assess the potential for its funds to be diverted to criminal or insurgent groups. DOD and USAID share vetting information informally, but without a formal mechanism to share vetting results the two agencies cannot ensure that their current practices will endure. Further, as State expands its use of local contractors, it will become imperative that it is part of the data sharing with DOD and USAID.

What GAO Recommends

GAO is making recommendations related to improving DOD's and USAID's vetting processes and information sharing. GAO is also recommending that State assess the need for and possible options to vet non-U.S. vendors. DOD and USAID concurred with GAO's recommendations. State generally concurred.