DOE Has Not Used or Developed Processes for Using the Enhanced Procurement Authority to Manage Supply Chain Risk

As of May 2016, the Secretary of Energy had not used the enhanced  procurement authority, and DOE had not developed processes for using  the authority, as it had not fully assessed the circumstances under which  the authority might be useful. Once  the Secretary was made aware of a significant supply chain risk, to use  the enhanced procurement authority he or she must make a  determination in writing that use of the authority was necessary to protect  national security, and that less restrictive measures were not reasonably  available to reduce the supply chain risk, among other things. However, DOE had not developed specific processes to collect such  information for a risk assessment report and provide it to the Secretary so  that he or she could make a determination about whether to use the  authority. According to DOE officials, M&O  contractors generally procure the parts for covered systems, and NNSA  officials said that it is unlikely that an M&O contractor would need to  request that the Secretary use the authority. NNSA and M&O contractor  representatives told us, that since M&O contractors are not federal  entities, they are not subject to the same procurement restrictions as such  entities and already possess the capability to exclude a supplier that  poses a supply chain risk. When procuring a part from a supplier, an  M&O contractor is generally not required to disclose security-related  reasons to a potential supplier to explain why that supplier was not  selected. Some DOE officials  also told us that there are mechanisms within the Federal Acquisition  Regulation for federal entities to mitigate supply chain risks for covered  system procurements. Some DOE officials provided us their views about circumstances under  which the enhanced procurement authority could be useful; however, as  of May 2016, DOE had not fully assessed these or other circumstances  under which using the authority would help the department manage  supply chain risk. However,  DOE and NNSA officials said they had not identified the extent to which  their direct procurements were for components of covered systems to  which the enhanced procurement authority could apply. However, without assessing the circumstances  under which the authority could be useful, DOE will have difficulty  determining the authority’s relevance and, if the authority is considered to  be relevant, developing processes for using it. As a result, if the authority  is needed, DOE may miss opportunities to use the authority to better  manage supply chain risk. DOE Has Not Examined Whether Adequate Resources Are in Place for Using the Enhanced Procurement Authority

DOE has identified resources for potentially using the enhanced  procurement authority but has not examined whether these resources are  adequate. Although DOE has not fully examined whether adequate resources are in  place to support using the enhanced procurement authority, DOE and  M&O contractor representatives expressed a range of opinions about  whether adequate resources are available. For example, some DOE  OCIO officials said that they did not anticipate a need for more resources  because of the enhanced procurement authority. However, M&O  contractor representatives said that they could not assess what resources  might be needed to support the use of the authority without a requirement  to do so in their M&O contracts and that DOE has not established any  such requirements. While DOE officials expect that instances under which  the authority would be useful would be infrequent, given other options  DOE and its M&O contractors have to manage risks, DOE has not fully  assessed the circumstances where the authority could be useful,  consistent with federal standards that call for management to periodically  review control activities for relevance and effectiveness. Examining whether  adequate resources are in place, consistent with internal control  standards, could help provide assurance that the resources are available  to support using the authority in accordance with any processes that DOE  develops. Recommendation for Executive Action

To ensure that DOE’s control activities continue to be relevant and  effective for managing supply chain risk, the Secretary should direct the  Under Secretary for Nuclear Security, as the Administrator of the NNSA,  to work with the Office of Intelligence and Counterintelligence and other  DOE organizations, as appropriate, to assess the circumstances that  might warrant using the enhanced procurement authority, and  If this assessment identifies circumstances that might warrant using  the authority, the Secretary should direct the Under Secretary for  Nuclear Security to work with other DOE organizations, as  appropriate, to establish processes for using it and examine whether  adequate resources are in place to support those processes.
Why GAO Did This Study

DOE, through NNSA, is responsible for ensuring the safety and reliability of the nation's nuclear weapons stockpile, among other nuclear weapons-related activities. According to NNSA, the trend toward a non-domestic supply chain for components of nuclear weapons and related systems may pose risks to these weapons and systems. The National Defense Authorization Act for Fiscal Year 2014 provides the Secretary of Energy with an enhanced procurement authority, which may be used to exclude a supplier that poses a supply chain risk from a contract or subcontract, and limit disclosing the reason for the exclusion to the supplier. The act includes a provision for GAO to report annually on DOE's use of the enhanced procurement authority. This report assesses the extent to which DOE has (1) used and developed processes for using the authority, and (2) examined whether adequate resources are in place for using the authority. GAO reviewed DOE and NNSA documents, interviewed DOE and NNSA officials, and interviewed M&O contractor representatives for seven NNSA sites—selected based on their NNSA management and activities.

What GAO Found

As of May 2016, the Secretary of Energy had not used the enhanced procurement authority, and the Department of Energy (DOE) had not developed processes for using the authority, as it had not fully assessed the circumstances under which the authority might be useful. To use the authority, the Secretary must be made aware of a supply chain risk by officials from DOE or its semiautonomous National Nuclear Security Administration (NNSA). Once aware of a risk, the Secretary must make a written determination that using the authority is necessary to protect national security and that less restrictive measures are not reasonably available to reduce the supply chain risk, among other things. However, DOE has not developed specific processes to collect information to provide to the Secretary for making the determination. DOE officials said that they expect instances under which the authority would be useful to be infrequent, but DOE has not conducted an assessment to confirm that view. NNSA officials said that it is unlikely that management and operating (M&O) contractors who operate NNSA's sites and are generally responsible for procuring parts for nuclear weapons and related systems, would need to request that the Secretary use the authority. NNSA officials and M&O contractor representatives told GAO that, as nonfederal entities, M&O contractors are generally not required to disclose security-related reasons to explain why a particular supplier was not selected. Additionally, DOE officials stated that mechanisms exist within the Federal Acquisition Regulation for federal entities to reject suppliers that pose a supply chain risk. Some DOE officials identified circumstances under which the authority could be useful, but DOE has not fully assessed these or other circumstances under which using the authority would help it manage supply chain risk. Under federal standards for internal control, management should periodically review policies, procedures, and related control activities for relevance and effectiveness. Without assessing the circumstances under which the authority could be useful, DOE will have difficulty determining its relevance and, if necessary, developing processes for using it. As a result, DOE may miss opportunities to use the authority to manage supply chain risks.
DOE has not examined whether adequate resources are in place for using the enhanced procurement authority. DOE officials stated that there were some resources in place, such as information and trained personnel, that could be important in using the authority. However, DOE has not examined whether these resources were adequate, consistent with federal standards for internal control. DOE officials and M&O contractors expressed a range of opinions about whether the resources in place were adequate to support using the authority if needed. For example, while officials in DOE's Office of the Chief Information Officer said that they did not anticipate a need for more resources, some M&O contractor representatives said they might need more trained personnel. However, M&O contractor representatives stated that they could not assess the need without a requirement to do so in their M&O contracts and that DOE had not established such requirements. Examining whether adequate resources are in place, consistent with internal control standards, can help provide assurance that resources are available to support using the authority in accordance with any processes that DOE develops.

What GAO Recommends

GAO recommends that DOE assess the circumstances that might warrant using the enhanced procurement authority and take additional actions based on the results, such as developing processes to use the authority, if needed, and examining whether resources for doing so are adequate. DOE concurred with the recommendation.