United States General Accounting Office

GAO Report to Congressional Committees

October 1999 COMBATING

TERRORISM

Chemical and

Biological Medical

Supplies Are Poorly

Managed

GAO/HEHS/AIMD-00-36

GAO United States

General Accounting Office

Washington, D.C. 20548

Health, Education, and

Human Services Division

B-282839 

October 29, 1999

The Honorable Arlen Specter, Chairman

Committee on Veterans’ Affairs

United States Senate

The Honorable John Rockefeller

Ranking Minority Member

Committee on Veterans’ Affairs

United States Senate

The Honorable Christopher Shays, Chairman

Subcommittee on National Security, Veterans’ Affairs,

 and International Affairs

Committee on Government Reform

House of Representatives

The Honorable Ike Skelton

Ranking Minority Member

Armed Services Committee

House of Representatives

The threat of chemical or biological terrorist attacks against U.S. citizens

is a high-priority, national concern. The March 1995 terrorist attack in the

Tokyo subway system using the nerve agent sarin, and other more recent

national and international terrorist incidents have raised concerns about

whether the United States can effectively respond to incidents involving

chemical or biological agents. Reflecting these concerns, the federal

government has established several stockpiles of antidotes and other

medical supplies and plans to develop a larger national

stockpile—referred to as the National Pharmaceutical Stockpile

Program—to be used in the event of domestic chemical and biological

attacks.

This report responds to your concerns about the adequacy of the

stockpiles. Our objectives were to (1) review the accuracy and currency of

the inventory tracking systems for federal medical stockpiles that would

be used to treat the civilian population following a chemical or biological

terrorist attack and (2) examine the internal controls in place to manage

the stockpiles. We conducted a 100 percent inventory of the existing

domestic federal stockpiles managed by the Department of Veterans

Affairs (VA) for the Department of Health and Human Services’ (HHS) Office

Page 1 GAO/HEHS/AIMD-00-36 Combating Terrorism
B-282839 

of Emergency Preparedness (OEP). We also conducted a 100 percent

inventory of the medical supplies kept by the Marine Corps Chemical

Biological Incident Response Force (CBIRF), whose mission includes

responding to domestic terrorist events. We also reviewed the inventories

taken and procedures followed by the vendor storing the Centers for

Disease Control and Prevention’s (CDC) smallpox vaccine, although we did

not count the stockpile. Consistent with our review objectives, we did not

assess the effectiveness and appropriateness of medical preparedness. In

addition, the threat of chemical and biological terrorism is the subject of

another study we recently published.1

 We conducted our review from

May 1999 through September 1999 in accordance with generally accepted

government auditing standards. Details of our scope and methodology are

in appendix I.

Results in Brief The U.S. ability to effectively respond to chemical or biological terrorist

incidents is compromised by poor management controls and the lack of

required items. Our physical inventory of OEP’s stockpiles, which VA

manages, compared with OEP’s required list showed a discrepancy of more

than 12 percent. Although most discrepancies were overages, we also

found shortages. For example, we found 3,400 excess gloves at one

location and 400 extra diazepam vials (a controlled substance) at another.

We also found that the inventory was short of 1,000 required diazepam

injectors at one location and at another location had 500 fewer vials of

diazepam than required. In addition, when we compared our inventory

with VA’s inventory records, we found expired items. At one location, the

entire amount of amyl nitrate listed in VA’s records (2,000 vials) had

expired 8 months before our visit, and at another location we found more

than 400 vials of pralidoxime whose expiration date was recorded

incorrectly. In comparing CBIRF’s medical supplies with the records in its

inventory tracking system, for approximately 26 percent of the inventory

items we found either discrepancies between the inventory records and

the amount in stock or errors in the recording of lot numbers and

expiration dates.

The principal cause of problems we identified is that the responsible

federal agencies did not implement basic internal controls that would

reasonably assure that all medical supplies and pharmaceuticals are

current, accounted for, and available for use. Consistent with the Federal

Managers’ Financial Integrity Act of 1982 (FMFIA), agencies should have

1

Combating Terrorism: Need for Comprehensive Threat and Risk Assessments of Chemical and

Biological Attacks (GAO/NSIAD-99-163, Sept. 7, 1999).

Page 2 GAO/HEHS/AIMD-00-36 Combating Terrorism
B-282839 

efficient and effective internal controls over their operations and

programs. Neither OEP nor CBIRF explained its lack of compliance, and we

identified problems in all major aspects of internal controls—control

environment, risk assessment, control activities, information and

communications, and monitoring. For example, their systems lacked basic

information required for good recordkeeping, such as documentation of

back orders, replacements, and shipment and receipt of all pharmaceutical

and medical supplies. They also did not conduct periodic inventories,

maintain program policies and procedures, or provide adequate security of

the stockpiles. As a result, these systems cannot be relied upon to

consistently and accurately account for the items required to be in the

stockpiles.

Even more will be at stake in the future as CDC establishes the National

Pharmaceutical Stockpile Program. Although CDC is still in the early

phases of developing this program, its current plan does not include

comprehensive internal controls to prevent the types of problems we

found at the other agencies. To reasonably assure the proper management

of this new stockpile, as well as to correct deficiencies in the others, we

are recommending actions to improve the internal control programs for

the federal chemical and biological medical stockpiles.

Background The United States has established national policy for combating chemical

and biological terrorism and managing the consequences of terrorist

attacks. The Federal Emergency Management Agency (FEMA) is the lead

agency for managing the consequences of terrorist attacks, with the

authority to assign missions to any federal agency in the event of a disaster

or emergency declared by the president.2 FEMA coordinates the federal

response through a contingency plan, known as the Federal Response

Plan, that details the roles and responsibilities of federal agencies during

natural or manmade emergencies. The plan also categorizes types of

federal assistance into specific emergency support functions (for example,

information and planning, health and medical services, urban search and

rescue).

As we reported earlier, “If the consequences of a terrorist threat become

imminent or actually occur, state and local authorities would initiate

consequence management actions, while FEMA would monitor the situation

in consultation with the President and the governor. If state and local

capabilities are overwhelmed, the President could then direct FEMA, with

2

Under the Robert T. Stafford Disaster Relief and Emergency Assistance Act (P.L. 93-288), as amended.

Page 3 GAO/HEHS/AIMD-00-36 Combating Terrorism
B-282839 

the support of appropriate federal agencies, to assist.”3 FEMA, through the

Federal Response Plan, has designated HHS as the lead agency to

coordinate medical assistance in the event of a federally declared natural

or manmade disaster, including chemical or biological terrorist incidents.

Within HHS, OEP is responsible for implementing and coordinating this

medical assistance, and in 1997 it established four National Medical

Response Teams, each with a medical stockpile containing antidotes,

antibiotics, and medical supplies for responding to chemical terrorist

attacks. OEP also maintains one smaller stockpile that contains only

antidotes for chemical incidents; this stockpile can be loaned to local

governments or predeployed for special events, such as the Olympics.

OEP’s stockpiles are positioned throughout the United States, and all but

one are located at federally owned facilities. While OEP is responsible for

these stockpiles, through an interagency agreement, it has delegated

day-to-day management to VA.

CBIRF, created in 1996 by the Commandant of the Marine Corps, maintains

a working stock of medical supplies to respond to chemical and biological

incidents.4 CBIRF is the only Department of Defense (DOD) unit whose

mission includes responding to and treating civilian victims of chemical or

biological terrorist attacks. Its staff includes a medical unit of 27 Navy

personnel who manage the working stock of pharmaceuticals and medical

supplies. CBIRF also uses local government stockpiles where available to

treat civilians.

In 1998, the Congress appropriated $51 million for CDC to acquire a

pharmaceutical and vaccine stockpile to counter potential biological,

disease, and chemical threats to civilian populations.5

 Currently, CDC is

developing its plans to accumulate these medical supplies, and it has also

recently transferred $1.4 million of the $51 million to OEP to augment its

supply of antidotes for chemical attacks. For the past 26 years, CDC has

also maintained the nation’s stockpile of smallpox vaccine through a

contract with the manufacturer. This vaccine can be used against a

terrorist release of smallpox.

3

Combating Terrorism: Federal Agencies’ Efforts to Implement National Policy and Strategy

(GAO/NSIAD-97-254, Sept. 26, 1997). In 1997, under section 1417 of title XIX of the Defense Against

Weapons of Mass Destruction Act of 1996, FEMA developed and implemented a Rapid Response

Information System (RRIS), which can be accessed on the Internet. The RRIS contains data on federal

assets, such as decontamination units, and training programs available to assist terrorist response

operations of state and local governments. It does not contain information on the contents of the

existing federal stockpiles for responding to chemical or biological terrorist incidents.

4

CBIRF officials refer to the medical supplies they maintain as a working stock. To simplify our

presentation, we refer to CBIRF’s medical supplies as a stockpile.

5

The Omnibus Consolidated and Emergency Supplemental Appropriations Act (P.L. 105-277).

Page 4 GAO/HEHS/AIMD-00-36 Combating Terrorism
B-282839 

In addition to federal efforts, state and local agencies have the

responsibility for providing “first response” medical assistance to the

civilian population in natural and manmade disasters, including chemical

or biological terrorist attacks. If state and local capacities are

overwhelmed by a disaster, federal assets such as the chemical and

biological medical supplies that CDC, CBIRF, and OEP stockpile could be

deployed to augment local responses.

FMFIA requires GAO to issue standards for internal control in government.

The standards provide the overall framework for internal control, and the

Office of Management and Budget (OMB) Circular A-123, Management

Accountability and Control, revised June 21, 1995, provides the specific

requirements for assessing and reporting on controls.

Inventory Tracking

Systems Are Neither

Current Nor Accurate

Our complete inventory of the OEP and CBIRF stockpiles showed that

neither inventory control system accurately tracks federal medical

supplies. Our comparison of OEP’s list of required items with our physical

inventory revealed discrepancies for about 23,000 items, or more than

12 percent, across the five sites.6

 Although most discrepancies were

overages, others involved items that were stocked in a smaller quantity

than required or were not in stock at all. For instance, some of the

overages at individual sites included about 600 extra amyl nitrate

inhalants; a total of 3,400 small, medium, and large pairs of gloves; about

1,000 potassium iodide tablets; and 1,000 diazepam injectors. Shortages

included about 300 pralidoxime vials, 100 diazepam vials, and at two

locations almost 300 potassium iodide tablets at each site. In addition,

OEP’s list required 1,000 diazepam injectors in the stockpile; however, at

one location, we found none, and none were recorded in VA’s inventory

record. At another location, we found 500 fewer vials of diazepam than

required.

Our comparison of OEP’s stockpiles with VA’s computerized inventory

records revealed a discrepancy of more than 11 percent. For the most part,

discrepancies occurred in three categories—overages, shortages, and

items for which lot numbers and expiration dates were recorded

incorrectly. At one location, we found about 600 more amyl nitrate

inhalants than recorded; we found 1,600 extra pairs of gloves at another

location and 250 extra doxycycline tablets at another. Some shortages

6

When we compared our physical inventory with OEP’s required list, we identified overages and

shortages. We were also able to identify other incorrectly recorded items when we compared our

physical inventory with VA’s inventory records. See appendix I for an explanation of how we

calculated the discrepancy rates.

Page 5 GAO/HEHS/AIMD-00-36 Combating Terrorism
B-282839 

included 100 vials of diazepam, 100 Mark I injectors (a chemical antidote),

and 250 doxycycline tablets. Items recorded incorrectly included 2,000

amyl nitrate inhalants, which had expired 8 months before our visit, and

about 440 pralidoxime vials, 250 doxycycline tablets, and 100 ciprofloxacin

tablets, whose expiration dates and lot numbers were recorded

incorrectly.

The Marine Corps CBIRF stockpile had similar problems. Specifically, we

determined that about 2,300 items of the 38,000-item inventory list were

not in stock. These items included about 1,500 doses of an antidote. In

addition, CBIRF’s computerized inventory system did not identify and track

5,700 items that we found in the inventory, such as oral and nasal airways

that would be deployed in response to a chemical or biological terrorist

attack. However, the computerized inventory system recorded and tracked

other CBIRF medical materials that would not be used in a chemical or

biological incident, such as training equipment and pharmaceuticals for

the general use of the unit. Additional details of the results of our

inventories are in appendix II.

Lack of Controls Is

the Principal Cause of

Poor Inventory

Management

The root cause of the inventory problems we identified was a fundamental

lack of internal controls, although the agencies did not explain their lack

of compliance with our internal control standards. Internal controls, as

outlined by our standards for internal control, provide reasonable

assurance that program objectives for effective and efficient operations,

reliable financial reporting, and compliance with applicable laws and

regulations are met.7 OEP, VA, and CBIRF did not implement the following

five internal control standards for managing their stockpile programs:

(1) effective control environment, (2) risk assessments, (3) control

activities, (4) information and communications, and (5) monitoring.

Control Environment OEP, VA, and CBIRF did not provide sufficient leadership and supervision to

their own personnel to reasonably assure an adequate control

environment for the stockpiles. While OEP has overall responsibility for

managing the stockpiles, it has chosen to delegate day-to-day

responsibility for stockpile management to VA through an interagency

agreement. In delegating its responsibilities for the stockpiles, OEP did not

provide clear guidance to VA on the requirements and standards that VA

should follow to effectively manage and maintain OEP’s stockpiles.

7

See our exposure draft entitled Internal Control: Standards for Internal Control in the Federal

Government (GAO/AIMD-99-21.3.1, May 1999).

Page 6 GAO/HEHS/AIMD-00-36 Combating Terrorism
B-282839 

Moreover, VA did not provide formal guidance or clearly define activities,

key duties, and responsibilities for personnel charged with managing OEP’s

stockpiles. Similarly, the Marine Corps did not provide adequate guidance

to CBIRF concerning the composition of its medical supply inventory or

how to manage it.

Risk Assessment OEP, VA, and CBIRF did not determine the hazards and risks that their

stockpiles faced, assess the likelihood of each risk’s occurrence, and

establish plans to detect or mitigate them. For example, neither OEP nor VA

assessed the possibility of the theft of stockpile items and, therefore, did

not have a plan in case a theft occurred. When VA personnel counted items

at one of OEP’s stockpile locations, in anticipation of our visit, they found

that 48 amyl nitrate inhalants were missing and presumed stolen. VA

replaced the missing items, waited 30 days before reporting the missing

amyl nitrate to OEP, and then raised concerns about its limited control over

the secured storage and the security of the stockpile. OEP had neither

addressed nor improved the storage situation at this site by

September 1999. The location of the missing drugs at this site remains a

mystery and is unresolved between OEP and VA.

Control Activities OEP, VA, and CBIRF did not establish procedures to carry out control

activities and manage the medical stockpiles. For example, key duties

need to be segregated among different people to reduce the risk of error

and fraud. However, the same individual who ordered supplies for OEP’s

stockpiles also replaced and disposed of items and recorded all changes in

the computerized tracking system. At CBIRF, staff entering data into the

computer tracking system also participated in physical inventory counts.

In addition, CBIRF staff stated that some items are consumed and some are

lost during exercises and are replaced from the warehouse stock, but

records of such consumption and loss are not included in the computer

tracking system. Both agencies’ systems also lacked basic information

required for adequate recordkeeping. For example, they did not document

back orders, replacements, or the shipment and receipt of all

pharmaceutical and medical supplies.

We found that all three agencies had not implemented adequate security

measures for their medical stockpiles. For example, at three of OEP’s five

stockpile locations, we found that VA had comingled OEP’s refrigerated

supplies in unsecured refrigerators, in violation of a general maintenance

and storage policy established by VA. Comingling supplies puts the

Page 7 GAO/HEHS/AIMD-00-36 Combating Terrorism
B-282839 

stockpile items at risk because more people have access to the items,

making them more susceptible to waste, loss, unauthorized use, and

misappropriation. At one site, a supply of amyl nitrate—which is a

pharmaceutical with a street value—was stored in a large refrigerator in

the VA Inpatient Pharmacy, comingled with other VA medical center

pharmaceuticals. At another site, we found that amyl nitrate and an

antidote were stored in an unsecured staff refrigerator along with

employees’ lunches. And at a third site, OEP’s refrigerated supplies were

stored with other non-OEP supplies in an unlocked refrigerator outside the

secure area. VA officials explained that sometimes the secured areas where

OEP’s stockpiles are kept do not include electrical outlets needed to store

refrigerated items.

Information and

Communications

OEP, VA, and the Marine Corps did not require periodic reporting on

program status to agency management. Communication about stockpile

matters between OEP and VA was infrequent and irregular. For example,

both OEP and VA officials told us that they had originally planned to have

quarterly teleconferences or meetings about stockpile-related issues but

could demonstrate that only one meeting had taken place. Although VA has

managed OEP’s stockpiles since April 1997, OEP never requested that VA

produce (and VA has not provided) any regular, formal, written progress or

status reports on the stockpiles.

We found that the exchange of information on stockpile inventory status

and managerial activities between CBIRF, the Marine Corps, and the Navy

was also lacking. Marine Corps officials did not communicate clear

expectations about the type, extent, and frequency of reports they

expected CBIRF to produce on the status of its stockpile or about the type

and frequency of oversight the Marine Corps would exert. Neither the

Navy Medical Command nor the Marine Corps had ever requested that

CBIRF regularly produce written progress reports, inventory status, or fiscal

reports on its stockpile.

Monitoring Neither OEP nor VA required or conducted periodic inventories of the

stockpiles to determine whether stockpiled items were current, accounted

for, and available for use. Although CBIRF periodically counted items in the

stockpile, it does not have an approved inventory list. As a result, it cannot

determine whether the stockpile contains all supplies needed to respond

to a chemical or biological terrorist attack. In contrast, we determined that

Page 8 GAO/HEHS/AIMD-00-36 Combating Terrorism
B-282839 

the vendor storing the nation’s smallpox vaccine for CDC follows standards

for internal control.

CDC Is Managing a

New Stockpile

Program

CDC received $51 million in fiscal year 1999 to establish the nation’s

National Pharmaceutical Stockpile Program. It has requested $52 million

for fiscal year 2000 to continue establishing this stockpile. Under the

program, CDC will stockpile medical supplies to be used in a biological or

chemical attack. Like OEP, CDC has selected VA to procure, oversee, and

store the national stockpile. As the program is currently envisioned, CDC

plans to require VA to begin stockpiling items 14 days after the interagency

agreement is signed. However, CDC’s draft National Pharmaceutical

Stockpile Program plan lacks information on how CDC will review and

assess the stockpile and contractor, what security measures it has to

safeguard the stockpile, and which CDC personnel will manage the

stockpile, stockpile operations, and command, control, and

communication functions.

Conclusion Sound management of the chemical and biological stockpiles is critical to

the protection of public health in the event of a terrorist attack. However,

OEP, VA, and the Marine Corps did not explain why they have not followed

the basic standards of internal control we have set forth. The poor

management controls and lack of required items in their stockpiles lead us

to conclude that they cannot provide reasonable assurance that the

required medical supplies will be available if needed.

As the federal agency primarily responsible for emergency preparedness,

OEP did not provide leadership to reasonably assure that the necessary

medical supplies will be current, accounted for, and available for use. In

the absence of explicit requirements or oversight from OEP, VA has

developed a stockpile management program without adequate internal

control. CBIRF’s inventory management and tracking system also did not

meet basic federal standards for internal control. The inventory systems

that are supposed to track and account for the stockpiles of medical

supplies to be used in a chemical or biological attack are inaccurate and

unreliable.

While the current stockpiles are not well managed and lack required items,

even more will be at stake in the future as CDC expands its new stockpile.

Developing and implementing internal controls needs to be a fundamental

Page 9 GAO/HEHS/AIMD-00-36 Combating Terrorism
B-282839 

aspect of managing this stockpile to avoid repeating problems we found at

OEP and CBIRF.

Recommendations To address the internal control weaknesses identified in this report, we

recommend that the Department of Health and Human Services’ Office of

Emergency Preparedness, the HHS Centers for Disease Control and

Prevention, the Marine Corps Chemical and Biological Incident Response

Force, and the Department of Veterans Affairs establish sufficient systems

of internal control over their chemical and biological stockpile

management. The agencies need to reasonably assure that personnel carry

out the following specific control activities:

• conduct risk assessments and organize program activities to identify and

mitigate risks;

• arrange for periodic, independent inventories;

• implement a tracking system that retains complete documentation for all

supplies that have been ordered, received, and destroyed; and

• rotate supplies properly.

Agency Comments We sent a draft of this report to VA, HHS, and DOD for their review and

comment.

While VA indicated that this is an important issue, it wanted additional time

to review the results of our inventory and to respond to us later.

HHS generally agreed with our findings and recommendations and reported

that it is redefining and adjusting its management oversight of OEP’s

stockpiles by drafting a new memorandum of agreement between VA and

OEP. In addition, it said that CDC has relied on our work to develop such a

memorandum with VA for the National Pharmaceutical Stockpile Program.

HHS’s comments are reproduced in appendix III.

The Special Assistant to the Assistant to the Secretary of Defense for Civil

Support as well as CBIRF officials acknowledged weaknesses in CBIRF’s

inventory management controls and described corrective actions that DOD

intends to take. For example, CBIRF is in the process of defining its medical

inventory, will institute a risk assessment and mitigation activities, and

will conduct independent inventories. DOD officials also told us that CBIRF’s

primary mission is to support war fighters, although it also supports

civilian agencies. For this reason, CBIRF officials asked that we delete their

Page 10 GAO/HEHS/AIMD-00-36 Combating Terrorism
B-282839 

agency from the report. However, we believe we appropriately included

CBIRF for two reasons. First, a Marine Corp document entitled The

Chemical/Biological Incident Response Force states CBIRF’s mission is to

respond to chemical or biological incidents worldwide and, when directed,

to assist local civilian and military agencies. CBIRF officials also told us that

responding to civilian incidents is a part of their mission. Second, OEP’s

plan reflects its intention to rely on CBIRF to assist in the treatment of

civilian victims. We have made technical clarifications in response to other

CBIRF comments where appropriate.

As we agreed with your offices, unless you publicly announce the contents

of this report earlier, we plan no further distribution of it until 30 days

after its date. We will then send copies to appropriate congressional

committees and the federal agencies discussed in this report. We will also

make copies available to others who are interested.

Please contact me at (202) 512-7101 or Ronald Guthrie, Assistant Director,

at (303) 572-7332 if you have any questions. Other major contributors to

this report were Martin Eble, Lesia Mandzia, Lawrence Moore, Carolina

Morgan, and Thomas Yatsco.

Cynthia A. Bascetta

Associate Director, Veterans Affairs

 and Military Health Care Issues

Page 11 GAO/HEHS/AIMD-00-36 Combating Terrorism
Contents

Letter 1

Appendix I 

Scope and

Methodology

14

Appendix II 

Stockpile Tracking

System Control

Deficiencies

16

Appendix III 

Comments From the

Department of Health

and Human Services

23

Glossary 25

Abbreviations

CBIRF Chemical Biological Incident Response Force

CDC Centers for Disease Control and Prevention

DOD Department of Defense

EMSHG Emergency Management Strategic Healthcare Group

EPS Emergency Pharmacy Services

FEMA Federal Emergency Management Agency

FMFIA Federal Managers’ Financial Integrity Act of 1982

HHS Department of Health and Human Services

OEP Office of Emergency Preparedness

OMB Office of Management and Budget

RRIS Rapid Response Information System

SAMS Ships Automated Management System

VA Department of Veterans Affairs

Page 12 GAO/HEHS/AIMD-00-36 Combating Terrorism
Page 13 GAO/HEHS/AIMD-00-36 Combating Terrorism
Appendix I 

Scope and Methodology

Our objectives were to (1) review the accuracy and currency of the

inventory tracking systems for federal medical stockpiles that would be

used to treat the civilian population following a chemical or biological

terrorist attack and (2) examine the internal controls in place to manage

the stockpiles. We obtained documents and interviewed officials at the

Centers for Disease Control and Prevention (CDC) and the Office of

Emergency Preparedness (OEP) at the Department of Health and Human

Services (HHS), the vendor storing the smallpox vaccine for CDC, the Marine

Corps Chemical Biological Incident Response Force (CBIRF) at the

Department of Defense (DOD), the Department of Veterans Affairs (VA), and

the Federal Emergency Management Agency (FEMA).

To assess the accuracy and currency of the inventory tracking systems

that monitor OEP’s medical stockpiles, we (1) obtained OEP’s required list of

medical supplies, (2) obtained VA’s computerized inventory tracking

records of OEP’s stockpiles, and (3) conducted a 100 percent inventory of

each of OEP’s stockpiles. We then conducted three analyses. Our first

analysis compared the findings of our 100 percent inventory with VA’s

computerized inventory records to test their accuracy. Our second

analysis compared OEP’s list of required items with VA’s computerized

inventory records. Our third analysis compared OEP’s required list of items

with our inventory count. A discrepancy was recorded if (1) an item

specified on VA’s inventory record was not found in the specified container

(shortage), (2) an item not on the record was found in the container

(overage), or (3) an item had incorrect recordkeeping for either the lot

number or the expiration date. We calculated the discrepancy rate by

dividing the number of discrepancies we found by the total number of

items recorded on the inventory. Therefore, in some cases, multiple

discrepancies were assessed for a single item. For instance, an item

located in the wrong container was counted as both a shortage in the

container it belonged in and an overage in the container it was found in.

Since CBIRF did not have an approved inventory list, we compared the

results of our inventory of CBIRF’s stockpile with its computerized

inventory records. We also reviewed the inventories taken and procedures

followed by the vendor storing the smallpox vaccine for CDC.

We reviewed the unclassified version of Presidential Decision Directive 39,

the fact sheet available on Presidential Decision Directive 62, and the

Stafford Act to determine U.S. policy on chemical and biological terrorism.

Also, to assess the adequacy of internal controls, we applied criteria from

our exposure draft entitled Internal Control: Standards for Internal

Page 14 GAO/HEHS/AIMD-00-36 Combating Terrorism
Appendix I 

Scope and Methodology

Control in the Federal Government (GAO/AIMD-99-21.3.1, May 1999). We also

considered the Federal Managers’ Financial Integrity Act of 1982 (FMFIA);

Office of Management and Budget (OMB) Circular A-123, Management

Accountability and Control, revised June 21, 1995; and Federal Financial

Management System Requirements of the Joint Financial Management

Improvement Program.

We did not examine stockpiles and inventories for noncivilian use used by

U.S. military forces and managed by the Defense Logistics Agency. We also

excluded from our scope stockpiles that are maintained by Metropolitan

Medical Response System teams in several U.S. cities to prepare for

chemical and biological terrorist incidents.

Page 15 GAO/HEHS/AIMD-00-36 Combating Terrorism
Appendix II 

Stockpile Tracking System Control

Deficiencies

Our exposure draft entitled Internal Control: Standards for Internal

Control in the Federal Government requires that agencies

1. have an effective control environment,

2. conduct risk assessments,

3. implement control activities that are linked to the results of a mission

risk assessment,

4. properly record information and communicate with management, and

5. ensure monitoring.8

The purpose of the standards issued pursuant to FMFIA is to provide

reasonable assurance that key objectives are met, including effective and

efficient operations, reliable financial and other reporting, and compliance

with applicable regulations and other laws. Agencies are to view these

standards as elements of an ongoing internal control process that must be

constantly maintained.

Control Environment Our Standards for Internal Control in the Federal Government states that

“Management and employees should establish and maintain an

environment throughout the organization that sets a positive and

supportive attitude toward internal control and conscientious

management.” OEP, VA, and CBIRF did not establish an adequate control

environment to effectively carry out their medical stockpile management

responsibilities. According to OEP officials, VA’s management of its

stockpiles is based completely on the interagency agreement and on trust.

OEP also did not require regular reports from VA, including inventories and

financial reports (although it has been receiving financial reports since

May 1999), and did not require or arrange for periodic, independent

inventories of its stockpiles. OEP officials told us that they presumed that

VA would perform inventory control functions as part of its stockpile

maintenance responsibilities, as outlined in the interagency agreement.

However, the agreement is silent about these requirements. The

responsibility for managing OEP’s stockpiles is fragmented within the VA

organization. Because of the lack of clear lines of command, the

employees who manage OEP’s stockpiles from day to day receive little

8

GAO/AIMD-99-21.3.1. We quote this source throughout this appendix as we discuss each of the five

standards for internal control.

Page 16 GAO/HEHS/AIMD-00-36 Combating Terrorism
Appendix II 

Stockpile Tracking System Control

Deficiencies

supervision from upper-level VA management. For example, although the

interagency agreement with OEP was negotiated with and signed by VA’s

Emergency Management Strategic Healthcare Group (EMSHG), the group

plays no role in the management of OEP’s stockpiles. Another group within

VA—the Emergency Pharmacy Services (EPS)—actually manages OEP’s

stockpiles. The director of a VA Consolidated Mail-Out Pharmacy that is

independent of EMSHG heads the EPS group. The director of EPS divides his

time between managing OEP’s stockpiles and directing this pharmacy. He

acknowledged that no clear chain of command exists. In the absence of

adequate internal supervision and oversight, employees of EPS have not

appropriately managed OEP’s stockpiles.

Marine Corps managers also did not provide leadership for CBIRF’s

activities adequate to establish an environment to support internal control.

Specifically, the Marine Corps did not provide written standards and

expectations to CBIRF’s personnel on stockpile control activities; did not

request regular reports from CBIRF on the status of its medical stockpile,

including inventories and financial reports; and did not arrange for

periodic, independent inventories of CBIRF’s stockpile.

Risk Assessment Our Standards for Internal Control in the Federal Government states that

“Internal control should provide for an assessment of the risks the agency

faces from both external and internal sources.” Risk management is the

deliberate process of understanding risk—the likelihood that a threat will

harm an asset with some severity of consequences—and then deciding on

and implementing actions to create a certain level of protection or

preparedness. Agencies should conduct risk assessment to (1) identify all

potential internal and external risks, (2) prioritize the risks by assessing

their likelihood and their effect on mission needs, and (3) take steps to

mitigate those risks.

While required to do so by our standards for internal control, OEP, VA, and

CBIRF have not performed mission risk assessments for their stockpiles.

These agencies have not identified the risks that could threaten the

availability and usefulness of their medical stockpiles, and they have not

prioritized the risks according to their likelihood or their severity. As a

result, the agencies have not taken steps to prevent, detect, or provide

contingency plans if those threats were realized.

Page 17 GAO/HEHS/AIMD-00-36 Combating Terrorism
Appendix II 

Stockpile Tracking System Control

Deficiencies

Control Activities Our Standards for Internal Control in the Federal Government states that

“Internal control activities help ensure that management’s directives are

carried out. The control activities should be effective and efficient in

accomplishing the agency’s control activities.” OEP, VA, and CBIRF did not

establish clear policies and procedures that allow them to carry out

control activities and appropriately manage drugs and medical supplies.

We found a lack of (1) controls over computerized inventory systems,

(2) periodic inventories, and (3) inventory security.

Computerized Inventory

Systems Are Inadequate

The agencies’ computerized inventory systems should include controls

over the hardware, operating system, and database management systems

that ensure that all transactions affecting their stockpiles are recorded and

that all data in these systems are complete and accurate. However, VA’s

and CBIRF’s systems lack fundamental controls, which impedes their ability

to comprehensively track medical supplies. This, in turn, places at risk

their ability to fulfill their missions. Both agencies’ systems lack basic

information, such as

• documentation of back orders, replacements, and shipment and receipt of

all pharmaceuticals and medical supplies;

• the identity of all individuals who entered and made changes to the

databases, the changes they made, and the dates and times they made

them; and

• detailed, verifiable historical records on all replaced and discarded

pharmaceuticals and medical supplies or a history of additions, deletions,

and changes to the physical stock.

CBIRF’s computer system has additional problems that make it unreliable

for accurately tracking the medical supplies in the stockpile. According to

CBIRF’s personnel, the computer system they use to track their

inventory—known as the Ships Automated Management System

(SAMS)—was originally developed for use in remote locations such as on

ships at sea and is not suitable for CBIRF’s mission. They noted that many

of the supplies in the stockpile have not been assigned permanent Navy

supply numbers in SAMS. These numbers are needed to order stockpile

replacements through the Navy’s procurement system, and SAMS does not

record a supply item without an assigned number. As a result, CBIRF staff

had to create ad hoc (or dummy) numbers for many stockpile items so

that SAMS can record them in the database.

Page 18 GAO/HEHS/AIMD-00-36 Combating Terrorism
Appendix II 

Stockpile Tracking System Control

Deficiencies

CBIRF’s computer system has also shown serious instability in recent

months, including a complete computer system failure just before our

visit. The system failure reportedly destroyed all CBIRF’s inventory

information and forced unit personnel to recreate their entire database by

physically counting each item in their stockpile and reentering all

inventory data back into the computer system.

Periodic Inventories Are

Not Conducted

Medical supply inventories should be periodically counted and compared

with records to ensure physical control over assets. However, before our

audit, neither OEP nor VA had ever conducted a complete physical

inventory of OEP’s stockpiles. While VA possessed the required list of items

that OEP wanted in the stockpile, after initially acquiring the medical

supplies for the stockpile, VA never again compared OEP’s required

stockpile list with the actual items in each stockpile. When we compared

OEP’s required list with VA’s inventory records from its computer tracking

system, we found 17,000 discrepancies (9 percent). When we conducted

our inventory of the items in the five stockpiles, we found that out of

approximately 195,000 total items, there were about 22,000 discrepancies

between VA’s computerized inventory tracking system and the actual items

maintained in the stockpiles—a discrepancy of about 11 percent. And

when we compared OEP’s required list with our inventory results, we found

a discrepancy rate of more than 12 percent, or 23,000 discrepancies.

Discrepancies included overages, shortages, and incorrectly recorded

items. Stockpile overages included both pharmaceuticals and general

medical supplies, but most were general medical supplies such as gloves,

bandages, and needles. For example, at one stockpile location, when we

compared both VA’s inventory list and our inventory results with the OEP

list of required items, we found that VA purchased and maintained an

excess of 2,400 pairs of gloves. The OEP list required 2,400 pairs of the

nonlatex gloves; VA’s inventory list showed 3,200 pairs in the stockpile; we

found 4,800 pairs. At another location, we found 159 injector devices in the

stockpile that were not on OEP’s required list. VA’s inventory system

showed the amount although OEP had not required it.

Other discrepancies included shortages and incorrectly recorded items.

Some of the shortages included controlled substances and antidotes. At

two locations, the entire amount of diazepam, a controlled substance, was

not in the stockpile. That is, it did not appear on VA’s inventory list and we

did not find it during our inventory, even though OEP required it. At one

location, we found more than 1,000 additional potassium iodide tablets

Page 19 GAO/HEHS/AIMD-00-36 Combating Terrorism
Appendix II 

Stockpile Tracking System Control

Deficiencies

than OEP required. Yet VA’s inventory spreadsheet showed that it stored the

same amount that OEP required. And at another location, when we

compared our inventory results with VA’s computerized inventory records,

we found that the lot numbers of 438 vials of pralidoxime were recorded

incorrectly.

CBIRF did not have an approved list of what should be in its inventory.

Consequently, we were unable to determine whether any discrepancies

existed between the actual stockpile of medical supplies and an approved

list of medical supplies. Neither CBIRF personnel nor we could determine

whether the correct medical supplies and quantities were on hand. Instead

of physically counting the items in the stockpile and comparing the results

with an approved list, CBIRF officials told us that they periodically count

their medical supplies and then adjust their computer records to reflect

the results of that most recent count. Nonetheless, when we compared our

100 percent inventory count with CBIRF’s computer records of the

stockpile, we found shortages and overages in CBIRF’s stockpile.

Specifically, we found that out of approximately 38,000 total items listed

on CBIRF’s computerized inventory record, there were about 10,000

discrepancies between CBIRF’s inventory record and the actual items in the

stockpiles—a discrepancy rate of about 26 percent.

Discrepancies in CBIRF’s stockpile included overages, shortages, incorrect

expiration dates, and incorrect lot numbers. We found about 5,700 items

that were not recorded in the SAMS database but were in CBIRF’s stockpile,

accounting for excesses in the stockpile of approximately 15 percent. In

total, we also found that about 2,300 items were not in CBIRF’s

stockpile—an antidote accounted for 65 percent of these items. CBIRF staff

explained that 967 of the atropine injectors we identified actually

constituted a data entry error—the contents of one container were entered

into the database twice, using two different names for the same container.

Finally, CBIRF’s database comingles more than 3,000 training and unit

medical supplies in the same database with the CBIRF stockpile supplies,

making it difficult to place special emphasis on and track mission-critical

items.9 CBIRF officials are unable to determine whether the necessary items

are in its inventory because of inaccuracies in the computerized inventory

system and the lack of an authorized list of medical supplies.

9

Small quantities of medical supplies and pharmaceuticals that are used for the general medical care of

CBIRF members.

Page 20 GAO/HEHS/AIMD-00-36 Combating Terrorism
Appendix II 

Stockpile Tracking System Control

Deficiencies

Inventories Lack Security In managing medical supply inventories that are vulnerable to risk of loss

or unauthorized use, agencies should establish physical security

procedures to reasonably assure that stockpiles remain intact and are

available for use. Four of OEP’s five stockpiles are located at VA facilities,

and one is at a local nonfederal facility. The physical security at the

various sites differs, but most stockpiles were stored in caged and locked

areas. However, at one location, the windows in the building housing the

stockpile had padlocked fencing material covering them, but the windows

were open and the fencing material was loose, posing a risk of

unauthorized access. Further, neither VA nor CBIRF had implemented

sign-in sheets or logs to record entry and exit from the stockpiles that

would allow management to review the security of and frequency of visits

to the stockpiles.

Like OEP, the Marine Corps has not communicated clear expectations to

CBIRF medical personnel about how their medial stockpile should be

secured. CBIRF had no sign-in procedures or logs for recording access to its

warehouse and trucks where its supplies are stored. Therefore, it cannot

ensure that proper access is maintained at those locations. We found that

antidotes were stored in an unsecured office inside the warehouse—an

area that many CBIRF staff can gain access to. The office was kept at a cool

temperature to accommodate the antidotes but was not always monitored.

In contrast, CBIRF’s physical security for its controlled substances was

adequate. CBIRF maintains these items in a separate building, in a secured

safe that had a sign-in book and was inventoried quarterly.

Effective

Communication and

Information Exchange

Our Standards for Internal Control in the Federal Government states that

“Information should be recorded and communicated to management and

others within the entity who need it and in a form and within a time frame

that enables them to carry out their management control and other

responsibilities.” The exchange of information on stockpile inventory

status and managerial activities among management within and across

agencies was lacking. OEP officials did not communicate clear expectations

about the type, extent, and frequency of reports they expected VA to

produce on the status of OEP’s stockpile. Their expectations regarding the

type and frequency of oversight they would exert were also not clear. OEP

intermittently requested fiscal reports from VA, which provided

expenditure and financial reports for April, November, and December 1997

and October 1998. The reports varied significantly in the amount of

information they offered and did not provide a clear and consistent picture

of stockpile status and the program’s financial status.

Page 21 GAO/HEHS/AIMD-00-36 Combating Terrorism
Appendix II 

Stockpile Tracking System Control

Deficiencies

Monitoring Our Standards for Internal Control in the Federal Government states that

“Internal control monitoring should assess the quality of performance

over time and ensure that the findings of audits and other reviews are

promptly resolved.” All organizations that depend on a stockpile of assets

to meet their mission must assure themselves that these assets are current,

accounted for, and available for use. However, OEP, VA, and CBIRF have not

implemented adequate systems to monitor their medical stockpiles and

the activities of the staff who manage them. OEP did not require and VA did

not perform regular audits or other reviews of the design and

implementation of the stockpile program. Because no inventories had ever

been conducted, neither VA nor OEP management could identify overages

and shortages in supplies, correct deficiencies, implement improvements,

or demonstrate that the program stockpiles were controlled in accordance

with existing laws and standards.

Page 22 GAO/HEHS/AIMD-00-36 Combating Terrorism
Appendix III 

Comments From the Department of Health

and Human Services

Page 23 GAO/HEHS/AIMD-00-36 Combating Terrorism
Appendix III 

Comments From the Department of Health

and Human Services

Page 24 GAO/HEHS/AIMD-00-36 Combating Terrorism
Glossary

The pharmaceuticals listed here may have alternative uses in a chemical or

biological incident. We have described their primary purposes.

Amyl Nitrate An inhalation drug that is used as an antidote for cyanide poisoning. It is

also a common recreational stimulant known as a popper.

Atropine A cardiac drug that is also used to reverse the effects of organophosphate

poisoning.

Ciprofloxacin A drug, also known as Cipro, that is used to treat infections, including

anthrax.

Controlled Substance A substance that has a high potential for abuse, as classified by the

Controlled Substances Act, title II of the Comprehensive Drug Abuse

Prevention and Control Act of 1970.

Diazepam A drug that is used to treat the symptoms of anxiety, convulsions, and

muscle spasms. Its brand name is Valium.

Doxycycline A drug that can be used to treat bacterial infections, including anthrax.

Mark I An injection kit that contains an atropine auto-injector and a pralidoxime

chloride auto-injector. Together, the drugs are used as an antidote for

nerve gas poisoning.

Nasal Airway A device that is inserted into an unobstructed pharynx through the nose to

provide an airway.

Oral Airway A device that is inserted into an unobstructed pharynx through the mouth

to provide an airway.

Potassium Iodide A drug that is used to help relieve breathing and lung problems.

Page 25 GAO/HEHS/AIMD-00-36 Combating Terrorism
Glossary

Pralidoxime A drug that is used as an antidote for organophosphate poisoning.

(406169) Page 26 GAO/HEHS/AIMD-00-36 Combating Terrorism
Ordering Information

The first copy of each GAO report and testimony is free.

Additional copies are $2 each. Orders should be sent to the

following address, accompanied by a check or money order

made out to the Superintendent of Documents, when

necessary. VISA and MasterCard credit cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address

are discounted 25 percent.

Orders by mail:

U.S. General Accounting Office

P.O. Box 37050

Washington, DC 20013

or visit:

Room 1100

700 4th St. NW (corner of 4th and G Sts. NW)

U.S. General Accounting Office

Washington, DC

Orders may also be placed by calling (202) 512-6000 

or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and

testimony. To receive facsimile copies of the daily list or any

list from the past 30 days, please call (202) 512-6000 using a

touchtone phone. A recorded menu will provide information on

how to obtain these lists.

For information on how to access GAO reports on the INTERNET,

send an e-mail message with "info" in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov

PRINTED ON RECYCLED PAPER
United States

General Accounting Office

Washington, D.C. 20548-0001

Official Business

Penalty for Private Use $300

Address Correction Requested

Bulk Rate

Postage & Fees Paid

GAO

Permit No. G100