Nuclear Supply Chain: DOE Should Assess Circumstances for Using Enhanced Procurement Authority to Manage Risk
Published: 2016-08-11T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: DOE, through NNSA, is responsible for ensuring the safety and reliability of the nation's nuclear weapons stockpile, among other nuclear weapons-related activities. According to NNSA, the trend toward a non-domestic supply chain for components of nuclear weapons and related systems may pose risks to these weapons and systems. The National Defense Authorization Act for Fiscal Year 2014 provides the Secretary of Energy with an enhanced procurement authority, which may be used to exclude a supplier that poses a supply chain risk from a contract or subcontract, and limit disclosing the reason for the exclusion to the supplier. The act includes a provision for GAO to report annually on DOE's use of the enhanced procurement authority. This report assesses the extent to which DOE has (1) used and developed processes for using the authority, and (2) examined whether adequate resources are in place for using the authority. GAO reviewed DOE and NNSA documents, interviewed DOE and NNSA officials, and interviewed M&O contractor representatives for seven NNSA sites—selected based on their NNSA management and activities.
section_title: What GAO Found
paragraphs: As of May 2016, the Secretary of Energy had not used the enhanced procurement authority, and the Department of Energy (DOE) had not developed processes for using the authority, as it had not fully assessed the circumstances under which the authority might be useful. To use the authority, the Secretary must be made aware of a supply chain risk by officials from DOE or its semiautonomous National Nuclear Security Administration (NNSA). Once aware of a risk, the Secretary must make a written determination that using the authority is necessary to protect national security and that less restrictive measures are not reasonably available to reduce the supply chain risk, among other things. However, DOE has not developed specific processes to collect information to provide to the Secretary for making the determination. DOE officials said that they expect instances under which the authority would be useful to be infrequent, but DOE has not conducted an assessment to confirm that view. NNSA officials said that it is unlikely that management and operating (M&O) contractors who operate NNSA's sites and are generally responsible for procuring parts for nuclear weapons and related systems, would need to request that the Secretary use the authority. NNSA officials and M&O contractor representatives told GAO that, as nonfederal entities, M&O contractors are generally not required to disclose security-related reasons to explain why a particular supplier was not selected. Additionally, DOE officials stated that mechanisms exist within the Federal Acquisition Regulation for federal entities to reject suppliers that pose a supply chain risk. Some DOE officials identified circumstances under which the authority could be useful, but DOE has not fully assessed these or other circumstances under which using the authority would help it manage supply chain risk. Under federal standards for internal control, management should periodically review policies, procedures, and related control activities for relevance and effectiveness. Without assessing the circumstances under which the authority could be useful, DOE will have difficulty determining its relevance and, if necessary, developing processes for using it. As a result, DOE may miss opportunities to use the authority to manage supply chain risks.
DOE has not examined whether adequate resources are in place for using the enhanced procurement authority. DOE officials stated that there were some resources in place, such as information and trained personnel, that could be important in using the authority. However, DOE has not examined whether these resources were adequate, consistent with federal standards for internal control. DOE officials and M&O contractors expressed a range of opinions about whether the resources in place were adequate to support using the authority if needed. For example, while officials in DOE's Office of the Chief Information Officer said that they did not anticipate a need for more resources, some M&O contractor representatives said they might need more trained personnel. However, M&O contractor representatives stated that they could not assess the need without a requirement to do so in their M&O contracts and that DOE had not established such requirements. Examining whether adequate resources are in place, consistent with internal control standards, can help provide assurance that resources are available to support using the authority in accordance with any processes that DOE develops.
section_title: What GAO Recommends
paragraphs: GAO recommends that DOE assess the circumstances that might warrant using the enhanced procurement authority and take additional actions based on the results, such as developing processes to use the authority, if needed, and examining whether resources for doing so are adequate. DOE concurred with the recommendation.

section_title: Letter
paragraphs: The Department of Energy (DOE), through the National Nuclear Security  Administration (NNSA)—a semiautonomous agency within DOE—is  responsible for ensuring the safety and reliability of the nation’s nuclear  weapons stockpile. NNSA, among other things, is responsible for  strategic management, safeguards, and security at government facilities  where nuclear stockpile management and nonproliferation activities are  carried out. According to an NNSA document, threats have changed  significantly over the past decade, and the U.S. government is concerned  about the trend toward a non-domestic supply chain for nuclear weapons  components, and the increasing sophistication of adversaries. Risks to  the supply chain include the possibility that (1) a counterfeit or sabotaged  component could cause a nuclear weapon to malfunction, (2) an  adversary could gain access to DOE’s classified information, or (3) the  costs of DOE programs could increase.
To help manage supply chain risks, the National Defense Authorization  Act for Fiscal Year 2014 (the act) provides the Secretary of Energy an  enhanced procurement authority. This authority allows the Secretary, in  the interest of national security, to exclude from certain procurements a  supplier who may present a significant supply chain risk. The authority  also allows the Secretary to withhold consent for a contractor to use a  particular supplier or direct that the supplier be excluded. Under the act,  this authority applies specifically to components of nuclear weapons, and  certain other systems including nonproliferation and counterproliferation  systems. The Secretary is not required to provide the supplier with  reasons for withholding consent, and the decision is not subject to review  in federal court. DOE’s enhanced procurement authority is similar in  some ways to authorities that the Department of Defense and the  intelligence community already have.
The act also includes a provision for GAO to report annually for 5 years  on DOE’s use of the enhanced procurement authority. This report  examines the extent to which DOE has (1) used and developed  processes for using the enhanced procurement authority to manage  supply chain risk and (2) examined whether adequate resources, such as  trained personnel, are in place for using the enhanced procurement  authority.
To determine the extent to which DOE has used and developed  processes for using the enhanced procurement authority, we reviewed  DOE and NNSA guidance and procedures on supply chain risk  management. To determine the extent to which DOE has examined  whether adequate resources, such as trained personnel, are in place for  using the enhanced procurement authority, we reviewed DOE and NNSA  reports, such as DOE’s 2013 Report to Congress on Information and  Communications Technology Supply Chain Risk Management and  NNSA’s fiscal year 2016 Stockpile Stewardship and Management Plan.
For both objectives, we interviewed officials from DOE, NNSA  headquarters, and NNSA site offices, and representatives from six  management and operating (M&O) contractors for seven of NNSA’s eight  nuclear security enterprise sites. Through these interviews, we collected  information from DOE and NNSA officials, and M&O contractor  representatives at each site, pertaining to our objectives. For example, we  obtained officials’ and representatives’ views on the circumstances under  which the enhanced procurement authority might be used and the  processes that might be followed to submit information to support its use.  In addition, to obtain more in-depth information on DOE’s supply chain  risk management efforts, we visited two sites: the Kansas City National  Security Campus in Missouri and the Sandia National Laboratory in  Albuquerque, New Mexico. We selected these two sites because NNSA  officials told us that these sites were leading supply chain risk  management efforts and because of their key role in current programs to  extend the life of nuclear weapons through refurbishment or replacement  of components. We evaluated DOE’s efforts to manage the use of the  enhanced procurement authority against practices described in Standards  for Internal Control in the Federal Government.
We conducted this performance audit from July 2015 to August 2016, in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Within DOE, NNSA conducts its mission activities across several  research and development laboratories, production plants, and other  sites, known collectively as the nuclear security enterprise. Seven of the  eight sites in the nuclear security enterprise, as shown in figure 1, include  facilities, equipment, and components owned by NNSA and operated by  M&O contractors on behalf of NNSA. Five M&O contractors each  operate one site, and one contractor operates both the Pantex and Y-12  sites. M&O contractor activities include, among other things, producing  parts or procuring parts from suppliers. For example, the Kansas City  National Security Campus produces or procures more than 100,000 parts  annually—ranging from nuts and bolts to more complex radar  components—including about 85 percent of the components that go into  a typical nuclear weapon. We previously reported that the site had  increased the percentage of nonnuclear components purchased from  external suppliers from about 54 to 70 percent.
DOE’s efforts to manage supply chain risk include the following:
M&O contractors may develop lists of approved suppliers of nuclear  weapons components and certain information technology systems.  M&O contractor representatives we interviewed said that suppliers are  added to the list after an evaluation that examines their ownership or  management based on publicly available data and a review of their  capability to meet technical and quality assurance requirements.
DOE’s Office of Intelligence and Counterintelligence supports the  department by conducting intelligence and counterintelligence  activities. For example, the office’s field staff can provide information  to M&O contractors when there are potential issues of concern related  to a “foreign nexus” of a supplier or potential supplier. If a foreign  nexus is identified, the Office of Intelligence and Counterintelligence  can perform an in-depth evaluation to determine whether the supplier  poses a risk to the supply chain.
DOE’s Office of the Chief Information Officer (OCIO) is responsible for  providing, among other things, department-wide guidance, policy, and  oversight to ensure secure, efficient, and cost-effective use of  information technology resources. DOE program offices can request  that OCIO review the risk that an information technology supplier  poses to the supply chain. Upon receiving such a request, OCIO  assesses the risk using information from open source databases, and  works with the DOE Office of Intelligence and Counterintelligence  when additional analysis is needed.
In addition, NNSA has taken several steps in recent years to increase its  focus on supply chain risk management. For example, in 2011 NNSA  initiated a multi-disciplinary effort with the Sandia National Laboratories  and the Kansas City National Security Campus, which focused on  identifying, analyzing, and mitigating risks that may arise through  malicious exploitation of NNSA supply chain and cyber-security  vulnerabilities. Also, in 2013 NNSA issued a weapon quality policy, which  it updated in 2015, that stated, in part, that information about unique  problems, such as the insertion of malicious hardware and software into  the supply chain, shall be shared and investigated throughout the nuclear  security enterprise. In addition, NNSA officials said the agency was in the  process of establishing a Nuclear Enterprise Assurance Steering Group  composed of senior NNSA and DOE headquarters officials to provide  oversight and management of NNSA nuclear enterprise assurance  activities. Such activities include supply chain risk management practices  to protect against malicious components that could interfere with the  functionality of a weapons system.
The enhanced procurement authority provided by the act applies  specifically to supply chain risk for covered systems as follows:
Supply chain risk is the risk that an adversary may sabotage,  maliciously introduce unwanted function, or otherwise subvert the  design, integrity, manufacturing, production, distribution, installation,  operation, or maintenance of a covered system or covered item to  surveil, deny, disrupt, or otherwise degrade the function, use, or  operation of the covered system or item.
Covered systems are primarily nuclear weapons and components and  items associated with design, production, and maintenance of such  weapons or of nonproliferation and counterproliferation programs and  certain information technology systems.
The enhanced procurement authority may provide a tool to help DOE  manage supply chain risk in certain circumstances where, under the  Federal Acquisition Regulation, DOE might otherwise need to disclose  the reason for its determination not to award a procurement contract or  subcontract to a particular supplier or DOE’s decision might be subject to  appeal. Specifically, the authority permits the exclusion of contractors or  subcontractors that pose a supply chain risk and allows DOE to not  disclose the reasons for its determination to use the authority and, unlike  most other procurement actions, the use of the authority, including the  decision to not disclose, is not subject to review in any federal court. In  circumstances where DOE uses the enhanced procurement authority, the  Secretary is to notify other federal agencies responsible for a  procurement that may be subject to the same or similar supply chain risk  in a manner and to the extent consistent with the requirements of national  security. Under the act, DOE’s enhanced procurement authority will  terminate in June 2018, 4 years from the effective date of the act.
section_title: DOE Has Not Used or Developed Processes for Using the Enhanced Procurement Authority to Manage Supply Chain Risk
paragraphs: As of May 2016, the Secretary of Energy had not used the enhanced  procurement authority, and DOE had not developed processes for using  the authority, as it had not fully assessed the circumstances under which  the authority might be useful. To use the enhanced procurement  authority, the Secretary must be made aware of a supply chain risk. DOE  or NNSA officials would have to notify the Secretary that a supplier or  potential supplier could pose a significant risk to a covered system. Once  the Secretary was made aware of a significant supply chain risk, to use  the enhanced procurement authority he or she must make a  determination in writing that use of the authority was necessary to protect  national security, and that less restrictive measures were not reasonably  available to reduce the supply chain risk, among other things. The act  requires the Secretary to obtain a risk assessment that demonstrates that  there is a significant risk to the supply chain. Although the act does not  define the elements of a risk assessment, DOE officials stated that a risk  assessment may include a system characterization, threat identification,  vulnerability identification, impact analysis, and risk determination, among  other things. They stated that the risk assessment would be similar to a  risk analysis and mitigation report which the department used to  document supply chain issues, such as suspect counterfeit parts.  However, DOE had not developed specific processes to collect such  information for a risk assessment report and provide it to the Secretary so  that he or she could make a determination about whether to use the  authority.
DOE officials said that they expect that instances under which the  authority would be useful to be infrequent, but that DOE had not  conducted an assessment to confirm that view. Some DOE and NNSA  officials and M&O contractor representatives expressed uncertainty about  whether the authority was needed. According to DOE officials, M&O  contractors generally procure the parts for covered systems, and NNSA  officials said that it is unlikely that an M&O contractor would need to  request that the Secretary use the authority. NNSA and M&O contractor  representatives told us, that since M&O contractors are not federal  entities, they are not subject to the same procurement restrictions as such  entities and already possess the capability to exclude a supplier that  poses a supply chain risk. When procuring a part from a supplier, an  M&O contractor is generally not required to disclose security-related  reasons to a potential supplier to explain why that supplier was not  selected. In addition, when an M&O contractor establishes a subcontract  with a supplier, the M&O contractor can terminate the subcontract at any  time for convenience without providing a reason. Some DOE officials  also told us that there are mechanisms within the Federal Acquisition  Regulation for federal entities to mitigate supply chain risks for covered  system procurements. For example, the Federal Acquisition Regulation  states that a federal entity can contract only with a “responsible”  supplier. According to DOE officials, a supplier that presents a supply  chain risk may not be considered a responsible supplier and may be  excluded from a federal contract for a covered system.
Some DOE officials provided us their views about circumstances under  which the enhanced procurement authority could be useful; however, as  of May 2016, DOE had not fully assessed these or other circumstances  under which using the authority would help the department manage  supply chain risk. For example, some DOE officials mentioned particular  circumstances under which the authority might be useful, such as if DOE  learned about an adversary’s connection to a potential or existing supplier  and an M&O contractor was not aware of the connection. However, the  DOE officials also said that, if such a situation arose, the enhanced  procurement authority would not be the only option because DOE’s Office  of Intelligence and Counterintelligence could contact the M&O contractor,  which could then decide whether to terminate the supplier for  convenience, or in the case of a potential supplier, choose another  supplier without providing an explanation. Alternatively, some DOE  officials said that the enhanced procurement authority could be useful in a  case where DOE or NNSA directly contracted with a supplier. However,  DOE and NNSA officials said they had not identified the extent to which  their direct procurements were for components of covered systems to  which the enhanced procurement authority could apply.
Under federal standards for internal control, legislators and others may  change either an entity’s objectives or how an entity is to achieve an  objective, and management should periodically review policies,  procedures, and related control activities for continued relevance and  effectiveness in achieving the entity’s objectives or addressing related  risk. Congress provided the Secretary with the enhanced procurement  authority as an additional means to manage supply chain risk, but DOE  has not fully assessed how the authority might help the department  achieve its objectives. DOE officials said the Nuclear Enterprise  Assurance Steering Group, which was still being formed, would be the  appropriate group to develop processes for using the enhanced  procurement authority. However, without assessing the circumstances  under which the authority could be useful, DOE will have difficulty  determining the authority’s relevance and, if the authority is considered to  be relevant, developing processes for using it. As a result, if the authority  is needed, DOE may miss opportunities to use the authority to better  manage supply chain risk. Additionally, under federal standards for  internal control, management should communicate information externally  so that external parties can help the entity achieve its objectives and  address related risks. Without assessing the circumstances under which  the authority could be useful, DOE will not have information about the  relevance of the authority to support congressional decision-making about  whether to extend the authority beyond June 2018, when it is currently  scheduled to terminate.
section_title: DOE Has Not Examined Whether Adequate Resources Are in Place for Using the Enhanced Procurement Authority
paragraphs: DOE has identified resources for potentially using the enhanced  procurement authority but has not examined whether these resources are  adequate. DOE officials described two types of resources that were in  place and that could be important in using the authority: (1) information on  DOE, NNSA, or M&O contractor procurements and potential suppliers for  those procurements that are gathered from open or classified sources or  solicited from potential suppliers, and (2) trained personnel who can  evaluate supply chain risks based on that information. For example,  DOE’s Office of Intelligence and Counterintelligence and OCIO officials  said that they were involved in DOE’s supply chain risk management  efforts and that they could collect information on counterintelligence risks  posed by potential suppliers to support the use of the enhanced  procurement authority. Additionally, DOE has access to other data that  could help support the use of the authority. A DOE official told us that, for  DOE-led procurements related to covered systems, the department’s  Strategic Integrated Procurement Enterprise System (STRIPES) could  be queried to identify whether a particular supplier of concern either had a  contract or was bidding on a contract. However, DOE officials said since  the database does not contain information about M&O contractors’  suppliers, DOE would need to request such information from the M&O  contractors.
Although DOE has not fully examined whether adequate resources are in  place to support using the enhanced procurement authority, DOE and  M&O contractor representatives expressed a range of opinions about  whether adequate resources are available. For example, some DOE  OCIO officials said that they did not anticipate a need for more resources  because of the enhanced procurement authority. Some M&O contractor  representatives told us that they might need more trained personnel if  they had to follow additional procedures for examining whether potential  suppliers had foreign ownership or connections. However, M&O  contractor representatives said that they could not assess what resources  might be needed to support the use of the authority without a requirement  to do so in their M&O contracts and that DOE has not established any  such requirements. Establishing a requirement for the M&O contractors to  assess available resources could be a component of any process DOE  develops for using the authority however, as noted above, DOE has not  developed processes for using the authority.
Under federal standards for internal control, personnel need to possess  and maintain a level of competence that allows them to accomplish their  assigned responsibilities, as established by management to achieve  objectives. Management evaluates competence of personnel across the  entity in relation to established policies. These standards also state that  management should design a process that uses the entity’s objectives  and related risks to identify the information requirements needed to  achieve the objectives and address the risks. If DOE determines that  some circumstances warrant using the enhanced procurement authority,  examining whether its resources are adequate could help ensure that the  department can support using the authority in accordance with any  processes that it develops.
section_title: Conclusions
paragraphs: DOE has taken several steps in recent years to increase its focus on  managing supply chain risk. However, 2 years after Congress provided  the Secretary with enhanced procurement authority to help manage  supply chain risk DOE has not used and has not developed processes for  using the authority. While DOE officials expect that instances under which  the authority would be useful would be infrequent, given other options  DOE and its M&O contractors have to manage risks, DOE has not fully  assessed the circumstances where the authority could be useful,  consistent with federal standards that call for management to periodically  review control activities for relevance and effectiveness. Without  assessing the circumstances under which the enhanced procurement  authority could be useful, DOE will not know how, if at all, the authority  could help it achieve its objective of managing supply chain risk and will  not be able to provide information about the relevance of the authority to  support congressional decision-making about whether to extend the  authority beyond its current termination date. Further, because DOE has  not developed processes for using the authority, DOE also has not  assessed whether adequate resources—trained personnel and  information—are in place to support such processes. Examining whether  adequate resources are in place, consistent with internal control  standards, could help provide assurance that the resources are available  to support using the authority in accordance with any processes that DOE  develops.
section_title: Recommendation for Executive Action
paragraphs: To ensure that DOE’s control activities continue to be relevant and  effective for managing supply chain risk, the Secretary should direct the  Under Secretary for Nuclear Security, as the Administrator of the NNSA,  to work with the Office of Intelligence and Counterintelligence and other  DOE organizations, as appropriate, to assess the circumstances that  might warrant using the enhanced procurement authority, and  If this assessment identifies circumstances that might warrant using  the authority, the Secretary should direct the Under Secretary for  Nuclear Security to work with other DOE organizations, as  appropriate, to establish processes for using it and examine whether  adequate resources are in place to support those processes.
Communicate the results of this assessment to the relevant  congressional committees for their use in determining whether to  extend the authority past its current termination date.
section_title: Agency Comments
paragraphs: We provided a draft of this report for review and comment to DOE. In  written comments, reproduced in appendix I, DOE agreed with our  recommendation. Specifically, NNSA said it will work with other DOE  organizations, as appropriate, in an assessment of the situations that  might warrant the use of the enhanced procurement authority. Should  specific circumstances be identified to use the authority, NNSA will  develop a process for its use, including an assessment of resources  supporting the process. NNSA estimated these activities would be  completed by December 31, 2016, and the results will be shared with  relevant congressional committees. NNSA also provided technical  comments that we incorporated as appropriate.
We are sending copies of this report to the appropriate congressional  committees, the Secretary of Energy, and other interested parties. In  addition, the report is available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff members have any questions about this report, please  contact me at (202) 512-3841 or neumannj@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. GAO staff who made key contributions to  the report are listed in appendix II.
section_title: Appendix I: Comments from the Department of Energy
section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Christopher Murray, Assistant  Director; Pamela Davidson; Ellen Fried; Daniel Semick; Alexandra Stone;  and Barbara Timmerman made key contributions to this report.