Defense Supply Chain: DOD Needs Complete Information on Single Sources of Supply to Proactively Manage the Risks
Published: 2017-09-28T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: DOD has an extensive network of suppliers that provide millions of parts needed to sustain its weapon systems. Some parts are provided by a single source of supply (e.g., one manufacturing facility), and if that single source were no longer able to provide the part, DOD could face challenges in maintaining systems. Senate Report 114-49 directed DOD to report on risks associated with single sources of supply. DOD completed its report in October 2016.
House Report 114-102, accompanying a bill for the National Defense Authorization Act for Fiscal Year 2016, included a provision that GAO review single sources of supply for major defense acquisition programs. This report evaluates the extent to which (1) DOD's 2016 report addressed the direction in the Senate report and (2) DOD's weapon systems program offices have information for identifying and managing single source of supply risks. GAO reviewed DOD policy and procedures, analyzed DOD's report, and interviewed officials from a non-generalizable selection sample of nine program offices.
section_title: What GAO Found
paragraphs: The Department of Defense's (DOD) 2016 report on risks associated with single sources of supply did not fully address two of the four elements directed by a Senate report and did not include other information that would have provided further insight into those risks. DOD included information on major defense acquisition programs and supporting parts provided by each single source of supply. However, DOD did not include implementation plans and timelines for risk mitigation actions or information about the effects of the loss of suppliers, as directed. In addition, complete information about DOD organic facilities was not included. While DOD is not required to update its report, it regularly reports industrial base information to congressional committees. Without complete information about critical suppliers, congressional and DOD decision makers do not know all potential risks and effects associated with the loss of single sources of supply for weapon systems.
Program offices do not have complete information to fully identify and manage single source of supply risks. First, program officials GAO spoke with were not aware of DOD's 2016 report, and thus did not have information about parts from single-source suppliers that are considered to be most critical, which could provide important focus for managing these risks. Second, program offices often rely on the prime contractor to identify single source of supply risks, among other types of risks, and GAO found that program offices in some instances had limited information to manage those risks because DOD does not have a mechanism to ensure program offices obtain complete information from contractors. Without such a mechanism, program offices may not be aware of risks early enough to take proactive actions to understand and, as appropriate, mitigate those risks. Third, DOD has a program intended to provide information regarding the loss of suppliers and shortages and to proactively manage these risks, called the Diminishing Manufacturing Sources and Material Shortages (DMSMS) program, but GAO found that DMSMS implementation varied at selected program offices. DOD is taking steps toward improving DMSMS management, but there is no department-wide policy that clearly defines the requirements for DMSMS implementation at the program office level throughout the acquisition life cycle. Without such a policy there is no clearly defined requirement for program managers to proactively manage DMSMS issues.
section_title: What GAO Recommends
paragraphs: GAO is recommending that DOD provide complete information to decision makers on risk mitigation plans and timeframes, potential effects from losses, and all critical facilities, commercial and organic, regarding risks from single sources of supply; share information on critical risks with program offices; develop a mechanism to ensure program offices obtain complete information; and issue a DMSMS policy. DOD concurred with GAO's six recommendations.

section_title: Letter
paragraphs: The Department of Defense (DOD) has an extensive network of suppliers  that provide millions of the parts needed to sustain its weapon systems.   This supplier network, part of the defense industrial base, includes DOD  organic facilities and many private-sector companies, ranging from some  of the largest public companies to small businesses.  Due to costs,  demand, and other reasons, some parts are provided by a single source  of supply (e.g., one manufacturing facility). If that single source were no  longer able to provide the part, DOD could face a disruption in the  weapon system’s supply chain and, over time, challenges in maintaining  the weapon system at the needed level of availability. For example, a fire  in February 2015 destroyed a factory that was the single source of  propellers for the C-130J aircraft, which provides tactical airlift in support  of military and peacetime missions. The Air Force was able to obtain  propellers from various stocks and the other military services and develop  alternative sources of supply for the propellers, but in the absence of a  successful mitigation effort, a disruption in the supply of propellers could  have caused manufacturing and repair delays.
Senate Report 114-49, accompanying a bill for the National Defense  Authorization Act for Fiscal Year 2016, directed DOD to provide a  classified report to the congressional defense committees on matters  related to the risks of having a single source of supply for a major defense  acquisition program.  DOD completed its assessment and submitted its  classified report to the congressional defense committees in October  2016. House Report 114-102, accompanying a bill for the National  Defense Authorization Act for Fiscal Year 2016, included a provision that  we review aspects of DOD’s management of single sources of supply for  major defense acquisition programs.  In conjunction with this provision,  we were asked to review DOD’s report on single source of supply risks.  This report evaluates the extent to which (1) DOD’s 2016 report on single  source of supply risks addressed the direction in the Senate Report and  (2) DOD’s weapon systems program offices have information for  identifying and managing risks from a single source of supply. This report  specifically focuses on one type of risk that can affect supply chains  within DOD’s industrial base; GAO has ongoing work that will assess a  broader array of risks that can affect the defense industrial base and  associated risk mitigation strategies. That work is planned for completion  in 2018.
For the first objective, we compared DOD’s October 2016 report against  the four elements directed by Senate Report 114-49. We assessed  whether the information included in DOD’s report addressed, partially  addressed, or did not address each element. Two GAO analysts  independently reviewed DOD’s report and determined the degree to  which each element was addressed. We also reviewed available DOD  information and data on single sources of supply and compared the report  and related information and data to criteria outlined in, Standards for  Internal Control in the Federal Government such as those that state that  agency management should obtain and use quality information to achieve  the entity’s objectives and should communicate the quality information  internally and externally.  We discussed the report with DOD officials who  have a role in identifying and assessing single source of supply risks in  the defense industrial base.
For the second objective, we reviewed DOD and military department  guidance related to weapon systems acquisition and program  management, supply chain management, and risk mitigation.  We  interviewed and obtained information from officials at relevant DOD,  military department, and program executive offices. From the population  of programs with single source of supply risks identified in DOD’s October  2016 report, we identified three categories—air, missile, and other types  of programs—and randomly selected nine programs across these  categories. We interviewed relevant officials in those program offices  about their risk identification and management processes. While not  generalizable to all program offices, the results of our discussions at  selected program offices provide insights into how they identify and  manage risks. Appendix I provides further information on our scope and  methodology.
We conducted this performance audit from June 2016 to September 2017  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: Roles and Responsibilities for Programs and Their Supply Chains
paragraphs: DOD relies on a cadre of program managers to lead the development,  delivery, and sustainment of individual weapon systems throughout their  life cycles. The program managers are the designated individuals with  responsibility for and authority to accomplish the program’s development,  production, and sustainment objectives to meet the users’ operational  needs. Additionally, along with certain other senior officials, the program  manager is responsible for decision-making and program execution and  is accountable for results.  Program offices include the program  managers and other individuals who support the program. Product teams,  comprised of program office staff and other relevant experts and  contractor officials, as appropriate, also support the management of the  program.
Generally, program managers or their designees interact with prime  contractors who manage subcontractors to provide the final good or  service to DOD. In addition, program executive officers within the military  departments manage a portfolio of programs (e.g., aircraft, missiles,  combat vehicles, and ships). Once delivered to DOD, weapon systems  are sustained under various arrangements that may include contactors,  DOD organic facilities, or some combination of the two. Materiel support  commands in the military services, as well as the Defense Logistics  Agency, manage inventories of spare parts, and individual weapon  system programs are typically supported by a complex supplier network  that includes a prime contractor, sub-contractors, and various tiers of  parts suppliers.
Within the Office of the Under Secretary of Defense for Acquisition,  Technology and Logistics, the Office of the Deputy Assistant Secretary of  Defense for Supply Chain Integration describes its mission as  establishing strategic supply chain governance and reporting and  overseeing the integration of global logistics and supply chain  performance. According to the office, its specific responsibilities include  leading the development of DOD supply chain policies, reducing excess  inventories, improving control of critical assets, and strengthening  detection of counterfeit items, among others. Also within the Office of the  Under Secretary of Defense for Acquisition, Technology and Logistics,  the Deputy Assistant Secretary of Defense for Manufacturing and  Industrial Base Policy (MIBP) is responsible for various industrial base  matters, including developing DOD policy and providing guidance,  oversight, and technical assistance on assessing or investing in defense  industrial capabilities to the Under Secretary of Defense for Acquisition,  Technology and Logistics. MIBP supports the Office of the Secretary of  Defense and Service Acquisition Executives by providing analyses of  defense supply chains and recommendations for taking appropriate  actions to maintain the health, integrity, and technical superiority of those  supply chains.  MIBP reports annually to the Senate and House Armed  Services Committees on DOD’s industrial base assessments, actions  initiated during the previous year to better understand or respond to risks,  and investments planned for certain defense industrial base funding  programs. MIBP’s assessments of the supply base are intended in part  to identify and mitigate weaknesses stemming from fragile suppliers that  are likely to be disrupted or from critical characteristics that make a part  difficult to replace. MIBP typically analyzes supply base issues that jointly  affect more than one DOD component. The military services also conduct  supply base analyses that focus on their own programs.
DOD recognizes that there are potential risks to its supply chain, including  risks associated with having single sources of supply, and DOD’s policy is  to identify and manage these risks. Specifically, DOD Instruction 4140.01  states that potential disruptions in the DOD supply chain shall be  identified, monitored, and assessed to mitigate risk to supply chain  operations. The instruction further indicates that supply chain risk  management strategies shall be employed to address potential supply  chain disruptions. Some examples of supply chain disruptions are  unreliable suppliers, flooding, terrorism, labor strikes, and natural  disasters.  While DOD has multiple sources of supply for some parts, it  relies on a single source for many others. There are a number of reasons  for using single sources of supply. For example, demand for parts may  not be high enough to justify the cost of maintaining more than one  production line, and limitations on DOD’s access to technical data may  also inhibit its ability to develop multiple sources of supply.
section_title: DOD’s Critical Asset Identification Process
paragraphs: DOD has established a process for analyzing defense infrastructure  called the Critical Asset Identification Process (CAIP). CAIP is intended to  provide a common analytical framework that is consistent and repeatable  to identify critical assets, such as facilities to protect against supply  disruptions. This process is part of DOD’s Mission Assurance program,  which is intended to protect and ensure the continued functioning of  capabilities and assets by securing, protecting, and managing the risks of  programs that support DOD’s mission.  The defense industrial base is  one of several defense infrastructure sectors, and CAIP is repeated  annually to identify critical facilities, or “assets,” in the defense industrial  base that must be protected. As the Defense Infrastructure Sector Lead  Agent for the defense industrial base, the Defense Contract Management  Agency (DCMA) leads this process for the defense industrial base,  working in conjunction with MIBP. According to DOD, defense industrial  base input into CAIP is supported by a continuous assessment process  that includes fragility and criticality assessments, service industrial base  assessments, data calls to the services and defense agencies, and direct  information from industry.
According to its October 2016 report, in implementing the CAIP, DCMA  evaluates assets in the defense industrial base against risk-based criteria.  One of the key criteria it notes is whether an item has a single source of  supply. From an initial list of important capabilities, the annual process  results in three main lists of assets—task assets, task critical assets  (TCA), and defense critical assets; each successive list is of more critical  importance to DOD and national security. DOD officials stated that the  assets on these lists remain relatively stable from year to year. Figure 1  shows how DOD describes different types of assets and the criteria for  each type of asset list within CAIP.
When the annual CAIP is completed, the TCA list for the defense  industrial base (as well as assets from other defense infrastructure  sectors) is submitted to the Joint Staff, which then is responsible for  compiling DOD’s overall TCA list from across all defense sectors. From  this list, Joint Staff officials also nominate assets for consideration as  defense critical assets and provide them to the Assistant Secretary of  Defense for Homeland Defense and Global Security for approval.  Defense critical assets are the most critical type of asset, defined as  assets of such extraordinary importance to operations in peace, crisis,  and war that incapacitation or destruction would have a very serious,  debilitating effect on the ability of DOD to fulfill its missions.
section_title: DOD’s 2016 Report Did Not Fully Address Two of Four Elements in the Senate Report Direction and Did Not Include Information That Would Have Provided Further Insight into Risks
subsections: section_title: DOD’s Report Fully Addressed Two Elements, Partially Addressed One Element, and Did Not Address One Element
paragraphs: DOD’s October 2016 report on single source of supply risks fully  addressed two elements of the direction in the Senate Report, partially  addressed one element, and did not address one element. Table 1  summarizes our assessment of DOD’s report against each element.
DOD’s report contained two classified appendixes, one that identified a  list of more than 380 task assets and the other that identified a list of 33  TCAs. Based on our analysis of these appendixes, we found that the  information they contained addressed two elements of the Senate  Report’s direction, identifying (1) major defense acquisition programs with  operational implications and (2) a list of critical components of such  programs that are provided by a single source of supply. The list of task  assets includes information about each facility, such as the major defense  acquisition programs that are supported by that facility and the part or  parts it supplies. In many cases, a single facility on the list provides parts  for numerous programs. While information on specific programs and parts  is not included on the TCA list, it is possible through cross-referencing to  identify the information that corresponds to that facility in the task asset  list.
MIBP officials stated that when the Senate Report direction for a report on  single source of supply risks was received, they believed the task would  be difficult, as there was no one list of all single sources of supply.  However, they determined that the existing CAIP could be used, because  it relies on criteria that include whether a facility is a single source of  supply. They therefore used information resulting from this process to  develop the two appendixes. They noted that the decision to use CAIP to  respond to the direction in the Senate Report was discussed with and  approved by the Joint Industrial Base Working Group. The working group  is a DOD forum to exchange information and collaborate on tasks relative  to defense industrial base issues. Its membership includes  representatives from the military departments’ acquisition and industrial  base assessment organizations.
subsections: section_title: DOD Partially Addressed One Element, but Has Not Identified Plans for Mitigating the Risk of Supplier Loss
paragraphs: DOD’s report partially addressed the direction to identify risk mitigation  actions—with associated implementation plans and time lines—that it  would take to prevent negative operational impact in the event of the loss  of single-source or single-provider suppliers. The report provided an  overview of some of the risk mitigation strategies DOD can use to  manage risks resulting from single sources of supply within the industrial  base; however, DOD did not identify implementation plans and time lines  for any risk mitigation actions pertaining to specific assets listed in the  report, including the TCAs. The report listed four tools that DOD can use  to mitigate risk in the defense industrial base—Titles I and III of the  Defense Production Act, the Manufacturing Technology program, and the  Industrial Base Analysis and Sustainment program.   Through these  available tools, DOD can provide funding to address critical problems  within a supply chain or to seek technological innovations as solutions to  those problems. DOD’s report did not describe other risk mitigation  actions that, according to DOD and service officials, are routinely used by  program offices to respond to and mitigate risks, such as life-of-need  buys, development of a new source, or redesign of parts, among others.
DOD officials have taken steps to mitigate risks or supply issues when  they become aware of a loss or a pending loss of a single source of  supply. We found that some of the parts supplied by the 33 TCAs have  been the focus of funding projects associated with the Defense  Production Act, the Manufacturing Technology program, or the Industrial  Base Analysis and Sustainment program. For example, the Industrial  Base Analysis and Sustainment program funded various projects on  chemicals used as part of batteries or other parts associated with certain  programs supported by TCAs.
However, DOD’s report did not identify plans and time lines for risk  mitigation actions associated with any specific facilities listed in the report.  Further, for parts supplied by facilities that have not been the focus of the  above funding programs, it is unclear what, if any, risk mitigation actions have been considered for those facilities. DOD officials stated that it  would be exceedingly time and resource intensive to develop risk  mitigation strategies for every supplier used by the department. DOD  Instruction 4140.01, however, states that potential disruptions in the DOD  supply chain shall be identified, monitored, and assessed to mitigate risk  to supply chain operations and indicates that supply chain risk  management strategies shall be employed to address potential supply  chain disruptions.  DOD officials acknowledged that numerous TCA  facilities or parts provided by those facilities have been the focus of risk  mitigation funding projects, as discussed previously. Further, they stated  that while it would not be feasible to develop risk mitigation strategies for  every supplier, focusing on risk mitigation plans and timeframes for the  most critical suppliers within the department, such as TCAs, would be  more appropriate. While DOD is not required to update its 2016 report on  single source of supply risks, the department regularly reports information  to congressional committees on the defense industrial base, such as  through an annual report. Without information on risk mitigation actions,  to include implementation plans and time lines, congressional and DOD  decision makers do not have reasonable assurance that it is prepared to  mitigate the loss of a critical facility, such as a TCA.
section_title: Report Did Not Address Element on Operational Impacts, but DOD Has Data on Capabilities That Could Be Affected by the Loss of a Facility
paragraphs: DOD’s report did not address the reporting element that the department  identify the severity of operational impacts resulting from the loss of single  source or single provider suppliers. DOD stated in its report that  information on operational impacts was not included in the report,  because the assessments, performed by the Joint Staff, are kept close- hold and are mission scenario-driven assessments. We found, however,  that the Joint Staff has not performed such operational impact  assessments. Joint Staff officials stated it would not be feasible due to  resource constraints to assess the operational impacts resulting from the  loss of all assets identified as critical within the industrial base. Moreover,  they stated it is difficult to determine operational impacts because of  stocked inventory or other strategies for mitigating the loss of an asset.
While DOD does not have information on operational impact  assessments for the facilities included in its report, it does collect relevant  data on the effects on defense capabilities that could result from the loss  of a critical facility such as a TCA. Joint Staff officials stated that as part of  CAIP, DCMA and other DOD components regularly submit data regarding  the types of defense capabilities that are supported by TCAs. According  to Joint Staff and other DOD officials, these defense capabilities allow  DOD to carry out specific types of tasks, including the use of necessary  equipment and supplies; this differs from operational impacts or the  resulting effect on military operations. The officials stated that information  on affected defense capabilities would be more relevant to understanding  single source of supply risks than information on operational impacts.
Other officials from DOD and the services also stated that determining the  effects on mission readiness resulting from the loss of a defense  industrial base facility could be difficult and that a focus on effects on  defense capabilities would be more relevant information for  understanding the potential negative effects of a loss. We reviewed the  Joint Staff’s database containing TCA information and found numerous  instances where potential effects on defense capabilities had been  reported. For example, a Navy official and a DCMA official both  nominated a facility as a TCA, because its loss would affect the  deployment and maintenance schedules for certain types of ships.  Standards for Internal Control in the Federal Government states that  agency management should obtain and use quality information to achieve  the entity’s objectives and should communicate the quality information  internally and externally.  As discussed previously, while DOD is not  required to update its 2016 report, the department does update its CAIP  information annually, and it regularly reports information about the  defense industrial base to congressional committees. In the absence of  such information in DOD’s report, congressional and DOD decision  makers may not have a full understanding of single source of supply  risks.
section_title: DOD’s Report Did Not Include Information on DOD Organic Facilities That Could Have Provided Further Insight into Risks
paragraphs: DOD’s report did not identify TCAs that are DOD organic facilities; we  found that this information was available and could have provided  additional insight into single source of supply risks. DOD’s report included  commercial TCA assets but did not include DOD organic facilities that  have been designated as TCAs that support the major defense  acquisition programs identified in the report. Examples of DOD organic  facilities in the defense industrial base are maintenance depots, shipyards, and ammunition factories. We reviewed data provided by the  Joint Staff and found more than 60 DOD organic facilities that have been  assessed as TCAs but were not included in DOD’s report. Further, Joint  Staff officials stated that one facility within the industrial base sector has  been identified as a defense critical asset and it is a DOD organic facility.  As noted previously, defense critical assets are extraordinarily important  to operations, and the loss of such an asset would have a very serious,  debilitating effect on the ability of DOD to fulfill its missions. This DOD  organic asset was not included in the October 2016 report.
Standards for Internal Control in the Federal Government states that  agency management should obtain and use quality information to achieve  the entity’s objectives and should communicate this quality information  internally and externally.  DOD officials stated that they did not include  existing information on DOD organic facilities in the October 2016 report  because, while DOD might not be aware of potential stoppages that could  occur at commercial facilities, it would be well aware of any changes at its  own facilities that could result in the loss of a production line. However,  DOD organic facilities, like commercial facilities, are susceptible to natural  disasters or other events that could disrupt a supply chain. As discussed  previously, while DOD is not required to update its 2016 report, the  department does update its CAIP information annually and it regularly  reports information to congressional committees on the defense industrial  base. Without information about DOD organic facilities that are critical  single sources of supply, such as TCAs, including the potential effects on  defense capabilities and risk mitigation actions, congressional and DOD  decision makers may not be fully aware of, and prepared to address,  potential risks associated with the loss of facilities that are single sources  of supply for weapon systems.
section_title: Program Offices May Not Have Complete Information for Identifying and Managing Risks Associated with a Single Source of Supply
paragraphs: Weapon systems program offices do not consistently receive complete  information that would help them to identify and manage risks associated  with a single source of supply. The selected program offices we contacted  had procedures to manage risks, including known single source of supply  risks. However, these program offices were not aware of results relevant  to their programs that were generated by CAIP and included in DOD’s  October 2016 report. In addition, we found that program offices may have  limited information from contractors on single sources of supply within the  tiers of their supply chains, and they were inconsistent in implementing a  DOD program that is intended to identify and manage risks associated  with the loss of suppliers and material shortages, which may involve  single sources of supply.
subsections: section_title: Selected Programs Had Procedures to Manage Single Source of Supply Risks
paragraphs: Program managers are responsible for managing risks to their weapon  systems programs, and selected program offices we met with had  procedures to manage such risks. DOD guidance indicates that program  managers are the single point of accountability for accomplishing program  objectives for total life-cycle systems management and are accountable  for credible cost, schedule, and performance reporting to the Milestone  Decision Authority.  DOD guidance also describes program manager  responsibilities regarding risk management, including consideration of risk  management techniques such as assessing industrial base availability  and capabilities. It further states that program management is responsible  for incorporating industrial base analysis, to include capacity and  capability considerations, into acquisition planning and execution. As  described by guidance, the objectives of industrial base analysis include  ensuring that DOD can identify and mitigate industrial capability risks  such as single points of failure and support resilience of critical defense  industrial base capabilities.
MIBP and service officials stated that, ultimately, it is the responsibility of  program office management to identify and manage the risks affecting the  program, including risks stemming from a single source of supply. To  manage known risks from a single source of supply, the selected program  offices we met with had procedures, such as risk management boards or  meetings and integrated product teams, that focused on issues such as  the program’s industrial base or obsolete parts. A risk management  board, serving as an advisory body to the program manager, reviews risk  analysis results, risk mitigation plans, and associated resources, as well  as progress associated with implemented risk mitigation plans. It includes  relevant program management officials, subject matter experts, and  contractor personnel, as appropriate. Integrated product teams, according  to DOD, are composed of representatives from appropriate functional  disciplines working together to build successful programs, identify and  resolve issues, and make sound and timely recommendations to facilitate  decision making.
An Air Force program office we met with had an internal risk management  board comprised of government employees and a joint risk management  board with representatives from both the program office and its main  contractor. According to officials, both boards met monthly to discuss and  address risks. Similarly, officials from a Navy program office stated that  program officials and representatives from its contractor and suppliers  participated in management and technical reviews to analyze  performance metrics and prioritize any risks. They stated that while both  program officials and contractor representatives discuss strategies to  address risks, it is ultimately the program management that determines  the severity of a risk and how to address it. Other program officials we  contacted stated that the Program Executive Office played an important  role in monitoring the industrial base for the portfolio of related programs.  For example, officials from an Army program office stated that they  conduct ongoing monitoring of the availability and production of needed  items for their program and also participate in an integrated product team  covering the Program Executive Office’s entire portfolio that meets  monthly to discuss risks. Officials also described risk management plans,  including management plans that identify known risks and opportunities  as well as potential obsolescence issues or material shortages or the loss  of suppliers, for example, as well as single sources of supply.
section_title: Selected Program Offices Were Not Aware of CAIP Results That Potentially Affected Their Weapon Systems
paragraphs: DOD used CAIP to generate the information for its October 2016 report  on risks associated with single sources of supply, but program officials  from the nine offices we spoke with from March to June 2017 said they  were not familiar with the CAIP results in DOD’s report, including those  regarding TCAs. Although each selected program had at least one part  supplied by a TCA listed in DOD’s report, none of the officials from the  nine program offices we spoke with were aware of this fact. In addition,  service officials from the offices above for the nine selected programs  were not aware that the program had an item supplied by a TCA.
Numerous service and program office officials stated that information  about risks associated with certain suppliers, such as that generated  through CAIP, would be beneficial to the management of their supply  chain. Officials from program offices added that early identification of  risks, when possible, provides additional options or opportunities for risk  management. For example, with advance notice of a facility ceasing  production of a part, a life of need buy can be made to ensure that parts  are available until a substitute part or another source becomes available,  which can prevent negative effects on a weapon system’s availability and  higher costs. Some officials we spoke with stated that they requested  copies of DOD’s October 2016 report after we brought it to their attention.  In addition, we found that two of the programs in our sample were also  supported by a DOD organic facility that was identified as a TCA in data  provided by the Joint Staff. As discussed earlier, DOD’s report included  only commercial TCAs and not DOD organic facilities.
DOD Instruction 4140.01 identifies potential supply chain disruptions as a  factor to be considered as part of DOD supply chain operations, and DOD  guidance regarding the defense acquisition system notes the importance  of complete and current program information to the acquisition process.  According to DOD policy regarding supply chain management, potential  disruptions within and outside the DOD supply chain shall be identified,  monitored, and assessed to mitigate risk to supply chain operations.   DOD policy on acquisition states that complete and current program  information is essential to the acquisition process.  As discussed  previously, DOD guidance on acquisition further discusses both the  responsibility of program management and the importance of information  in the context of industrial base analysis.  Further, Standards for Internal  Control in the Federal Government states that agencies should use  quality information that is complete and current and should internally  communicate necessary information to achieve objectives.
DOD officials involved in developing the October 2016 report stated that  there is an existing information-sharing channel with the military services  through the Joint Industrial Base Working Group. DOD officials  additionally stated that it was at the discretion of military service  representatives on the working group to share the information as needed.  However, our interviews with program offices and program executive  offices indicated that such information-sharing did not occur. DOD  officials acknowledged that improved communication and sharing of  information among the various offices that play a role in managing DOD’s  supply chains and responding to industrial base risks would be beneficial  to the management of DOD’s programs. Having relevant information  generated through the annual CAIP, such as the type of information  included in the October 2016 report, would help program managers to be  aware of parts supplied by a single source that is considered to be a most critical risk (i.e., a TCA), and thus have complete and current information  that could provide important focus for managing these risks.
section_title: Program Offices May Have Limited Information from Contractors on Single Source of Supply Risks
paragraphs: Program offices often rely heavily on the prime contractor to identify  existing and potential single source of supply risks, among other types of  risks, but in some cases they may have limited information from  contractors to help them be aware of and manage those risks. DOD and  service officials stated that risk identification is part of the activities that  the federal government pays a prime contractor to manage as part of a  contract, and that the prime contractor is to be aware of the health of the  supply chain and any risks within the supply chain that supports the  program. However, we found there have been several instances when a  known risk was not communicated up through the tiers of suppliers to the  government. For example, DOD officials stated that several years ago a  supplier of a chemical compound that is a key component of a type of  butane needed for certain missiles had planned for several years to stop  production of the material, but this information was unknown by the  government until the material was no longer available after production  had stopped and a shortage of butane occurred. While DOD officials said  such instances do not occur frequently, and they took steps to  successfully resolve the issue, they stated that advance warning of risks  can result in less costly and more efficient mitigation of those risks.
During our interviews at the selected program offices, numerous officials  stated that they expect the prime contractor for their program to identify  risks related to a single source of supply and to bring that information to  the attention of the program office. However, they acknowledged that they  do not have a way to ensure this information-sharing and that they are not  fully aware of risks that exist in the sub-tiers of contracts. In contrast,  officials from two programs, both of which manage older systems that  have long been in the sustainment phase of their life cycle, told us they  did not rely on contractors for information on supply risks. Officials from  one of these program offices stated that while a contractor can be an  important partner, the government should not rely on a contractor to  understand and manage risks to the federal government. Also, these  officials stated that independent analysis is critical to appropriately  manage risk. For example, an official from an Army program stated that  detailed analysis performed by the Army found that certain targeted  investments in critical parts, such as infrared technologies and  transmissions, would ensure continued availability of the system and  preserve the health of certain single sources of supply. The Army official  stated that this kind of detailed analysis allows program offices to have  the same or better information than the contractors and thus results in  more informed decision making and negotiations with suppliers and more  effective use of resources.
DOD has efforts under way to obtain better information from contractors  on obsolescence risks but not for other types of related risks, such as  those stemming from a single source of supply. For example, DOD  officials said that the department and military services determined that  contract language requiring certain contractors to notify program offices of  certain obsolescence risks associated with electronic parts would benefit  program offices’ ability to manage risks proactively, and they are pursuing  this type of requirement through proposed changes to the Defense  Federal Acquisition Regulation Supplement.  However, DOD has not  developed a mechanism to ensure the timely and comprehensive sharing  of information on single-source risks from contractors to program offices.  DOD officials stated that while departmental guidance directs program  offices to obtain information about risks, this guidance could be improved  with a mechanism to ensure that program offices can obtain information  from contractors. High-quality and comprehensive information is the  foundation for proper management and decision making at any program or agency. Standards for Internal Control in the Federal Government  states that agency management should obtain relevant data from both  internal and external sources in a timely manner and that these data  should be reliable and free from error and bias.  Timely and  comprehensive information from contractors about single source of  supply risks would help program offices be aware of risks early enough to  take proactive steps to understand and, where necessary, mitigate those  risks.
section_title: Selected Program Offices Varied in Implementing Efforts Aimed at Managing Loss of Suppliers and Parts Shortages
paragraphs: DOD has a program intended to provide information regarding the loss of  suppliers and parts shortages and to proactively manage these risks, but  program offices we met with varied in their implementation of this  program. DOD’s Diminishing Manufacturing Sources and Material  Shortages (DMSMS) program is intended to predict and respond to the  loss, or impending loss, of manufacturers or suppliers of items, raw  materials, or software. In its DMSMS guidebook, DOD describes DMSMS  management as a process to identify issues, assess the potential for  negative effects, analyze potential mitigation strategies, and implement  the most cost-effective strategy.  The guidebook provides best practices  on how to conduct robust management of supply chain risks connected  with DMSMS, which include the loss of suppliers and single source of  supply risks. Proactive DMSMS management can mitigate risks, avoid  costs, and prevent schedule delays resulting from the loss of a single  source of supply.
DOD has reported cost savings from proactive DMSMS management. For  example, by integrating DMSMS management into the design and build  process, the Virginia-class submarine program resolved over 1,200  obsolescence issues and avoided over $150 million in costs, according to  DOD. Similarly, DOD reported that when the manufacturer indicated that  an expensive system upgrade was required for the B-1 bomber due to an  impending obsolescence issue, the program office used its DMSMS  monitoring to determine that only minimal concerns existed and alternate  parts were readily available. In this case, DOD estimated a cost  avoidance of more than $300 million over 10 years.  Further, according  to an official leading implementation of DMSMS across the department,  when DMSMS is managed properly, there is typically more access to the  data and information, which can speed other solutions. A Navy program  official stated that, due to obsolete technologies identified through its  DMSMS management, the program is switching to a new type of  processor chip. The program was able to purchase enough of the current  type of chip to maintain its systems until the supplier completed the  lengthy redesign and requalification process for the new chip. If the  program had not been aware of the obsolescence issue, the official  stated, the program office would have had to pursue a costly solution.
Although DOD has reported positive results from DMSMS, we found  through our interviews with officials at the nine program offices in our  sample that their implementation of DMSMS practices varied. Six  program offices had some type of DMSMS management strategy, and  three did not. Of the six program offices that had some type of strategy,  two offices relied primarily on their prime contractor to identify and  manage supply chain risks, including DMSMS concerns; two offices  retained DMSMS management within their program offices; and two used  a combination of program office and contractor management. Of the three  offices that did not have DMSMS management strategies, two were  participating in a pilot for DMSMS management through an Army  command-level program, and one was in the process of establishing but  had not yet implemented DMSMS management. Officials from one of the  offices participating in the Army pilot stated that next steps would be  determined after the completion of evaluations of various methods for  managing risks, including the pilot program.
In June 2017, a DOD official involved in leading DMSMS efforts estimated  that between 50 and 75 percent of DOD program offices have effective  DMSMS management and that most of the programs that do not have  strong DMSMS management either rely heavily on contractors for  information about risks to their programs or are very small programs.  DOD reported in its most recent annual report to congressional  committees on defense industrial base capabilities that DMSMS issues  continue to be a concern for the department.  For example, DOD  reported that 98 percent of suppliers within the missile and munitions  sector are single sources of supply, it is not possible to find replacements  for parts if a supplier stops production, and requalification for new parts or  materials can be very costly, especially for larger missile systems.  Additionally, the report states that most programs do not plan or budget  for obsolescence, and the department and industry do not have a  coordinated mitigation approach for this issue. Further, different programs  and companies operate independently, which leads to the services paying  to solve the same issue multiple times, and a more coordinated approach  would be more efficient and less costly to the department.
A key factor contributing to the variance in implementation of DMSMS is  that DOD guidance regarding DMSMS management contains limited  detail regarding actions required at the level of a weapon system’s  program office. DOD’s DMSMS guidebook details strategies and best  practices for effective DMSMS management, including that a program  manager or product support manager should establish a DMSMS  management team and that the program manager should develop and  adopt a plan to carry out the DMSMS management strategy. However,  higher-level DOD guidance containing requirements and procedures for  DMSMS management across the department, such as the DOD manual  regarding supply chain material management procedures, does not  clearly detail requirements to be followed by program managers to  implement DMSMS at the weapon system program level. Military  department-level guidance varies. The Navy instruction on acquisition  requires that program managers establish a DMSMS program to  proactively identify, resolve, and eliminate any negative effects from  DMSMS throughout all phases of a program’s life cycle and requires the  development of a DMSMS plan for certain programs.  The Air Force  instruction on life-cycle management of weapon systems’ programs also  details some responsibilities of its program managers to consider and  support DMSMS management.  Further, the Air Force has a command- level instruction regarding implementation of DMSMS, but it does not  require a DMSMS plan during weapon system development or clearly  describe the responsibilities at the program office level.  This guidance is  currently under revision and an Air Force official stated that DMSMS  requirements would be strengthened. The Army’s industrial base process  regulation requires that program managers consider DMSMS throughout  the acquisition life cycle, including during design, redesign, and  production, but direction specific to DMSMS planning largely focuses on  post-production support planning activities.  Standards for Internal  Control in the Federal Government states policy should be used to define  the responsibilities that should be assigned to best achieve objectives  and implement control activities.
DOD officials are considering the need for improved DMSMS policies as  part of their efforts to improve the DMSMS program and their efforts to  address the associated risks. The improvement efforts are being led by  the Defense Standardization Program Office and a department-wide  DMSMS working group. The working group is pursuing 10 objectives,  based on 23 DMSMS program gaps it has identified. Among these  objectives is an effort to focus on improving DMSMS policies.  A DOD  official leading DMSMS efforts stated in June 2017 that the working group  is discussing changes to future versions of existing high-level DOD  acquisition and supply chain policy that would provide more focus on  obsolescence, a type of DMSMS issue. However, the official stated that  none of these changes represent a specific, stand-alone policy that  requires DMSMS implementation and management throughout a weapon  system’s acquisition life cycle. For example, DOD’s supply chain  management manual indicates that the military departments and DLA are  to proactively take timely and effective actions to manage DMSMS issues  and to proactively consider DMSMS through a system’s life cycle. It also  directs the military departments and DLA to designate a focal point to  plan and coordinate actions, such as assessing DMSMS effects on new  DOD weapon systems, including during design, redesign, or production.   However, DOD officials stated that this guidance is used primarily by  inventory managers during the sustainment phase of the acquisition life  cycle—as opposed to program managers during the earlier stages of  acquisition—and noted the utility of adding DMSMS procedures and  requirements to other guidance documents used more directly by  program managers, such as DOD Instruction 5000.02. Moreover, various  members of the working group have acknowledged the need for  department-wide policy to clarify DOD’s DMSMS strategy by defining  roles and responsibilities and procedures to follow as part of DMSMS  management at the program office level. The official leading DMSMS  stated that a DMSMS policy could require a service-specific, dedicated  lead for DMSMS, the development of a DMSMS plan for each program  office throughout the acquisition life cycle, and the use of consistent  metrics for monitoring the program.
While efforts are under way within DOD to improve DMSMS  management, in the absence of a DMSMS policy—such as an instruction  that clearly defines the requirements for DMSMS management at the  individual program office level and details the responsibilities and  procedures to be followed to implement that policy—DOD will continue to  have inconsistent implementation of DMSMS management across  program offices. Further, program offices may not have complete  information to proactively identify and manage diminished manufacturing  sources and material shortages, including those stemming from single  source of supply risks, in order to reduce costs and prevent shortages.
section_title: Conclusions
paragraphs: DOD relies on many single sources of supply to provide needed parts for  its weapon systems and has reported to congressional committees on  facilities that represent risks associated with single sources of supply. In  the case of the 33 TCAs listed in the October 2016 report, these are  considered critical risks. DOD’s report contains important information for  congressional and DOD decision makers. However, DOD’s report did not  identify risk mitigation actions with associated implementation plans and  time lines for the assets listed in its report, including the relatively small  number of TCAs. In addition, DOD’s report did not identify the severity of  operational impacts that could result from the loss of single source  suppliers or include available information on the effects of such a loss on  defense capabilities. Further, the report was limited to commercial TCAs  and did not include DOD organic facilities. Without more complete  information, such as the risks to and effects from potential losses of  commercial and organic single sources, congressional and DOD decision  makers do not have a full understanding of potential risks associated with  the loss of facilities that are single sources of supply for weapon systems.  Further, if DOD does not ensure that risk-mitigation actions have been  considered for the most critical single sources of supply, it cannot assure  that plans are in place to prevent costly delays or parts shortages that  could affect mission readiness.
Program managers may not have complete information on single source  of supply risks within the supply chain that are associated with their  weapon systems programs. First, program offices may not be receiving  the results from the annual CAIP for the defense industrial base, because  existing channels of communication with the military services either have  not been used or are not sufficient. Second, program offices often rely  heavily on the prime contractor to identify single source of supply risks,  but DOD does not have a mechanism to ensure that program offices  obtain information on risks from contractors. Third, the DMSMS program  is intended to provide information regarding the loss of suppliers and  parts shortages and to proactively manage these risks, but program  offices varied in their implementation of this program due to the lack of a  department-wide policy, such as an instruction, that clearly defines  requirements or procedures for DMSMS management by program offices.  In the absence of information provided though CAIP assessments,  reporting from contractors, and a better defined and consistent  implementation of DMSMS, program offices may not have all of the  information available to identify and manage supply chain risks for their  weapon systems programs, including single source of supply risks.
section_title: Recommendations for Executive Action
paragraphs: We are making the following six recommendations to DOD:  The Under Secretary of Defense for Acquisition, Technology and  Logistics, in conjunction with DCMA and the military departments, should  assess whether risk mitigation actions have been identified in the event of  a loss of each TCA facility in the defense industrial base and, based on  this assessment, develop risk mitigation actions with associated  implementation plans and time lines, and provide this information to  congressional and DOD decision makers. (Recommendation 1)
The Under Secretary of Defense for Acquisition, Technology and  Logistics, in conjunction with DCMA and the military departments, should  provide congressional and DOD decision makers with information on  potential effects on defense capabilities in the event of a loss of each  TCA facility in the defense industrial base. (Recommendation 2)
The Under Secretary of Defense for Acquisition, Technology and  Logistics, in conjunction with DCMA and the military departments, should  provide congressional and DOD decision makers with information on  DOD organic facilities that have been identified as TCAs, similar to the  information provided previously on commercial facilities. This information  also should include (1) the potential effects on defense capabilities in the  event of a loss of the facility and (2) risk mitigation actions and associated  implementation plans with time lines. (Recommendation 3)
The Under Secretary of Defense for Acquisition, Technology and  Logistics, in conjunction with DCMA and the military departments, should  take steps to share information on risks identified through the annual  CAIP with relevant program managers or other designated service or  program officials. At a minimum, relevant officials should receive  information on the most critical facilities (such as TCAs) that produce  parts supporting their programs. This information-sharing could occur  through service-specific channels of communication or another method of  internal communication deemed appropriate by DOD. (Recommendation  4)
The Under Secretary of Defense for Acquisition, Technology and  Logistics, in conjunction with the military departments, should develop a  mechanism to ensure that program offices obtain information from  contractors on single source of supply risks. (Recommendation 5)
The Under Secretary of Defense for Acquisition, Technology and  Logistics, in conjunction with the military departments, should issue  department-wide DMSMS policy, such as an instruction, that clearly  defines requirements of DMSMS management and details responsibilities  and procedures to be followed by program offices to implement the policy.  (Recommendation 6)
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DOD for review and comment. In its  written comments, which we received on September 20, 2017, DOD  concurred with our six recommendations and noted planned actions to  address each recommendation. DOD’s comments are reprinted in their  entirety in appendix II. DOD also provided technical comments, which we  incorporated into the report as appropriate.
We are sending copies of this report to the appropriate congressional  committees; the Secretary of Defense; the Under Secretary of Defense  for Acquisition, Technology and Logistics; the Secretaries of the Army,  the Navy and the Air Force; the Commandant of the Marine Corps, and  the Director of the Defense Contract Management Agency. In addition,  the report is available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-5257 or merrittz@gao.gov. Contact points for our Office  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff members who made key contributions to  this report are listed in appendix III.
section_title: Appendix I: Scope and Methodology
paragraphs: To determine the extent to which the Department of Defense’s (DOD)  report on single source of supply risks addresses the direction in the  Senate Report, we compared DOD’s October 2016 report against the  elements identified in the provision of Senate Report 114-49. The  provision directed DOD to develop a classified report that addressed the  following four elements:  1.  Identify major defense acquisition programs with operational  implications.  2.  Include a list of critical components of such programs provided by  single source and single provider suppliers.  3.  Identify risk management actions with associated implementation  plans and time lines DOD will take to prevent negative operational  impact in the event of a loss of such suppliers.  4.  Identify severity of the operational impact of the loss of such  suppliers.
DOD’s report included unclassified information and two classified  appendixes listing specific assets, or facilities. We assessed whether the  information in DOD’s report addressed, partially addressed, or did not  address each element. Two GAO analysts independently reviewed  DOD’s report and discussed and resolved any disagreements regarding  their assessments. They also discussed their assessment with a GAO  attorney to ensure a common understanding regarding each element.
To obtain information on the process used to develop the report, we  reviewed relevant DOD guidance and documents and interviewed officials  from DOD’s Manufacturing and Industrial Base Policy (MIBP) office and  the Defense Contract Management Agency’s (DCMA) Industrial Analysis  Group. Specifically, we reviewed guidance on supply chain material  management, the DOD acquisition system, industrial base capabilities,  and the mission assurance program. In our interviews with MIBP and  DMCA officials, we discussed the scope of the report, the methodology  and data used to generate the information in the report, and their  perspectives on how the report and associated information was to be  used within the department. In those discussions and through a review of  relevant documents and guidance that detail procedures to be followed  when collecting and verifying data within the Critical Asset Identification  Process (CAIP), we assessed the reliability of the data used to generate  lists contained in DOD’s report. We concluded that the data submitted as  part of CAIP by DCMA and the military services to be sufficiently reliable  for the purposes of discussing the total numbers of facilities and critical  facilities listed in DOD’s report. We also met with Joint Staff officials to  understand their role in CAIP and their perspectives on DOD’s report  based on CAIP information from the defense industrial base. We  compared Joint Staff-provided data from a database used as part of CAIP  against the data contained in DOD’s report, and we identified any types of  information contained in the Joint Staff database that was not included in  DOD’s report. We also compared DOD’s report and related information  and data to relevant criteria in Standards for Internal Control in the  Federal Government, such as internal control principles related to using  quality information and the communication of that information.
To determine the extent to which DOD’s weapon systems program offices  have information for identifying and managing single source of supply  risks, we reviewed DOD and military department guidance related to  acquisitions, program management, and risk mitigation, as well as  guidance regarding the Diminishing Manufacturing Source and Material  Shortages (DMSMS) program. We interviewed, and obtained information  from, officials at relevant DOD, military department, and program offices,  including MIBP and Office of Supply Chain Integration, DCMA, and the  Defense Logistics Agency. We also interviewed DOD’s lead for the  DMSMS program in the Defense Standardization Program Office. Within  the military departments, we interviewed headquarters officials involved in  logistics policy and oversight, as well as officials at materiel and  sustainment commands. We also interviewed or contacted relevant  officials within the DMSMS program from the military departments and  defense agencies.
From the population of programs with single source of supply risks  identified in DOD’s report, we randomly selected nine major program  offices from three categories—air, missile, and other types of programs.  For the selection, we individually numbered assets listed in DOD’s report,  assigned them to a category, and then used a random generator to order  the numbers. Using the generated number list, we created a list by  category of programs corresponding to the numbered assets. From the  random selection, we chose the first three programs with publicly- available information from each military department to ensure we included  perspectives from Army, Navy, and Air Force program officials. We  interviewed relevant officials in the nine selected offices about their risk  identification and management processes.  We also interviewed or  received responses to submitted questions from each program’s higher  program executive office on these topics. While not generalizable to all  program offices, our discussions with officials from selected program  offices provide insights into how they identify and manage risks.
We conducted this performance audit from June 2016 to September 2017  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Department of Defense
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, key contributors to this report  were Thomas Gosling, Assistant Director, Rebekah Boone, Joshua  Ormond, Suzanne Perkins, Richard Powelson, Michael Shaughnessy,  and Andrew Stavisky.