The sale or transfer of U.S. defense items to friendly nations and allies is an integral component in both U.S. national security and foreign policy. The U.S. government authorizes the sale or transfer of military equipment, including spare parts, to foreign countries either through government-to government agreements or through direct sales from U.S. manufacturers. The Arms Export Control Act and the Foreign Assistance Act of 1961, as amended, authorize the DOD foreign military sales program. The Department of State sets overall policy concerning which countries are eligible to participate in the DOD foreign military sales program. DOD identifies military technology that requires control when its transfer to potential adversaries could significantly enhance a foreign country's military or war-making capability. The transfer or release of military technology to foreign countries involves various agencies such as the Department of State and DOD, which are responsible for controlling, in part, the transfer of such technology. The Defense Security Cooperation Agency, under the direction of the Under Secretary of Defense for Policy, has overall responsibility for administering the foreign military sales program, and the military services generally execute the sales agreements with the individual countries. A foreign country representative initiates a request by sending a letter to DOD asking for such information as the price and availability of goods and services, training, technical assistance, and follow-on support. Once the foreign customer decides to proceed with the purchase, DOD prepares a Letter of Offer and Acceptance stating the terms of the sale for the items and services to be provided. After this letter has been accepted, the foreign customer is generally required to pay, in advance, the amounts necessary to cover costs associated with the services or items to be purchased from DOD and then is allowed to request spare parts through DOD's supply system. The foreign military sales policy and oversight for the Department of the Army are the responsibility of the Deputy Assistant Secretary of the Army for Defense Exports and Cooperation. The Commander, U.S. Army Materiel Command, is the Army's executive agent for implementing, administrating, and managing the foreign military sales program. The U.S. Army Security Assistance Command performs the executive agent's functions for the U.S. Army Materiel Command. The United States Army Security Assistance Command's responsibilities start with the initial negotiation of a foreign military sale and end with the transfer of items and completion of all financial aspects of the sales agreement. The command uses an automated system called the Centralized Integrated System for International Logistics to support the U.S. Army's management of the foreign military sales program. The command originally developed the system in 1976, and in October 1997, the Defense Security Cooperation Agency transferred the Army's system to the Defense Security Assistance Development Center. The command retained responsibility for defining system-user requirements, designing new processes, and directing programming modifications to the system's applications. However, the overall responsibility for providing system information technology maintenance support, such as writing and testing the programs and coordinating infrastructure support, was transferred to the Defense Security Assistance Development Center. Foreign military sales requisitions for Army spare parts and other items initially are processed through the system. For blanket orders, the system uses the security classification code to restrict the spare parts available to foreign military sales customers. Once the system validates a requisition, the requisition is sent to a supply center to be filled and shipped. The Army's requisition process for foreign military sales of parts and other items is shown in figure 1. The Army's internal controls over foreign military sales using blanket orders are not adequate, placing classified spare parts, as well as unclassified items containing military technology, at risk of being shipped to foreign countries, who are not eligible to receive them. We found that the Army (1) lacked control edits in its system and allowed the substitution and release of classified spare parts under blanket orders for shipment to foreign countries, and that a written policy does not exist to determine the actions needed to recover these items; (2) lacks adequate control edits in its system to prevent the release of some unclassified spare parts and other items containing military technology, and that a written policy does not exist to determine the actions needed to recover these items; and (3) has not conducted periodic tests to validate that its system is accurately reviewing and approving blanket orders. As a result of these inadequate internal controls, classified spare parts, as well as unclassified items containing military technology, were shipped to foreign countries that may not be eligible to receive them under blanket orders. The Army lacked control edits in its system and allowed the substitution and release of classified spare parts under blanket orders for shipment to foreign countries. The Army and DOD policies prohibit the release of classified spare parts, under blanket orders, to foreign countries. We identified 3 of the 40 requisitions in our review for the period between October 1, 1997, and April 30, 2003, where the Army item manager had released classified parts under 3 separate blanket orders. For these 3 requisitions, the original parts requested were unclassified but not in stock. The item manager substituted 11 classified digital processors for the unavailable parts and then released these parts under blanket orders for shipment to a foreign country. According to Army officials, the foreign countries were not entitled to receive these items under blanket orders. However, according to Army officials, the foreign countries would be entitled to these items because they have the equipment that these classified spare parts support and that these countries could obtain the parts under a different process such as a defined order. Therefore, according to the officials, in this particular case there is no need to retrieve the items. Based on the Army officials' response, we agree with their decision. Until we identified the problem, Army officials at the United States Army Security Assistance Command, who are responsible for implementing, administrating, and managing the Army's foreign military sales program, were not aware that these classified parts had been substituted for the originally requisitioned unclassified parts. Based on our review, the Army has modified the system to validate substituted parts selected by item managers. According to United States Army Security Assistance Command officials, they have no written policy to determine the actions the Army needs to take to recover classified spare parts or unclassified items containing military technology that were shipped to foreign countries that are not eligible to receive them. Army officials indicated that they have procedures to recover items shipped in lieu of the items ordered; however, the procedures do not address the recovery of items shipped that the foreign country was not eligible to receive. During our review, the officials did not agree with us that they should have written procedures in place to recover these items indicating that this responsibility belongs in the foreign military sales end-using monitoring program. They suggested we contact the Department of State and the Defense Security Cooperation Agency for additional information on recovering these items. While the Army may not be responsible for recovering these items, the Army would initially be aware that these items were shipped to foreign countries that may not be eligible to receive them, and could initiate recovery of these items. However, in discussions with officials on a draft of this report, officials indicated their current policies and procedures to recover items shipped in lieu of items ordered need to be modified to include items shipped to foreign countries that may not be eligible to receive them. The Army lacks control edits in its system to prevent the release of some unclassified items containing military technology to foreign countries under blanket orders. As a result, the Army has shipped some unclassified items containing military technology to foreign countries that may not be eligible to receive them. Officials from DOD's Office of the Deputy Under Secretary of Defense Technology Security Policy and Counterproliferation indicated that the Army should have control over unclassified items containing military technology. In addition, the Defense Security Cooperation Agency indicated criteria for releasing these items should be considered on a country-by-country basis prior to releasing any items to a foreign country. The agency also stated that the military departments should use the applicable codes available as a means to help identify spare parts that contain military technology to ensure that the appropriate means are taken and adequate controls are in place to prevent unauthorized releases. Within the 21,663 requisitions for unclassified items containing military technology that were shipped, we found the following requisitions were not identified and reviewed before they were released: (1) 17,175 requisitions were for 381,245 items such as circuit card assemblies, fire control units, and electron tubes that require their inherent military capability to be destroyed or demilitarized prior to their release to the public; and (2) 387 requisitions were for 2,267 items that foreign countries are prohibited from requesting using blanket orders because the spare parts require release authority from inventory control points. Based on our review, the Army had initiated action to modify its system to cancel blanket orders for parts that require release authority from inventory control points. With such a modification, these 387 requests would be canceled. However, the action to modify the system is pending based on the official interpretation of the Army regulation on spare parts that requires release authority from inventory control points. In addition, as previously mentioned, according to United States Army Security Assistance Command officials, the Army has no written policy for recovering classified spare parts and unclassified items containing military technology that were shipped to foreign countries not eligible to receive them. According to Army officials, the foreign countries were entitled to receive these items. Therefore, according to the officials, in these particular cases there is no need to retrieve the items. Based on the Army officials' response, we agree with their decision. In 1991, the Army had a control edit installed in its system that identified requisitions for parts containing military technology for manual review. This control edit caused thousands of requisitions to be referred for manual review. Army documents indicate that it removed the control edit because according to guidance from the U.S. Army Defense Systems Command and System Integration and Management Activity, the parts containing military technology do not require protected storage. Army documents also indicate that removing the control edit that identified requisitions for unclassified items containing military technology would eliminate an enormous number of labor hours required to research these parts. The system does not refer for review those requisitions for items containing military technology because Army officials stated that DOD has determined that these items are not classified, sensitive, or pilferable; consequently, the items should not be subjected to controlled physical inventory requirements. In 1992, DOD changed selected stock numbers from unclassified to a classification indicating unclassified stock containing military technology to ensure that parts requiring demilitarization could be researched if shortages were reported during depot inventory reviews and do not require protected storage. In our earlier review of the Air Force, we reported that the Air Force did not use control edits to prevent spare parts containing sensitive military technology from being released to foreign countries. The Air Force plans to develop criteria for identifying spare parts containing sensitive military technology and establish appropriate control edits in its automated system so that requisitions for spare parts containing sensitive military technology are identified and referred for review. Also, the Air Force uses criteria, such as federal supply class, to restrict the parts available to foreign military sales customers. For example, we reported that the Air Force restricts countries from requisitioning parts belonging to the 1377 federal supply class (cartridge and propellant actuated devices and components) using blanket orders. There are three codes the Army could use to identify spare parts that contain military technology. These codes are (1) the controlled inventory item code, which indicates the security classification and security risk for storage and transportation of DOD assets; (2) the demilitarization codes assigned by the item manager identifying how to dispose items; and (3) the federal supply class code. Demilitarization codes are assigned to spare parts for new aircraft, ships, weapons, supplies, and other equipment. The demilitarization codes also determine whether the items contain military technology and establish what must be done to the items before they are sold. The Army has not conducted periodic tests to validate that its system is accurately reviewing and approving blanket order requisitions and operating in accordance with the Army's foreign military sales policies. GAO's and the Office of Management and Budget's internal control standards require that a system such as the Army's be periodically validated and tested to ensure that it is working as intended and the ability to accurately review and approve requisitions is not compromised. In the Federal Information Systems Controls Audit Manual, which lists control activities for information systems, one of the control activities listed involves the testing of new and revised software to ensure that it is working correctly. Also, in the Management of Federal Information Resources, the manual requires that each agency establish an information system management oversight mechanism that provides for periodic reviews to determine how mission requirements might have changed and whether the information system continues to fulfill ongoing and anticipated mission requirements. Furthermore, the Internal Control Management and Evaluation Tool -- a tool that assists managers and evaluators in determining how well an agency's internal control is designed and functioning -- lists monitoring as one of five standards of internal controls. Internal control monitoring should assess the quality of performance over time and ensure findings from reviews are promptly resolved. Ongoing monitoring occurs during normal operations and includes regular management and supervisory activities, comparisons, reconciliations, and other actions people take in performing their duties. In our review, we found that a foreign country had requested unclassified parts using blanket orders for which the item manager substituted and shipped classified spare parts. According to DOD officials, had the system validated the substituted classified spare parts, the system would have canceled the orders. United States Army Security Assistance Command officials were unaware of this situation until we identified the problem. Also, we found spare parts where the security classification had been changed from unclassified to classified without Army officials being notified of the change. Based on our review, the Army initiated actions to add control edits to its system to (1) validate substituted spare parts before they are released to foreign countries and (2) review monthly supply catalog updates and cancel open blanket orders when spare parts' security classification changes from unclassified to classified. Defense Security Assistance Development Center officials indicated that periodic tests of the Army's system have not been conducted because, in October 1998, the Defense Security Cooperation Agency directed that no additional funds be used to expand the current system. However, Defense Security Cooperation Agency officials stated that this directive does not preclude the Army from periodically testing the system and its logic. According to DOD and Army officials, they have not tested the system's logic for restricting requisitions since 1999 when they initially modified the system to cancel requisitions for classified spare parts under blanket orders. As part of our review, we tested the system by reviewing Army restrictions applied to historical requisitions on classified spare parts and unclassified items containing military technology and found that the system did not always perform as intended. According to Army officials, there have not been any reviews to assess whether the foreign military sales requisition process for items ordered are processed correctly. The Centralized Integrated System for International Logistics system creates daily reports that identify problems with requisitions, which are then reviewed by Army case managers before continuing through the system. While officials indicated several external audits with GAO and the Army Audit Agency have been recently completed, these audits focused on the overall foreign military sales program and not the requisition process. Based on our observations, these audits do not replace a system test to determine whether the current system is in compliance with existing requisitioning policies and procedures. The Army has not maintained effective internal controls over foreign military sales sold under blanket orders. Specifically, the Army lacked control edits in its system and allowed the substitution and release of classified spare parts under blanket orders for shipment to foreign countries that may not be eligible to receive them. Also, the Army lacks control edits in its system to prevent the release of some unclassified items containing military technology to foreign countries. Moreover, the Army has no written policies to determine the actions needed to recover classified spare parts and unclassified items containing military technology that have been shipped to foreign countries not eligible to receive them. Further, the Army failed to periodically test the Centralized Integrated System for International Logistics system. If the Army had conducted tests to determine whether its system was in compliance with requisitioning policies and procedures, some classified spare parts--as well as unclassified items containing military technology--may not have been released to foreign countries under blanket orders. Without adequate internal controls, classified spare parts and unclassified items containing military technology may be released to foreign countries under blanket orders, thereby providing military technology to countries that might use it against U.S. interests. Recommendations for To improve internal controls over the Army's foreign military sales Executive Action program and to prevent foreign countries from being able to obtain classified spare parts or unclassified items containing military technology that they are not eligible to receive under blanket orders, we are recommending that the Secretary of Defense instruct the Secretary of the Army to take the following two actions: Modify existing policies and procedures, after consultation with the appropriate government officials, to cover items shipped in lieu of items ordered to also ensure the recovery of classified spare parts that have been shipped to foreign countries that may not be eligible to receive them under blanket orders. Modify existing policies and procedures covering items, after consultation with the appropriate government officials, to cover items shipped in lieu of items ordered to also ensure the recovery of unclassified items containing military technology that have been shipped to foreign countries that may not be eligible to receive them under blanket orders. To improve the Army system's internal controls aimed at preventing foreign countries from obtaining classified spare parts or unclassified items containing military technology under blanket orders, we are recommending that the Secretary of Defense direct the Under Secretary of Defense for Policy to require the appropriate officials to take the following two actions: Modify the system so that it identifies blanket order requisitions for unclassified items containing military technology that should be reviewed before they are released. Periodically test the system and its logic for restricting requisitions to ensure that the system is accurately reviewing and approving blanket order requisitions. In commenting on a draft of this report, DOD concurred with two of our recommendations and did not concur with the two other recommendations. First, with regard to our recommendation to modify the system so that it identifies blanket order requisitions for unclassified items containing military technology that should be reviewed before they are released, the department concurred. DOD's comments indicated that the Army will comply with making the specific changes to the system that the Defense Security Cooperation Agency identified as required or that the Army would conduct its own study, given the funding and guidance necessary, to identify items that should be reviewed before they are released. Second, with regard to our recommendation to periodically test the Centralized Integrated System for International Logistics, the department stated that the Army will conduct periodic testing of the system and its logic for restricting requisitions, given the funding and guidance necessary to do so. We also received technical comments and we incorporated them wherever appropriate. With regard to our two recommendations to consult with the appropriate agencies to determine what actions the Army needs to initiate in order to recover (1) classified spare parts and (2) unclassified items containing military technology that have been shipped in error, i.e., shipped in lieu of items ordered, under blanket orders, DOD did not concur. The department said that the Army already has procedures in place to recover classified spare parts and unclassified items containing military technology that have been shipped in error, i.e., shipped in lieu of items, ordered under blanket orders. The procedures include (1) systemic status codes that will advise the case manager that an incorrect item is being shipped by the supply center, at which time the error can be corrected; (2) if the item is still shipped, the case manager can begin retrieval actions by contacting the Security Assistance Office in country; and (3) the customer can initiate a Supply Discrepancy Report upon receipt of the incorrect item to return the item. We acknowledge that these procedures might address wrong items shipped. However, they do not address the intent of our recommendations to recover classified spare parts and unclassified items containing military technology shipped to foreign countries that are not eligible to receive them. If the country requested classified spare parts or unclassified items containing military technology that it is not eligible to receive under blanket orders, it will not likely submit a Supply Discrepancy Report if it had intended to order the items. In addition, we interviewed Defense Security Cooperation Agency and Army officials to determine if the procedures they cited in the agency comments are referring to items shipped in lieu of items ordered instead of shipment of items that foreign countries are not eligible to receive. According to the officials, the procedures are for items shipped in lieu of items ordered and not for the recovery of items that the foreign countries are not eligible to receive. As stated in our report, Army officials told us that they had no written procedures in place to recover classified spare parts or unclassified items containing military technology, because it is not within their responsibility to recover these items. These officials stated that this responsibility belongs to the foreign military sales end-use monitoring program, which includes the Department of State and the Defense Security Cooperation Agency. In following-up with officials on their written comments on the draft of this report, they agreed that they need to modify existing policies and procedures covering items, after consultation with the appropriate government officials, to cover items shipped in lieu of items ordered to also ensure the recovery of classified spare parts and unclassified items containing military technology that have been shipped to foreign countries that may not be eligible to receive them. As a result, we have modified our two recommendations accordingly. To assess and test whether the Army's internal controls adequately restricted blanket orders for classified spare parts sold to foreign countries, we obtained current DOD and Army guidance on the foreign military sales programs. We also held discussions with key officials from the United States Army Security Assistance Command, New Cumberland, Pennsylvania, to discuss the officials' roles and responsibilities, as well as the criteria and guidance they used in performing their duties to restrict foreign countries from requisitioning classified spare parts and other items containing military technology under blanket orders. Also, we interviewed the officials on the requisitioning and approval processes applicable to classified spare parts. In addition, we obtained written responses from officials at the Defense Security Cooperation Agency, Washington, D.C., to identify the agency's roles and responsibilities regarding the policies and procedures relevant to the foreign military sales programs. We also interviewed officials from the Defense Security Assistance Development Center, Mechanicsburg, Pennsylvania, to discuss their roles and responsibilities, as well as the criteria and the guidance they used to maintain and oversee the Army's Centralized Integrated System for International Logistics system to restrict foreign countries from requisitioning classified spare parts and other items containing military technology under blanket orders. Furthermore, we interviewed officials to determine the functional and operational controls that are used to validate requisitions entered into the system. To test the adequacy of the Army's internal controls to restrict access to certain unclassified items containing military technology, we obtained DOD and Army guidance on the foreign military sales program. We also reviewed requisitions for unclassified items containing military technology for which the system had approved the shipments under blanket orders. In addition, we interviewed Army officials to obtain their reasons for releasing these items. Also, we obtained records from the United States Army Security Assistance Command on all classified spare parts and unclassified items containing military technology that were purchased using blanket orders and approved for shipment to foreign countries from October 1, 1997, through April 30, 2003. We limited our review to blanket orders because defined orders and Cooperative Logistics Supply Support Agreements specified the parts that countries were entitled to requisition by the national stock number. The records covered 21,703 requisitions for classified spare parts and unclassified spare parts and other items that contain military technology. We tested the system by identifying the 40 requisitions for classified spare parts that were shipped under blanket orders and reviewed the restrictions applied to determine if the system was operating as intended. To assess the Army's internal controls on the release of unclassified items containing military technology, we reviewed 21,663 requisitions for which the system had approved the shipments under blanket orders. Further, we obtained written responses from DOD officials concerning whether unclassified items containing military technology should be reviewed prior to being released to foreign countries. While we identified some issues concerning the appropriate procedures for such items, in all the cases we reviewed, we found that the items had been ordered and shipped from the Army's system. To determine whether the Army periodically conducted tests to validate the system to ensure that it accurately identified for review and approval blanket order requisitions to support foreign military sales, we obtained and reviewed documentation identifying the system tests to determine how often they were conducted. Also, we interviewed Army and DOD officials to determine how periodic reviews and tests were performed on the system. We conducted our review from May 2003 through December 2003 in accordance with generally accepted government auditing standards. As arranged with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from the date of this report. At that time, we will send copies of this report to the Secretary of Defense; the Secretary of the Army; the Director, Office of Management and Budget; and interested congressional committees. We will also make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. Please contact me on (202) 512-8365 if you or your staff have any questions concerning this report. Key contributors to this report were Lawson (Rick) Gist, Jr.; Carleen Bennett; Latrealle Lee; Elisah Matvay; Arthur James, Jr.; and Ann DuBois.

Summary:
From 1993 through 2002, the Department of Defense (DOD) delivered over $150 billion in services and defense articles--including classified spare parts and unclassified items containing military technology--to countries through foreign military sales programs. GAO was asked to review whether the Army's key internal controls adequately restricted blanket orders for (1) classified spare parts and (2) unclassified items containing military technology. GAO was also asked to determine if periodic tests were conducted to validate the Army's system and its logic. The Army's internal controls over foreign military sales are not adequate, placing classified spare parts and unclassified items containing military technology at risk of being shipped to foreign countries that may not be entitled to receive such items under blanket orders. Foreign countries may request items using blanket orders, which are for a specific dollar value and are used to simplify supply actions on certain categories of items. The Army lacked control edits in its system and allowed the substitution and release of classified spare parts under blanket orders for shipment to foreign countries. The Army and DOD policies prohibit the release of classified items, under blanket orders, to foreign countries. GAO identified 3 requisitions in its review, where the item manager released 11 classified digital processors to foreign countries under blanket orders. Because the Army's system did not have control edits in place to validate the substituted parts, classified items were released to foreign countries. Also, the Army has no written policy to determine the actions needed to recover classified items that have been shipped to countries not eligible to receive them. Army officials indicated that the countries were not entitled to receive these items under blanket orders but they could obtain them under a different process; so there is no need to retrieve them, and GAO agreed with their decision. Also, the Army has modified the system to validate substituted parts selected by item managers. The Army lacks control edits in its system to prevent the release of some unclassified items containing military technology requisitioned under blanket orders. Within the 21,663 requisitions that were shipped without a review, GAO found that 387 requisitions were for 2,267 restricted items that foreign countries are prohibited from requesting using blanket orders because the parts require release authority from inventory control points. Also, the Army has no written policies to recover items that have been shipped to countries not eligible to receive them. Army officials said the countries were entitled to request these items, so there is no need to recover the items. The Army has not conducted periodic tests, as required, to validate that its system is accurately reviewing and approving blanket order requisitions. GAO's and the Office of Management and Budget's internal control standards require that a system such as the Army's be periodically tested to ensure that it is working as intended. According to DOD and Army officials, they have not tested the system's logic for restricting requisitions since 1999. Also, the officials stated that the Defense Security Cooperation Agency, in October 1998, directed that no additional funds be used to expand the current system. However, according to the agency, the Army is not prohibited from periodically testing the system.