Entities seeking to do business with DOD may have opaque ownership structures that obscure ownership or control by other entities or individuals. Beneficial Owner For the purposes of this report, we define a beneficial owner as the natural person or persons who directly or indirectly own and control, or receive substantial economic benefit from, a company. As the number of layers of ownership increases, ownership information becomes more opaque, as shown in figure 1. This opacity can make it difficult for DOD to determine which entities and individuals ultimately own or control its contractors. In the United States, no centralized information source or national registry maintains company ownership information. In 2014, the National Association of Secretaries of State found that most states collect minimal ownership data. The association reviewed key information collected by the 50 states and the District of Columbia during the entity-formation process and in annual or periodic reports. During both the entity-formation process and in annual or periodic reporting, the association found that very few states collect some form of entity ownership or control information from limited liability companies or corporations. The Securities and Exchange Commission collects some ownership information on publicly traded companies. Any person or group of persons that acquires beneficial ownership of more than 5 percent of a publicly traded company’s registered voting securities must register with the Securities and Exchange Commission. Institutional investment managers regularly disclose their holdings, and company officers, directors, and holders of more than 10 percent of a class of the company’s registered equity securities must file a statement of ownership with the Securities and Exchange Commission. GSA’s SAM is a federal government-wide database for vendor data that is used across all federal agencies. Any entity that wishes to do business with the government must register in SAM to be eligible to receive a contract award, except in specific circumstances outlined in the law and FAR. To increase procurement transparency and traceability, and broaden the government’s ability to implement fraud-detection technologies, the FAR was amended to begin requiring entities that wish to do business with the federal government to provide additional ownership information through the annual registration process in SAM starting on November 1, 2014. The required ownership information includes the “immediate” and “highest” level ownership of an offeror, as shown in figure 2 below. The FAR includes a requirement for ownership to be provided at the entity level. There is no requirement for offerors to report their beneficial owners. The FAR contains several provisions governing the selection of an offeror. Provisions such as price and past performance of the offeror are generally applicable in determining which offeror should win a contract. Additional requirements may apply to certain types of procurements, such as the procurement of national security systems. We outline several of the relevant FAR provisions; however, this does not represent a comprehensive list of all steps required by the FAR in making contract- award decisions. A prospective contractor must affirmatively demonstrate its responsibility, including, when necessary, the responsibility of its proposed subcontractors. Contracting officers must then determine the responsibility of prospective contractors, including whether prospective contractors can perform the terms of a contract. To be determined responsible, a prospective contractor must have adequate financial resources to perform the contract (or the ability to obtain them); be able to comply with the required delivery or performance schedule; have a satisfactory performance, integrity, and ethics record; have the necessary organization, experience, accounting and operational controls, and facilities to carry out the contract (or the ability to obtain them); and be otherwise qualified and eligible to receive an award under applicable laws and regulations. Before awarding a contract over the simplified acquisition threshold (generally $250,000 at the time of our review), a contracting officer must review the prospective contractor’s performance and integrity information available in the Federal Awardee Performance and Integrity Information System (FAPIIS). FAPIIS is a federal government-wide database designed to assist contracting officers with making a responsibility determination by providing integrity and performance information of covered federal agency contractors and grantees. FAPIIS provides a prospective contractor “Report Card” that includes information pertaining to the prospective contractor’s past performance (if applicable), such as any administrative agreements, contract terminations, nonresponsibility determinations, and exclusions, among other things. It also includes the ability to view the company relationship information, which details the ownership information that prospective contractors are required to report in SAM. When making a responsibility determination, the contracting officer must consider all the information available through FAPIIS with regard to the prospective contractor and any immediate owner, predecessor (an entity that the prospective contractor replaced by acquiring assets and carrying out affairs under a new name), or subsidiary identified for that prospective contractor in FAPIIS. The contracting officer must document in the contract file how the information in FAPIIS was considered in any responsibility determination, as well as the action that was taken as a result of the information. DCMA can play a role in supporting contracting officials in making responsibility determinations. For example, DCMA officials stated that they may provide information on a company’s business systems, financial capabilities, and company history, and assess whether the prospective contractor is likely to stay in business for the duration of the contract. When assessing the capacity to perform a contract, DCMA officials stated they examine company assets as a whole, including any parent company, to make a determination. According to officials, DCMA’s goal for identifying the organizational structure is to determine whether the company as a whole has the assets to perform the contract rather than to identify fraud or other risks that may be associated with that company. The level and type of support that DCMA provides to contracting officials depends on the particular needs of contracting officials for any given procurement. Some contracts require contractors to comply with cost- accounting standards and submit disclosures of their cost-accounting practice to show from which specific business units they receive allocations and to which specific business units they pass allocations; however, these disclosures are only required after a contract that is covered by cost-accounting standards is awarded. Contract award decisions are based on evaluation factors and significant subfactors that are tailored to the procurement, at the discretion of procurement officials. At a minimum, these factors must include: price/cost, quality, and past performance. Federal law grants DOD additional authority to use public and nonpublic information to make source-selection decisions when acquiring national security systems. DOD may exclude an offeror if necessary to protect national security by reducing supply-chain risk. Under this authority, DOD does not have to disclose the reason an offeror was excluded, nor can the offeror protest DOD’s decision. The FAR requires contracting officers to purchase supplies and services from responsible sources at fair and reasonable prices. For negotiated contracts, price reasonableness is ordinarily established by adequate competition, such as when there are more than two responsible offerors competing independently. For noncompetitive purchases with only one offeror, the contracting officer must obtain certified cost or pricing data, or data other than certified cost or pricing data, as necessary to establish a fair and reasonable price. Procurements with only one offeror may still be considered competitive if there was a reasonable expectation that two or more responsible and independent offerors would submit offers and the offeror submitted the offer with the expectation of competition. Section 841 of the 2015 National Defense Authorization Act grants DOD and other federal agencies the authority to limit contracts with entities that provide funds to a person or group that actively opposes U.S. or coalition forces involved in a contingency operation in which members of the armed forces are actively engaged in hostilities. It also allows agencies to terminate for default, void, or restrict the award of a contract to any contractor that provides funds received under a federal contract directly or indirectly to entities actively opposing U.S. forces engaged in hostilities. Fraud and “fraud risk” are distinct concepts. Fraud involves obtaining something of value through willful misrepresentation and is challenging to detect because of its deceptive nature. Fraud risk exists when individuals have an opportunity to engage in fraudulent activity, have an incentive or are under pressure to commit fraud, or are able to rationalize committing fraud. When fraud risks can be identified and mitigated, fraud may be less likely to occur. According to federal standards and leading practices, executive-branch agency managers are responsible for managing fraud risks and implementing practices for combating those risks. Federal internal control standards call for agency management officials to assess the internal and external risks their agencies face as they seek to achieve their objectives. The standards state that, as part of this overall assessment, management should consider the potential for fraud when identifying, analyzing, and responding to risks. In July 2015, GAO issued its Fraud Risk Framework, which provides a comprehensive set of key components and leading practices that serve as a guide for agency managers to use when developing efforts to combat fraud in a strategic, risk-based way. The Fraud Risk Framework consists of four components to effectively manage fraud risk: Assess, Design and Implement, Evaluate and Adapt, and Commit. The Assess component calls for federal managers to plan regular fraud risk assessments and to assess risks to determine a fraud risk profile. Identifying fraud risks is one of the steps included in the Fraud Risk Framework for assessing risks to determine a fraud risk profile. The fraud risk profile supports the development of a strategy to mitigate fraud risks. The Fraud Reduction and Data Analytics Act of 2015 (FRDAA), enacted in June 2016, requires the Office of Management and Budget to establish guidelines for federal agencies to create controls to identify and assess fraud risks and to design and implement antifraud control activities. The act further requires the Office of Management and Budget to incorporate the leading practices from the Fraud Risk Framework in the guidelines. In July 2016, the Office of Management and Budget published guidance about enterprise risk management and internal controls in federal executive departments and agencies. Among other things, this guidance affirms that managers should adhere to the leading practices identified in the Fraud Risk Framework. The act also requires federal agencies to submit to Congress a progress report each year for 3 consecutive years on the implementation of the controls established under the Office of Management and Budget guidelines, among other things. Recent GAO work examined federal agencies that are subject to FRDAA, including DOD, and found that 85 percent of those agencies have started planning and 78 percent have started implementing efforts to meet FRDAA requirements; however, the majority of these efforts were characterized as not being mature. Maturity was determined by agency responses to a survey question that asked whether the agency’s status of implementing FRDAA requirements was “not started,” “started but not mature,” or “mature.” The report identified the number and percentage of agencies that fell into each of these status categories, but did not state the level of maturity for any individual agency. Contractors with opaque ownership structures can pose a range of financial and nonfinancial fraud and national security risks to DOD by misrepresenting or concealing company ownership information to commit fraud against the government or to do harm to U.S. national security concerns. We identified multiple types of fraud and national security risks by examining 32 cases for fraud involving DOD contractors that were adjudicated or settled from calendar years 2012 through 2018 and conducting interviews with knowledgeable DOD officials and criminal investigators. There may be additional risks and cases related to contractor ownership that are not identified below. Court cases we identified were investigated by DOD and other entities based on, for example, information from whistleblowers, defective parts received by DOD, lawsuits involving contractors, and U.S. government officials determining they were receiving false contractor information. As discussed later in this report, DOD has not systematically assessed risks posed by contractor ownership; therefore the magnitude and prevalence of the risks we identified are not known. Appendix II of this report contains a complete listing and additional details of the 32 cases we identified. Contractors can use opaque ownership structures for illicit financial gain through a variety of methods, as described below. Concealing relationship with subcontractor to inflate prices. Contractors can subcontract with companies they own or control to inflate prices for financial benefit. For example, in a 2014 federal court case we examined, a contractor and another company with common ownership pled guilty to major fraud against the United States. They agreed to pay $434 million in criminal penalties and to settle a lawsuit in connection with concealing their relationship with a subcontractor that the contractor directed to fraudulently mark up costs on items that the contractor purchased and resold to DOD. Specifically, the contractor purchased goods from a company that its owners created, controlled, and used to make the fraudulent markups appear legitimate. Further highlighting the relationship between the company and the contractor, contractor personnel were also responsible for hiring individuals to work for the subcontractor. The contractor billed the government an artificially high price for the goods from July 2005 through April 2009 and resulted in a loss to DOD of $48 million. Figure 3 below illustrates this scheme to conceal ownership and fraudulently inflate prices. Billing for work not performed. Contractors or subcontractors can bill for work not performed by creating fictitious invoices that add costs to a contract. For example, in four court cases we examined, multiple DOD subcontractors were actually shell companies that did not have the inventory they purported to ultimately provide to the government or perform the work indicated in the contract requirements. According to documents filed in U.S. district court, some of these subcontractors hired other companies to perform work, but created additional invoices that added costs for work the subcontractors did not perform. These additional costs were then passed on to DOD. Disguising conflicts of interest. Contractors or subcontractors can conceal conflicts of interest for financial benefits. We identified a case involving a DOD subcontractor that concealed ownership for illicit financial gain. According to court records, a DOD contractor employee and his spouse formed a company and concealed their interests by not listing their names but listing the names of family members on formation documents. This company became a subcontractor to the company that employed the DOD contractor. The contractor employee, in his official position, wrote letters justifying awards of purchase orders to the subcontractor he owned and approving recommendations that the awards be made to the subcontractor. The co-owner of the subcontractor concealed her involvement by signing contracts using a different name, knowing that the use of her real name could reveal the DOD contractor employee’s ownership of the subcontractor and affect the awards. Creating the appearance of competition on a contract to inflate prices. In our review of 32 cases, we also identified the potential risk of companies creating the appearance of competition by submitting bids from fictitious companies. Specifically, we identified one case that involved a DOD contractor whose executives admitted as part of their plea agreements to creating fictitious, inflated bids that were not from actual businesses to ensure that the contractor’s own bid would be selected by DOD as the supposed lowest. In this instance, the contractor was required to obtain at least two competitive bids for certain services and items and provide the bids to DOD for selection. As part of their plea agreements, the individuals involved with the scheme also admitted that the scheme allowed the contractor to control and inflate the prices charged to DOD without any true, competitive bidding, as required. The contractor also fraudulently inflated invoices that were sent to DOD, and two individuals involved in the scheme admitted they were aware of losses to DOD of at least $34.8 million. Court records state that the scheme took place from 2011 to 2013. In 2017, two contractor executives involved with this scheme were sentenced to prison for 70 and 46 months. Additionally, we identified additional cases involving this contractor and its owner bribing government officials in exchange for the approval of fraudulent invoices, steering contracts, and covering up the contractor’s overcharging practices, which has led to at least 22 individuals pleading guilty. Additionally, DOD officials from Defense Pricing and Contracting and DLA identified the risk of different companies concealing common ownership to create the appearance of competition on a solicitation and attempt to inflate prices. By analyzing a subset of DOD solicitation data, we further examined the risk that contractors could disguise their ownership to create the appearance of competition. We identified potential relationships among the offerors of solicitations that could indicate common ownership. Our analysis of responses to approximately 2,700 solicitations in the Federal Business Opportunities (FBO) website from fiscal years 2015 through 2017 found indications that at least 16 offerors were potentially related to at least one other offeror when bidding on the same solicitation. This analysis shows indications that offerors may not always compete independently and the relationship among offerors is not always readily apparent to contracting officials or disclosed in SAM registration information. Specifically, we identified the following types of potential relationships among offerors. Offerors who shared the same management. We identified two offerors who each submitted bids on the same three solicitations and also shared the same mailing address and point-of-contact address, including suite number. According to the companies’ websites, the owner (who was also the President and Chief Executive Officer) for one offeror was the President and Chief Executive Officer of the other offeror. Further, both companies shared the same management team and neither company had reported any ownership information in SAM. According to DOD contracting officials, no additional information was disclosed to the contracting office for these offerors, nor were they otherwise aware of the potential relationship. Figure 4 below shows an example from one solicitation. Offerors who were potentially related to an entity excluded from doing business with the government. We identified two offerors who were potentially related to a third offeror who was actively excluded from doing business with the government. One of these offerors bid together with the excluded offeror on eight solicitations. Figure 5 below shows an example of one solicitation. In addition, a third potentially related offeror was identified as sharing information with one of these offerors who later bid together on a ninth solicitation. For one of the nine solicitations, one of the offerors potentially related to the excluded company was awarded a contract. According to DOD contracting officials, no additional information was disclosed to the contracting office for these offerors, nor were they otherwise aware of the potential relationship. Offerors who shared other information. We identified 11 offerors who shared other information with at least one other offeror when bidding on the same solicitation. In some instances, these potentially related offerors bid on multiple solicitations. For example, we found two potentially related offerors bid together on three separate solicitations in our FBO data. We further examined these 11 potentially related offerors’ SAM registration information to determine whether they reported shared ownership in SAM, and found one instance in which two of the potentially related offerors self-reported their relationship that one offeror owned the other; the remaining nine offerors did not report any type of shared ownership information in SAM. According to DOD contracting officials, none of the nine offerors disclosed a relationship with another offeror nor was the contracting officer otherwise aware of the potential relationship. While sharing certain information does not definitively confirm they are owned by the same entity, it is an indicator that these offerors are related. Figure 6 below highlights an example in which two offerors bidding on the same solicitation shared information and did not report shared ownership in SAM. Additionally, we identified an instance in which this type of information was also shared between two offerors and a subcontractor for a third offeror, as shown in figure 7 below. The potentially related offerors we identified did not appear to affect the overall competition on these contracts because other, seemingly unrelated offerors also submitted bids. As a result, it is unlikely that they would have affected the price paid by the government in these contracts. However, these potentially related offerors represent a risk that offerors may not always be competing independently and these types of relationships may not always be readily apparent to contracting officers, which is important when evaluating the sufficiency of competition on a solicitation and the independence of its offerors. Further, contractors may not always be forthcoming in reporting their ownership information in SAM, which can affect other areas of the procurement process, including any procedures that rely on the accuracy of this information. Contractors can pose nonfinancial fraud risks to DOD by concealing their ownership structure to bid on and obtain contracts that they are not eligible to receive. These nonfinancial risks may not pose a direct financial cost to DOD, but they can allow ineligible companies to contract with DOD while potentially denying eligible companies from contracting with DOD. As discussed below, these risks can also lead to additional vulnerabilities. In our review of 32 cases, we identified DOD contractors that concealed their ownership information to obtain contracts set aside for particular types of businesses, to obtain contracts only intended for domestic companies, and to circumvent debarment by the government. Set-Aside Contract Eligibility. Contractors with opaque ownership structures can pose the risk that government contracts set aside for small businesses are awarded to ineligible companies. Ineligible contractors could take advantage of Small Business Administration set-aside programs that allow small businesses that are owned by service-disabled veterans, women, minorities, or economically and socially disadvantaged individuals to receive government contracts specifically set aside for these types of businesses. Of the 32 cases we reviewed, we identified 20 cases in which DOD contractors or DOD contractor employees were found guilty, pled guilty, or settled with the government for representing themselves as eligible to receive set-aside contracts. These contractors falsified self-reported information and made false certifications to the government to claim eligibility by using eligible individuals as figurehead owners. In these cases, the figurehead owners did not actually maintain the level of beneficial ownership or control of the contractor required by federal regulations, or the contractors simply used the names of eligible individuals when communicating with the government to bid on and win contracts. For example, we identified one case that involved two DOD contractors participating in a single scheme to misrepresent their common ownership and obtain over $200 million in awards that they were not eligible to receive. One of the contractors that fraudulently obtained set-aside contracts claimed it was owned by a service-disabled veteran; however, that veteran had virtually no involvement with the contractor. The other contractor claimed to be owned by an economically disadvantaged individual who worked full-time for another entity and did not control the contractor. These contractors were not eligible to receive the set-aside contracts because they were not at least 51 percent controlled by the eligible individuals and the eligible individuals did not make long-term decisions for the companies. Rather, the contractors were controlled by an ineligible individual who owned and controlled a separate company that actually performed work on the set-aside contracts. To obtain government contracts set aside for companies owned by economically and socially disadvantaged individuals, the qualifying individuals must also control the majority of the company and make day- to-day decisions. Figure 8 below, which is based on an actual case, illustrates how ineligible contractors can obtain and receive government funds on contracts intended for Service-Disabled Veteran–Owned Small Businesses. Domestic Contractor Eligibility. Contractors with opaque ownership structures can also pose the risk of circumventing eligibility requirements for contracts that are only designated for domestic companies, which can lead to other vulnerabilities that affect warfighter readiness. Of the 32 cases we reviewed, we identified four cases in which individuals created domestic shell companies for foreign manufacturers and bid on contracts designated for domestic companies. In three of the four cases, the individuals behind the shell companies also had ownership interests in the foreign manufacturing companies. Foreign manufacturers received payments from the contracts, despite the contracts only allowing domestic manufacturers to be eligible, and one such manufacturer ultimately supplied DOD with defective and nonconforming parts that led to the grounding of at least 47 fighter aircraft. In multiple instances, another ineligible contractor supplied parts that were unusable due to design flaws and nonconformities. Three of these companies also exported military technical drawings and blueprints to foreign countries in violation of the Arms Export Control Act. Figure 9 below, which is based on an actual case, illustrates a contractor acting as a shell company and misrepresenting foreign manufacturing. Circumventing Debarment. Individuals that have been debarred, or prohibited from conducting business with the federal government, can circumvent their debarment by concealing their ownership in new companies that were created for the sole purpose of continuing to conduct business with the government. Of the 32 cases we reviewed, we identified one conviction of an individual who was debarred from 2013 to 2016 for supplying defective parts to DOD. This individual created three shell companies and concealed his beneficial ownership and control of these companies by omitting his name from communication with DOD and using fictitious names and names of family members as company officials. These three shell companies continued to provide defective and nonconforming parts to DOD, and the debarred individual received approximately $2.8 million in payments from DOD from May 2013 to June 2016. DOD officials we spoke with and published DOD research have identified the risk of contractors disguising company ownership as an enabler to do harm to national security interests. Contractors fraudulently misrepresenting themselves to DOD could actually be operated by adversaries seeking to act against the government’s interests. Foreign- owned contractors can conceal ownership information when registering in SAM, which allows contractors to self-attest ownership information. For example, in addition to the 32 cases we identified through our review, we also identified a bid protest filed with GAO challenging a contract award made to a foreign-owned DOD contractor in fiscal year 2018 that prohibited the participation of foreign firms or domestic companies under foreign ownership, control, or influence. This contractor did not disclose its foreign ownership or control in SAM or to DOD, as required by the FAR and the solicitation. As a result of the bid protest, DOD subsequently terminated the contract later in fiscal year 2018 after confirming the foreign ownership with the contractor. DIA and DLA officials stated that adversarial foreign governments or other malicious entities, such as companies attempting to access sensitive government information, could access sensitive systems to conduct sabotage or surveillance. These entities could infiltrate DOD’s supply chain to introduce components, such as circuit-board chips and routers modified to fail, facilitate state or company espionage, or compromise the integrity of DOD’s information-technology systems. According to CIO officials, adversarial entities could also potentially gain access to sensitive information through their relationship with DOD contractors. For example, DIA officials identified the possibility of foreign or adversarial entities exploiting companies in DOD’s supply chain with financial difficulties, and according to CIO officials, DOD may not always have visibility over foreign entities acquiring a domestic contractor. In 2017, the Office of the Director of National Intelligence released a management background paper discussing supply-chain risks, which stated that the multiple layers and networks of suppliers in this chain can allow foreign adversaries the ability to access the supply chain at multiple points. For example, according to the background paper, a hostile foreign intelligence entity could potentially conceal its presence in government supply chains by operating through multiple front organizations, companies, hackers, and organized crime, making it extremely difficult to discover and counter its actions. The paper also states that adversaries may be able to penetrate the supply chain to access sensitive research and development programs, steal intellectual property and personally identifiable information, insert malware into critical components, and mask foreign ownership, control, or influence of key providers of components and services. Furthermore, in April 2018, the U.S.-China Economic and Security Review Commission issued a report identifying a supply-chain threat to U.S. national security that stems from products produced, manufactured, or assembled by entities that are owned, directed, or subsidized by national governments or entities known to pose a supply- chain or intelligence threat to the United States. DOD officials have also identified an additional risk of contracting with companies that have opaque ownership structures. For example, a 2017 Defense Contract Audit Agency report to Congress described the risk of individuals receiving government contracts or gaining access to government installations who would harm deployed troops. Officials we spoke with from the Joint Staff Logistics Directorate also acknowledged the risk that government funds could be provided to contractors owned by a person or entity that is actively opposing U.S. or coalition forces involved in a contingency operation in which service members are actively engaged in hostilities. These adversaries can potentially use opaque ownership structures to disguise their ownership and contract with the government in areas involved in contingency operations, such as Iraq or Afghanistan, to fund their operations or gain access to military bases. DOD has taken steps that could address some fraud and other risks related to contractor ownership in the procurement process. It has not yet conducted a department-wide assessment of these risks or identified them as a risk area for assessment in its development of a fraud risk management program in accordance with federal internal control standards and leading practices, however. As mentioned previously, DOD and other federal agencies revised the FAR in 2014 to collect some contractor ownership information. DOD has also begun to consider contractor ownership to address national security risks, including identifying and using contractor ownership information as part of its supply-chain risk analysis in the procurement of national security systems and critical components, avoiding contracting with the enemy, and determining whether contractor facilities can be cleared to access classified materials. Although DOD has taken these actions, it faces a number of challenges in identifying and verifying contractor ownership. To assist the department and its components in identifying and assessing fraud risks, DOD has also begun a department-wide fraud risk management program. As it develops a fraud risk assessment across the department, DOD has opportunities to systematically assess risks related to contractor ownership as part of this larger effort. This fraud risk assessment, if used to inform the development of a risk-based antifraud strategy, could enhance the effectiveness of managing fraud risks for DOD, including those related to contractor ownership. DOD, GSA, and the National Aeronautics and Space Administration amended the FAR in May 2014 to require prospective contractors to self- report their immediate and highest-level entity owner, but not their beneficial owner, as part of contractors’ annual registration process in SAM. The agencies added the requirement to support the implementation of business tools to help track contractor performance issues across corporations as well as to improve supply-chain transparency and integrity efforts, among other reasons. According to DOD procurement policy officials, the intent is that the ownership information would be made available in FAPIIS for contracting officers to help identify past-performance issues across corporations to aid with responsibility determinations. The FAR requires contracting officers to consider all relevant information available in FAPIIS when making responsibility determinations, but, according to DOD procurement policy officials, there is no requirement to document whether and how ownership information is considered. According to DOD procurement policy officials, contracting officers’ general focus in the responsibility determination process is largely centered on whether the contractor is financially solvent, has the ability to carry out the contract, and has satisfactory past performance. DOD procurement policy officials said that they did not want to be too prescriptive in directing contracting officers on the use of this information, and therefore have not developed policies or procedures or provided training on how to specifically use the ownership information collected. According to these officials, DOD has not historically considered contractor ownership structures in the responsibility determination process, nor has the agency been aware of the extent to which such structures could pose a range of risks. As discussed below, conducting a department-wide assessment of risks posed by contractor ownership—an action that DOD has not yet taken—would be a key first step for the department before developing such policies and procedures. Within DOD, DLA has taken steps that could address some risks posed by contractor ownership. First, according to procurement officials, DLA provides its contracting officials with a “contractor responsibility matrix,” which outlines mandatory, recommended, and optional steps to take when making a responsibility determination for procurements both below and above the simplified acquisition threshold. Among the steps included, DLA requires contracting officials to review contractors’ attestations to ownership or control by a foreign government to determine whether the prospective contractor is qualified and eligible to receive an award. It also recommends contracting officials obtain responsibility information from other sources, including an internet search of the company’s reviews, and its owners and principals. This step is listed as optional for existing contractors. Further, DLA’s contracting officers are required to review the Defense Contractor Review List to identify any past-performance information. The Defense Contractor Review List is an internal tool used by DLA that is designed to monitor fraud, waste, and abuse for commercial entities and military unique items. The system is designed to allow DLA to identify and communicate information on its contractors, such as performance ability, delinquency information, suspension and debarment information, and various types of notes that may be relevant to contract performance or procurement decisions. DLA officials told us the Defense Contractor Review List can be used to communicate information or risks about contractor ownership. The Defense Logistics Acquisition Directive requires DLA contracting officers to review any Special Attention Reason Codes in the Defense Contractor Review List and comply with its associated Special Attention Treatment Codes when making responsibility determinations. The Special Attention Reason Codes describe the basis for being on the list and the Special Attention Treatment Codes provide recommended actions to contracting officers for mitigating risk. According to DLA officials, contractor ownership information is generally not identified in the Defense Contractor Review List. Nevertheless, ownership information may be included in the documentation if, for example, the contracting officer identifies that two or more companies appear to be related or in cases in which there may be suspected collusion. DOD has taken steps in other areas to use contractor ownership information to address risks in specific types of procurements, including those involving national security systems. For example, DOD has taken steps to address national security concerns related to contractor ownership, including conducting threat assessments to identify risks related to supply chains for critical components and national security systems. DOD has also taken steps to identify contractor ownership information to avoid contracting with the enemy, and to address foreign ownership, control, and influence in contracts involving classified information. DOD has outlined policies and procedures in some, but not all, of these areas. As discussed below, conducting a department-wide assessment of risks posed by contractor ownership—an action that DOD has not yet taken—would be a key first step for the department before fully developing such policies and procedures. Steps taken to use ownership information to address supply chain risks. DOD has taken some steps to identify and consider contractor ownership to address supply-chain risks. For example, DIA considers contractor ownership information when conducting threat assessments as part of its supply-chain risk analysis for procurement of national security systems and critical components, according to DIA officials. Specifically, DOD is able to use public and nonpublic intelligence information to exclude sources that present risks of an adversarial foreign government or other malicious entities infiltrating DOD’s supply chain and stealing information or compromising government systems. DIA officials told us that, as part of this supplier- related threat assessment, they identify and consider ownership information along the supply chain, including beneficial-ownership information. The guidelines in Intelligence Community Standard 731-02 state that a supply-chain threat assessment for a procurement item determined to be mission-critical should at a minimum include information on the contractor’s parent company, ultimate parent company, and subsidiaries. However, the guidance does not specify whether this ownership and related company information is to be independently verified or whether it relies on the contractor self-attestations in SAM. According to the guidance, supply-chain threat assessments should also include, at a minimum, information on the contractor’s key management personnel, such as members of the board of directors, officers, general partners, and senior management officials. The guidance does not mention, however, identifying beneficial owners or those who do not have direct control over a contractor but derive substantial economic benefit from it. Steps taken to use ownership information to address legal provisions against contracting with the enemy. Officials from the Joint Staff Logistics Directorate responsible for DOD’s vendor vetting program told us that contractor ownership information, including beneficial ownership, may be identified as part of the intelligence information gathered on vendors by combatant commands to ensure that money is not flowing to contractors owned by a person or entity that is actively opposing U.S. or coalition forces involved in a contingency operation in which service members are actively engaged in hostilities. According to these officials, DOD has not established department-wide policies or procedures to implement reviews of contractor ownership during the process of vetting vendors, but it is something the department is currently developing. These officials stated that a vendor threat-mitigation working group discusses how to close gaps in information sharing among the intelligence, procurement, and operations communities. Officials also noted some challenges. Although contracting officers are responsible for determining the responsibility of vendors and whether vendors can perform the terms of a contract, the information that may be available to contracting officers and the actions that they can take are not always clear. For example, the officials we spoke with mentioned concerns that contracting officers are not always able to access or act on intelligence information. GAO recently completed a review of this program in a classified report. Steps taken to address ownership risks in contracts involving classified information. DOD has taken steps to address risks posed by contractor ownership as part of the Facilities Clearance Process. DOD uses the Facilities Clearance Process to determine whether a contractor is eligible to access classified information. DOD has developed written policies and procedures for how contractor ownership, including foreign ownership, control, and influence, is to be investigated and addressed. As part of this process, Defense Security Service (DSS) guidance instructs its officers to identify key management personnel and to assess the risks they pose for possible foreign ownership, control, or influence. DSS guidelines indicate that key management personnel include company officers, directors, and members of a limited liability company, among others. Some key management personnel, such as members of a limited liability company, may also be the owners. According to DSS officials, beneficial owners who benefit financially but do not partake in active management may be identified as key management personnel as part of the clearance process, depending on various factors including the percentage of ownership. As an example, DSS officials stated that an individual who owns 50 percent of a company would not be able to purport that he or she does not control the company. According to the DSS guidance, if foreign ownership, control, or influence is found, mitigation agreements can be put into place to reduce the risk. DOD officials identified a number of challenges in identifying and verifying contractor ownership, especially if the contractor is actively seeking to misrepresent its ownership. For example, verifying contractor ownership can be challenging because state governments determine the type of information collected during company formation and, as discussed earlier, most states collect minimal ownership information as part of this process. As described earlier, there is no centralized information source or registry on company ownership information in the United States. As a result, contracting officers could face challenges in time-consuming efforts to verify contractor ownership. Further, DOD procurement policy officials stated that workload and resource constraints limit the extent to which they can verify contractor ownership. The nature of ownership information submitted during the SAM registration process also presents challenges to any verification efforts conducted by contracting officers. The ownership information submitted in SAM is self-reported by the prospective contractor, and therefore relies on the contractor to honestly report such information. DOD officials told us that, for most procurements, with the exception of those involving classified work or other national security concerns, this information is not verified. A related limitation involving SAM ownership information is that contractors must provide information on the immediate and highest-level entity owners and are not required to report beneficial-ownership information, that is, on the natural person or persons who own or control, or benefit financially from, the company. Lastly, while the SAM ownership requirement provides some transparency at the prime-contractor level, it does not provide transparency at the subcontracting levels below the prime contractor. Subcontractors are not required to register in SAM and, therefore, are not required to report their ownership. Consequently, DOD generally does not have insight into the ownership of its subcontractors. DOD procurement policy officials noted that this poses particular challenges in identifying fraud and other risks to the supply chain. For example, the contractor itself may not pose a risk; but that does not guarantee that the contractor’s suppliers do not pose fraud or other risks. DOD procurement policy officials told us that it would be helpful to require subcontractors to register in SAM and report their ownership. This requirement would be an additional burden on contractors, however, and would need to be balanced with the potential benefit of being able to identify problem actors. Another challenge involves the use of publicly available ownership information, including commercially available data services, by contracting officers to help identify contractor ownership. Depending on how a company is structured, there may be no publicly available ownership information. Furthermore, DOD procurement policy officials told us that public information, including ownership information, could be inaccurate or outdated and potentially expose the department to bid protests from the contractor. Therefore, any external or supplemental information used that was not part of the contractor’s submission would need to be vetted by the contractor before using it. These officials said that DOD would need to come up with an efficient process to inform the prospective contractor of the additional information and provide due process to allow it the opportunity to refute any information obtained. Additionally, DOD procurement policy officials noted that another difficulty with using a commercial tool to determine ownership is the volume of contracts processed by contracting officials, which amounted to over 570,000 new contracts in fiscal year 2018. For sensitive procurements in which DOD has the authority to use both public and nonpublic information (for example, those involving national security systems or classified work), DSS officials stated that the process of identifying and verifying ownership is lengthy, particularly with complex ownership. In some instances, it has taken DSS 1 to 2 years to resolve issues that have arisen when clearing contractors’ facilities for access to classified materials. In addition, DSS officials mentioned that the many different types of business structures, including new structures that DSS comes across, create challenges for identifying ownership. According to DIA officials, it is significantly easier to identify the beneficial owner of publicly traded companies than privately owned companies. DSS officials also mentioned that it is difficult and resource-intensive to monitor changes to contractor ownership, particularly given that they monitor 13,000 facilities. According to DOD procurement policy officials, DOD would need to determine which contracts require additional research into contractor ownership and which office would be responsible for conducting the research. Officials noted that DOD does not currently have the resources in place to focus on these kinds of activities because contracting officers are already operating in a constrained environment with limited resources, lacking the time, resources, or training they need to conduct in-depth reviews or analysis of the ownership aspects of a particular company. According to these officials, DOD should dedicate staff and funds to resolve this problem, including bringing in people with data- analysis and data-mining skillsets to learn from private-sector companies and organizations that already conduct vendor ownership-related risk assessments and data analytics. DOD procurement policy officials identified that another strategy to address opaque ownership structures would be to require contractors to report additional ownership information, such as beneficial-ownership information, when registering to do business with the federal government in SAM. However, the officials also noted that, previously, both public- sector organizations and private companies have resisted requirements to provide additional ownership information, due in part to the difficulty in defining ownership. Additionally, regulatory trends within government contracting have generally focused on easing the burden to do business with the government. New requirements to provide additional information may be viewed as an additional burden. A selected group of companies that contracted with DOD in the last 5 years provided us with mixed views on the potential burden of providing additional ownership information. Most small-business contractors we contacted told us that an additional beneficial-ownership reporting requirement would pose little to no further burden on them. In contrast, both of the large, publicly traded companies that similarly contracted with DOD expressed concerns about the complexity and difficulty of reporting their beneficial ownership. One large company noted that beneficial ownership would need to be more narrowly defined for it to determine the resulting regulatory burden. DOD has taken steps to conduct a department-wide fraud risk management program designed to identify and assess fraud risks. According to DOD’s Fraud Risk Management Pilot Program Instructions, in 2017 DOD began efforts to design, implement, and operate an internal control system that addresses fraud risks and to comply with requirements established by FRDAA. As mentioned earlier, FRDAA created requirements for agencies to establish financial and administrative controls for managing fraud risks. FRDAA also requires agencies to report their progress identifying risks and vulnerabilities to fraud affecting payroll, beneficiary payments, grants, purchase and travel cards, and large contracts. As part of this implementation process, and to test the development of its fraud risk management program, DOD conducted a fraud risk management pilot program in 2018 by selecting four components to identify fraud risks, assess controls they have in place to mitigate these risks, and develop mitigation plans, as appropriate. According to DOD, the pilot program was designed to assist DOD and its components in the development of a department-wide fraud risk management program by identifying and assessing fraud risks in a manner that is aligned with the leading practices within GAO’s Fraud Risk Framework. To prepare for this pilot program, in 2017, the Office of the Under Secretary of Defense (Comptroller) (OUSD) conducted a survey requesting that 66 DOD components determine the extent and maturity of control activities currently in place related to the prevention, detection, and response to fraud. The survey asked components to provide, among other things, information on any antifraud programs, key fraud risks identified, and processes for identifying, responding to, and monitoring risks. The responses from the 41 responding components were scored to determine their fraud program maturity. According to DOD’s Fraud Risk Management Pilot Program Instructions, the results of this survey were also used to identify potential vulnerabilities from the FRDAA requirements and guide the development of DOD’s pilot program. DOD officials told us that before the recent development of their fraud risk management pilot program, the department did not have a process for assessing fraud risks department-wide. Also, as part of the pilot program, OUSD(C) and the components identified seven fraud schemes that affect large contracts, five of which we discuss above as having the potential to involve risks posed by contractor ownership. Specifically, the pilot program identified fraud schemes involving service-disabled veteran–owned businesses, inflated prices charged by contractors for the services rendered, bid submission with the same two or three offerors on multiple contract opportunities, inclusion of one or more contractors as a subcontractor on the bid rigger’s proposal, and counterfeit parts. As discussed previously in this report, opaque ownership structures can play a role in carrying out these types of fraud schemes. DOD completed the pilot program in 2018, and in March 2019 began expanding the fraud risk management program department- wide by requesting that DOD components identify fraud risk and controls in place to mitigate these risks by July 2019. As with the pilot program, the components were requested to identify and assess fraud risks to meet requirements established by FRDAA and allow DOD to identify fraud risks and vulnerabilities facing the department. While DOD has taken some steps to identify and potentially address fraud and other risks posed by contractor ownership, it has not conducted a department-wide assessment of these risks or selected them as a risk area for assessment in its development of a fraud risk management program. DOD procurement policy officials told us that contractor ownership and financing structures have not historically been considered by the department. DOD procurement policy officials expressed the need for a strategic assessment of contractor ownership risks at the Office of the Secretary of Defense (OSD) level to deal with the wide range of potential threats that exist. Still, getting support at the senior OSD level to consider the risks posed by contractor ownership and dedicate resources to mitigating these risks is a challenge, according to these officials. The challenge exists because senior DOD officials may not be aware of the potential magnitude or frequency of risks posed by contractor ownership issues, including the extent to which risks cross multiple areas throughout the department. Additionally, DOD procurement policy officials told us that contracting officers do not have anyone within the department to contact for assistance in determining ownership during the procurement process and there is no dedicated entity within the department that deals with contractor ownership issues. Federal internal control standards call for agency management officials to assess the internal and external risks their entities face as they seek to achieve their objectives. The standards state that as part of this overall assessment, management should consider the potential for fraud when identifying, analyzing, and responding to risks, including changes to risks, and consider factors such as absent or ineffective controls that provide an opportunity to commit fraud. In a complementary fashion, the Assess component of GAO’s Fraud Risk Framework calls for federal managers to plan regular fraud risk assessments and to identify and assess risks to determine a fraud risk profile, as described in figure 10 below. According to the Fraud Risk Framework, a fraud risk profile documents the findings from a fraud risk assessment and can help agencies decide how to allocate resources to respond to residual fraud risks. The Assess component also indicates that relevant stakeholders, including those with responsibilities for specific control activities and with knowledge of emerging fraud risks, should be involved in the assessment process. This could include a variety of internal and external stakeholders, such as general counsel, contractors, or other external entities with knowledge about emerging fraud risks or responsibilities for specific control activities. For example, the DOD Office of Inspector General and its work on emerging risks involving contractor ownership may inform the fraud risk assessment process and help managers to identify fraud risks. Additionally, an assessment of ownership risks could include relevant DOD officials responsible for assessing and responding to national security risks, such as those responsible for assessing supply- chain risks in national security system procurements, vetting vendors to ensure DOD avoids contracting with the enemy, and determining whether contractor facilities can be cleared to access classified materials. Including relevant stakeholders would allow DOD to leverage the knowledge and experience of such officials and more comprehensively identify risks related to contractor ownership. Further, it would allow DOD to better understand the extent to which risks cross multiple areas throughout the department. At a fundamental level, assessing risks arising from contractor ownership would allow DOD to take a strategic, risk-based approach to identifying and managing these risks. In addition, a risk assessment would help DOD better understand the magnitude and prevalence of these risks, including the effects these risks have from both a fraud and national security perspective, and whether certain types of procurements are more vulnerable to contractor ownership risks. Further, conducting a department-wide assessment of risks posed by contractor ownership would assist the department in its evaluation of whether its existing control activities are sufficient and designed to effectively respond to these risks or whether additional control activities are needed. For example, it would allow DOD to better determine how contractor ownership information should be used and verified, and whether additional ownership information should be collected. In accordance with leading practices, DOD would then be positioned to design and implement specific control activities to prevent and detect contract ownership-related fraud and make informed decisions on how best to use its resources. DOD is the largest contracting agency in the federal government in terms of contract dollars obligated and number of contracts awarded. The scope and scale of this activity makes DOD procurement inherently susceptible to fraud. Our various analyses and discussions with procurement officials from across the department identified risks posed by contractors with opaque ownership that involve various types of procurements. DOD has taken some steps that could address some risks posed by contractor ownership in the procurement process. It has the opportunity to include these risks as part of its department-wide fraud risk assessment at a strategic level. Assessing risks related to contractor ownership, as a fundamental first step, would help DOD better determine whether certain types of procurements are more vulnerable to this type of risk. Further, it would help DOD determine whether additional policies and procedures are needed to articulate how officials should use and verify the ownership information it collects, or to require additional ownership information. We recognize that collecting additional ownership information, including beneficial-ownership information, could pose compliance burdens for contractors; and regulatory trends have generally focused on easing the burden to do business. Additionally, verifying contractor ownership can be challenging and time-consuming. Nevertheless, having a thorough assessment of contractor-ownership risks will better position DOD to make informed decisions on how best to use its resources and help ensure that the department’s fraud risk management program is organized and targeted to manage risks in a prioritized manner. Lastly, involving relevant stakeholders with knowledge of emerging risks could help inform other types of risk assessments across the department, including national security concerns. Doing so will contribute to the effective implementation of leading fraud risk management practices when considering the existing and emerging risks to the department. The Office of the Undersecretary of Defense (Comptroller) (OUSD) should include an assessment of risks related to contractor ownership as part of its ongoing efforts to plan and conduct a department-wide fraud risk assessment. As part of this assessment, consistent with leading practices, DOD should involve relevant stakeholders with knowledge of emerging risks and use this information to help inform other types of risk assessments across the department, including for national security concerns. (Recommendation 1) We provided a draft of the sensitive version of this report to DOD and GSA for comment. In commenting on a draft of the sensitive version of this report, DOD concurred with our recommendation and provided additional written comments outlining current and planned efforts in response to our recommendation. These written comments were deemed sensitive by DOD and have been omitted from this report. In an email, GSA stated that it did not have any comments. DOD also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Secretary of Defense, the Administrator of GSA, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made contributions to this report are listed in appendix III. This report is a public version of a sensitive report that we issued on September 12, 2019, with the objectives to (1) identify types of fraud and other risks, if any, that contractors with opaque ownership could pose to the Department of Defense (DOD) in the procurement process and (2) assess whether DOD has taken steps to address risks posed by contractor ownership in the procurement process. The sensitive report included the results of data analysis we conducted to identify offerors who might disguise their ownership to create the appearance of competition. DOD deemed some of the details from this analysis to be sensitive, which must be protected from public disclosure. This report also omits sensitive information about ongoing investigations, certain internal controls and vulnerabilities, and actions taken to address some of these vulnerabilities. Although the information provided in this report is more limited, it addresses the same overall objectives as the sensitive report and uses the same methodology. To address our first objective, we researched information on closed cases investigated by the Defense Criminal Investigative Organizations or prosecuted by the Department of Justice (DOJ) from calendar years 2012 through 2018. These cases were identified by researching press releases from the websites of the DOJ Office of Public Affairs, Offices of the U.S. Attorney, DOD Office of Inspector General, and Defense Criminal Investigative Organizations. We also researched legal databases and news articles involving DOD contractors to identify federal court cases and federal agency decisions. We reviewed GAO bid-protest decisions to identify cases in which a contractor may have failed to disclose foreign ownership or concealed beneficial-owner information to obtain contracts that they were not eligible to receive. We interviewed investigators from the Defense Criminal Investigative Organizations and DOD contracting offices to supplement our research. For each case identified, we reviewed the associated federal court filings or DOJ press releases to determine the outcome of the case and how contractor ownership was used or concealed to carry out the offense. To identify additional types of risks that may not have been identified through our case-study research, we interviewed officials from the General Services Administration (GSA) and officials from across DOD, including the Office of Inspector General, Defense Criminal Investigative Organizations, Defense Pricing and Contracting, the Office of the Under Secretary of Defense (Comptroller) (OUSD), the Office of the Chief Information Officer, Defense Intelligence Agency (DIA), Defense Security Service (DSS), Defense Logistics Agency (DLA), Defense Contract Management Agency (DCMA), and Defense Contract Audit Agency, and relevant procurement policy officials from the Departments of the Army, Navy, and Air Force. We examined known risks identified through our case-study research and interviews with DOD officials; however, these risks are not necessarily representative of the extent or the types of these risks. There may be additional fraud or other risks and cases related to contractor ownership that are presently undiscovered fraud and are not identified in our report. Additionally, we further examined the risk that contractors could be disguising their ownership to create the appearance of competition on a contract to inflate prices by analyzing bid response data from GSA’s Federal Business Opportunities (FBO) website and registration data in GSA’s System for Award Management (SAM). Specifically, we analyzed responses to approximately 2,700 solicitations submitted for fiscal years 2015 through 2017 to identify indications of potentially related offerors bidding on the same solicitation. We selected this date range because fiscal year 2015 was the first year in which the Federal Acquisition Regulation (FAR) required offerors to report their ownership and fiscal year 2017 was the most-recent complete year of data at the time of our analysis. To identify whether offerors were potentially related, we analyzed information to identify instances in which different offerors shared certain information. Offerors sharing information does not definitively prove that the offerors are related or share ownership; however, it is an indicator that these offerors may not be independent of each other. For offerors we identified as potentially related, we researched company websites and third-party data sources to determine whether we could find other indicators of a relationship. Further, we provided a list of the potentially related offerors we identified to the relevant DOD contracting office to determine whether the offeror disclosed any relationships to other offerors or whether the contracting officer was otherwise aware of the relationship with another offeror. The results of our analysis are limited to the approximately 2,700 solicitations we reviewed and are not generalizable to other DOD solicitations. To assess the reliability of the data used in our analysis, we performed electronic testing to determine the validity of specific data elements in the FBO bid module and other datasets. We also reviewed documentation related to these databases, compared the data to published sources and source documentation maintained in the DOD contracting files, and interviewed GSA officials responsible for these databases. We determined that the data were sufficiently reliable for the purposes of analyzing potential ownership relationships. To address our second objective, we reviewed federal laws, the FAR, DOD regulations, directives, instructions, policies, procedures, and training documents. We also reviewed OUSD(C) fraud assessment templates and preliminary results from DOD’s fraud risk management pilot program. We interviewed procurement policy officials from GSA, Defense Pricing and Contracting, DLA, and the Departments of the Army, Navy, and Air Force as well as officials from the Office of the Chief Information Officer, OUSD(C), DIA, DSS, DCMA, the Defense Contract Audit Agency, the Joint Staff Logistics Directorate, the Defense Industrial Policy office, members of DOD’s Procurement Fraud Working Group, and the Naval Contracting Council to discuss how DOD has addressed risks. We also interviewed officials from the Defense Acquisition University to determine how, if at all, DOD trained contracting officials to consider risks posed by contractor ownership. To assess these efforts, we compared these documents and the information from our interviews to federal internal control standards and the leading practices outlined in GAO’s Framework for Managing Fraud Risks in Federal Programs. To gain the perspectives of contractors on whether a requirement to report beneficial- ownership information when doing business with DOD would impose a burden on companies, we researched and contacted several government contractors’ associations to gain the perspectives of their members. The contractors’ associations we contacted included associations for large, medium, and small businesses working in a variety of industries doing business with the government. We received responses to our inquiries from three associations. To gain their members’ perspectives, officials from the three associations forwarded our inquiries to their members and we received responses from 16 members. These 16 members were from a range of business sizes and industries. The perspectives gained from our queries are limited to the contractors from whom we received a response and are not generalizable to all contractors. We conducted this performance audit from August 2017 to September 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We subsequently worked with DOD from September 2019 to November 2019 to prepare this version of the original sensitive report for public release. This public version was also prepared in accordance with these standards. The table below summarizes the information we reviewed involving Department of Defense (DOD) contractors or subcontractors that provided false information about ownership or corporate structure to allegedly commit fraud. We identified cases involving contractors that posed financial and nonfinancial risks to DOD (see app. I for additional details on the methodology used). Financial risks we identified involved DOD contractors using opaque ownership structures to fraudulently inflate prices on DOD contracts. We also identified subcontractors that misrepresented ownership or shared common ownership with a contractor for the purpose of obtaining awards or overcharging the government. Nonfinancial risks we identified involved contractors bidding on and obtaining contracts that they were not eligible to receive, including contracts set aside for small businesses owned by service-disabled veterans or socially and economically disadvantaged individuals. We also identified cases involving ineligible foreign manufacturers creating domestic shell companies to obtain government contracts. As discussed in our report, DOD has not assessed risks posed by contractor ownership; therefore the magnitude and prevalence of these risks are not known. There may be additional risks and cases related to contractor ownership that are not identified below. The 32 cases below were adjudicated or settled from calendar years 2012 through 2018. As shown in the table below, we used public court records and Department of Justice and DOD press releases to identify the type of fraud and calendar years in which the cases were adjudicated or settled, a summary of how the contractor’s ownership was disguised or obfuscated to carry out the fraud schemes, dollar amount awarded or received to the extent available in each case, and the government agencies affected by the fraud. In addition to the contact named above, the following staff members made key contributions to this report: Tonita Gillich (Assistant Director); Tracy Abdo (Analyst-in-Charge); Marissa Esthimer; Colin Fallon; Mollie Lemon; Maria McMullen; Madeline Messick; Dustin Milne; Lauren Ostrander; Daniel Purdy; Daniel Silva; Sabrina Streagle; and Shana Wallace. Others who contributed to this report include Steven Campbell, Suellen Foth, and Pamela Snedden.

Summary: DOD generally accounts for about two-thirds of federal contracting activity. Some companies doing business with DOD may have an opaque ownership structure that conceals other entities or individuals who own, control, or financially benefit from the company. Opaque ownership could be used to facilitate fraud and other unlawful activity. The House Armed Services Committee report on the National Defense Authorization Act for fiscal year 2018 included a provision for GAO to examine the risks posed by contractors with opaque ownership and DOD's processes for identifying ownership. This report identifies types of fraud and other risks that opaque contractor ownership poses to DOD in the procurement process and assesses whether DOD has taken steps to address those risks. GAO reviewed applicable laws and regulations and interviewed DOD officials, including procurement staff and criminal investigators. GAO researched cases from 2012–2018 where contractors may have concealed or failed to disclose ownership information. GAO compared DOD's efforts to leading practices in GAO's Fraud Risk Framework. This is a public version of a sensitive report that GAO issued in September 2019. Information that DOD deemed sensitive involving ongoing investigations and certain internal controls and vulnerabilities has been omitted. The Department of Defense (DOD) faces several types of financial and nonfinancial fraud and national security risks posed by contractors with opaque ownership. These risks, identified through GAO's review of 32 adjudicated cases, include price inflation through multiple companies owned by the same entity to falsely create the appearance of competition, contractors receiving contracts they were not eligible to receive, and a foreign manufacturer receiving sensitive information or producing faulty equipment through a U.S.-based company. For example, one case involved an ineligible foreign manufacturer that illegally exported sensitive military data and provided defective and nonconforming parts that led to the grounding of at least 47 fighter aircraft, as illustrated below. DOD has taken some steps that could address some risks related to contractor ownership in the procurement process but has not yet assessed these risks across the department. DOD, in coordination with other agencies, revised the Federal Acquisition Regulation in 2014 to require contractors to self-report some ownership information. DOD has taken steps to identify and use ownership information—for example, as part of its supply-chain risk analysis when acquiring critical components. DOD has also begun a department-wide fraud risk management program, but it has neither assessed risks of contractor ownership across the department nor identified risks posed by contractor ownership as a specific area for assessment. Assessing risks arising from contractor ownership would allow DOD to take a strategic approach to identifying and managing these risks, make informed decisions on how to best use its resources, and evaluate its existing control activities to ensure they effectively respond to these risks. GAO recommends that DOD assess risks related to contractor ownership as part of DOD's ongoing efforts to assess fraud risk. DOD should use this information to inform other types of risk assessments, including national security concerns. DOD concurred with GAO's recommendation.