The transfer of defense items to friendly nations and allies is an integral component in both U.S. national security and foreign policy. The U.S. government authorizes the sale or transfer of military equipment, including spare parts, to foreign nations either through government-to-government agreements or through direct sales from U.S. manufacturers. The Arms Export Control Act and Foreign Assistance Act of 1961, as amended, authorize the DOD foreign military sales program. The Department of State sets the overall policy concerning which countries are eligible to participate in the foreign military sales program. DOD, through the military services, enters into foreign military sales agreements with individual countries. The Air Force Security Assistance Center, which is an activity of the Air Force Materiel Command, is responsible for the administration of the Air Force’s foreign military sales program. The center’s responsibilities start with the initial negotiation of the foreign military sale and end with the delivery of parts and completion of all financial aspects of the agreements. The center uses an automated management information system, the Security Assistance Management Information System, to support its management of the program with accurate and timely information. For blanket order cases, the system uses criteria such as an item’s national item identification number, a federal supply class, or a federal supply group to restrict the parts available to foreign military sales customers. Once the system has verified a country’s eligibility and approved a requisition, the requisition is sent to a supply center to be filled and shipped. The overall foreign military sales process, as it applies to the Air Force, is shown in figure 1. This report addresses the portion of the process relating to the Air Force’s approval or disapproval of foreign countries’ requisitions for classified and controlled spare parts under blanket order cases. Blanket orders are for a specific dollar value and generally cover classes of parts that a country may need rather than a specific item within a class. Under blanket orders, the Air Force restricts classes of items, such as munitions and nuclear spare parts, from being requisitioned. The Air Force’s internal controls for foreign military sales using blanket orders are not adequate to prevent countries from ordering and receiving classified and controlled spare parts that they are not eligible to receive. We found that (1) controls based on supply class restrictions were ineffective and resulted in erroneously approved requisitions for shipment, and that written policies for recovering the erroneously shipped items did not exist; (2) the Air Force did not validate modifications to its Security Assistance Management Information System related to blanket orders or test the system’s logic for restricting requisitions, and (3) command country managers did not always document reasons for overriding either the Security Assistance Management Information System or foreign military sales case manager recommendations not to ship classified spare parts. As a result of these inadequate internal controls, classified and controlled spare parts were shipped to countries not authorized to receive them. The Air Force Security Assistance Center has taken or plans to take actions to correct these issues. Foreign country requisitions for classified and controlled spare parts were erroneously validated, as a result of an incorrect federal supply class, by the Air Force’s Security Assistance Management Information System. The Air Force attempts to prevent countries from obtaining classified and controlled spare parts by restricting them from receiving spare parts that belong to selected federal supply classes. Included in the national stock number is a four-digit federal supply class (see fig. 2), which may be shared by thousands of items. The national stock number also contains a nine-digit national item identification number that is unique for each item in the supply system. A country can obtain a classified or controlled spare part by using an incorrect, but unrestricted, supply class with an item’s correct national item identification number. We found that because the Security Assistance Management Information System was not properly programmed, it erroneously validated 35 blanket order requisitions (of the 123 in our review), even though an incorrect supply class number was used, because the countries used supply classes that were not restricted. For example, in one case, the Air Force restricted countries from requisitioning parts belonging to the 1377 federal supply class (cartridge- and propellant-actuated devices and components) on blanket orders. The restriction included an outline sequencer (national stock number –1377010539320) used on ejection seats for various aircraft. The country ordered the sequencer using national stock number 1680010539320. Because supply class 1680 (miscellaneous aircraft accessories and components) was not restricted and the Security Assistance Management Information System did not verify that 1680 was the correct supply class for national item identification number 010539320, the system approved the requisition. Had the system validated the entire 13-digit national stock number, it would have found that the number was incorrect and would not have approved the requisition. Subsequently, the item manager recognized that 1680 was not the correct federal supply class and corrected the supply class to 1377 before the part was shipped. This example is summarized in figure 3. Air Force officials were unaware of this situation until our review identified the problem. In another case, involving the restricted 1377 federal supply class, a country ordered a restricted battery power supply for the F-16 aircraft using national stock number 6130013123511. Because supply class 6130 (nonrotating electrical converters) was not restricted and the Security Assistance Management Information System did not verify the entire 13- digit national stock number, the requisition was approved. The Air Force shipped the restricted battery power supply to the country. Neither the Air Force nor the center had written policies or procedures in place for recovering the items erroneously shipped. Without these types of policies and procedures, the Air Force cannot be assured that appropriate steps will be taken to recover the parts. Air Force Security Assistance Center officials agreed that the supply class restrictions alone were ineffective and could be bypassed by use of inaccurate supply class information. The Air Force has not validated modifications to the Security Assistance Management Information System that restrict parts that countries can requisition, and has not tested the system’s logic for restricting requisitions since 1998 to ensure that it is working properly. As a result, modifications that were not properly made went undetected, and foreign countries were able to requisition and obtain controlled spare parts that the Air Force was trying to restrict. For example, the Air Force instructed programmers to modify a table of restrictions in the Security Assistance Management Information System to prevent certain countries from using blanket orders to requisition controlled bushings in the 5365 supply class. Although Air Force Security Assistance Center officials subsequently told us that the bushings had been improperly restricted, we found that, for 18 of the 123 requisitions we reviewed, countries had ordered and received the bushings, because the Security Assistance Management Information System was incorrectly programmed and did not identify the requisitions as requiring a review by command country managers. After we brought the transactions to the attention of Air Force Security Assistance Center officials, they investigated and found that programmers had entered the restrictions in the wrong area of the system. Because the Air Force had not validated that system modifications were properly made, the system had approved the requisitions. Although the Air Force later determined that the bushings should not have been restricted, this example nevertheless demonstrates the need to validate system changes. The Air Force does not periodically test the Security Assistance Management Information System to ensure that it accurately reviews requisitions for compliance with restrictions. For example, when the system is working correctly, it will identify restrictions relating to parts, such as ammunition or nuclear spare parts, and will disapprove requisitions from countries that are ineligible to order these parts. Air Force Security Assistance Command officials said that the system had not been tested since 1998 to ensure that it accurately reviews requisitions for compliance with restrictions. When we tested the system’s ability to restrict items based on their federal supply class, we found that the system did not always perform as intended. As discussed earlier, the system did not perform as intended because countries could requisition and obtain classified and controlled spare parts using an incorrect, but unrestricted, federal supply class with an item’s correct national item identification number. In the Federal Information System Controls Audit Manual, which lists internal control activities for information systems, one of the control activities listed involves the testing of new and revised software to ensure that it is working correctly. In addition, management of federal information resources rules require agencies to establish information system management oversight mechanisms that provide for periodic reviews to determine how mission requirements might have changed and whether the information system continues to fulfill ongoing and anticipated mission requirements. Further, DOD’s ADP Internal Control Guidelineat the time stated that periodic reviews of systems should be conducted to determine if they operate as intended. According to Air Force Security Assistance Center officials, there have been few changes to the table of restrictions in the system. However, they did agree that existing changes need to be validated and were working to accomplish this. Based on our observations, the Air Force’s failure to validate modifications and test model logic is in part due to an unquestioning confidence in the Security Assistance Management Information System’s ability to correctly restrict the requisitioning of classified and controlled spare parts. Command country managers did not always document reasons for overriding Security Assistance Management Information System or foreign military sales case manager recommendations not to ship classified spare parts. According to the Standards for Internal Control in the Federal Government, all transactions and other significant events need to be clearly documented. The standards state that such documentation should be properly managed and maintained and should be readily available for examination. Of the 123 requisitions we reviewed, the Security Assistance Management Information System identified 36 requisitions for command country manager review. For 19 of the requisitions, command country managers overrode the system recommendations and shipped classified and controlled spare parts without documenting the reasons for overriding the system. For example, the command country manager overrode the system and shipped four classified target-detecting devices, but the case file did not contain any documentation explaining why the command country manager did so, and managers we queried could not provide an explanation for the override. Similarly, a command country manager authorized the shipment of a controlled communications security part that the Security Assistance Management Information System and foreign military sales case manager recommended not be shipped. The case file contained no documentation explaining why the spare part was shipped. According to Air Force officials, there were no written policies or procedures for documenting decisions to override the system or foreign military sales case manager recommendations. The Air Force Security Assistance Center plans to issue guidance to command country managers to document system bypass authorizations. The Air Force has not established nor does it maintain effective internal controls over foreign military sales sold under blanket orders. Specifically, internal controls involving use of the federal supply class to restrict requisitions, the modification of tables restricting the access to classified and controlled spare parts in the Air Force’s system, testing of the system, and documentation of system overrides were inadequate. Without adequate internal controls, classified and controlled spare parts may be released to countries that are ineligible to receive them, thereby providing military technology to countries that might use it against U.S. national interests. Further, without written policies detailing the steps to be taken when the Air Force becomes aware of an erroneous shipment, the Air Force’s ability to recover erroneously shipped classified or controlled parts is lessened. To improve internal controls over the Air Force’s foreign military sales program and to minimize countries’ abilities to obtain classified or controlled spare parts under blanket orders for which they are not eligible, we are recommending that the Secretary of Defense instruct the Secretary of the Air Force to require the appropriate officials to take the following steps: Modify the Security Assistance Management Information System so that it validates country requisitions based on the requisitioned item’s complete national stock number. Establish policies and procedures for recovering classified or controlled items that are erroneously shipped. Establish polices and procedures for validating modifications made to the Security Assistance Management Information System to ensure that the changes were properly made. Periodically test the Security Assistance Management Information System to ensure that the system’s logic for restricting requisitions is working correctly. Establish a policy for command country managers to document the basis for their decisions to override Security Assistance Management Information System or foreign military sales case manager recommendations. In commenting on a draft of this report, DOD fully concurred with four of our recommendations and cited corrective actions that had been taken or were planned, and it partially concurred with another recommendation. Specifically, with regard to our recommendation to modify the Security Assistance Management Information System to validate country requisitions based on the requisitioned item’s national stock number, the department said that it has had a change in place since January 2003 to validate requisitions based on an item’s national stock number. We believe that the department’s change is responsive to findings that we brought to the Air Force’s attention in December 2002. However, because our audit work was completed when the Air Force brought this change to our attention, we did not have an opportunity to validate the change. The department also stated that the Air Force (1) will write a policy memorandum on procedures for recovering classified or controlled items that are erroneously shipped, (2) will issue a policy memorandum directing that all modifications to the system be validated in accordance with existing policies and procedures, and (3) has issued a policy memorandum specifying those staff who can input transactions for overriding restrictions and requiring that waiver approvals for using the bypasses be documented. With regard to our recommendation to periodically test the system to ensure that its logic for restricting requisitions is working correctly, DOD partially concurred. The department said that a program is being implemented to test new modifications placed in the system and that the testing of old modifications would be an ongoing effort. Testing the modifications placed in the system will ensure that they were made correctly. However, just testing the modifications will not ensure that the system is correctly applying its logic to the modifications in order to restrict requisitions for items that countries are not eligible to receive. For example, testing modifications may not identify logic problems, such as the one we identified involving the approval of requisitions based on an item’s federal supply class. Thus, we continue to believe that the system’s logic for restricting requisitions should be periodically tested to ensure that it is working correctly. Otherwise, classified and controlled spare parts that are requisitioned may continue to be erroneously released. DOD’s comments appear in appendix I. To determine the adequacy of the Department of the Air Force’s key internal control activities aimed at preventing countries from requisitioning and receiving classified and controlled spare parts that they are ineligible to receive, we held discussions with officials from the Under Secretary of Defense (Policy Support) International Security Program Directorate; Deputy Under Secretary of the Air Force (International Affairs); and the Air Force Materiel Command’s Security Assistance Center, Dayton, Ohio. We discussed the officials’ roles and responsibilities, the criteria and guidance they used in performing their duties, and the controls used to restrict countries from receiving parts that they are not eligible to requisition. At the Air Force Security Assistance Center and Air Logistics Centers at Warner Robins Air Force Base, Macon, Georgia, and Tinker Air Force Base, Oklahoma City, Oklahoma, we interviewed military and civilian officials to obtain an overview of the requisitioning and approval processes applicable to classified and controlled spare parts. To test the adequacy of the internal controls, we obtained records from the Air Force Security Assistance Center on all classified and controlled spare parts that were purchased under blanket orders and approved for shipment to foreign countries for the period October 1, 1997, through July 31, 2002. We limited our study to blanket orders because defined orders and Cooperative Logistics Supply Support Agreements specified the parts that countries were entitled to requisition by national stock number. In contrast, only Security Assistance Management Information System restrictions limited the parts that countries were entitled to order under blanket orders. The records covered 444 blanket orders that resulted in 72,057 requisitions for classified and controlled spare parts. Specifically, we took the following steps: We tested the Security Assistance Management Information System by applying the system’s restrictions that applied to classified and controlled spare parts that were shipped under blanket orders, and identified 525 requisitions that appeared to violate the restrictions. We obtained satisfactory explanations from the Air Force Security Assistance Command for all except 200 of the requisitions, which were shipped despite restrictions. We reviewed case files for 123 requisitions, including 87 requisitions for which the Security Assistance Management Information System had approved the shipment of classified and controlled spare parts without referring the requisitions to command country managers to determine if the requisitions should be approved. We followed up on these requisitions by consulting with command country managers. The case files that we reviewed included 36 requisitions that the Security Assistance Management Information System had referred to command country managers for review to determine if they had documented their decisions to override the system’s decisions. We followed up on these reviews through discussions with command country managers. We conducted our review from May 2002 through May 2003 in accordance with generally accepted government auditing standards. As arranged with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from the date of this letter. At that time, we will send copies of this report to the Secretary of Defense; the Secretary of the Air Force; the Director, Office of Management and Budget; and interested congressional committees. We will also make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. Please contact me on (202) 512-8365, if you or your staff have any questions concerning this report. Key contributors to this report were Lawson (Rick) Gist, Jr.; Jennifer Thomas; Arthur James, Jr.; Lou Modliszewski; Susan Woodward; John Lee; and Kristy Lehmann.

Summary: From 1990 through 2001, the Department of Defense delivered over $138 billion in services and defense articles--including classified and controlled parts--to foreign governments through its foreign military sales programs. Classified spare parts are restricted for national security reasons, while controlled parts contain technology that the military does not want to release. GAO was asked to review the Air Force's internal controls aimed at preventing countries from requisitioning and receiving classified or controlled spare parts that they are ineligible to receive. The Air Force's internal controls for its foreign military sales program using blanket orders are not adequate, placing classified and controlled spare parts at risk of being shipped to countries not authorized to receive them. The Air Force's system has erroneously approved foreign country requisitions for classified and controlled spare parts based on incorrect federal supply classes. The system approves items for shipment based in part on an item's federal supply class--not the item's entire national stock number, which is a combination of the supply class number and a part number unique to the item. GAO found that because the system was not properly programmed and countries used unrestricted supply class numbers, the system erroneously approved 35 of 123 selected requisitions reviewed. For example, one country ordered a controlled outline sequencer used on various aircraft by using a supply class that was unrestricted, but incorrect for the part it requisitioned. Because supply class 1680 was not restricted and the system did not verify that 1680 was the correct supply class for national item identification number 010539320, the system approved the requisition. Had the system validated the entire 13-digit national stock number, it would have found that the number was incorrect and would not have approved the requisition. In addition, the Air Force has no written policies or procedures in place for recovering items that have been shipped in error. The Air Force has not validated modifications to the Security Assistance Management Information System that restrict parts available to foreign countries and has not tested the system since 1998 to ensure that it is working properly. Because modifications were not validated, the Air Force did not detect improperly made modifications to the system, and foreign countries were able to requisition and obtain controlled spare parts that, at the time, the Air Force was trying to restrict. GAO identified 18 instances in which countries requisitioned and received a controlled part for which they were not eligible because programmers had entered the restrictions in the wrong area of the system. Although Air Force officials subsequently told us that the part was improperly restricted, this example nevertheless demonstrates the need to validate system changes. Air Force command country managers did not always document reasons for overriding the recommendations of the system or the foreign military sales case manager. For 19 of the 123 requisitions GAO reviewed, command country managers overrode the system recommendations and shipped classified and controlled spare parts without documenting the reasons for overriding the system. For example, a command country manager overrode the system and shipped four classified target-detecting devices without documenting the reasons for overriding the system.