Two NNSA offices, NA-23 and NA-25, documented management controls for almost all of their contracts that we reviewed; but the third office, NA- 24, could not provide us with the complete records necessary to document these controls. Similarly, NA-23 and NA-25 provide their technical reviewers and contract managers with procedural guidance that assists in maintaining these controls, while NA-24 did not provide this type of guidance. In addition, NA-23 and NA-25 maintain the key contract documents at headquarters and the national laboratories, respectively, in such a way that the records are quickly accessible for active monitoring by contract and program managers, as evidenced by their ability to provide us with key contract records. Two NNSA offices, NA-23 and NA-25, documented management controls for most of their contracts that we reviewed. As shown in table 1, for eight of the nine contracts we reviewed from these two offices, NA-23 staff and national laboratory officials who manage NA-25’s contracts provided us with complete records of deliverables and invoices as well as evidence that technical reviewers and contract officers reviewed and approved deliverables and invoices, respectively. (For the ninth contract, which involved comprehensive physical protection upgrades to a strategic rocket forces site in Russia, Oak Ridge National Laboratory did not provide complete documentation of approvals for deliverables.) For example, the two contracts we reviewed from NA-23—which are designed to construct or refurbish fossil-fuel plants for the Russian cities of Zheleznogorsk and Seversk so that each city can shut down its plutonium-producing nuclear reactor that it currently uses to generate heat and electricity—involve multiple contractors in the United States and Russia. Despite being by far the largest contracts by dollar value in our sample ($390 million for Seversk and $570 million for Zheleznogorsk—the next largest contract was valued at $29 million), NA-23 headquarters provided us with, among other things, complete documentation of all invoices; photographs of the deliverables (i.e., construction work) completed to date; and evidence of the reviews and approvals of the invoices and payments to the foreign contractors and subcontractors. NA-23 also provided us with detailed breakdowns of work (called Work Breakdown Structures), work authorizations, and cost evaluations for each project. The documentation NA-23 provided us was among the most complete and organized of all the contracts we reviewed. An NA-23 official told us that this office makes efforts to specify in acute detail the work to be done and the costs for that work because this enables the office to effectively monitor and maintain a degree of control over the work of foreign contractors and subcontractors. NA-25 officials also provided us with complete documentation of management controls for the contracts they manage. As shown in table 1, for six of the seven contracts we reviewed, the national laboratories that manage these contracts provided complete records of deliverables and invoices as well as evidence that technical reviewers at the national laboratories and/or contract officers at the national laboratories and/or NA-25 reviewed and approved the deliverables and invoices, respectively. (The seventh contract is the Oak Ridge contract, mentioned above.) For example, for the two contracts we reviewed that Brookhaven National Laboratory manages for NA-25, each invoice on the contracts received at least one approval from technical reviewers at the laboratory, and each financial transaction received two approvals from contract managers. In another contract involving the purchase of nuclear detection devices for deployment in Russia, the national laboratory managing the contract— Pacific Northwest—provided us with purchase orders for the contract as well as a receipt of delivery so that we could verify that the goods purchased had reached their destination prior to final delivery in Russia. Both NA-23 and NA-25 maintain copies of key records, such as deliverables and invoices within quick access to program and contract managers, as evidenced by the ability of each office to provide these records to us. NA-23 maintains these records at headquarters, while NA-25 maintains the records at the national laboratories that provide the day-to-day management over the contracts. However, it is important to note that the laboratories should be able to provide NNSA managers with complete and quick access to contract records, as the national laboratories are contractors to DOE, and it is NNSA that is ultimately responsible for monitoring the nonproliferation projects. NA-23 and NA-25 each apply formal, procedural guidance that assists technical reviewers and contract managers in maintaining management controls. For example, because the contracts involve capital procurement or acquisitions exceeding $5 million, NA-23 must apply the rules and procedures specified in DOE Order 413.3, Project Management for the Acquisition of Capital Assets. NA-23’s contract managers receive program guidance through work authorizations signed by an authorized official at NNSA headquarters and guidance on the payment process via DOE’s Contract Specialist Guide 42.8, which specifies procedures for review and approval of vouchers and invoices so that contract managers will handle them in a timely and efficient manner. According to NA-23 officials, Federal Acquisition Regulations also stipulate many of the specific steps that NA- 23 must undertake in the planning, implementation, and review of the contracts that make up the Seversk and Zheleznogorsk projects. NA-25 developed its own procedural guidance, known as the Project Management Document, for technical reviewers and contract officials. This guide provides instructions on, among other things, project planning, funds management, reporting of a project’s ongoing progress and costs, contract management, and procedures for putting important contract data into NA- 25’s Program Management Information System. Finally, according to NNSA’s Director of Policy and Internal Controls Management and an NNSA official in charge of acquisitions in the Office of Defense Nuclear Nonproliferation, neither NA-23 nor NA-25 perform periodic reviews of their management control processes, although NNSA’s Office of Engineering and Project Support, at the outset of NA-23’s projects, did perform a general review of NA-23’s management controls. GAO’s management control guidelines state that agencies should monitor and regularly evaluate their control activities to ensure that they are still appropriate and working as intended. NA-24 could not provide evidence of the records necessary to document its management controls. Despite our numerous inquiries from January 2005 to June 2005 and discussions with agency officials—including one with NNSA’s Principal Assistant Deputy Administrator—the documentation we received on seven of the nine contracts we examined from this office was either incomplete or did not provide a clear audit trail that we could follow. (For the two other contracts, one managed by Brookhaven National Laboratory and one managed by Los Alamos National Laboratory, laboratory officials provided complete documentation of management controls.) For example, for one contract managed by the Idaho National Laboratory involving the discovery of bioactive compounds in Russia that may be used in watershed protection or carbon sequestration: Ten of the 35 invoices did not include a document showing that NA-24 had authorized payment to the Russian contractors. Fourteen invoices on this contract did not include evidence that Idaho National Laboratory’s technical reviewer for the contract approved the deliverable on which the invoice was based. For another contract managed through NA-24 headquarters, Foundation for Russian American Economic Cooperation (FRAEC), NA-24 provided us with documentation, but we were able to determine very little about the contract on the basis of this documentation because of the following reasons: there appeared to be no explanation of the linkages between the work products outlined in the contract, the deliverables, and the invoices, and we received fewer than half of the invoices for the contract and fewer than one-fifth of the deliverables for the contract. Senior officials with NA-24 told us that it doesn’t need to keep copies of key contract documents because the documents are maintained at the national laboratories managing the contracts and accessible to NA-24. However, the fact NA-24 was unable to obtain complete sets of records on seven of the nine contracts we reviewed suggests otherwise. In addition, NA-24 did not provide us with formal, written guidance that provides managers with the procedures on how to process and maintain key contract records, and the office appears to rely on each national laboratory to provide its own procedural guidelines. Finally, NA-24, like NA-23 and NA-25, does not perform periodic reviews of its management control processes. GAO’s management control guidelines state that agencies should monitor and regularly evaluate their control activities to ensure that they are still appropriate and working as intended. On the basis of our review of the contracts, it appears that, if an NNSA program office provides its managers with procedural guidance on how to maintain management controls, the office does a better job at implementing and documenting these management controls. In our view, procedural guidance enables program and contract managers to implement and document management controls in a systematic way, as evidenced by the fact that NA-23 and NA-25 each use procedural guidance and were able to document their controls. In addition, maintaining managers’ quick and complete access to key contract records—regardless of whether the records are located at the national laboratory or NNSA headquarters—appears to coincide with maintaining and documenting management controls. Officials at NA-24 told us that they have access to all contract records through the laboratories that manage their contracts, yet the office was unable to provide us with these records. Finally, as required by GAO standards for management controls, periodic reviews of management controls would help the NNSA offices that we reviewed determine whether they are adhering to their management controls and whether these controls are relevant and effective. For example, if NA-24 had performed a review of its management control procedures, it might have discovered that it did not have on hand complete sets of invoices and approvals of deliverables for each of the office’s nonproliferation contracts. To ensure that each NNSA office that we reviewed maintains complete documentation of its management controls, we recommend that the Secretary of Energy, working with the Administrator of the National Nuclear Security Administration, require NNSA to take the following three actions: each NNSA office use formal, procedural guidance that clearly states NNSA’s program managers maintain quick access to key contract records such as deliverables and invoices that relate to management controls, regardless of whether the records are located at a national laboratory or headquarters; and NNSA perform periodic reviews of its management control processes to be certain that each program office’s management controls can be documented and remain appropriate and effective. We provided the Department of Energy’s National Nuclear Security Administration (NNSA) with a draft of this report for its review and comment. NNSA’s written comments are presented as appendix III. In its written comments, NNSA notes that it will undertake a series of actions in response to our recommendations, but also states that our report creates an incorrect perception that the Defense Nuclear Nonproliferation Program, particularly NA-24, is lacking in the application of management controls. In their comments to our draft report, NNSA’s major points are as follow: 1. We reviewed only contracts from a portion of NA-24, Global Initiatives for Proliferation Prevention (GIPP), and we did not receive complete documentation from NA-24 because we did not speak to the procurement officer for the GIPP program; 2. NA-24 has implemented “very stringent” management controls; 3. We mischaracterize the management controls on two contracts—one managed by the Idaho National Laboratory (INL) and the other managed by NA-24 headquarters staff; 4. For an NA-25 contract managed by Oak Ridge National Laboratory, we received incomplete documentation because of an initial misunderstanding by the laboratory rather than a control problem within NA-25, and that managers at Oak Ridge sent us the missing documents on August 16, 2005. 5. NA-25 does conduct external program management reviews of its management controls through a Technical Survey Team (TST). First, regarding the scope of our review, at the outset of our work, we asked NA-24 for a list of all its contracts in Russia and other countries that were active from the beginning of June 2001 through the end of June 2004, then took a nonprobability sample of those contracts. We did not intentionally focus solely on NA-24’s GIPP program. Regardless, as we state in the report, results from nonprobability samples cannot be used to make inferences about a population, and our statements about NA-24 relate to its ability to document the management controls for the contracts we examined. Regarding NNSA’s comment that we did not meet with the GIPP procurement officer, it is unclear to us why NNSA is making this point. For most of the contracts we reviewed, NA-24 provided us with documents directly. After providing NA-24 with a fact sheet stating that we received incomplete documentation for seven of the nine the contracts we reviewed, we met with NA-24’s Assistant Deputy Administrator on June 27, 2005, who provided us with additional documentation that she characterized as “complete”. After a thorough review, we found much of this additional documentation to be incomplete, indecipherable, and often duplicative of the information we had already been given earlier in our review. On August 17, 2005, after submitting our draft report to NNSA for comment, we met again with the Assistant Deputy Administrator as well as the Associate Assistant Deputy Administrator, the Principal Assistant Deputy Administrator for Defense Nuclear Nonproliferation, and the GIPP procurement officer. At this meeting, the procurement officer provided us with no new documentation, and the NA-24 officials again asserted that the documents they provided us in June were “complete”. Furthermore, during the meeting, while discussing some of the documents that we found to be missing, we asked the officials to produce a few of these documents at random from the materials they gave us in June. In most cases, they were unable to do so. In fact, in the case of one missing document, an NA-24 official stated that it “had to be somewhere in there” (included in the materials submitted in June), but it was not. Second, we disagree with NA-24’s contention that it has implemented “very stringent” management controls. Although NNSA cites a number of actions that NA-24 has taken to strengthen its controls, the fact remains that NA-24 did not provide us with sufficient documentation for seven of the nine contracts we reviewed despite numerous requests from us to do so. For example, on one contract managed by the Y-12 National Security Complex, rather than providing a “real-time” technical reviewer’s approval for each deliverable, NA-24 provided us with a single email from the technical reviewer, dated June 24, 2005, that purported to cover two years’ worth of missing approvals. This post-hoc approval does not represent a satisfactory management control. Based on what NA-24 provided us, we believe that the office’s controls for some contracts we reviewed are weak. In our view, NA- 24 needs to implement actions that address and strengthen the specific management controls we identify in the report, and we are encouraged that NNSA has agreed to implement our recommendations. Third, for the INL-managed contract, NNSA asserts that it provided us in June with the documentation we sought. However, the documents were indecipherable to us because most were unlabeled, presented in no particular chronological order, and rely on emails in which neither the sender’s nor recipients’ positions were identified. For the headquarters- managed contract, NNSA contends that, at our meeting on August 17, 2005, it explained how the process of deliverables and invoices for this contract (providing assistance to the Foundation for Russian American Economic Cooperation) differs from the processes of other contracts we examined. Although this may be the case, the documents that NA-24 provided did not clearly explain or illustrate those processes. More importantly, the documents that NA-24 provided comprised fewer than one-half of the deliverables and one-fifth of the invoices that we identified in June as missing. Fourth, although we have fewer concerns about NA-25’s management controls, in the case of one of the contracts managed by Oak Ridge National Laboratory, managers provided acceptable documentation of technical reviewers’ approvals on only three of six deliverables. Although we agree with NNSA that officials at the laboratory did not initially provide us with complete documentation of technical approvals, as we state in the report, NNSA is ultimately responsible for the controls on its contracts, even if the contracts are managed day-to-day by someone else. In addition, the documentation that officials at the laboratory sent us on August 16, 2005, did not provide all the information that was missing. Rather, they provided documentation of one additional technical review and resubmitted materials that we had already informed Oak Ridge managers did not represent acceptable documentation. As a result, we stand by our recommendation that NNSA perform periodic reviews of management controls for each of the three offices we examined. Fifth, regarding NNSA’s statement that TST performs external reviews of NA-25’s management controls, it is important to note that the TST is a panel of experts established by DOE to determine if DOE-installed security systems at Russian nuclear sites meet departmental guidelines for effectively reducing the risk of nuclear theft. Moreover, we spoke to NNSA’s Director of Policy and Internal Controls Management on August 26, 2005, and he agreed that, while the TST provides useful project oversight, it does not provide the kind of comprehensive review of program management controls examined in our review. More importantly, during the course of our work, NA-25 did not provide evidence of any reviews of their management controls. Finally, we believe it is important to note that management controls were most evident on NA-24 and NA-25 contracts managed by national laboratories from which we were able to obtain all the necessary documentation directly, without any NNSA headquarters involvement. This was especially noteworthy in the case of NA-24 because both of this office’s contracts that we determined demonstrated effective management controls were managed by a national laboratory – Brookhaven or Los Alamos – and in both cases we obtained all the necessary documents directly from the laboratory managers. To assess the effectiveness of the NNSA’s management controls of its nonproliferation projects, we identified the three offices within NNSA that currently oversee and manage the nonproliferation projects that fell within the scope of our work: (1) the Office of Nuclear Risk Reduction (designated by NNSA as NA-23), (2) the Office of Nonproliferation and International Security (NA-24), and (3) the Office of International Material Protection and Cooperation (NA-25). To identify what constitutes management controls, we consulted two GAO documents: Standards for Internal Controls in the Federal Government and Internal Control Management and Evaluation Tool. Using these documents, we focused on the management controls associated with NNSA’s nonproliferation contracts. More specifically, we examined the supervisory actions designed to ensure that the work performed under the contract (known as “deliverables”) meet the contract’s specifications and that payments for that work receive required approvals and reach the intended recipients. To do this, we sought from NNSA the following documents for each of the contracts we reviewed: contract deliverables (or summary of the deliverable – as practicable); technical approval from an NNSA or national laboratory official for each invoices for all deliverables; documentation of an independent payment authorization and review for each deliverable, which should include at least one signature from a national laboratory financial office official supervising the contract and/or one official at NNSA headquarters; approval letter from NNSA or the national laboratory authorizing the final payment of the contractors for a deliverable (as applicable); a guide to the process each national laboratory uses to approve a deliverable and authorize payment. To select a nonprobability sample of contracts, we obtained, from the three offices in NNSA, a list of all their nonproliferation contracts in Russia and other countries that were active from the beginning of June 2001 through the end of June 2004. We identified contracts whose value exceeded $1 million and arranged them in descending dollar value. We chose the 15 contracts with the largest dollar value, subject to the constraints that (1) no more than two contracts come from NA-23, 7 contracts from NA-24, and six contracts from NA-25 and (2) a single national laboratory manages no more than three contracts in our sample. We chose these constraints so that (1) the mix of contracts among the three offices in our sample roughly reflected the mix of contracts among the three offices in our original list and (2) the sample would reflect a diversity of laboratories. Finally, we included one contract from each of the three remaining laboratories that were not yet included in our sample, bringing our final list to 18 contracts. To ensure that NNSA’s lists of its nuclear nonproliferation contracts were sufficiently reliable for our purposes, we obtained responses to a series of questions covering issues such as data entry, data access, quality-control procedures, and the accuracy and completeness of the data for the eight databases from which these data were drawn. Follow-up questions were added, whenever necessary. Based on our review of this work, we found these data to be sufficiently reliable for the purpose of using these lists to select a nonprobability sample of 18 contracts for review. In addition to contract documents, we also interviewed NNSA officials in Washington, D.C., and Germantown, Maryland. To gather information about the contracts we selected for review, we traveled to Brookhaven National Laboratory in New York and Los Alamos and Sandia National Laboratories in New Mexico to meet with laboratory officials and program, project, procurement, and contract managers to explain our review; to learn about NNSA programs and projects, as well as procedures for implementing management controls; and to determine the kinds of project documents we would need. To gather information and documents on the remaining contracts, on the basis of what we learned during these trips, we sent detailed written communications and conducted teleconferences, numerous and frequent in some cases, with the requisite staff in headquarters and at other national laboratories. Specifically, we contacted staff at the Lawrence Berkeley and Lawrence Livermore National Laboratories in California, the Oak Ridge National Laboratory and the Y-12 National Security Complex in Tennessee, the Pacific Northwest National Laboratory in Washington, and the Idaho National Laboratory. We focused on identifying the controls implemented to ensure that former Soviet Union partners meet contract terms before the invoices for the deliverables are paid. After we gathered and evaluated all the available documentation from NNSA headquarters and the various national laboratories for each contract, we assessed the contracts on the basis of the completeness of their documentation and overall evidence of the implementation of management controls. We placed each contract in one of three categories: (1) contracts for which all or almost all of the necessary documentation was provided— especially the major contract documents (statement of work and task orders), deliverables, and technical and independent contractual/financial approvals of each deliverable—providing clear evidence of the systematic implementation of management controls throughout the life-cycle of the contract; (2) contracts for which most of the documents were provided, suggesting that systematic implementation of management controls may be occurring but not clearly indicating as much; and (3) contracts for which there were significant gaps in necessary documentation, providing no basis to conclude that systematic management controls are implemented. We conducted our review between May 2004 and July 2005 in accordance with generally accepted government auditing standards. We are sending copies of this report to interested congressional committees and the Secretary of Energy. We will also make copies available to others upon request. In addition, the report will be available on the GAO Web site at http://www.gao.gov. If you have any questions regarding this report, please contact Mr. Aloise at (202) 512-3841 or aloisee@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report. GAO contacts and staff acknowledgements are listed in appendix IV. The following table lists all NNSA contracts that we reviewed. Luch - Task Order 1 – Blend-down HEU to LEU PBZ-C2 Comprehensive Physical Protection Upgrades to Russian Navy Site CBC-B2 Comprehensive Physical Protection Upgrades to Russian Navy Site COMP2BR-Comprehensive Physical Protection System Upgrades Aquila – Purchase of Equipment to enhance the monitoring of nuclear materials FRAEC –Technical and administrative assistance in planning, establishing, and operating the international development centers. Pipe Coating Facility (#63544) – Establish a production facility within the city of Snezhinsk for the production of insulated pipes. T2-0192-RU – Development of a 3-D neutronics optimization algorithm for application to cancer treatment facilities. Nuclear Non-Proliferation Center –The Analytical Center for Nuclear Non- Proliferation will carry out research on several projects, including a Quarterly Information Bulletin and Internet Analysis and creation of an Internet page. T2-0186-RU – Development of a Tank Retrieval and Closure Demonstration Center in the Mining and Chemical Combine (MCC) to help in retrieval and processing of radioactive wastes generated during production of plutonium for nuclear weapons. T2-0194-RU – The use of new technologies to process important Ti alloys for medical applications and aerospace industries. T2-0204-UA – Welding and Reactive Diffusion Joining (RDJ) repair technologies for use in aircraft and land-based turbine engines. SAIC/P.O. # 14436 – Nuclear material detectors for border guards T2-0244-RU – Development of an explosives detection system. T2-2002-RU – Discovery of bioactive compounds from selected environments in Russia for products such as watershed protection and carbon sequestration. Luch Task Order 1 – Blend-down HEU to LEU PBZ C2 – Security Upgrades to Russian Navy Site CBC B2 – Security Upgrades to Russian Navy Site TVZ01– Minatom Guard Railcar Procurement COMP2BR – Comprehensive Physical Protection Systems Upgrades Aquila – Enhanced nuclear materials monitoring systems FRAEC – Technical and administrative assistance in planning, establishing, and operating international development centers. In addition, Nancy Crothers, Greg Marchand, Judy Pagano, Daren Sweeney, and Kevin Tarmann made significant contributions to this report.

Summary: The National Defense Authorization Act for FY 2004 mandated that we assess the management of threat reduction and nonproliferation programs that the Departments of Defense and Energy each administer. The objective of this report is to assess how the Department of Energy's National Nuclear Security Administration (NNSA) implements management controls, which we define here to be the processes ensuring that work done under a contract meets contract specifications and that payments go to contractors as intended. Two NNSA offices, the Office of Nuclear Risk Reduction (designated by NNSA as NA-23) and International Material Protection and Cooperation (NA- 25), documented management controls for almost all of their contracts that we reviewed, but the third office, the Office of Nonproliferation and International Security (NA-24), did not document controls for most of their contracts because they could not provide the required documentation. More specifically, for eight of the nine NA-23 and NA-25 contracts we reviewed, the NA-23 headquarters staff and the laboratory staff that manage the contracts for NA-25 provided to us complete records of deliverables and invoices, as well as evidence that technical officials reviewed and approved the deliverables and contract officers reviewed and approved the invoices. (For the ninth contract, NA-25 provided us with incomplete documentation of its controls.) In addition, NA-23 and NA-25 each apply procedural guidance that assists managers in maintaining these controls. However, according to an NNSA official, none of the three offices currently perform periodic reviews to ensure their existing management controls remain appropriate. In contrast, we were unable to determine if NA-24 implements management controls because, for seven of the nine contracts we reviewed, the documentation it provided to us was in most cases either incomplete or it provided no clear audit trail that we could follow. (Documentation was complete for the eighth and ninth contracts.) The types of documents that were missing varied across and within some contracts. In addition, NA-24 does not provide its contract managers with procedural guidance on how to maintain its management controls, nor does it perform a periodic review of its controls to ensure the controls are effective and appropriate.