The Arms Export Control Act authorizes the sale of defense articles and services to eligible foreign customers under the FMS program. Under the program, the purchased items must be used and secured properly by the customer and cannot be sold to third parties. Also, the FMS program must be administered at no cost to the U.S. government. To recover administration costs, DOD applies a surcharge to each FMS agreement that is a percentage of the value of each sale. Multiple organizations have a role in the FMS program, including DSCA and the military services, State, and CBP. DOD’s responsibilities, which are described in the Security Assistance Management Manual, largely focus on the overall administration of the program and FMS agreements. DSCA carries out key functions, such as managing the FMS administrative surcharge account and supervising end use monitoring of FMS items, and the military services carry out the day-to-day implementation of FMS agreements. State regulates the export of defense articles, in cluding the implementation of the FMS program, through its International Traffic in and CBP enforces export control laws and Arms Regulations (ITAR), regulations at U.S. ports and monitors the dollar value and quantity of defense articles exported under each FMS agreement. Typically, the FMS process begins when a foreign government submits a letter of request to State or DOD to purchase defense articles under the FMS program. The request is then forwarded to the military service responsible for the particular defense article, which then develops a letter of offer and acceptance, or a sales agreement between the United States and the foreign government. State and DOD officials approve the sale, and Congress is notified if the proposed sale meets certain dollar thresholds and other requirements. The military service sends the agreement to the foreign government for its acceptance. After the foreign government accepts the agreement, case managers within the military services can begin carrying out agreement actions such as contracting to procure defense articles, issuing requisition orders, providing program management, transporting defense articles if required, and administering financial transactions. A single FMS sales agreement may result in hundreds or thousands of individual shipments to a foreign government. In most cases, the military service provides the defense article to the foreign country’s freight forwarder, the authorized agent for the foreign customer. However, some countries use DOD’s defense transportation system to ship defense articles. The ITAR requires that freight forwarders register with State, which must receive a letter from the foreign government designating the registered freight forwarder as its authorized agent. CBP port officials rely on a list provided by State to confirm that the freight forwarder for a shipment is the registered freight forwarder for the foreign government. CBP port officials also verify export documentation and subtract the value of each shipment from the total value of exportable goods for each FMS agreement. If the items shipped are incorrect or damaged upon receipt, the foreign government submits a supply discrepancy report to the military service. Every FMS sales agreement has certain security requirements, including end-use monitoring requirements. To provide reasonable assurance that the foreign customer complies with these requirements, DSCA established the Golden Sentry end-use monitoring program in 2001. As part of this program, security assistance officers stationed in a foreign country monitor the use and security of defense articles purchased through the FMS program, and the officers conduct additional checks on certain sensitive defense articles such as Stinger missiles. DSCA officials conduct regional forums and familiarization visits where the foreign country and DOD representatives work together to mutually develop effective end-use monitoring compliance plans. In addition, DSCA officials conduct country visits to review and assess compliance with the requirements of the FMS agreement and perform investigative visits when possible end-use violations occur. We have previously reported on weaknesses in the FMS program, including lack of accountability for shipments to some foreign countries, lack of information on end use monitoring, and insufficient information on the costs to administer the program. Table 1 outlines our previous findings. Agencies responsible for the FMS program have not taken the actions needed to correct previously identified weaknesses in the FMS shipment verification process, and DOD’s expanded end-use monitoring program lacks written guidance for selecting countries for compliance visits using a risk-based approach. First, agencies are not properly verifying FMS shipment documentation, in part because State has not finalized revisions to the ITAR to establish DOD’s role in the verification process. Second, DOD lacks mechanisms to fully ensure foreign governments receive their FMS shipments—in part because DOD does not track most FMS shipments and continues to rely on FMS customers to notify the department when a shipment has not been received. Finally, while DOD has visited an average of four countries each year since 2003 to assess compliance with FMS agreement requirements, it does not have written guidance using a risk-based approach to prioritize the countries it visits to monitor compliance and has not yet visited several countries with a high number of uninventoried defense articles. To control the export of FMS defense articles, freight forwarders are required to provide the following information before CBP allows an FMS shipment to leave a U.S. port: the FMS sales agreement, State’s export authorization form (DSP-94), and evidence that shipment data was entered in the government’s Automated Export System (see table 2). CBP port officials review this information to confirm that the items are authorized under the FMS agreement and that the agreement has an exportable value remaining. The officials also subtract the shipment’s value from the total value of the defense articles permitted under the FMS agreement. Although we recommended in 2003 that State revise the ITAR to clearly establish control and responsibility for all FMS shipments, it has yet to do so. Shortly after our report, representatives from State, DSCA, and CBP met to draft proposed ITAR revisions that would require DOD to verify that the correct value and type of defense article is listed on the export documentation. According to agency officials involved in the process, agency representatives went through multiple iterations of the draft ITAR revisions over a period of several years. However, these revisions have been in State’s final clearance stages since May 2008. In the meantime, weaknesses we previously identified in the verification process continue to go unaddressed. Anticipating the ITAR updates, in 2004 DOD issued guidance in its Security Assistance Management Manual instructing the military services to verify that the sales value listed on the DSP-94 by the freight forwarders includes only the value of the exportable defense articles listed in the FMS agreement. However, because the guidance only applies to DOD and not the freight forwarders, we found cases where freight forwarders did not submit DSP-94 forms for DOD review. For example, in 10 of our 16 case studies, freight forwarders—who are not bound by DOD’s guidance—did not submit DSP-94s to the military services for verification. In addition, in the six cases that were verified by the military services, one listed the full FMS agreement value on the DSP- 94, including administration charges, rather than only the value of the exportable defense articles, as DOD policy requires. Further, officials from one military service were uncertain who within their security assistance command was supposed to verify the documents and how they were supposed to be verified. CBP port officials lack key information in export documentation that is needed to properly record the value of defense articles shipped under an FMS sales agreement and ensure the value of the shipments made are not more than the exportable value of the agreement. According to CBP guidance, each FMS agreement should have one port that records the value of the exports made against an agreement. However, freight forwarders are not required to identify the primary port on the DSP-94 they provide to CBP at the time of the shipment. For example, freight forwarders listed multiple ports on this form for several of the agreements we reviewed. In one case, the DSP-94 listed seven ports. While information from the Automated Export System is required to accompany all FMS shipments, we found that this system only lists the port of export—not the primary port. CBP port officials have told us that they have no way of knowing if an FMS agreement or a DSP-94 is filed at more than one port because CBP does not have a method to prevent these documents from being filed at multiple ports. Without accurate and complete information on the primary port, officials at other ports cannot notify the primary port regarding shipments that are made through their ports so that the value of these exports can be properly recorded. In some cases, port officials were reducing the exportable value of FMS agreements at ports that were not the primary port. For example, two ports contained duplicate entries for 67 FMS agreements, and, for many of these agreements, both ports were independently recording the value of shipments made against the agreement. In one case, the records for one port showed that the agreement value was exhausted, while the records for the second port still showed an exportable value of $2.9 million. Although CBP agreed to develop guidelines for FMS shipment verification and reduction of allowable export value after a shipment in response to our 2003 report recommendations, the U.S. Customs Control Handbook for Department of State Licenses has not been updated since 2002, and it does not provide instructions to CBP port officials on tracking shipment and agreement values. CBP issued a policy memorandum in 2004 directing port personnel on how to record shipment values for FMS sales agreements and coordinate with other ports to designate one primary port to track and record shipments against each FMS agreement, but CBP port officials we met with in July 2008 did not have the memorandum, and it was not posted on CBP’s intranet, a resource that CBP began to use after 2004 to distribute policy information among the ports. The list of closed agreements included 467 cases that were identified as closed for the 2003 GAO report and 2212 agreements that were closed from October 2007 to September 2008. determine if shipments are authorized. We determined that multiple shipments were made against six of these agreements, including agreements for the sale of technical defense publications, avionics components, and missile components. According to DOD officials, one o these agreements was closed before any orders were placed against it; however, we found that 21 shipments were made against this agreement by a freight forwarder. In October 2008, DSCA officials provided a list of recently closed FMS agreements to CBP, and they plan to meet with officials to discuss how to use the information. However, this list only covers agreements that were closed in fiscal year 2008, which could all shipments to continue to be made against agreements that were closed prior to that time. According to DOD guidance, DOD considers its responsibility for the shipment of FMS articles complete when the title transfers from DOD to the foreign government, which typically occurs when the item is picked up by the freight forwarder at a DOD supply center or other point of origin. DOD does not usually notify the foreign customer when a defense article has been shipped. If a foreign customer has not received an FMS shipment or it is damaged upon receipt, problems that may not be identified until months after the article was shipped, the customer files a supply discrepancy report. Each FMS sales agreement may have thousands of shipments associated with it, and discrepancy reports could be filed against each shipment. For example, in our 16 case studies, 188 supply discrepancy reports were filed. Thirty-one of these reports were filed because an incorrect item was received. In such cases, DOD officials may tell the foreign government to dispose of the item and give the foreign government a credit against their account. However, if the report is not submitted within one year, DOD is not required to take action on the discrepancy. If a country chooses not to submit a report, DOD has no procedures in place to identify a lost or diverted FMS shipment as it does not generally track such shipments once they leave the DOD supply center. According to DOD officials, DOD investigates the whereabouts of defense articles that foreign governments claim they did not receive, or received but never ordered, when the foreign customer notifies DOD. Without notification from the customer, DOD may not know when defense articles are mistakenly transferred to a foreign customer. This occurred in 2006 when DOD mistakenly transferred forward section assemblies for the Minuteman III intercontinental ballistic missile to Taiwan instead of the helicopter batteries the country had requested through the FMS program. DOD only became aware of an error in 2007, when Taiwanese officials notified U.S. officials that they did not receive the requested batteries. At the time, DOD did not fully investigate the discrepancy and also did not realize that it had sent missile components to Taiwan until 2008—more than one year after being notified of the error. In 2008, the Defense Logistics Agency (DLA) —which manages the inventory for weapon system spare parts and other consumable items in the DOD supply system—took action to ensure that defense articles for shipment are properly labeled in an effort to minimize the risk that an incorrect article is provided to a foreign customer. According to a DLA headquarters official, DLA found it had a high inaccuracy rate for its supply center shipments. DLA inspectors found, for example, that if a shipping label got caught in the printer, the rest of the shipments on the line may have incorrect shipping labels because the personnel on the line may unknowingly skip the jammed label and affix subsequent labels on the wrong packages. DLA’s two largest FMS supply depots have recently put in place a double inspection process in which inspectors at the depots ensure that the shipping documentation matches the items in the package. A DLA official stated that this new process should address the problem of improperly labeled defense articles leaving the supply depot—the first part of the shipment process. However, Navy officials responsible for FMS shipments noted that DLA needs to determine the source of the problems to ensure that its solutions are correct. It is too early to know whether DLA’s new process will reduce the inaccuracy rate for supply center shipments. According to DSCA officials, while DOD currently does not track all shipments under FMS sales agreements, it has mechanisms intended to improve visibility over shipments in limited circumstances. For example, DOD established the Enhanced Freight Tracking System, which is intended to allow DOD personnel, freight forwarders, and foreign customers to track shipments from their point of origin to their final destination. Currently, participation by FMS customers is voluntary. DSCA and military service officials stated that the system was designed for customers to track their shipments, and the officials do not plan to use the system to track all FMS shipments. DOD also faces challenges in successfully implementing the new system. First, the system is in the first phase of implementation, which focuses on tracking defense articles from the initial location in the military depot to the freight forwarder, and subsequent phases will allow for shipment tracking to the final destination in the foreign country. Second, in some cases the transportation control numbers that are used to track shipments have been incomplete or changed when shipments were consolidated and therefore are not a reliable method to track shipments. According to DOD officials, while the freight tracking system has multiple searchable fields, for some FMS shipments the transportation control number is the only searchable field. In addition, DOD officials identified another mechanism for tracking FMS shipments that is being used for countries within the U.S. Central Command area of responsibility, in particular Iraq and Afghanistan. All such shipments are required to have radio frequency identification tags that allow for electronic tracking of shipments through the Enhanced Freight Tracking System to their destination. DSCA officials noted that DOD developed this requirement to address the unique security situation in those countries, and DOD does not have plans to expand it to include shipments to other countries. In 2003, we found that DSCA lacked the information needed to implement and report on its Golden Sentry end-use monitoring program. Since then, DSCA expanded this program and has been reporting annually on its resources. According to DSCA’s fiscal year 2009 monitoring report to Congress, the purpose of the program is to scrutinize the foreign purchaser’s use of U.S. defense articles to ensure compliance with U.S. security requirements. The report further notes that to conduct end-use monitoring with available resources, DSCA uses a risk-based approach. Countries are to secure all defense articles purchased through the FMS program. They are also required to maintain a detailed inventory of every item received by serial number for 16 defense articles DOD designated as sensitive. These sensitive defense articles have been purchased by 76 countries and include night vision devices, communication security equipment, and certain types of missiles, such as Stingers. To ensure that foreign governments and security assistance officers are complying with monitoring requirements, DSCA headquarters officials lead in-country compliance visits, which DSCA has identified as an important part of the Golden Sentry program. Specifically, the visit objectives are to: assess in-country security assistance officers’ overall compliance with the end-use monitoring program; assess the foreign government’s compliance with specific physical security and accountability agreements through facility visits, records reviews, and reviews of local security policies and procedures; conduct routine or special inventories of U.S.-origin defense articles; appraise possible violations of the U.S. laws, international agreements, or FMS agreements. To conduct these compliance visits, DSCA assigned three officials to particular regions of the world. These DSCA personnel periodically lead teams made up of several military service and overseas DOD personnel with expertise on sensitive weapon systems or the country visited. DSCA budgeted $1.4 million for such visits in each of the fiscal years 2006 through 2008. Since DSCA began conducting compliance visits in 2003, it has visited 19 countries—or 25 percent—of the 76 countries that have purchased sensitive defense articles, averaging about four visits per year. According to DSCA policy, DSCA compliance visits should focus on the countries that have purchased sensitive defense articles, with a particular emphasis on visiting those with Stinger missiles. DSCA officials stated that they determine compliance visits based in part on foreign policy considerations, such as the need to coordinate visits with foreign governments to respect their sovereignty. While no written guidance exists, officials stated they consider a variety of risk-based factors in determining countries to visit, including considering whether the country is in a stable region of the world or if the officials have information indicating sensitive defense articles may not be properly protected or inventoried. Yet, out of the 19 countries they visited, about 50 percent were in a stable region of the world. In addition, DSCA has not yet conducted compliance visits in three countries that have a high number of uninventoried defense articles, including Stinger missiles and related components and night vision devices, as identified by DSCA’s data system. According to a DSCA official responsible for the compliance visits, these three countries are now scheduled for visits in 2009. DSCA also noted that one of these countries needed assistance to help it meet standards before it could have a successful compliance visit. However, as DSCA has not created written guidance for selecting countries for compliance visits, it is unclear how it applied a risk-based approach in prioritizing its country selections to date. While DOD has implemented initiatives aimed at improving the overall administration of the FMS program, it lacks the information needed to effectively administer and oversee the program. First, DOD does not have information on the actual cost of administering FMS sales agreements and, as a result, is not able to link the administrative surcharge DOD charges foreign customers with actual costs. Second, DOD lacks information for determining an improved metric to measure the timeliness with which FMS agreements are developed. Finally, DOD does not have consistent data from each of the military services on administering FMS agreements. Over the past decade, DSCA has implemented several initiatives aimed at improving the balance between FMS expenditures and income. Specifically, DSCA has twice adjusted the surcharge rate—the rate charged to FMS customers to cover program administration costs. However, DSCA does not have sufficient information to determine the balance necessary to support the program in the future. In 1999, DSCA decreased the surcharge rate from 3 to 2.5 percent because the administrative surcharge account had a surplus. Prior to this change, we recommended that DSCA not lower the rate until it determined the cost of implementing the FMS program. However, DSCA disagreed with this recommendation and lowered the rate despite declining income that the program experienced between 1995 and 2000. According to DSCA officials, by 2005 the program experienced a decrease in income that raised concerns about DSCA’s ability to pay FMS program expenses if sales continued at the existing rate. Following a year-long internal study to determine a sustainable rate, DSCA increased the surcharge rate from 2.5 to 3.8 percent in August 2006 and clarified what services are included in the administrative surcharge and what services require additional charges. Since then, the administrative surcharge account balance has grown—a result of both the increased rate and higher than anticipated sales. In fiscal year 2008 alone, FMS program sales totaled $36 billion— almost triple the amount DSCA had previously projected. Once the customer signs the agreement and pays the required deposit, DSCA collects 100 percent of the administrative surcharge from agreements in support of the Global War on Terrorism and other agreements with different funding sources and 50 percent of the administrative surcharge for all other agreements. Expenditures from these sales agreements continue throughout the entire life of the agreement, which on average last 12 years. However, DSCA knows only historical costs associated with the overall program, not the costs to implement each FMS agreement. Identifying the costs of administering the FMS program is a good business practice identified in federal financial accounting standards. DSCA plans to reassess the optimal rate based on the level of sales and estimated expenses, but without data on actual agreement costs, the surcharge rates DSCA establishes may not be sufficient to pay for needed administrative activities. According to a senior DSCA official, while the fund is not currently in danger of becoming insolvent, it is unclear how the current economic situation may affect future sales levels and, therefore, the administrative account balance. DSCA’s selection of its current surcharge rate has also raised issues with FMS customers and the military services regarding which administrative services require additional charges beyond what is included in the standard administrative surcharge. The standard level of service includes services such as the preparation and processing of requisitions. A country that wants services in addition to the standard level of service, such as additional reviews or contractor oversight, is charged separately for those services. DSCA has provided guidance and training to help the Army, Navy, and Air Force apply the revised standard level of service to new cases. However, according to Navy officials, measuring one standard level of service is unrealistic because every case is unique and may require varying levels of service. Several FMS customer representatives to the Foreign Procurement Group also raised questions about administrative surcharge billing and the consistency with which the standard level of service was applied across the services. A briefing prepared by the Foreign Procurement Group in July 2008 noted improvement in the application of the standard level of service but identified the need for additional transparency in DOD’s charges for the standard level of service for FMS agreements. For example, the group cited incidences of charging customers for services that should be covered under the standard level of service. In an effort to ensure FMS sales agreements are developed and presented to customers in a timely manner, DSCA established a goal of developing and presenting 80 percent of agreements to its customers within 120 days of receiving a request to purchase a defense article through the FMS program. DSCA’s 120-day time period begins with the initial receipt of the purchase request and includes the time required to receive pricing information for defense articles from contractors, to allow the services to write the actual FMS agreement, and for all of the relevant agencies to review and approve the sale of the defense articles. In 2008, DSCA began a study to determine if the 120-day goal was reasonable or if it needed to be revised. However, DSCA officials stated they did not have sufficient information to make such a determination. As a result, DSCA directed each military service to study its FMS process to assess internal FMS processes and the time frames associated with those processes. According to DSCA officials, they anticipate receiving the results of the studies in early summer 2009. A variety of factors may affect the military services’ ability to meet the 120- day time frame for developing an FMS agreement. For all agreements implemented from January 2003 to September 2008, DSCA developed 72 percent of FMS agreements within its stated 120-day goal. While it takes an average of 122 days after the initial receipt of a request to develop an FMS agreement, the number of days that it took to develop an FMS agreement ranged from less than one to 1,622 days. While DSCA officials noted that the creation of a central agreement writing division in 2007 has helped improve the consistency of agreements, there are other factors affecting the time it takes to develop an agreement. Officials responsible for developing the FMS agreements stated that while it is possible to meet the 120-day goal on routine agreements, such as blanket order agreements, it is difficult to meet the goal for complex agreements, such as agreements for weapons systems. Agreements over certain dollar thresholds could require more time if they have to go through the congressional notification process. Similarly, for example, non-NATO cases may require more time for the U.S. Embassy in the customer country to conduct an evaluation of the proposed sale. Prioritization of certain agreements, such as Iraq FMS agreements, can also delay the development of other FMS agreements. Other factors that can extend FMS agreement development times include slow customer response to follow-up questions about requests to purchase defense articles, workload challenges within the military services, and slow contractor response times for pricing information about the defense article the foreign government wants to purchase. FMS implementation, management, and financial data—which DOD uses to track, oversee, and execute FMS sales agreements—are currently dispersed among 13 electronic systems across the military services and other DOD components. As a result, DSCA’s ability to obtain FMS program information and to manage the efficiency of the FMS process is limited. For example, one DSCA official responsible for collecting program information noted that DSCA cannot effectively measure cost, schedule, and performance on FMS agreements because current systems only provide three consistent indicators that are comparable across the military services. According to the official, while the service specific systems may provide information for analyzing the performance of FMS agreements within that service, the information is not comparable with data produced by other services, thus reducing its value to DSCA for overall oversight of the program. DSCA compiles the limited available data from the military services for quarterly meetings that review the FMS program in an effort to determine potential problems. In addition, as DOD does not have a centralized system, the services have independently developed tools to enhance the capabilities of their existing systems, one of which has been in place since 1976. For example, the Air Force independently developed a web-based system for processing supply discrepancy reports, but DSCA has yet to fully fund this system to be used by the other services. In an effort to develop more comparable, detailed, and complete data on agreement implementation, DSCA is working to develop the Security Cooperation Enterprise Solution. DSCA is currently defining the requirements for this potential system and has yet to determine how it will relate to other data systems. According to DSCA officials, recent increases in FMS sales and the administrative surcharge rate will provide sufficient funds to begin the development of a new data system. DSCA also uses the Security Cooperation Information Portal—a web-based tool designed to provide a point of access for DOD’s multiple FMS information systems, such as the services’ requisition systems, the system used to write agreements, and the financial systems. The portal retrieves information from existing DOD systems and is intended to provide consolidated information to DOD and foreign customers. However, as the portal is based on information from 13 different systems, the data have the same limitations in providing DSCA with comparable data to oversee the FMS program. The FMS program, as a part of a broader safety net of export controls designed to protect technologies critical to national security as well as an important foreign policy tool to advance U.S. interests, presents a set of unique challenges to the agencies involved in the program. Previously identified weaknesses in the FMS shipment verification process remain unaddressed and require the immediate and collective attention of leadership within State, DOD, and Homeland Security. While these departments each have a distinct role to play in the FMS program, they have failed to work collectively to ensure that FMS articles are not vulnerable to loss, diversion, or misuse. This failure has clear national security implications because defense articles will be at risk of falling into the wrong hands. Consistent with our 2003 report, we still believe that State should revise the ITAR to establish procedures for DOD verification of FMS shipments to address weaknesses in the shipment verification process. Also, DOD may not be maximizing its resources by fully applying a risk-based approach to ensure that sensitive defense articles are protected as required. In addition, DOD has made changes to its FMS program administration without sufficient information on which to base these changes, and it lacks information to assess how well the program is working. Without this information, DOD’s ability to know if the program is achieving intended results is limited. To improve controls for exported items as well as administration and oversight of the FMS program, we are reiterating a recommendation to State from our 2003 report and making the following five recommendations. To establish procedures for DOD verification of FMS shipments, we recommend that the Secretary of Defense direct the Under Secretary of Defense for Policy to provide additional guidance to the military services on how to verify FMS shipment documentation. To ensure CBP port officials have the information needed to verify FMS shipments are authorized, we recommend that the Secretary of State direct the Assistant Secretary for Political-Military Affairs, that the Secretary of Defense direct the Under Secretary of Defense for Policy, and that the Secretary of Homeland Security direct the Commissioner of Homeland Security’s U.S. Customs and Border Protection to coordinate on establishing a process for: ensuring the value of individual shipments does not exceed the total value of the FMS agreement; designating a primary port for each new and existing FMS agreement; developing a centralized listing of these primary ports for use by CBP providing CBP officials with information on FMS agreements that were closed prior to fiscal year 2008. To ensure that correct FMS shipments reach the right foreign customers, we recommend that the Secretary of Defense direct the Under Secretary of Defense for Policy to examine its existing mechanisms and determine if they can be used to improve tracking of FMS shipments. To ensure that FMS defense articles are monitored as required, we recommend that the Secretary of Defense direct the Under Secretary of Defense for Policy to create written guidance for selecting in-country visits that consider a risk-based approach. To improve the administration and oversight of the FMS program, we recommend that the Secretary of Defense direct the Under Secretary of Defense for Policy to better determine the administrative costs of implementing the FMS program and develop metrics that allow DSCA to comprehensively assess the performance of the FMS program. State, DHS, and DOD provided written comments on a draft of this report, which are reprinted in appendices II through IV. DHS and DOD also provided technical comments, which we incorporated as appropriate. In written comments, State and DHS concurred with our recommendations and outlined plans to implement them. DOD concurred with two of our recommendations and partially concurred with the other three. In its technical comments, DOD also noted that it disagreed with our characterization of the information it uses to administer the FMS program. In concurring with the recommendation that State should revise the ITAR, which we reiterated from our 2003 report, State noted that the Political- Military Bureau is processing the recommended changes to the ITAR and will publish them in the Federal Register as soon as all requirements for doing so are met. DOD concurred with our recommendation to provide additional guidance on verifying FMS shipment documentation and agreed to work with the military services to review the current guidance and revise as necessary. DOD also concurred with our recommendation that it examine its existing mechanisms for tracking FMS shipments and will work with agency representatives to improve end-to-end visibility. In response to our recommendation that State, DHS and DOD coordinate to ensure CBP port officials have the information needed to verify that FMS shipments are authorized, DHS and DOD agreed to work together to provide this information. DHS identified several specific actions that it plans to take, including reconvening an interagency working group to address FMS-related issues, obtaining a complete list of closed FMS agreements from DOD, and establishing a list of all primary ports for existing and new FMS agreements. DOD also agreed to provide CBP with a list of closed FMS agreements. While DOD agreed to work with State and CBP to establish a process for designating a primary port for each new FMS agreement, it noted that it will have to examine the resource impact of designating a primary port for existing FMS agreements before taking further action. Once DOD has made this assessment it will be important for the agencies to determine the appropriate course of action for existing agreements. DOD partially concurred with our recommendation to create written guidance for in-country visits and said that such guidelines could be included in the Security Assistance Management Manual. DOD noted that these guidelines would take risk into account, but would have to be broad enough to consider other factors, such as the experience of personnel, when scheduling in-country visits. DOD has reported to Congress that it uses a risk based approach to conduct end-use monitoring with available resources. While our report notes that a variety of factors play a role in the selection of countries for compliance visits, we also found that the current system, which lacks written guidance, may not ensure that DOD is distributing its resources in a risk-based manner. As DOD has identified these visits as an important part of its monitoring program, we continue to believe that DOD needs written guidance—whether in published guidance or internal policy memos—that applies a risk-based approach to ensure that sensitive defense articles are protected as required. DOD also partially concurred with our recommendation that it improve the administration and oversight of the FMS program. DOD agreed that rigorous data analysis and well-defined, targeted metrics are vital for FMS program administration. It noted that it conducted a year-long study prior to changing the current administrative surcharge rate in August 2006 and that it hosts a quarterly forum at which security cooperation leadership review metrics related to the FMS program. In its technical comments, DOD also stated that it has sufficient information and that it is not required to gather information on actual costs to administer the FMS program. As we state in our report, DOD’s August 2006 study relies on future sales estimates and historical budget data for program administration to develop its surcharge rate, which does not provide it with the actual costs to implement existing FMS agreements. We also note that identifying the costs of administering the FMS program is a good business practice recognized in federal financial accounting standards. In addition, while we acknowledge that DOD officials meet at quarterly forums to review existing metrics, they have limited consistent indicators that are comparable across the military services. As such, we continue to believe that DOD should obtain additional information regarding the cost of implementing FMS agreements and to develop metrics to administer and oversee the program. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution of it until 30 days from the date of this report. We will then send copies to the Secretaries of State, Defense, and Homeland Security. In addition, we will make the report available at no charge on the GAO Web site at http://www.gao.gov. Please contact me at (202) 512-4841 or lasowskia@gao.gov, if you or your staff have any questions about this report. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report were Ann Calvaresi- Barr, Director; John Neumann, Assistant Director; Heather Miller; Jean Lee; Sarah Jones; Ann Rivlin; Noah Bleicher; John Krump; Karen Sloan; Art James; and Rebecca Rygg. To examine the changes that State, DOD, and DHS have made to the FMS program since 2003, we reviewed the regulatory framework governing the FMS process, including the Arms Export Control Act, the International Traffic in Arms Regulations (ITAR), and a draft of potential revisions to the ITAR. We also reviewed the U.S. Customs Control Handbook for Department of State Licenses, the Defense Department’s Security Assistance Management Manual, and other guidance from Customs and Border Protection (CBP), the Defense Department, and the military services. We used case studies to assess the steps in the FMS process. Using data available to the military services and FMS officials through the Defense Security Assistance Management System, we selected 16 FMS agreements based on the following attributes: the military service responsible for administering the FMS agreement, the type of defense item sold, whether the item required enhanced end-use monitoring, the customer country, and agreements that used both the Defense Transportation Service and freight forwarders to transport defense articles to their end destination. We selected similar defense articles to compare across the military services. We obtained data from DOD systems used to manage the FMS program. We verified that the agreements we selected contained the traits for which they were selected. Based upon this verification, we confirmed that the data we used were sufficiently reliable for our purposes. We also obtained data from two major ports, one airport and one seaport. These ports are 2 of the top 10 U.S. ports in terms of the dollar value of FMS shipments they process. We used these data to determine if FMS agreements were being lodged at multiple ports and to determine if exports were occurring against FMS agreements for which exports were no longer authorized. We reviewed copies of licenses and shipment logs to identify when actual shipments were made against FMS agreements that were no longer authorized to have shipments. Our analysis of these data allowed us to determine whether gaps in controls exist, but did not allow us to assess the state of controls at all ports. In addition, we interviewed officials and obtained documentation at the State Department, the Defense Security Cooperation Agency (DSCA), the Air Force Security Assistance Center, the United States Army Security Assistance Command, the Navy International Programs Office, the Naval Inventory Control Point, the Defense Logistics Agency, CBP headquarters and port personnel at two ports, and U.S. security assistance officers stationed in one NATO and one non-NATO country. To determine the information DOD uses to administer and oversee the FMS program, we reviewed the Defense Department’s Security Assistance Management Manual and other guidance from the Defense Department and the military services. We also reviewed the Office of Management and Budget's Managerial Cost Accounting Concepts and Standards for the Federal Government - Statement of Federal Financial Accounting Standards Number 4. We analyzed data the military services use to manage FMS agreements implemented from fiscal years 2003 to 2008. We conducted interviews with officials at DSCA and the military services. We also met with the Foreign Procurement Group, a group composed of FMS customer countries, to ask them about their experiences with the FMS program and reviewed the group’s 2008 briefing for the program. We conducted this performance audit from May 2008 to April 2009 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Summary: In fiscal year 2008, the Foreign Military Sales (FMS) program sold over $36 billion dollars in defense articles and services to foreign governments. The Departments of State, Defense (DOD), and Homeland Security (DHS) all have a role in the FMS program. In 2003, GAO identified significant weaknesses in FMS control mechanisms for safeguarding defense articles transferred to foreign governments. In 2007, GAO designated the protection of technologies critical to U.S. national security a high-risk area. GAO was asked to (1) evaluate program changes State, DOD, and DHS have made since 2003 to ensure that unclassified defense articles transferred to foreign governments are authorized for shipment and monitored as required, and (2) determine what information DOD has to administer and oversee the FMS program. GAO conducted 16 case studies; analyzed U.S. port data and FMS agreements; reviewed program performance metrics; and interviewed cognizant officials. Agencies involved in the FMS program have made some changes in the program but have not corrected the weaknesses GAO previously identified in the FMS program's shipment verification process, and the expanded monitoring program lacks written guidance to select countries to visit to ensure compliance with requirements. State--which is responsible for the program and approving FMS sales--has not finalized proposed regulatory revisions to establish DOD's role in the FMS shipment verification process, although the FMS agencies reached agreement on the proposed revisions about a year ago. DHS port officials, responsible for export enforcement, also continue to lack information needed to verify that FMS shipments are properly authorized. GAO found six FMS agreements that had unauthorized shipments, including missile components. In one case, 21 shipments were made after the agreement was closed. At the same time, DOD, which administers the FMS program and FMS agreements, lacks mechanisms to fully ensure that foreign governments receive their correct FMS shipments--in part because DOD does not track most FMS shipments once they leave its supply centers and continues to rely on FMS customers to notify the department when a shipment has not been received. With regard to monitoring defense articles once in country, DOD does not have written guidance to prioritize selecting countries for compliance visits using a risk management approach and has not yet visited several countries with a high number of uninventoried defense articles. DOD lacks information needed to effectively administer and oversee the FMS program. For example, within the last 10 years DOD has twice adjusted the surcharge rate--the rate charged to FMS customers to cover program administration costs--but it does not have information on program costs to determine the balance necessary to support the program in the future. Also, while DOD has a goal to release 80 percent of FMS agreements to a foreign government within 120 days of receiving its request to purchase defense articles, DOD officials stated they do not have the information needed to determine if the goal is reasonable. In addition, DOD lacks information to oversee the program, in large part due to the fact that FMS data reside in 13 different accounting, financial, and case implementation systems. DOD is in the process of defining its requirements for FMS program information before it moves forward with improving its data systems. In the meantime, DOD is relying on systems that do not provide it with sufficient, comparable data to oversee the program's performance.