Congress created the CTR program in 1991 to help the states of the former Soviet Union secure and eliminate their weapons of mass destruction and prevent their proliferation. Through the CTR program, the United States has supported activities to eliminate nuclear missiles, build a storage facility for nuclear materials, eliminate chemical weapons, secure biological pathogens, and employ former weapons scientists. As of January 2005, the CTR program has assisted in the elimination of about 570 intercontinental ballistic missiles and nearly 30 nuclear powered ballistic missile submarines. In 2004, Congress authorized DOD to expand the scope of the CTR program to countries outside the former Soviet Union. For example, beginning in 2005, CTR assistance will help Albania destroy its chemical weapons stockpile. Figure 1 shows the DOD management structure for the CTR program. Within the Office of the Under Secretary of Defense for Policy, the CTR Policy Office is responsible for developing and coordinating policy guidance, defining program objectives for the CTR program, and negotiating agreements with CTR recipients. The CTR Policy Office works with the office of the Under Secretary of Defense for Acquisition, Technology, and Logistics through the Deputy Assistant to the Secretary of Defense for Chemical Demilitarization and Threat Reduction. DTRA reports to the Assistant to the Secretary of Defense for Nuclear and Chemical and Biological Defense Programs. The Deputy Assistant to the Secretary of Defense for Chemical Demilitarization and Threat Reduction provides strategic implementation guidance on and oversight of CTR projects, and interacts daily with DTRA on CTR matters. Within DTRA, the Cooperative Threat Reduction (CT) directorate manages the program’s daily operations. The directorate is organized into five program areas: Biological Weapons Proliferation Prevention, Chemical Weapons Elimination, Nuclear Weapons Safety and Security, Strategic Offensive Arms Elimination, and Weapons of Mass Destruction (WMD) Proliferation Prevention. (For a more detailed description of these program areas, see app. IV.) The directorate is located at Ft. Belvoir, Virginia, and several DTRA offices throughout the former Soviet Union provide in-country support for CTR program implementation. At the beginning of the program in 1992, DOD primarily purchased and provided equipment such as cranes, cutting tools, and vehicles to recipient countries. As the program matured, CTR assistance provided more services, such as hiring U.S. contractors who helped recipient countries dismantle nuclear delivery systems and missiles. Currently, CTR provides most assistance to recipient countries through contracts with American firms. DOD executes, manages, and reviews the contracts according to DOD and federal acquisition requirements. Specifically, in 2001, the CTR program began using special contracts with prime contractors who, with their teams of supporting subcontractors, implement the majority of CTR projects in the recipient countries. These five contractors are known as CTR Integrating Contractors. DTRA has also contracted with the Science Applications International Corporation’s Threat Reduction Support Center (TRSC). TRSC staff provide support to CTR program and project managers in the areas of operations, logistics, engineering, financial, and program management. Since 2003, DOD has improved its management and internal controls over the CTR program. Prior to 2003, DOD’s internal controls over the program were limited and did not ensure that CTR program objectives were being met. Following two project failures in Russia, DOD implemented a series of new measures in 2003 that provided a more structured approach to managing the CTR program. Most importantly, in July 2003, DOD filled vacancies within AT&L, the office responsible for ensuring that DTRA’s implementation of CTR projects was meeting cost, schedule, and performance goals. After DOD filled these positions, the new leadership worked closely with DTRA officials to introduce important enhancements to the program’s internal controls. For example, DOD adopted several new methods to assess and mitigate the risks involved in cooperating with CTR- recipient governments. Although these methods attempt to reduce risk to an acceptable level, DOD cannot fully mitigate the risks involved in working jointly with CTR-recipient governments. While DOD’s enhancements are an improvement over the previous management and internal controls for the program, CTR procedures do not include final reviews of CTR projects upon their completion. As such, DOD has no mechanism for assessing the success of completed projects and applying lessons learned to future projects. Beginning in 2003, DOD implemented several new and enhanced management processes to allow program managers to better assess the progress of CTR projects and address program implementation weaknesses to reduce the risk of program failures. For example, DOD filled vacant AT&L positions; developed specific guidance for project managers on reporting objectives, schedules, and cost estimates; and improved communication within the program and with recipient countries. (For a comparison of DOD’s CTR internal controls with selected control standards for the federal government, see app. V.) DOD developed a training course that all CTR project and program managers are required to complete, which provides detailed instruction on incorporating the new requirements of the internal control framework into all CTR projects. According to 24 of the 30 CTR program, policy, and acquisition officials responding to our structured interview, the new framework has helped improve CTR project implementation. For example, CTR officials stated that now the program management review system is more rigorous and project managers know what is expected of them in reporting on the cost, schedule, and performance of their projects. In July 2003, DOD filled AT&L vacancies, closing a critical gap in the department’s ability to ensure that the CTR program was meeting cost, schedule, and performance goals. Previously, DOD had not been carrying out its own management plans for ensuring that CTR projects were meeting stated goals. Specifically, in May 1994, the Deputy Secretary of Defense approved a plan to strengthen the implementation of CTR projects. Under this plan, the CTR policy office was responsible for negotiating agreements with recipient countries, establishing policy guidance, working on the CTR budget, and notifying Congress of developments in the program. After CTR policy approved a project and signed an agreement to begin work, AT&L was responsible for developing detailed implementation plans, monitoring ongoing work, and ensuring that work was meeting cost, schedule, and performance goals. However, DOD left several AT&L positions vacant until 2003, leaving a critical gap in oversight over the CTR program. The CTR policy office began managing daily CTR project activities to fill this leadership gap. However, according to the director of the policy office, staff in that office were not qualified to manage the activities of the program because they were not familiar with DOD acquisition guidelines nor did they have the technical expertise necessary to manage CTR programs. According to a 2004 DOD Inspector General (IG) report on the management of the CTR program, if the AT&L positions had been filled, those officials might have identified some of the risks involved in the two failed CTR projects that cost DOD nearly $200 million. Since the AT&L positions were filled in July 2003, the office now participates in CTR program planning and review, overseeing program review meetings, and providing guidance on issues such as performance measurement and reporting requirements. The Deputy Assistant Secretary of Defense for Chemical Demilitarization and Threat Reduction attends informal monthly meetings with CTR program managers to be updated on the status of projects and other management issues. He also serves as the program reviewer for several CTR projects, making him responsible for overseeing the cost, schedule, and performance of each of those projects and approving them at the end of each project phase. For example, in July 2004, he approved a biological weapons proliferation prevention project’s acquisition program baseline and authorized the program manager to move the project into the demonstration phase. CTR officials stated that it is now clear who they need to report to and when. DOD uses several new methods to assess and mitigate risks associated with CTR projects. DOD identifies a senior official responsible for ensuring the potential risks to meeting objectives are evaluated for each project, requires stakeholders on each project to meet regularly to conduct specific risk management activities, and implements each project in three phases. According to DOD’s risk management guide, risk is defined as a measure of the potential inability of a program to achieve its overall program objectives within defined cost, schedule, and technical constraints. DOD’s approach to assessing program risks was limited prior to 2003. In September 1996, we reported that the CTR multiyear plan did not indicate whether program officials had omitted risk and contingencies from project cost estimates. In addition, a 2003 DOD IG report found that DOD did not identify risks or have adequate controls in place to mitigate risk when managing projects. According to a CTR official, CTR program and project managers periodically included risk assessments in planning their projects, but did not include actions to control the risks identified if problems occurred. The DOD IG reported that the CTR program management’s failure to fully assess project risks contributed to DOD spending nearly $200 million on projects in Russia to construct a liquid rocket fuel disposition facility that was never utilized and to design a solid rocket motor elimination facility that was never constructed. In an effort to improve assessments of the risks associated with CTR projects, DOD began designating an official, known as the Milestone Decision Authority (MDA), to be responsible for ensuring that project managers, with assistance from project stakeholders, assess the risks to meeting project objectives and formulate plans to mitigate these risks. MDAs are assigned to projects based on several factors, including the project’s risk and expected cost. According to an AT&L official, the Deputy Assistant to the Secretary of Defense for Chemical Demilitarization and Threat Reduction is usually assigned as the MDA for high-cost or high-risk projects. For projects with less risk or expense, the MDA is usually the director of the DTRA/CT directorate. MDAs review the risks identified by the project managers and evaluate the plans they have developed to mitigate these risks. In addition, DOD instituted periodic stakeholders meetings to assess and minimize risks associated with CTR projects and to discuss major project issues and milestones.