The transfer of defense items to friendly nations and allies is an integral component in both U.S. national security and foreign policy. The U.S. government authorizes the sale or transfer of military equipment, including spare parts, to foreign nations either through government-to-government agreements or through direct sales from U.S. manufacturers. The Arms Export Control Act and Foreign Assistance Act of 1961, as amended, authorize the DOD foreign military sales program. The Department of State sets the overall policy concerning which countries are eligible to participate in the foreign military sales program. DOD, through the military services, enters into foreign military sales agreements with individual countries. The Air Force Security Assistance Center, which is an activity of the Air Force Materiel Command, is responsible for the administration of the Air Force’s foreign military sales program. The center’s responsibilities start with the initial negotiation of the foreign military sale and end with the delivery of parts and completion of all financial aspects of the agreements. The center uses an automated management information system, the Security Assistance Management Information System, to support its management of the program with accurate and timely information. For blanket order cases, the system uses criteria such as an item’s national item identification number, a federal supply class, or a federal supply group to restrict the parts available to foreign military sales customers. Once the system has verified a country’s eligibility and approved a requisition, the requisition is sent to a supply center to be filled and shipped. The overall foreign military sales process, as it applies to the Air Force, is shown in figure 1. This report addresses the portion of the process relating to the Air Force’s approval or disapproval of foreign countries’ requisitions for classified and controlled spare parts under blanket order cases. Blanket orders are for a specific dollar value and generally cover classes of parts that a country may need rather than a specific item within a class. Under blanket orders, the Air Force restricts classes of items, such as munitions and nuclear spare parts, from being requisitioned. The Air Force’s internal controls for foreign military sales using blanket orders are not adequate to prevent countries from ordering and receiving classified and controlled spare parts that they are not eligible to receive. We found that (1) controls based on supply class restrictions were ineffective and resulted in erroneously approved requisitions for shipment, and that written policies for recovering the erroneously shipped items did not exist; (2) the Air Force did not validate modifications to its Security Assistance Management Information System related to blanket orders or test the system’s logic for restricting requisitions, and (3) command country managers did not always document reasons for overriding either the Security Assistance Management Information System or foreign military sales case manager recommendations not to ship classified spare parts. As a result of these inadequate internal controls, classified and controlled spare parts were shipped to countries not authorized to receive them. The Air Force Security Assistance Center has taken or plans to take actions to correct these issues. Foreign country requisitions for classified and controlled spare parts were erroneously validated, as a result of an incorrect federal supply class, by the Air Force’s Security Assistance Management Information System. The Air Force attempts to prevent countries from obtaining classified and controlled spare parts by restricting them from receiving spare parts that belong to selected federal supply classes. Included in the national stock number is a four-digit federal supply class (see fig. 2), which may be shared by thousands of items. The national stock number also contains a nine-digit national item identification number that is unique for each item in the supply system. A country can obtain a classified or controlled spare part by using an incorrect, but unrestricted, supply class with an item’s correct national item identification number. We found that because the Security Assistance Management Information System was not properly programmed, it erroneously validated 35 blanket order requisitions (of the 123 in our review), even though an incorrect supply class number was used, because the countries used supply classes that were not restricted. For example, in one case, the Air Force restricted countries from requisitioning parts belonging to the 1377 federal supply class (cartridge- and propellant-actuated devices and components) on blanket orders. The restriction included an outline sequencer (national stock number –1377010539320) used on ejection seats for various aircraft. The country ordered the sequencer using national stock number 1680010539320. Because supply class 1680 (miscellaneous aircraft accessories and components) was not restricted and the Security Assistance Management Information System did not verify that 1680 was the correct supply class for national item identification number 010539320, the system approved the requisition. Had the system validated the entire 13-digit national stock number, it would have found that the number was incorrect and would not have approved the requisition. Subsequently, the item manager recognized that 1680 was not the correct federal supply class and corrected the supply class to 1377 before the part was shipped. This example is summarized in figure 3. Air Force officials were unaware of this situation until our review identified the problem. In another case, involving the restricted 1377 federal supply class, a country ordered a restricted battery power supply for the F-16 aircraft using national stock number 6130013123511. Because supply class 6130 (nonrotating electrical converters) was not restricted and the Security Assistance Management Information System did not verify the entire 13- digit national stock number, the requisition was approved. The Air Force shipped the restricted battery power supply to the country. Neither the Air Force nor the center had written policies or procedures in place for recovering the items erroneously shipped. Without these types of policies and procedures, the Air Force cannot be assured that appropriate steps will be taken to recover the parts. Air Force Security Assistance Center officials agreed that the supply class restrictions alone were ineffective and could be bypassed by use of inaccurate supply class information. The Air Force has not validated modifications to the Security Assistance Management Information System that restrict parts that countries can requisition, and has not tested the system’s logic for restricting requisitions since 1998 to ensure that it is working properly. As a result, modifications that were not properly made went undetected, and foreign countries were able to requisition and obtain controlled spare parts that the Air Force was trying to restrict. For example, the Air Force instructed programmers to modify a table of restrictions in the Security Assistance Management Information System to prevent certain countries from using blanket orders to requisition controlled bushings in the 5365 supply class. Although Air Force Security Assistance Center officials subsequently told us that the bushings had been improperly restricted, we found that, for 18 of the 123 requisitions we reviewed, countries had ordered and received the bushings, because the Security Assistance Management Information System was incorrectly programmed and did not identify the requisitions as requiring a review by command country managers. After we brought the transactions to the attention of Air Force Security Assistance Center officials, they investigated and found that programmers had entered the restrictions in the wrong area of the system. Because the Air Force had not validated that system modifications were properly made, the system had approved the requisitions. Although the Air Force later determined that the bushings should not have been restricted, this example nevertheless demonstrates the need to validate system changes. The Air Force does not periodically test the Security Assistance Management Information System to ensure that it accurately reviews requisitions for compliance with restrictions. For example, when the system is working correctly, it will identify restrictions relating to parts, such as ammunition or nuclear spare parts, and will disapprove requisitions from countries that are ineligible to order these parts. Air Force Security Assistance Command officials said that the system had not been tested since 1998 to ensure that it accurately reviews requisitions for compliance with restrictions. When we tested the system’s ability to restrict items based on their federal supply class, we found that the system did not always perform as intended. As discussed earlier, the system did not perform as intended because countries could requisition and obtain classified and controlled spare parts using an incorrect, but unrestricted, federal supply class with an item’s correct national item identification number. In the Federal Information System Controls Audit Manual, which lists internal control activities for information systems, one of the control activities listed involves the testing of new and revised software to ensure that it is working correctly. In addition, management of federal information resources rules require agencies to establish information system management oversight mechanisms that provide for periodic reviews to determine how mission requirements might have changed and whether the information system continues to fulfill ongoing and anticipated mission requirements. Further, DOD’s ADP Internal Control Guidelineat the time stated that periodic reviews of systems should be conducted to determine if they operate as intended. According to Air Force Security Assistance Center officials, there have been few changes to the table of restrictions in the system. However, they did agree that existing changes need to be validated and were working to accomplish this. Based on our observations, the Air Force’s failure to validate modifications and test model logic is in part due to an unquestioning confidence in the Security Assistance Management Information System’s ability to correctly restrict the requisitioning of classified and controlled spare parts. Command country managers did not always document reasons for overriding Security Assistance Management Information System or foreign military sales case manager recommendations not to ship classified spare parts. According to the Standards for Internal Control in the Federal Government, all transactions and other significant events need to be clearly documented. The standards state that such documentation should be properly managed and maintained and should be readily available for examination. Of the 123 requisitions we reviewed, the Security Assistance Management Information System identified 36 requisitions for command country manager review. For 19 of the requisitions, command country managers overrode the system recommendations and shipped classified and controlled spare parts without documenting the reasons for overriding the system.