The sale or transfer of U.S. defense items to friendly nations and allies is an integral component of both U.S. national security and foreign policy. The U.S. government authorizes the sale or transfer of military equipment, including spare parts, to foreign countries either through government-to-government agreements or through direct sales from U.S. manufacturers. The Arms Export Control Act and the Foreign Assistance Act of 1961 authorize the DOD foreign military sales program. From 1993 through 2002, DOD delivered over $150 billion worth of services and defense articles to foreign countries through foreign military sales programs administered by the military services. The articles sold include classified and controlled cryptographic spare parts. The Department of State sets overall policy concerning which countries are eligible to participate in the DOD foreign military sales program. DOD identifies military technology that requires control when its transfer to potential adversaries could significantly enhance a foreign country’s military or war-making capability. Various agencies such as the Department of State and DOD are responsible for controlling, in part, the transfer or release of military technology to foreign countries. The Defense Security Cooperation Agency, under the direction of the Under Secretary of Defense for Policy, has overall responsibility for administering the foreign military sales program, and the military services generally execute the sales agreements with the individual countries. A foreign country representative initiates a request by sending a letter to DOD asking for such information as the price and availability of goods and services, training, technical assistance, and follow-on support. Once the foreign customer decides to proceed with the purchase, DOD prepares a Letter of Offer and Acceptance stating the terms of the sale for the items and services to be provided. After this letter has been accepted, the foreign customer is generally required to pay, in advance, the amounts necessary to cover the costs associated with the services or items to be purchased from DOD and then is allowed to request spare parts through DOD’s supply system. Generally, the military services use separate automated systems to process requisitions from foreign countries for spare parts. While the Air Force has retained responsibility for its system, responsibility for the Army’s and the Navy’s systems was transferred to the Defense Security Assistance Development Center in October 1997. The Center, which is part of the Defense Security Cooperation Agency, has overall responsibility for providing system information technology maintenance support, such as testing the system. For blanket orders, the systems use various codes and item identifiers to restrict the spare parts available to the countries. In cases where the systems validate a requisition, the requisition is sent to a supply center to be filled and shipped. In cases where the systems reject a requisition, the requisition is sent to a country manager for review. The country manager will either validate the requisition and forward it to the supply center to be filled and shipped or reject the requisition, in which case the requisition is canceled. Our reviews showed that the Army, the Navy, and the Air Force were not testing their automated systems to ensure that the systems were accurately reviewing and approving blanket order requisitions for compliance with restrictions and operating in accordance with foreign military sales policies. Our tests of the services’ automated systems used to manage foreign countries’ requisitions for spare parts made through blanket orders showed that classified and controlled spare parts that the services did not want released were being released to countries. For example, we identified 5 out of 38 blanket order requisitions for which the Navy’s system approved and released 32 circuit card assemblies’ controlled cryptographic spare parts to foreign countries. According to Defense Security Assistance Development Center officials, who are responsible for this portion of the Navy’s system, the system was not programmed to review the controlled cryptographic items codes, and as a result, the system automatically approved and released the parts requested by the foreign countries. Navy and DOD officials were unaware that the system was not reviewing controlled cryptographic parts prior to their release to foreign countries. For another example, the Air Force’s system used controls that were based on supply class restrictions and that were ineffective and resulted in erroneously approving requisitions for shipment. Included in an item’s national stock number is a four-digit federal supply class, which may be shared by thousands of items. The national stock number also contains a nine-digit item identification number that is unique for each item in the supply system. We found that countries requisitioning parts under the Air Force’s system could obtain a classified or controlled spare part by using an incorrect, but unrestricted, supply class with an item’s correct national item identification number. The Air Force was unaware of this situation until our test of the system identified the problem. In response to our work, the Air Force corrected the problem. GAO’s internal control standards require periodic testing of new and revised software to ensure that it is working correctly, while the Office of Management and Budget’s internal control standards require periodic reviews to determine how mission requirements might have changed and whether the information systems continue to fulfill ongoing and anticipated mission requirements. The importance of testing and reviewing systems to ensure that they are operating properly is highlighted in the Federal Information Security Management Act of 2002. The act requires periodic testing and evaluation of the effectiveness of information security controls and techniques. Moreover, the act requires agencies, as part of their information security program, to include a process for planning, implementing, evaluating, and documenting remedial actions to address deficiencies. Under guidance from the Office of Management and Budget, agencies are to develop a Plan of Actions & Milestones to report on the status of remediation efforts. This plan is to list information security weaknesses, show estimated resource needs or other challenges to resolving them, key milestones and completion dates, and the status of corrective actions. In commenting on our prior reports, DOD either concurred or partially concurred with our recommendations for testing the services’ requisition- processing systems. The department, however, does not have a plan specifying the remedial actions to be taken to implement these recommendations. If actions are not taken to implement testing and reviews, the potential benefits of these controls in preventing the inadvertent release of classified or controlled spare parts may not be realized. Regarding our recommendation to periodically test the Army’s system, DOD concurred and stated that testing of the Army system and its logic would occur, given the funding and guidance required to do so. In response to our recommendation to periodically test the Navy’s system, DOD concurred. Concerning our recommendation to periodically test the Air Force’s system, DOD partially concurred and stated that a program was being developed to test new modifications to the Air Force’s system and that testing of old modifications would be an ongoing effort. Testing only the modifications to the Air Force’s system, as DOD commented, will not necessarily ensure that the system’s logic is working correctly. Subsequently, the Air Force concurred with our recommendation and reported that it had modified its system and would be conducting annual tests of the system’s logic. The Defense Security Cooperation Agency and the military services are developing a new automated system, the Case Execution Management Information System, to process foreign military sales requisitions. The new system will replace the services’ existing legacy systems with a standard DOD system. DOD expects to deploy the new system in fiscal year 2007. Internal control standards requiring testing will be applicable to the new system. Our reviews showed that the Navy’s and the Air Force’s systems allowed country managers, who are responsible for managing the sale of items to foreign countries, to override system decisions not to release to foreign countries classified or controlled parts that are requisitioned under blanket orders. We identified instances where Navy and Air Force country managers overrode the systems’ decisions without documenting their reasons for doing so. For example, of the 123 Air Force requisitions we reviewed, the Air Force’s system identified 36 requisitions for country manager review. For 19 of the requisitions, the managers overrode the system’s decisions and shipped classified and controlled spare parts without documenting their reasons for overriding the system. The managers we queried could not provide an explanation for overriding the system. In 1999, the Army modified its system to reject requisitions that are made under blanket orders for classified or controlled parts. As a result, Army country managers were precluded from manually overriding the Army system’s decisions. Compared with the Navy’s and the Air Force’s systems, the Army’s system provides more stringent protection against releasing classified or controlled parts that are not authorized for release under blanket orders to foreign countries. Preventing the inadvertent release of classified and controlled spare parts that are not authorized for release under blanket orders to foreign countries deserves the highest level of management attention. The preemptive nature of testing and reviewing systems allows this internal control to identify system weaknesses prior to the inadvertent release of classified or controlled spare parts. Had the services conducted periodic tests of their systems, the instances of releasing spare parts that DOD did not want released that we identified in our reports could have been significantly reduced, if not eliminated. Developing effective corrective action plans is key to ensuring that remedial action is taken to address significant information-system internal control deficiencies. We believe the department could demonstrate its commitment to addressing this systemic weakness by providing specific information on its planned remedial actions. Documenting country managers’ decisions to override system decisions is a control that could help prevent the release of classified or controlled parts that are not authorized for release under blanket orders to a foreign country. However, modifying systems, as the Army did, to reject requisitions that are made under blanket orders for classified or controlled parts and to preclude country managers from manually overriding system decisions would provide more stringent protection against releasing classified or controlled parts that are not authorized for release under blanket orders to a foreign country.