- GAO recommended fraud risk training for staff of 18 Pentagon IT programs worth $10.29 billion
- Seven programs reported staff lacked or were unaware of training to identify IT system fraud
- Twelve programs reported using zero trust as the department works toward its 2027 deadline
The Government Accountability Office has recommended that the Department of War strengthen fraud risk training at 18 major IT business programs carrying $10.29 billion in planned spending, aiming to reduce their exposure to fraud. The watchdog also reviewed the programs’ cost, schedule, performance, software development and cybersecurity practices.
What Did GAO Recommend for Pentagon IT Fraud Risk Management?
GAO said in its seventh annual assessment of the programs, published Monday, that the secretary of war should direct the Pentagon chief information officer to work with the comptroller’s office on fraud-focused training for program staff. Training would cover fraud awareness, fraud risks in specific functional settings and risk assessment activities.
The watchdog also reiterated six unimplemented recommendations from prior reviews. In response, the department partially agreed and said the comptroller oversees fraud risk management, while GAO said the CIO must still coordinate with that office.
How Many Pentagon IT Programs Reported Fraud Awareness Training?
Eleven of the 18 programs reported that staff received fraud awareness training in the past two years, while seven said staff lacked or were unaware of training to identify and report IT system fraud or tampering. Ten programs reported assessing fraud risks, five had not and three did not know.
CIO officials said the department requires general fraud awareness training but not IT-specific instruction. According to GAO, the gaps could leave programs exposed to software development- and cybersecurity-related fraud.
How Are Pentagon IT Programs Advancing Zero Trust and Cybersecurity?
Fifteen of the 18 programs reported having an approved cybersecurity strategy, and 12 reported implementing zero trust architecture at different levels ahead of the department’s 2027 deadline. Three of the six programs not yet using zero trust reported plans to adopt it. Five programs said they use artificial intelligence tools for threat detection and vulnerability assessment to secure their systems. The department has two approved zero trust assessment teams, and its Zero Trust Portfolio Management Office is working to add more, officials from the CIO’s office said.
Which Pentagon IT Business Programs Account for the Most Spending?
Four programs accounted for $5.12 billion, or nearly half, of the portfolio’s planned costs: Navy Enterprise Resource Planning, the Defense Healthcare Management System Modernization, the Army’s Integrated Personnel and Pay System and Advancing Analytics, or Advana.
Operations and sustainment made up 74 percent of total planned spending, and the 18 systems average 18 years old. Eleven programs reported cost or schedule changes since January 2024, with seven reporting delays of two to 12 months. Of the 17 operational programs, 15 tracked the minimum required performance metrics.
