The Department of Defense (DOD) relies on IT systems to support its day-to-day operationsâincluding human capital, health care, contracting, and financial management. Â
DOD plans to spend billions to update and maintain these IT systems. Thatâs a lot of money, and there are concerns that some of it might be lost to fraud. Historically, DOD has struggled to prevent fraudâlosing as much as $11 billion in fiscal years 2017 through 2024. Â
Todayâs WatchBlog post looks at our new report on the sources and risk of fraud in DODâs IT plans, and how it can be prevented.Â
DODâs Planned Costs for the Four Largest IT Business Systems, FY 2024-2026Â
Image
DODâs IT modernization efforts failed to include fraud preventionÂ
DOD has been working to modernize its IT systems for more than 3 decades with the goal of improving how it does business. During the last two fiscal years, the department planned to spend $10.3 billion to update and maintain 18 critical IT business systems. But DODâs plans did not include training for staff to detect fraud in these systems. As a result, billions may have been lost to fraudsters and the systems were left vulnerable to possible cybersecurity attacks.Â
The full extent of fraud affecting DODâincluding its major IT business systemsâis unknown but potentially significant. From fiscal years 2017 through 2024, DOD reported almost $11 billion in confirmed fraud. The scope and scale of DOD contracting makes it inherently susceptible to fraud. For example,Â
- A contractor created a shell company that falsely claimed to be U.S.-based and owned in order to qualify for government contracts. The contractor then sent restricted military data to a foreign manufacturer and supplied DOD with defective military aircraft partsâputting pilots in danger.Â
- Two DOD contracting companies misrepresented their ownership statuses to qualify for contracts they werenât eligible for, defrauding the U.S. of more than $200 million.Â
Similarly, the cybersecurity risks associated with fraud are also potentially significant:Â
- Recently, a DOD contractor paid $8.4 million to resolve allegations that it failed to implement required cybersecurity protections, putting sensitive information at risk.Â
- A software developer failed to comply with cybersecurity requirements outlined in its contract. It put DOD information at risk by using unapproved third-party email hosting and failing to put required system protections in place.Â
What is DOD doing to manage fraud risk and what more is needed?
DOD has struggled to manage fraud for decades, which is why we added fraud risk management at DOD to our High Risk List in 2025. DOD has a general anti-fraud strategy that includes some training regarding fraud and cybersecurity. But, despite this, we found that DOD hadnât taken important steps to prevent fraud. Â
For example, it hadnât assessed fraud risks to five of the 18 IT systems we looked at. And DOD didnât know whether it had assessed fraud risks for another three of the systems. Similarly, the staff meant to manage these systems had not received training needed to detect and prevent fraud. We found that staff managing 11 of the 18 IT systems we looked at hadnât received this training over the past 2 years. Â
DOD should do more to protect its critical IT systems. This includes taking steps to promote anti-fraud awareness. Without training to recognize fraud in IT systems, DOD could fail to recognize fraud when it occurs. This includes recognizing when contractors may use substandard software or omit key required protections. Without safeguards against fraud, DOD potentially puts sensitive information at risk and wastes taxpayer dollars.Â
Learn more about this issue by reading our full report. Â
- GAOâs fact-based, nonpartisan information helps Congress and federal agencies improve government. The WatchBlog lets us contextualize GAOâs work a little more for the public. Check out more of our posts atâ¯GAO.gov/blog.â¯â¯Â
- Got a comment, question? Email us atâ¯blog@gao.gov.â¯â¯â¯Â
GAO Contacts
Image
Image
Related Products
GAO’s mission is to provide Congress with fact-based, nonpartisan information that can help improve federal government performance and ensure accountability for the benefit of the American people. GAO launched its WatchBlog in January, 2014, as part of its continuing effort to reach its audiencesâCongress and the American peopleâwhere they are currently looking for information.
The blog format allows GAO to provide a little more context about its work than it can offer on its other social media platforms. Posts will tie GAO work to current events and the news; show how GAOâs work is affecting agencies or legislation; highlight reports, testimonies, and issue areas where GAO does work; and provide information about GAO itself, among other things.
Please send any feedback on GAO’s WatchBlog to blog@gao.gov.
Source: WatchBlog: Official Blog of the U.S. Government Accountability Office
