Combating Terrorism: Chemical and Biological Medical Supplies Are Poorly
Managed (Letter Report, 10/29/1999, GAO/HEHS/AIMD-00-36).

Pursuant to a congressional request, GAO reviewed the federal
government's management of chemical and biological medical supplies,
focusing on the: (1) accuracy and currency of the inventory tracking
systems for federal medical stockpiles that would be used to treat the
civilian population following a chemical or biological terrorist attack;
and (2) internal controls in place to manage the stockpiles.

GAO noted that: (1) the U.S. ability to effectively respond to chemical
or biological terrorist incidents is compromised by poor management
controls and the lack of required items; (2) GAO's physical inventory of
the Office of Emergency Preparedness' (OEP) stockpiles, which the
Department of Veterans Affairs (VA) manages, compared with OEP's
required list showed a discrepancy of more than 12 percent; (3) although
most discrepancies were overages, GAO also found shortages; (4) GAO
found 3,400 excess gloves at one location and 400 extra diazepam vials
at another; (5) GAO also found that the inventory was short of 1,000
required diazepam injectors at one location and another location had 500
fewer vials of diazepam than required; (6) in addition, when GAO
compared its inventory with VA's inventory records, GAO found expired
items; (7) at one location, the entire amount of amyl nitrate listed in
VA's records had expired 8 months before GAO's visit, and at another
location GAO found more than 400 vials of pralidoxime whose expiration
date was recorded incorrectly; (8) in comparing the Marine Corps
Chemical Biological Incident Response Force's (CBIRF) medical supplies
with the records in its inventory tracking system, for approximately 26
percent of the inventory items GAO found either discrepancies between
the inventory records and the amount in stock or errors in the recording
of lot numbers and expiration dates; (9) the principal cause of problems
GAO identified is that the responsible federal agencies did not
implement basic internal controls that would reasonably assure that all
medical supplies and pharmaceuticals are current, accounted for, and
available for use; (10) consistent with the Federal Managers' Financial
Integrity Act of 1982, agencies should have efficient and effective
internal controls over their operations and programs; (11) neither OEP
nor CBIRF explained its lack of compliance, and GAO identified problems
in all major aspects of internal controls; (12) as a result, these
systems cannot be relied upon to consistently and accurately account for
the items required to be in the stockpiles; (13) even more will be at
stake in the future as the Centers for Disease Control and Prevention
(CDC) establishes the National Pharmaceutical Stockpile Program; and
(14) although CDC is still in the early phases of developing this
program, its current plan does not include comprehensive internal
controls to prevent the types of problems found at the other agencies.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  HEHS/AIMD-00-36
     TITLE:  Combating Terrorism: Chemical and Biological Medical
	     Supplies Are Poorly Managed
      DATE:  10/29/1999
   SUBJECT:  Internal controls
	     Noncompliance
	     Medical supplies
	     Inventory control systems
	     Terrorism
	     Chemical warfare
	     Biological warfare
	     Emergency preparedness
IDENTIFIER:  CDC National Pharmaceutical Stockpile Program

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO report.  Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved.  Major          **
** divisions and subdivisions of the text, such as Chapters,    **
** Sections, and Appendixes, are identified by double and       **
** single lines.  The numbers on the right end of these lines   **
** indicate the position of each of the subsections in the      **
** document outline.  These numbers do NOT correspond with the  **
** page numbers of the printed product.                         **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
** A printed copy of this report may be obtained from the GAO   **
** Document Distribution Center.  For further details, please   **
** send an e-mail message to:                                   **
**                                                              **
**                                            **
**                                                              **
** with the message 'info' in the body.                         **
******************************************************************

Cover
================================================================ COVER

Report to Congressional Committees

October 1999

COMBATING TERRORISM - CHEMICAL AND
BIOLOGICAL MEDICAL SUPPLIES ARE
POORLY MANAGED

GAO/HEHS/AIMD-00-36

Combating Terrorism

(406169)

Abbreviations
=============================================================== ABBREV

  CBIRF - Chemical Biological Incident Response Force
  CDC - Centers for Disease Control and Prevention
  DOD - Department of Defense
  EMSHG - Emergency Management Strategic Healthcare Group
  EPS - Emergency Pharmacy Services
  FEMA - Federal Emergency Management Agency
  FMFIA - Federal Managers' Financial Integrity Act of 1982
  HHS - Department of Health and Human Services
  OEP - Office of Emergency Preparedness
  OMB - Office of Management and Budget
  RRIS - Rapid Response Information System
  SAMS - Ships Automated Management System
  VA - Department of Veterans Affairs

Letter
=============================================================== LETTER

B-282839

October 29, 1999

The Honorable Arlen Specter, Chairman
Committee on Veterans' Affairs
United States Senate

The Honorable John Rockefeller
Ranking Minority Member
Committee on Veterans' Affairs
United States Senate

The Honorable Christopher Shays, Chairman
Subcommittee on National Security, Veterans' Affairs,
 and International Affairs
Committee on Government Reform
House of Representatives

The Honorable Ike Skelton
Ranking Minority Member
Armed Services Committee
House of Representatives

The threat of chemical or biological terrorist attacks against U.S. 
citizens is a high-priority, national concern.  The March 1995
terrorist attack in the Tokyo subway system using the nerve agent
sarin, and other more recent national and international terrorist
incidents have raised concerns about whether the United States can
effectively respond to incidents involving chemical or biological
agents.  Reflecting these concerns, the federal government has
established several stockpiles of antidotes and other medical
supplies and plans to develop a larger national stockpile--referred
to as the National Pharmaceutical Stockpile Program--to be used in
the event of domestic chemical and biological attacks. 

This report responds to your concerns about the adequacy of the
stockpiles.  Our objectives were to (1) review the accuracy and
currency of the inventory tracking systems for federal medical
stockpiles that would be used to treat the civilian population
following a chemical or biological terrorist attack and (2) examine
the internal controls in place to manage the stockpiles.  We
conducted a 100 percent inventory of the existing domestic federal
stockpiles managed by the Department of Veterans Affairs (VA) for the
Department of Health and Human Services' (HHS) Office of Emergency
Preparedness (OEP).  We also conducted a 100 percent inventory of the
medical supplies kept by the Marine Corps Chemical Biological
Incident Response Force (CBIRF), whose mission includes responding to
domestic terrorist events.  We also reviewed the inventories taken
and procedures followed by the vendor storing the Centers for Disease
Control and Prevention's (CDC) smallpox vaccine, although we did not
count the stockpile.  Consistent with our review objectives, we did
not assess the effectiveness and appropriateness of medical
preparedness.  In addition, the threat of chemical and biological
terrorism is the subject of another study we recently published.\1 We
conducted our review from May 1999 through September 1999 in
accordance with generally accepted government auditing standards. 
Details of our scope and methodology are in appendix I. 

--------------------
\1 Combating Terrorism:  Need for Comprehensive Threat and Risk
Assessments of Chemical and Biological Attacks (GAO/NSIAD-99-163,
Sept.  7, 1999). 

   RESULTS IN BRIEF
------------------------------------------------------------ Letter :1

The U.S.  ability to effectively respond to chemical or biological
terrorist incidents is compromised by poor management controls and
the lack of required items.  Our physical inventory of OEP's
stockpiles, which VA manages, compared with OEP's required list
showed a discrepancy of more than 12 percent.  Although most
discrepancies were overages, we also found shortages.  For example,
we found 3,400 excess gloves at one location and 400 extra diazepam
vials (a controlled substance) at another.  We also found that the
inventory was short of 1,000 required diazepam injectors at one
location and at another location had 500 fewer vials of diazepam than
required.  In addition, when we compared our inventory with VA's
inventory records, we found expired items.  At one location, the
entire amount of amyl nitrate listed in VA's records (2,000 vials)
had expired 8 months before our visit, and at another location we
found more than 400 vials of pralidoxime whose expiration date was
recorded incorrectly.  In comparing CBIRF's medical supplies with the
records in its inventory tracking system, for approximately 26
percent of the inventory items we found either discrepancies between
the inventory records and the amount in stock or errors in the
recording of lot numbers and expiration dates. 

The principal cause of problems we identified is that the responsible
federal agencies did not implement basic internal controls that would
reasonably assure that all medical supplies and pharmaceuticals are
current, accounted for, and available for use.  Consistent with the
Federal Managers' Financial Integrity Act of 1982 (FMFIA), agencies
should have efficient and effective internal controls over their
operations and programs.  Neither OEP nor CBIRF explained its lack of
compliance, and we identified problems in all major aspects of
internal controls--control environment, risk assessment, control
activities, information and communications, and monitoring.  For
example, their systems lacked basic information required for good
recordkeeping, such as documentation of back orders, replacements,
and shipment and receipt of all pharmaceutical and medical supplies. 
They also did not conduct periodic inventories, maintain program
policies and procedures, or provide adequate security of the
stockpiles.  As a result, these systems cannot be relied upon to
consistently and accurately account for the items required to be in
the stockpiles. 

Even more will be at stake in the future as CDC establishes the
National Pharmaceutical Stockpile Program.  Although CDC is still in
the early phases of developing this program, its current plan does
not include comprehensive internal controls to prevent the types of
problems we found at the other agencies.  To reasonably assure the
proper management of this new stockpile, as well as to correct
deficiencies in the others, we are recommending actions to improve
the internal control programs for the federal chemical and biological
medical stockpiles. 

   BACKGROUND
------------------------------------------------------------ Letter :2

The United States has established national policy for combating
chemical and biological terrorism and managing the consequences of
terrorist attacks.  The Federal Emergency Management Agency (FEMA) is
the lead agency for managing the consequences of terrorist attacks,
with the authority to assign missions to any federal agency in the
event of a disaster or emergency declared by the president.\2 FEMA
coordinates the federal response through a contingency plan, known as
the Federal Response Plan, that details the roles and
responsibilities of federal agencies during natural or manmade
emergencies.  The plan also categorizes types of federal assistance
into specific emergency support functions (for example, information
and planning, health and medical services, urban search and rescue). 

As we reported earlier, If the consequences of a terrorist threat
become imminent or actually occur, state and local authorities would
initiate consequence management actions, while FEMA would monitor the
situation in consultation with the President and the governor.  If
state and local capabilities are overwhelmed, the President could
then direct FEMA, with the support of appropriate federal agencies,
to assist."\3 FEMA, through the Federal Response Plan, has designated
HHS as the lead agency to coordinate medical assistance in the event
of a federally declared natural or manmade disaster, including
chemical or biological terrorist incidents.  Within HHS, OEP is
responsible for implementing and coordinating this medical
assistance, and in 1997 it established four National Medical Response
Teams, each with a medical stockpile containing antidotes,
antibiotics, and medical supplies for responding to chemical
terrorist attacks.  OEP also maintains one smaller stockpile that
contains only antidotes for chemical incidents; this stockpile can be
loaned to local governments or predeployed for special events, such
as the Olympics.  OEP's stockpiles are positioned throughout the
United States, and all but one are located at federally owned
facilities.  While OEP is responsible for these stockpiles, through
an interagency agreement, it has delegated day-to-day management to
VA. 

CBIRF, created in 1996 by the Commandant of the Marine Corps,
maintains a working stock of medical supplies to respond to chemical
and biological incidents.\4 CBIRF is the only Department of Defense
(DOD) unit whose mission includes responding to and treating civilian
victims of chemical or biological terrorist attacks.  Its staff
includes a medical unit of 27 Navy personnel who manage the working
stock of pharmaceuticals and medical supplies.  CBIRF also uses local
government stockpiles where available to treat civilians. 

In 1998, the Congress appropriated $51 million for CDC to acquire a
pharmaceutical and vaccine stockpile to counter potential biological,
disease, and chemical threats to civilian populations.\5

Currently, CDC is developing its plans to accumulate these medical
supplies, and it has also recently transferred $1.4 million of the
$51 million to OEP to augment its supply of antidotes for chemical
attacks.  For the past 26 years, CDC has also maintained the nation's
stockpile of smallpox vaccine through a contract with the
manufacturer.  This vaccine can be used against a terrorist release
of smallpox. 

In addition to federal efforts, state and local agencies have the
responsibility for providing first response medical assistance to
the civilian population in natural and manmade disasters, including
chemical or biological terrorist attacks.  If state and local
capacities are overwhelmed by a disaster, federal assets such as the
chemical and biological medical supplies that CDC, CBIRF, and OEP
stockpile could be deployed to augment local responses. 

FMFIA requires GAO to issue standards for internal control in
government.  The standards provide the overall framework for internal
control, and the Office of Management and Budget (OMB) Circular
A-123, Management Accountability and Control, revised June 21, 1995,
provides the specific requirements for assessing and reporting on
controls. 

--------------------
\2 Under the Robert T.  Stafford Disaster Relief and Emergency
Assistance Act (P.L.  93-288), as amended. 

\3 Combating Terrorism:  Federal Agencies' Efforts to Implement
National Policy and Strategy (GAO/NSIAD-97-254, Sept.  26, 1997).  In
1997, under section 1417 of title XIX of the Defense Against Weapons
of Mass Destruction Act of 1996, FEMA developed and implemented a
Rapid Response Information System (RRIS), which can be accessed on
the Internet.  The RRIS contains data on federal assets, such as
decontamination units, and training programs available to assist
terrorist response operations of state and local governments.  It
does not contain information on the contents of the existing federal
stockpiles for responding to chemical or biological terrorist
incidents. 

\4 CBIRF officials refer to the medical supplies they maintain as a
working stock.  To simplify our presentation, we refer to CBIRF's
medical supplies as a stockpile. 

\5 The Omnibus Consolidated and Emergency Supplemental Appropriations
Act (P.L.  105-277). 

   INVENTORY TRACKING SYSTEMS ARE
   NEITHER CURRENT NOR ACCURATE
------------------------------------------------------------ Letter :3

Our complete inventory of the OEP and CBIRF stockpiles showed that
neither inventory control system accurately tracks federal medical
supplies.  Our comparison of OEP's list of required items with our
physical inventory revealed discrepancies for about 23,000 items, or
more than 12 percent, across the five sites.\6 Although most
discrepancies were overages, others involved items that were stocked
in a smaller quantity than required or were not in stock at all.  For
instance, some of the overages at individual sites included about 600
extra amyl nitrate inhalants; a total of 3,400 small, medium, and
large pairs of gloves; about 1,000 potassium iodide tablets; and
1,000 diazepam injectors.  Shortages included about 300 pralidoxime
vials, 100 diazepam vials, and at two locations almost 300 potassium
iodide tablets at each site.  In addition, OEP's list required 1,000
diazepam injectors in the stockpile; however, at one location, we
found none, and none were recorded in VA's inventory record.  At
another location, we found 500 fewer vials of diazepam than required. 

Our comparison of OEP's stockpiles with VA's computerized inventory
records revealed a discrepancy of more than 11 percent.  For the most
part, discrepancies occurred in three categories--overages,
shortages, and items for which lot numbers and expiration dates were
recorded incorrectly.  At one location, we found about 600 more amyl
nitrate inhalants than recorded; we found 1,600 extra pairs of gloves
at another location and 250 extra doxycycline tablets at another. 
Some shortages included 100 vials of diazepam, 100 Mark I injectors
(a chemical antidote), and 250 doxycycline tablets.  Items recorded
incorrectly included 2,000 amyl nitrate inhalants, which had expired
8 months before our visit, and about 440 pralidoxime vials, 250
doxycycline tablets, and 100 ciprofloxacin tablets, whose expiration
dates and lot numbers were recorded incorrectly. 

The Marine Corps CBIRF stockpile had similar problems.  Specifically,
we determined that about 2,300 items of the 38,000-item inventory
list were not in stock.  These items included about 1,500 doses of an
antidote.  In addition, CBIRF's computerized inventory system did not
identify and track 5,700 items that we found in the inventory, such
as oral and nasal airways that would be deployed in response to a
chemical or biological terrorist attack.  However, the computerized
inventory system recorded and tracked other CBIRF medical materials
that would not be used in a chemical or biological incident, such as
training equipment and pharmaceuticals for the general use of the
unit.  Additional details of the results of our inventories are in
appendix II. 

--------------------
\6 When we compared our physical inventory with OEP's required list,
we identified overages and shortages.  We were also able to identify
other incorrectly recorded items when we compared our physical
inventory with VA's inventory records.  See appendix I for an
explanation of how we calculated the discrepancy rates. 

   LACK OF CONTROLS IS THE
   PRINCIPAL CAUSE OF POOR
   INVENTORY MANAGEMENT
------------------------------------------------------------ Letter :4

The root cause of the inventory problems we identified was a
fundamental lack of internal controls, although the agencies did not
explain their lack of compliance with our internal control standards. 
Internal controls, as outlined by our standards for internal control,
provide reasonable assurance that program objectives for effective
and efficient operations, reliable financial reporting, and
compliance with applicable laws and regulations are met.\7 OEP, VA,
and CBIRF did not implement the following five internal control
standards for managing their stockpile programs:  (1) effective
control environment, (2) risk assessments, (3) control activities,
(4) information and communications, and (5) monitoring. 

--------------------
\7 See our exposure draft entitled Internal Control:  Standards for
Internal Control in the Federal Government (GAO/AIMD-99-21.3.1, May
1999). 

      CONTROL ENVIRONMENT
---------------------------------------------------------- Letter :4.1

OEP, VA, and CBIRF did not provide sufficient leadership and
supervision to their own personnel to reasonably assure an adequate
control environment for the stockpiles.  While OEP has overall
responsibility for managing the stockpiles, it has chosen to delegate
day-to-day responsibility for stockpile management to VA through an
interagency agreement.  In delegating its responsibilities for the
stockpiles, OEP did not provide clear guidance to VA on the
requirements and standards that VA should follow to effectively
manage and maintain OEP's stockpiles.  Moreover, VA did not provide
formal guidance or clearly define activities, key duties, and
responsibilities for personnel charged with managing OEP's
stockpiles.  Similarly, the Marine Corps did not provide adequate
guidance to CBIRF concerning the composition of its medical supply
inventory or how to manage it. 

      RISK ASSESSMENT
---------------------------------------------------------- Letter :4.2

OEP, VA, and CBIRF did not determine the hazards and risks that their
stockpiles faced, assess the likelihood of each risk's occurrence,
and establish plans to detect or mitigate them.  For example, neither
OEP nor VA assessed the possibility of the theft of stockpile items
and, therefore, did not have a plan in case a theft occurred.  When
VA personnel counted items at one of OEP's stockpile locations, in
anticipation of our visit, they found that 48 amyl nitrate inhalants
were missing and presumed stolen.  VA replaced the missing items,
waited 30 days before reporting the missing amyl nitrate to OEP, and
then raised concerns about its limited control over the secured
storage and the security of the stockpile.  OEP had neither addressed
nor improved the storage situation at this site by September 1999. 
The location of the missing drugs at this site remains a mystery and
is unresolved between OEP and VA. 

      CONTROL ACTIVITIES
---------------------------------------------------------- Letter :4.3

OEP, VA, and CBIRF did not establish procedures to carry out control
activities and manage the medical stockpiles.  For example, key
duties need to be segregated among different people to reduce the
risk of error and fraud.  However, the same individual who ordered
supplies for OEP's stockpiles also replaced and disposed of items and
recorded all changes in the computerized tracking system.  At CBIRF,
staff entering data into the computer tracking system also
participated in physical inventory counts.  In addition, CBIRF staff
stated that some items are consumed and some are lost during
exercises and are replaced from the warehouse stock, but records of
such consumption and loss are not included in the computer tracking
system.  Both agencies' systems also lacked basic information
required for adequate recordkeeping.  For example, they did not
document back orders, replacements, or the shipment and receipt of
all pharmaceutical and medical supplies. 

We found that all three agencies had not implemented adequate
security measures for their medical stockpiles.  For example, at
three of OEP's five stockpile locations, we found that VA had
comingled OEP's refrigerated supplies in unsecured refrigerators, in
violation of a general maintenance and storage policy established by
VA.  Comingling supplies puts the stockpile items at risk because
more people have access to the items, making them more susceptible to
waste, loss, unauthorized use, and misappropriation.  At one site, a
supply of amyl nitrate--which is a pharmaceutical with a street
value--was stored in a large refrigerator in the VA Inpatient
Pharmacy, comingled with other VA medical center pharmaceuticals.  At
another site, we found that amyl nitrate and an antidote were stored
in an unsecured staff refrigerator along with employees' lunches. 
And at a third site, OEP's refrigerated supplies were stored with
other non-OEP supplies in an unlocked refrigerator outside the secure
area.  VA officials explained that sometimes the secured areas where
OEP's stockpiles are kept do not include electrical outlets needed to
store refrigerated items. 

      INFORMATION AND
      COMMUNICATIONS
---------------------------------------------------------- Letter :4.4

OEP, VA, and the Marine Corps did not require periodic reporting on
program status to agency management.  Communication about stockpile
matters between OEP and VA was infrequent and irregular.  For
example, both OEP and VA officials told us that they had originally
planned to have quarterly teleconferences or meetings about
stockpile-related issues but could demonstrate that only one meeting
had taken place.  Although VA has managed OEP's stockpiles since
April 1997, OEP never requested that VA produce (and VA has not
provided) any regular, formal, written progress or status reports on
the stockpiles. 

We found that the exchange of information on stockpile inventory
status and managerial activities between CBIRF, the Marine Corps, and
the Navy was also lacking.  Marine Corps officials did not
communicate clear expectations about the type, extent, and frequency
of reports they expected CBIRF to produce on the status of its
stockpile or about the type and frequency of oversight the Marine
Corps would exert.  Neither the Navy Medical Command nor the Marine
Corps had ever requested that CBIRF regularly produce written
progress reports, inventory status, or fiscal reports on its
stockpile. 

      MONITORING
---------------------------------------------------------- Letter :4.5

Neither OEP nor VA required or conducted periodic inventories of the
stockpiles to determine whether stockpiled items were current,
accounted for, and available for use.  Although CBIRF periodically
counted items in the stockpile, it does not have an approved
inventory list.  As a result, it cannot determine whether the
stockpile contains all supplies needed to respond to a chemical or
biological terrorist attack.  In contrast, we determined that the
vendor storing the nation's smallpox vaccine for CDC follows
standards for internal control. 

   CDC IS MANAGING A NEW STOCKPILE
   PROGRAM
------------------------------------------------------------ Letter :5

CDC received $51 million in fiscal year 1999 to establish the
nation's National Pharmaceutical Stockpile Program.  It has requested
$52 million for fiscal year 2000 to continue establishing this
stockpile.  Under the program, CDC will stockpile medical supplies to
be used in a biological or chemical attack.  Like OEP, CDC has
selected VA to procure, oversee, and store the national stockpile. 
As the program is currently envisioned, CDC plans to require VA to
begin stockpiling items 14 days after the interagency agreement is
signed.  However, CDC's draft National Pharmaceutical Stockpile
Program plan lacks information on how CDC will review and assess the
stockpile and contractor, what security measures it has to safeguard
the stockpile, and which CDC personnel will manage the stockpile,
stockpile operations, and command, control, and communication
functions. 

   CONCLUSION
------------------------------------------------------------ Letter :6

Sound management of the chemical and biological stockpiles is
critical to the protection of public health in the event of a
terrorist attack.  However, OEP, VA, and the Marine Corps did not
explain why they have not followed the basic standards of internal
control we have set forth.  The poor management controls and lack of
required items in their stockpiles lead us to conclude that they
cannot provide reasonable assurance that the required medical
supplies will be available if needed. 

As the federal agency primarily responsible for emergency
preparedness, OEP did not provide leadership to reasonably assure
that the necessary medical supplies will be current, accounted for,
and available for use.  In the absence of explicit requirements or
oversight from OEP, VA has developed a stockpile management program
without adequate internal control.  CBIRF's inventory management and
tracking system also did not meet basic federal standards for
internal control.  The inventory systems that are supposed to track
and account for the stockpiles of medical supplies to be used in a
chemical or biological attack are inaccurate and unreliable. 

While the current stockpiles are not well managed and lack required
items, even more will be at stake in the future as CDC expands its
new stockpile.  Developing and implementing internal controls needs
to be a fundamental aspect of managing this stockpile to avoid
repeating problems we found at OEP and CBIRF. 

   RECOMMENDATIONS
------------------------------------------------------------ Letter :7

To address the internal control weaknesses identified in this report,
we recommend that the Department of Health and Human Services' Office
of Emergency Preparedness, the HHS Centers for Disease Control and
Prevention, the Marine Corps Chemical and Biological Incident
Response Force, and the Department of Veterans Affairs establish
sufficient systems of internal control over their chemical and
biological stockpile management.  The agencies need to reasonably
assure that personnel carry out the following specific control
activities: 

  -- conduct risk assessments and organize program activities to
     identify and mitigate risks;

  -- arrange for periodic, independent inventories;

  -- implement a tracking system that retains complete documentation
     for all supplies that have been ordered, received, and
     destroyed; and

  -- rotate supplies properly. 

   AGENCY COMMENTS
------------------------------------------------------------ Letter :8

We sent a draft of this report to VA, HHS, and DOD for their review
and comment. 

While VA indicated that this is an important issue, it wanted
additional time to review the results of our inventory and to respond
to us later. 

HHS generally agreed with our findings and recommendations and
reported that it is redefining and adjusting its management oversight
of OEP's stockpiles by drafting a new memorandum of agreement between
VA and OEP.  In addition, it said that CDC has relied on our work to
develop such a memorandum with VA for the National Pharmaceutical
Stockpile Program.  HHS's comments are reproduced in appendix III. 

The Special Assistant to the Assistant to the Secretary of Defense
for Civil Support as well as CBIRF officials acknowledged weaknesses
in CBIRF's inventory management controls and described corrective
actions that DOD intends to take.  For example, CBIRF is in the
process of defining its medical inventory, will institute a risk
assessment and mitigation activities, and will conduct independent
inventories.  DOD officials also told us that CBIRF's primary mission
is to support war fighters, although it also supports civilian
agencies.  For this reason, CBIRF officials asked that we delete
their agency from the report.  However, we believe we appropriately
included CBIRF for two reasons.  First, a Marine Corp document
entitled The Chemical/Biological Incident Response Force states
CBIRF's mission is to respond to chemical or biological incidents
worldwide and, when directed, to assist local civilian and military
agencies.  CBIRF officials also told us that responding to civilian
incidents is a part of their mission.  Second, OEP's plan reflects
its intention to rely on CBIRF to assist in the treatment of civilian
victims.  We have made technical clarifications in response to other
CBIRF comments where appropriate. 

---------------------------------------------------------- Letter :8.1

As we agreed with your offices, unless you publicly announce the
contents of this report earlier, we plan no further distribution of
it until 30 days after its date.  We will then send copies to
appropriate congressional committees and the federal agencies
discussed in this report.  We will also make copies available to
others who are interested. 

Please contact me at (202) 512-7101 or Ronald Guthrie, Assistant
Director, at (303) 572-7332 if you have any questions.  Other major
contributors to this report were Martin Eble, Lesia Mandzia, Lawrence
Moore, Carolina Morgan, and Thomas Yatsco. 

Cynthia A.  Bascetta
Associate Director, Veterans Affairs
 and Military Health Care Issues

SCOPE AND METHODOLOGY
=========================================================== Appendix I

Our objectives were to (1) review the accuracy and currency of the
inventory tracking systems for federal medical stockpiles that would
be used to treat the civilian population following a chemical or
biological terrorist attack and (2) examine the internal controls in
place to manage the stockpiles.  We obtained documents and
interviewed officials at the Centers for Disease Control and
Prevention (CDC) and the Office of Emergency Preparedness (OEP) at
the Department of Health and Human Services (HHS), the vendor storing
the smallpox vaccine for CDC, the Marine Corps Chemical Biological
Incident Response Force (CBIRF) at the Department of Defense (DOD),
the Department of Veterans Affairs (VA), and the Federal Emergency
Management Agency (FEMA). 

To assess the accuracy and currency of the inventory tracking systems
that monitor OEP's medical stockpiles, we (1) obtained OEP's required
list of medical supplies, (2) obtained VA's computerized inventory
tracking records of OEP's stockpiles, and (3) conducted a 100 percent
inventory of each of OEP's stockpiles.  We then conducted three
analyses.  Our first analysis compared the findings of our 100
percent inventory with VA's computerized inventory records to test
their accuracy.  Our second analysis compared OEP's list of required
items with VA's computerized inventory records.  Our third analysis
compared OEP's required list of items with our inventory count.  A
discrepancy was recorded if (1) an item specified on VA's inventory
record was not found in the specified container (shortage), (2) an
item not on the record was found in the container (overage), or (3)
an item had incorrect recordkeeping for either the lot number or the
expiration date.  We calculated the discrepancy rate by dividing the
number of discrepancies we found by the total number of items
recorded on the inventory.  Therefore, in some cases, multiple
discrepancies were assessed for a single item.  For instance, an item
located in the wrong container was counted as both a shortage in the
container it belonged in and an overage in the container it was found
in. 

Since CBIRF did not have an approved inventory list, we compared the
results of our inventory of CBIRF's stockpile with its computerized
inventory records.  We also reviewed the inventories taken and
procedures followed by the vendor storing the smallpox vaccine for
CDC. 

We reviewed the unclassified version of Presidential Decision
Directive 39, the fact sheet available on Presidential Decision
Directive 62, and the Stafford Act to determine U.S.  policy on
chemical and biological terrorism.  Also, to assess the adequacy of
internal controls, we applied criteria from our exposure draft
entitled Internal Control:  Standards for Internal Control in the
Federal Government (GAO/AIMD-99-21.3.1, May 1999).  We also
considered the Federal Managers' Financial Integrity Act of 1982
(FMFIA); Office of Management and Budget (OMB) Circular A-123,
Management Accountability and Control, revised June 21, 1995; and
Federal Financial Management System Requirements of the Joint
Financial Management Improvement Program. 

We did not examine stockpiles and inventories for noncivilian use
used by U.S.  military forces and managed by the Defense Logistics
Agency.  We also excluded from our scope stockpiles that are
maintained by Metropolitan Medical Response System teams in several
U.S.  cities to prepare for chemical and biological terrorist
incidents. 

STOCKPILE TRACKING SYSTEM CONTROL
DEFICIENCIES
========================================================== Appendix II

Our exposure draft entitled Internal Control:  Standards for Internal
Control in the Federal Government requires that agencies

1.  have an effective control environment,

2.  conduct risk assessments,

3.  implement control activities that are linked to the results of a
mission risk assessment,

4.  properly record information and communicate with management, and

5.  ensure monitoring.\8

The purpose of the standards issued pursuant to FMFIA is to provide
reasonable assurance that key objectives are met, including effective
and efficient operations, reliable financial and other reporting, and
compliance with applicable regulations and other laws.  Agencies are
to view these standards as elements of an ongoing internal control
process that must be constantly maintained. 

CONTROL ENVIRONMENT

Our Standards for Internal Control in the Federal Government states
that Management and employees should establish and maintain an
environment throughout the organization that sets a positive and
supportive attitude toward internal control and conscientious
management. OEP, VA, and CBIRF did not establish an adequate control
environment to effectively carry out their medical stockpile
management responsibilities.  According to OEP officials, VA's
management of its stockpiles is based completely on the interagency
agreement and on trust.  OEP also did not require regular reports
from VA, including inventories and financial reports (although it has
been receiving financial reports since May 1999), and did not require
or arrange for periodic, independent inventories of its stockpiles. 
OEP officials told us that they presumed that VA would perform
inventory control functions as part of its stockpile maintenance
responsibilities, as outlined in the interagency agreement.  However,
the agreement is silent about these requirements.  The responsibility
for managing OEP's stockpiles is fragmented within the VA
organization.  Because of the lack of clear lines of command, the
employees who manage OEP's stockpiles from day to day receive little
supervision from upper-level VA management.  For example, although
the interagency agreement with OEP was negotiated with and signed by
VA's Emergency Management Strategic Healthcare Group (EMSHG), the
group plays no role in the management of OEP's stockpiles.  Another
group within VAthe Emergency Pharmacy Services (EPS)actually
manages OEP's stockpiles.  The director of a VA Consolidated Mail-Out
Pharmacy that is independent of EMSHG heads the EPS group.  The
director of EPS divides his time between managing OEP's stockpiles
and directing this pharmacy.  He acknowledged that no clear chain of
command exists.  In the absence of adequate internal supervision and
oversight, employees of EPS have not appropriately managed OEP's
stockpiles. 

Marine Corps managers also did not provide leadership for CBIRF's
activities adequate to establish an environment to support internal
control.  Specifically, the Marine Corps did not provide written
standards and expectations to CBIRF's personnel on stockpile control
activities; did not request regular reports from CBIRF on the status
of its medical stockpile, including inventories and financial
reports; and did not arrange for periodic, independent inventories of
CBIRF's stockpile. 

RISK ASSESSMENT

Our Standards for Internal Control in the Federal Government states
that Internal control should provide for an assessment of the risks
the agency faces from both external and internal sources. Risk
management is the deliberate process of understanding risk--the
likelihood that a threat will harm an asset with some severity of
consequencesand then deciding on and implementing actions to create
a certain level of protection or preparedness.  Agencies should
conduct risk assessment to (1) identify all potential internal and
external risks, (2) prioritize the risks by assessing their
likelihood and their effect on mission needs, and (3) take steps to
mitigate those risks. 

While required to do so by our standards for internal control, OEP,
VA, and CBIRF have not performed mission risk assessments for their
stockpiles.  These agencies have not identified the risks that could
threaten the availability and usefulness of their medical stockpiles,
and they have not prioritized the risks according to their likelihood
or their severity.  As a result, the agencies have not taken steps to
prevent, detect, or provide contingency plans if those threats were
realized. 

CONTROL ACTIVITIES

Our Standards for Internal Control in the Federal Government states
that Internal control activities help ensure that management's
directives are carried out.  The control activities should be
effective and efficient in accomplishing the agency's control
activities. OEP, VA, and CBIRF did not establish clear policies and
procedures that allow them to carry out control activities and
appropriately manage drugs and medical supplies.  We found a lack of
(1) controls over computerized inventory systems, (2) periodic
inventories, and (3) inventory security. 

--------------------
\8 GAO/AIMD-99-21.3.1.  We quote this source throughout this appendix
as we discuss each of the five standards for internal control. 

      COMPUTERIZED INVENTORY
      SYSTEMS ARE INADEQUATE
------------------------------------------------------ Appendix II:0.1

The agencies' computerized inventory systems should include controls
over the hardware, operating system, and database management systems
that ensure that all transactions affecting their stockpiles are
recorded and that all data in these systems are complete and
accurate.  However, VA's and CBIRF's systems lack fundamental
controls, which impedes their ability to comprehensively track
medical supplies.  This, in turn, places at risk their ability to
fulfill their missions.  Both agencies' systems lack basic
information, such as

  -- documentation of back orders, replacements, and shipment and
     receipt of all pharmaceuticals and medical supplies;

  -- the identity of all individuals who entered and made changes to
     the databases, the changes they made, and the dates and times
     they made them; and

  -- detailed, verifiable historical records on all replaced and
     discarded pharmaceuticals and medical supplies or a history of
     additions, deletions, and changes to the physical stock. 

CBIRF's computer system has additional problems that make it
unreliable for accurately tracking the medical supplies in the
stockpile.  According to CBIRF's personnel, the computer system they
use to track their inventoryknown as the Ships Automated Management
System (SAMS)--was originally developed for use in remote locations
such as on ships at sea and is not suitable for CBIRF's mission. 
They noted that many of the supplies in the stockpile have not been
assigned permanent Navy supply numbers in SAMS.  These numbers are
needed to order stockpile replacements through the Navy's procurement
system, and SAMS does not record a supply item without an assigned
number.  As a result, CBIRF staff had to create ad hoc (or dummy)
numbers for many stockpile items so that SAMS can record them in the
database. 

CBIRF's computer system has also shown serious instability in recent
months, including a complete computer system failure just before our
visit.  The system failure reportedly destroyed all CBIRF's inventory
information and forced unit personnel to recreate their entire
database by physically counting each item in their stockpile and
reentering all inventory data back into the computer system. 

      PERIODIC INVENTORIES ARE NOT
      CONDUCTED
------------------------------------------------------ Appendix II:0.2

Medical supply inventories should be periodically counted and
compared with records to ensure physical control over assets. 
However, before our audit, neither OEP nor VA had ever conducted a
complete physical inventory of OEP's stockpiles.  While VA possessed
the required list of items that OEP wanted in the stockpile, after
initially acquiring the medical supplies for the stockpile, VA never
again compared OEP's required stockpile list with the actual items in
each stockpile.  When we compared OEP's required list with VA's
inventory records from its computer tracking system, we found 17,000
discrepancies (9 percent).  When we conducted our inventory of the
items in the five stockpiles, we found that out of approximately
195,000 total items, there were about 22,000 discrepancies between
VA's computerized inventory tracking system and the actual items
maintained in the stockpilesa discrepancy of about 11 percent.  And
when we compared OEP's required list with our inventory results, we
found a discrepancy rate of more than 12 percent, or 23,000
discrepancies. 

Discrepancies included overages, shortages, and incorrectly recorded
items.  Stockpile overages included both pharmaceuticals and general
medical supplies, but most were general medical supplies such as
gloves, bandages, and needles.  For example, at one stockpile
location, when we compared both VA's inventory list and our inventory
results with the OEP list of required items, we found that VA
purchased and maintained an excess of 2,400 pairs of gloves.  The OEP
list required 2,400 pairs of the nonlatex gloves; VA's inventory list
showed 3,200 pairs in the stockpile; we found 4,800 pairs.  At
another location, we found 159 injector devices in the stockpile that
were not on OEP's required list.  VA's inventory system showed the
amount although OEP had not required it. 

Other discrepancies included shortages and incorrectly recorded
items.  Some of the shortages included controlled substances and
antidotes.  At two locations, the entire amount of diazepam, a
controlled substance, was not in the stockpile.  That is, it did not
appear on VA's inventory list and we did not find it during our
inventory, even though OEP required it.  At one location, we found
more than 1,000 additional potassium iodide tablets than OEP
required.  Yet VA's inventory spreadsheet showed that it stored the
same amount that OEP required.  And at another location, when we
compared our inventory results with VA's computerized inventory
records, we found that the lot numbers of 438 vials of pralidoxime
were recorded incorrectly. 

CBIRF did not have an approved list of what should be in its
inventory.  Consequently, we were unable to determine whether any
discrepancies existed between the actual stockpile of medical
supplies and an approved list of medical supplies.  Neither CBIRF
personnel nor we could determine whether the correct medical supplies
and quantities were on hand.  Instead of physically counting the
items in the stockpile and comparing the results with an approved
list, CBIRF officials told us that they periodically count their
medical supplies and then adjust their computer records to reflect
the results of that most recent count.  Nonetheless, when we compared
our 100 percent inventory count with CBIRF's computer records of the
stockpile, we found shortages and overages in CBIRF's stockpile. 
Specifically, we found that out of approximately 38,000 total items
listed on CBIRF's computerized inventory record, there were about
10,000 discrepancies between CBIRF's inventory record and the actual
items in the stockpilesa discrepancy rate of about 26 percent. 

Discrepancies in CBIRF's stockpile included overages, shortages,
incorrect expiration dates, and incorrect lot numbers.  We found
about 5,700 items that were not recorded in the SAMS database but
were in CBIRF's stockpile, accounting for excesses in the stockpile
of approximately 15 percent.  In total, we also found that about
2,300 items were not in CBIRF's stockpile--an antidote accounted for
65 percent of these items.  CBIRF staff explained that 967 of the
atropine injectors we identified actually constituted a data entry
error--the contents of one container were entered into the database
twice, using two different names for the same container.  Finally,
CBIRF's database comingles more than 3,000 training and unit medical
supplies in the same database with the CBIRF stockpile supplies,
making it difficult to place special emphasis on and track
mission-critical items.\9 CBIRF officials are unable to determine
whether the necessary items are in its inventory because of
inaccuracies in the computerized inventory system and the lack of an
authorized list of medical supplies. 

--------------------
\9 Small quantities of medical supplies and pharmaceuticals that are
used for the general medical care of CBIRF members. 

      INVENTORIES LACK SECURITY
------------------------------------------------------ Appendix II:0.3

In managing medical supply inventories that are vulnerable to risk of
loss or unauthorized use, agencies should establish physical security
procedures to reasonably assure that stockpiles remain intact and are
available for use.  Four of OEP's five stockpiles are located at VA
facilities, and one is at a local nonfederal facility.  The physical
security at the various sites differs, but most stockpiles were
stored in caged and locked areas.  However, at one location, the
windows in the building housing the stockpile had padlocked fencing
material covering them, but the windows were open and the fencing
material was loose, posing a risk of unauthorized access.  Further,
neither VA nor CBIRF had implemented sign-in sheets or logs to record
entry and exit from the stockpiles that would allow management to
review the security of and frequency of visits to the stockpiles. 

Like OEP, the Marine Corps has not communicated clear expectations to
CBIRF medical personnel about how their medial stockpile should be
secured.  CBIRF had no sign-in procedures or logs for recording
access to its warehouse and trucks where its supplies are stored. 
Therefore, it cannot ensure that proper access is maintained at those
locations.  We found that antidotes were stored in an unsecured
office inside the warehousean area that many CBIRF staff can gain
access to.  The office was kept at a cool temperature to accommodate
the antidotes but was not always monitored.  In contrast, CBIRF's
physical security for its controlled substances was adequate.  CBIRF
maintains these items in a separate building, in a secured safe that
had a sign-in book and was inventoried quarterly. 

EFFECTIVE COMMUNICATION AND
INFORMATION EXCHANGE

Our Standards for Internal Control in the Federal Government states
that Information should be recorded and communicated to management
and others within the entity who need it and in a form and within a
time frame that enables them to carry out their management control
and other responsibilities. The exchange of information on stockpile
inventory status and managerial activities among management within
and across agencies was lacking.  OEP officials did not communicate
clear expectations about the type, extent, and frequency of reports
they expected VA to produce on the status of OEP's stockpile.  Their
expectations regarding the type and frequency of oversight they would
exert were also not clear.  OEP intermittently requested fiscal
reports from VA, which provided expenditure and financial reports for
April, November, and December 1997 and October 1998.  The reports
varied significantly in the amount of information they offered and
did not provide a clear and consistent picture of stockpile status
and the program's financial status. 

MONITORING

Our Standards for Internal Control in the Federal Government states
that Internal control monitoring should assess the quality of
performance over time and ensure that the findings of audits and
other reviews are promptly resolved. All organizations that depend
on a stockpile of assets to meet their mission must assure themselves
that these assets are current, accounted for, and available for use. 
However, OEP, VA, and CBIRF have not implemented adequate systems to
monitor their medical stockpiles and the activities of the staff who
manage them.  OEP did not require and VA did not perform regular
audits or other reviews of the design and implementation of the
stockpile program.  Because no inventories had ever been conducted,
neither VA nor OEP management could identify overages and shortages
in supplies, correct deficiencies, implement improvements, or
demonstrate that the program stockpiles were controlled in accordance
with existing laws and standards. 

(See figure in printed edition.)Appendix III
COMMENTS FROM THE DEPARTMENT OF
HEALTH AND HUMAN SERVICES
========================================================== Appendix II

(See figure in printed edition.)

GLOSSARY
=========================================================== Appendix 0

The pharmaceuticals listed here may have alternative uses in a
chemical or biological incident.  We have described their primary
purposes. 

      AMYL NITRATE
------------------------------------------------------- Appendix 0:0.1

An inhalation drug that is used as an antidote for cyanide poisoning. 
It is also a common recreational stimulant known as a popper. 

      ATROPINE
------------------------------------------------------- Appendix 0:0.2

A cardiac drug that is also used to reverse the effects of
organophosphate poisoning. 

      CIPROFLOXACIN
------------------------------------------------------- Appendix 0:0.3

A drug, also known as Cipro, that is used to treat infections,
including anthrax. 

      CONTROLLED SUBSTANCE
------------------------------------------------------- Appendix 0:0.4

A substance that has a high potential for abuse, as classified by the
Controlled Substances Act, title II of the Comprehensive Drug Abuse
Prevention and Control Act of 1970. 

      DIAZEPAM
------------------------------------------------------- Appendix 0:0.5

A drug that is used to treat the symptoms of anxiety, convulsions,
and muscle spasms.  Its brand name is Valium. 

      DOXYCYCLINE
------------------------------------------------------- Appendix 0:0.6

A drug that can be used to treat bacterial infections, including
anthrax. 

      MARK I
------------------------------------------------------- Appendix 0:0.7

An injection kit that contains an atropine auto-injector and a
pralidoxime chloride auto-injector.  Together, the drugs are used as
an antidote for nerve gas poisoning. 

      NASAL AIRWAY
------------------------------------------------------- Appendix 0:0.8

A device that is inserted into an unobstructed pharynx through the
nose to provide an airway. 

      ORAL AIRWAY
------------------------------------------------------- Appendix 0:0.9

A device that is inserted into an unobstructed pharynx through the
mouth to provide an airway. 

      POTASSIUM IODIDE
------------------------------------------------------ Appendix 0:0.10

A drug that is used to help relieve breathing and lung problems. 

      PRALIDOXIME
------------------------------------------------------ Appendix 0:0.11

A drug that is used as an antidote for organophosphate poisoning. 

*** End of document. ***