GAO Finds DoD IT Programs Suffer from Poor Fraud Management

Executive Summary

A new report from the U.S. Government Accountability Office (GAO) has identified systemic failures in how the U.S. Department of Defense (DoD) manages fraud risks within its major information technology business programs. The report, published on September 28, 2026, reveals that these shortcomings have contributed to billions of dollars in financial losses and have significantly increased the cybersecurity risk to critical defense systems. The GAO found that many multi-billion dollar IT programs have not undergone required fraud risk assessments and that program staff lack the necessary training to identify fraud, leading to vulnerabilities and contractor non-compliance. The findings underscore the need for the DoD to urgently implement a comprehensive anti-fraud strategy to protect both taxpayer money and national security information.

Regulatory Details

The report, titled "IT Systems Annual Assessment: DOD Should Improve IT Fraud Risk Management Practices" (GAO-26-108596), is part of the GAO's ongoing oversight of federal government operations. It assesses the DoD's adherence to the 'Framework for Managing Fraud Risks in Federal Programs,' a set of leading practices for establishing an effective anti-fraud program. The GAO's review focused on 18 major DoD IT business programs, for which the department planned to spend $10.3 billion between fiscal years 2024 and 2026. The core issue identified is a lack of institutionalized processes for assessing and mitigating fraud risks throughout the IT system lifecycle.

Affected Organizations

The primary organization affected is the U.S. Department of Defense, including its various agencies and branches that manage and procure major IT systems. The report's findings have implications for the entire defense industrial base, particularly contractors involved in software development and IT services for the DoD.

Compliance Requirements

The GAO's findings indicate a failure to comply with established federal fraud risk management principles. Key compliance gaps include:

• Failure to Conduct Risk Assessments: Five of the 18 programs reviewed had not conducted a fraud risk assessment at all. For three others, the DoD could not even confirm if one had been performed. This is a fundamental failure in risk management.
• Lack of Training: Staff managing these programs were found to have insufficient training to recognize fraud indicators specific to IT procurement and software development. This includes identifying when contractors use substandard software or fail to implement contractually obligated cybersecurity controls.
• No Cybersecurity Threat Reduction Strategy: Three of the 18 programs lacked a strategy to reduce cybersecurity threats, a critical component of overall system security.

Impact Assessment

The impact of these failures is twofold:

1. Financial Loss: The GAO reports that the DoD confirmed nearly $11 billion in fraud losses between fiscal years 2017 and 2024. The poor risk management in IT programs directly contributes to this, for example, through contracts being awarded to ineligible companies, as seen in a case where two firms misrepresented their status to win over $200 million in contracts.

2. Cybersecurity Risk: More critically, the lack of oversight exposes sensitive DoD systems to cyber threats. The report cites an example where a developer's failure to use approved hosting and implement system protections put DoD information at risk. This creates vulnerabilities that could be exploited by adversaries for espionage or sabotage, directly threatening national security.

Due to these persistent issues, the GAO added DoD's fraud risk management to its High-Risk List in 2025, a designation for programs highly vulnerable to waste, fraud, abuse, and mismanagement.

Enforcement & Penalties

While the GAO report itself does not carry direct penalties, it serves as a powerful tool for congressional oversight. It can lead to congressional hearings, budget restrictions, and mandated changes in DoD policy and practice. The report's findings can also trigger investigations by the DoD Inspector General, which could lead to civil and criminal penalties for fraudulent contractors and potential disciplinary action for government employees.

Compliance Guidance

The GAO report implicitly and explicitly provides a roadmap for the DoD to improve its posture:

1. Mandate and Verify Fraud Risk Assessments: The DoD must enforce the requirement that all major IT programs conduct regular, comprehensive fraud risk assessments. This should be a prerequisite for program funding approval.
2. Implement Specialized Training: Develop and deploy mandatory training for all program management and acquisition staff on identifying fraud indicators in an IT context. This should cover software supply chain risks, contractor compliance verification, and cybersecurity control validation.
3. Promote Anti-Fraud Awareness: Leadership must champion a culture that encourages reporting and addressing fraud. This includes establishing clear reporting channels and protecting whistleblowers.
4. Integrate Fraud and Cybersecurity Risk Management: The DoD should treat fraud risk as an integral part of its overall cybersecurity risk management framework, recognizing that fraud often creates or exacerbates security vulnerabilities.