Multiple Award Schedule Contracts Offered Prohibited Items, Putting Customers at Risk of Unauthorized Surveillance by Foreign Adversaries

Why We Performed This Audit

GSA’s Federal Acquisition Service (FAS) is responsible for ensuring regulatory compliance related to items that contractors include on its Multiple Award Schedule (MAS) contracts. This is especially important with the increase in national security and intellectual property threats to the federal government’s supply chain. In 2017 and 2018, Congress passed laws that prohibit the federal government’s procurement of certain telecommunications and video surveillance services or equipment (telecom items) from certain named entities. In our Assessment of GSA’s Management and Performance Challenges for Fiscal Year 2021 and 2022, we listed managing supply chain risk as a management challenge and noted that FAS is challenged with identifying and removing prohibited telecom items and contractors from government-wide contracts. Given FAS’s responsibility and the challenge these laws present, we included this audit in our Fiscal Year 2021 Audit Plan. We performed this audit to determine if FAS is complying with laws, regulations, and policies to ensure that MAS contracts do not offer prohibited telecom items.

What We Found

Federal laws and the Federal Acquisition Regulation (FAR) prohibit the procurement of certain telecom items that foreign adversaries could use for unauthorized surveillance. Two of the primary methods that FAS relies on to ensure that MAS contracts do not include prohibited telecom items are contractor self-certifications in GSA’s System for Award Management and the Prohibited Products Robomod (Robomod) process. However, the self-certifications are inadequate and the Robomod process is insufficient to prevent contractors from including prohibited telecom items on their MAS contract price lists.

In addition, we found problems with FAS’s efforts to address prohibited telecom items offered on MAS contracts. We found that:

• FAS has not taken adequate actions against contractors that repeatedly violate the FAR restrictions on providing or using prohibited telecom items;
• FAS does not have a process in place to notify customer agencies about their purchases of prohibited telecom items; and
• FAS did not initially comply with FAR requirements to include subsidiaries and affiliates of named entities in its efforts to identify prohibited telecom items on MAS contracts.

Based on these findings, FAS should strengthen controls and take additional steps to minimize the risk of customer agencies procuring prohibited telecom items that foreign adversaries may use for unauthorized surveillance.

What We Recommend

We recommend that the FAS Commissioner:

1. Strengthen FAS’s Robomod process to ensure that it identifies MAS contracts with prohibited telecom items.
2. Establish and enforce procedures and internal controls to:
   1. Ensure that contract modifications are issued promptly when FAS identifies prohibited telecom items on MAS contacts, and
   2. Ensure that contractors promptly remove prohibited telecom items from MAS contract price lists.
3. Implement more stringent consequences for contractors that repeatedly attempt to offer prohibited telecom items, including executing General Services Administration Acquisition Regulation clause 552.238-79, Cancellation.
4. Implement a process to instruct contractors that violate the FAR restrictions on the procurement of prohibited telecom items to notify and remit refunds to any customer agencies that purchased prohibited telecom items after the FAR was updated regarding named entities.
5. Identify items offered from subsidiaries and affiliates of named entities and either cancel the subject contract or remove the prohibited items from MAS contracts.

The FAS Commissioner agreed with our recommendations and provided general comments on FAS’s internal controls and efforts in this subject area. These comments did not affect our findings and conclusions. FAS’s response is included in its entirety in Appendix B.