Summary

  • GAO reviewed 18 major Department of Defense IT business programs tied to $10.3 billion in planned spending across fiscal years 2024–2026. In its questionnaire, seven programs said staff had not received or did not know about training during the prior two years to recognize and report fraud or tampering in IT systems.
  • DOD said personnel receive mandatory general fraud awareness training, while program-specific instruction for spotting fraud in IT systems is not currently required. Ten programs reported assessing their own fraud risks; five said they did not, and three did not know.
  • GAO's new recommendation puts the CIO in collaboration with the Comptroller, which DOD says has overseen department-wide fraud risk since July 2020. A useful correction would leave a training record inside each major IT program, with a named owner and examples drawn from that program's work.

The general course and the program desk

Imagine the person who maintains a financial business system receiving a certificate for general fraud awareness. The certificate can prove attendance. A useful program exercise would then teach that person how a changed vendor field, an altered approval path or a suspicious adjustment could appear in the workflow they actually operate. GAO's question was simpler and sharper: could the program staff recognize and report fraud or tampering in their own IT setting?

The answer from seven of the 18 programs was no, or at least that staff did not know of relevant training. Eleven reported receiving it or knowing it was available during the previous two years. These figures came from program responses to GAO's questionnaire as of April 2026. They describe the reach and visibility of instruction among selected major business programs. A department-wide slide deck can be mandatory while the operational lesson still fails to arrive at a particular desk.

The programs matter because they run business work with real public money. DOD uses IT for health care, personnel, financial management, logistics and contracting. Its Office of the Chief Information Officer reported $10.3 billion in planned spending for the 18 programs over fiscal years 2024 through 2026. That three-year plan supplies the scale of the governance problem. Four of the programs accounted for half of the planned total. A weak handoff in one large system can therefore sit inside a very expensive portfolio while the central training register looks orderly.

The missing lesson has two owners

The audit exposes a division of labor that is easy to hide inside a large department. DOD told GAO that the Office of the Under Secretary of Defense (Comptroller) has been the dedicated entity for fraud risk management since July 2020. DOD also pointed to mandatory general fraud awareness training and its business-systems certification guidance. Those are real administrative instruments. The question at the program desk is who turns them into a lesson about that system's workflow and verifies that staff know where to find it.

The Office of the CIO is the obvious operational counterpart. It oversees the major IT business-program universe GAO examined. Yet DOD officials said the department does not currently require training specifically to recognize and report signs of fraud in IT systems. A general module and a program-specific risk exercise occupy different floors of the same building. The first can be counted centrally. The second needs someone who understands the software, the functional setting and the route for reporting a warning sign.

The program responses show the same split in risk assessment. Ten of 18 said they assess fraud risks facing the program; five said they do not; three did not know whether they do. That last group is especially awkward for a governance chart. A risk assessment that cannot be located by the people asked to describe it will do little work when a suspicious change appears. GAO's framework calls for staff to understand fraud risks in their functional setting, distinguish fraud controls from routine financial controls, and receive training that continues beyond induction.

The target is an operating habit with a place in the program's ordinary work.

One recommendation with two desks on the address line

GAO made one new recommendation in this annual assessment. The Secretary of Defense should direct the CIO, working with the Comptroller, to sustain an antifraud culture in major IT business programs through training on fraud awareness, recognition of risks in relevant functional settings and awareness of risk-assessment activity. DOD partially agreed. It argued that the Comptroller already holds the department-wide fraud role and described work in its certification guidance. GAO kept the recommendation because program staff still need the relevant instruction and a way to know it exists.

That exchange matters more than the usual choreography of agreement and disagreement. DOD's reply located an office. GAO asked for a working connection from that office to people who operate business software. An org chart can settle jurisdiction while leaving delivery untested. Here the test is concrete: does each program know its fraud scenarios, who teaches them, who attended, how new staff learn them and how an alert travels from a technical observation to someone able to act?

Other gaps in the same report sharpen the distinction. Eight of ten programs actively developing software did not demonstrate required Agile metrics and management tools. Six of 18 had no plan to implement zero trust by DOD's 2027 deadline, and three lacked an approved cybersecurity strategy. These are separate findings. Together they show why a portfolio cannot be governed by one reassuring completion number: program-specific practices have to be visible where software is built and run.

The missing public evidence is a program-level map connecting training content, attendance or awareness, an assessed functional risk and a responsible handoff between the CIO and Comptroller. A later DOD or GAO follow-up showing that map across all 18 programs would change the judgment. Until that record exists, the seven responses mark a delivery failure in a system that already knows how to issue general training.

Sources