The Pentagon Planned $10.3bn for 18 IT Systems. Eight Could Not Confirm a Fraud-Risk Assessment.

Factrail investigation | United States | Documentary cutoff: 31 October 2026 | Independent source QA completed 1 November 2026; publication is a separate decision

The finding. The Pentagon planned approximately $10.293 billion for 18 major business-information-technology programs across fiscal years 2024–2026. Yet when congressional auditors asked those programs about their own fraud controls, only ten reported that they had assessed program-specific fraud risks. Seven reported that their staff either lacked recent, relevant training or did not know whether it was available; six had not developed plans to implement zero-trust cybersecurity by the department's 2027 deadline. The September 28, 2026 Government Accountability Office assessment (opens in a new tab) does not establish that $10.3 billion was lost, that eight programs suffered fraud, or that any named contractor committed wrongdoing. It establishes something more precise and politically actionable: a department spending heavily on digital infrastructure could not demonstrate a consistent, program-level defense against fraud, while the secretary, chief information officer, comptroller and Congress held different pieces of the authority to fix it.

The most important distinction is between planned expenditure, confirmed fraud elsewhere in the department, and an assessed vulnerability. Confusing those categories produces a sensational but false scandal. Keeping them separate exposes the real accountability gap. A fraud-risk assessment is not a finding that fraud occurred; it is the step by which officials identify how it could occur, who could exploit the process, and which controls might prevent or detect it. When that step is undocumented or absent, a budget number tells taxpayers almost nothing about the quality of the safeguards attached to it.

The documentary timeline: an inherited portfolio and a current responsibility

Congress's fiscal 2019 defense authorization framework, subsequently amended, required GAO to assess major defense IT business investments annually through March 2029. The resulting September 2026 publication is the seventh assessment, not a sudden audit commissioned solely in response to the Trump administration. It covers systems, costs and decisions crossing multiple administrations. The agency used the Pentagon's fiscal 2026 Federal IT Dashboard submission to identify 18 major investments, reviewed the department's chief information officer data, and surveyed program offices about changes since January 2024. Its fraud-risk and cybersecurity questionnaire evidence was current as of April 2026. These dates matter: a problem first recorded under a predecessor cannot automatically be attributed to Pete Hegseth, and a current secretary cannot dismiss a still-open recommendation merely because the system predates him. GAO's report (opens in a new tab) supplies the audit scope and its legal origin.

On January 25, 2025, Pete Hegseth became secretary of defense. The administration subsequently authorized use of the secondary title 'Department of War', but the audit and federal statutes still describe the Department of Defense. The department's official historical biography (opens in a new tab) confirms the appointment and title change. The distinction is editorial rather than partisan: the secretary is accountable for directing remediation now, but the record does not prove that he personally selected the 18 investments, approved their original budgets or instructed anyone to omit a fraud assessment.

Kirsten A. Davies took over the Pentagon's CIO office at the end of 2025. A departmental announcement dated August 25, 2026 (opens in a new tab) identifies her as chief information officer and names Sonu Shankar as principal deputy. That places the CIO office at the operational center of information-technology governance. The comptroller's office separately owns departmentwide financial management and antifraud responsibilities. This division of labor is central to the dispute over the auditor's proposed remedy.

On September 28 GAO published its findings and a recommendation directed to the secretary. The next day its public explanatory article (opens in a new tab) put the findings into the context of historical fraud and procurement exposure. MeriTalk's September 30 coverage (opens in a new tab) independently reported the audit's denominators, the department's partial agreement and the unresolved split between CIO and comptroller. As of the October 31 research cutoff, GAO's new recommendation was shown as open. That status is not proof that no action was taken after the April survey; it means GAO had not confirmed implementation.

What the $10.3 billion actually measures

The GAO account (opens in a new tab) gives approximately $10.3 billion in planned spending for fiscal years 2024, 2025 and 2026. It is not a single fiscal-year appropriation, an audited outlay information or a verified sum paid to particular vendors. GAO's September 29 visual breakdown (opens in a new tab) specifies $10,293 million for the portfolio and $5,116 million for the four largest programs—49.7 percent. Those four are Navy Enterprise Resource Planning ($1,978 million), Defense Healthcare Management System Modernization ($1,643 million), Advancing Analytics ($750 million), and the Army's Integrated Personnel and Pay System ($745 million), all over the three-fiscal-year window.

That arithmetic yields two useful tests. First, the four largest systems account for nearly half of the planned amount, so aggregate averages can conceal concentration. Second, even the largest named system's planned figure is not a payment to one supplier. The Navy ERP figure is program spending; it is not evidence that a software company earned $1.978 billion. Similarly, the healthcare modernization amount covers a program with multiple functions and procurement arrangements. A contractor-beneficiary claim needs an award, obligation or invoice record, not merely a program title.

GAO also reported that 74 percent of the three-year portfolio cost was for operations and maintenance, versus 26 percent for development and modernization. That allocation changes what accountability means. For a system already in operation, continuity, security, correct payroll or health records and contract administration may matter more than the number of new features shipped. Spending on maintenance can be necessary, but it also makes the government's ability to compare service levels, incident rates and vendors' performance essential. A fraud assessment should identify exposure in existing operations as well as new procurement.

The auditors did find reported delivery pressure: 11 of the 18 program offices described cost or schedule changes since January 2024. Four reported cost increases between $2 million and $394 million, with a median of about $59 million; seven reported delays between two and 12 months, with a median of roughly three months. These are program-reported changes, not a causal calculation linking fraud-control gaps to cost growth. Some projects can have legitimate schedule changes as clinical, personnel and financial requirements evolve. The test is whether officials explain the baseline, the change and its consequences.

Three different control gaps—not one accusation

The first gap is the most basic. Only 10 of 18 programs reported assessing the fraud risks facing them. The GAO WatchBlog (opens in a new tab) breaks down the other eight as five that had not assessed the risks and three for which the department did not know whether an assessment had occurred. That difference matters. 'Eight confirmed failures' would overstate the evidence; 'eight without an affirmative, documented assessment in the audit response' accurately describes the gap. A documented assessment could subsequently surface for one of the unknown cases and narrow the finding.

The second gap concerns personnel. The formal September 28 report (opens in a new tab) says seven of 18 programs reported that personnel either had not received relevant training during the preceding two years or were unaware of such training to recognize and report fraud or tampering in IT systems. Eleven reported training or information of training. The September 29 GAO blog (opens in a new tab) appears to invert that count in one sentence, saying staff at 11 programs had not received the training. The formal GAO report's published questionnaire table is the controlling primary record: 11 of 18 programs reported training or information of available training, while seven did not. GAO's September 29 WatchBlog instead says 11 had not received the training; that sentence contradicts the formal table. This article reports seven gaps and explicitly attributes the conflicting blog claim rather than silently using its reversed count.

The third gap concerns cybersecurity architecture. Six programs had not developed plans to implement zero-trust principles by the department's 2027 target; three lacked an approved cybersecurity strategy. The categories may overlap, but the public summary does not provide enough information to calculate a unique count of affected programs. Nor does an absent plan demonstrate a breach. Zero trust is an approach to verifying access continuously and limiting unnecessary privileges, not a certification that a network can never be compromised.

There is a related performance-measurement problem. Seventeen programs were operational. Fifteen identified the minimum required performance metrics in each category; two did not. Of the 17 with reported metrics, six met all targets, ten met some but not all, and one met none. Ten programs said they were actively developing software with agile or iterative methods, but eight of those ten did not demonstrate required metrics or management tools in relevant areas. These numbers cannot simply be added to produce a total of 'noncompliant programs': the groups overlap, the survey questions differ, and performance targets do not measure the same thing as fraud controls.

The decision map: who can require what?

Congress created the recurring audit obligation and controls statutory authorizations, appropriations and oversight hearings. It can demand reports, request contract data and legislate stronger conditions, but an individual senator or representative does not manage a software program's training. The September report was addressed to congressional oversight and is a lever for questioning the executive branch.

The secretary of defense, Pete Hegseth, sits at the departmentwide direction and accountability point. GAO's recommendation expressly asks the secretary to direct the CIO to act in collaboration with the comptroller. That is a proposed governance instruction, not a finding that Hegseth personally committed misconduct. A secretary can demand a corrective plan, assign deadlines and hold subordinate leadership responsible; funding and personnel limits may constrain execution.

The CIO, Kirsten Davies, has the most direct cross-program technology governance role. GAO wants the CIO, working with the comptroller, to ensure that major IT program teams receive training tailored to recognizing fraud, understanding risk assessments and reporting warning signs. The chief information security officer and principal deputy CIO are relevant technical officials, but neither is independently shown to have approved the missing assessments in this record.

The comptroller's office is the institutional counterweight. In its formal response, the department partially agreed with GAO and emphasized that the comptroller is the dedicated entity overseeing fraud risk management. That is a meaningful jurisdictional argument: financial controls should not be fragmented into separate, inconsistent IT bureaucracies. GAO's rejoinder was that a general departmental antifraud owner does not remove the CIO's responsibility to make sure the actual technology-program staff understand risks specific to software development, access rights, data integrity and contractors.

Program managers and contracting officials make the most granular decisions. They can document risks, verify vendor deliverables, implement access controls, record exceptions and escalate suspected fraud. A contractor may be obligated by specific clauses to follow security standards or deliver certain documentation. The GAO audit does not publish a contractor-by-contractor list proving that any vendor breached a particular clause. That evidentiary boundary is critical.

Where private money enters—and where the proof stops

A beneficiary analysis should begin with a contract rather than speculation about personal ties. The GAO's portfolio chart (opens in a new tab) identifies Defense Healthcare Management System Modernization as the second-largest program by planned three-year spending. Its MHS GENESIS electronic health-record ecosystem has a documented prime integrator, Leidos. On October 13, 2026, defense procurement reporters described a roughly $317.99 million sole-source bridge award (opens in a new tab) to Leidos for integration, licensing and hosting through January 2028. HigherGov's award account (opens in a new tab) describes the planned gradual transfer to other providers and the agency's continuity rationale. The public award identifier reported there is HT0038-26-D-E014.

That award is a separate October 2026 contracting event, not part of GAO's April questionnaire and not a finding that Leidos caused any of the 18 programs' fraud or training gaps. It does show a real financial relationship in one named program family. The bridge amount is a contract award figure, not an audited cash payment or evidence of improper profit. The agency's stated reason for using a bridge is to avoid disrupting an operational health-record system while transitioning integration and licensing responsibilities. A genuine investigation must test that reason against the contract's justification, subsequent orders and transition milestones, not assume that 'sole source' means unlawful favoritism.

The strongest prospective beneficiaries of weak oversight are not automatically identifiable companies. A vendor that performs correctly benefits from clear specifications and fair comparison; a vendor cutting corners could theoretically benefit if controls are weak. The audit does not establish which case applies to any named contractor. Equally, an agency may benefit from avoiding duplicative reviews if its comptroller already operates effective central fraud controls. The unproven link is whether those general controls actually reach the 18 program offices and their specific vendors.

The public consequence is clearer than any unverified kickback story. A payroll system can misstate entitlements; a healthcare record can affect clinical workflows; an ERP platform can alter financial reporting; an analytics tool can influence managerial decisions. Those are exposure pathways, not documented harms in this audit. Service members, military families, federal workers and taxpayers depend on these systems functioning correctly and securely. They deserve a test that measures outcomes rather than an assurance that a large budget itself demonstrates competence.

The strongest counter-case: existing controls and genuine delivery

The Pentagon's formal response is not a denial that GAO counted the programs correctly. It partially agreed with the new recommendation and pointed to the comptroller's established role and existing general antifraud training. GAO itself information that the department is revising business-systems investment guidance, modernizing enterprise architecture, adopting a zero-trust strategy, developing AI acquisition guidance and undertaking cost-efficiency initiatives. It also records that six of the 17 programs with metrics met all their targets. The picture is mixed, not one of universal failure.

A second defense is operational necessity. Hospitals cannot simply suspend electronic records while managers redesign a control questionnaire. Personnel and pay systems must continue processing transactions. A short-term bridge contract can preserve continuity while the government attempts to separate service providers and reduce dependence on one integrator. The test for the October Leidos bridge is whether the transition actually occurs as described, not whether the word 'sole-source' appears in an award summary.

A third defense concerns measurement. A program manager who reports that a training module is not known to staff may reveal an internal communications problem rather than total absence of training. A missing documented assessment is a serious governance deficiency, but it is not equivalent to an observed fraudulent transaction. A cybersecurity strategy not formally approved could still coexist with deployed technical protections. GAO's recommendation addresses the demonstrability and consistency of the system, not a proven $10.3 billion theft.

Independent reporting largely corroborates the formal findings while offering different emphasis. MeriTalk (opens in a new tab) focuses on governance, metrics and the agency's partial agreement; Govly's September 30 procurement assessment (opens in a new tab) emphasizes what vendors may need to document in future performance and security reviews. Neither is evidence of an undisclosed payment or a specific program-level fraud incident. Their contribution is to show that the same public audit raises distinct operational and procurement questions.

The historical fraud number cannot be charged to these 18 systems

GAO's 2025 financial-management review (opens in a new tab) and 2026 explanatory article (opens in a new tab) cite approximately $10.8 billion in confirmed Defense Department fraud for fiscal years 2017–2024. That is a historical, departmentwide amount across a different period and many different activities. It is not an estimate of fraud in the 18 IT systems, cannot be added to their planned $10.3 billion budget, and cannot be attributed to the 2025–2026 leadership team as a single personal decision.

The juxtaposition matters only in a narrower sense: it establishes that fraud is not a hypothetical concept for the department. When a government organization has a demonstrated fraud problem, the quality of its preventive controls becomes a rational object of oversight. The historical figure raises the priority of assessing risk; it does not identify a perpetrator in the current IT portfolio.

The same caution applies to financial beneficiaries. The Leidos bridge establishes a contractual opportunity for a named private firm; it does not establish an illicit gain. The four program spending figures show where federal resources were planned; they do not reveal each ultimate recipient. To move from 'supplier may benefit' to 'supplier received X dollars' requires the award's obligation history and payment records. To move from 'received' to 'improperly received' requires a specific legal, contractual or evidentiary basis absent here.

What would change the verdict?

The most useful next record would be a program-by-program matrix identifying all 18 investments, dates of completed fraud assessments, approving officers, current training completion rates, the risk categories tested and the remediation plans. It would distinguish the five reported non-assessments from the three unknowns. It would also reconcile the formal report's seven-training-gap count with the contradiction between the formal GAO report (seven lacking) and GAO WatchBlog (eleven lacking).

A second record would show the secretary's actual directive responding to the open recommendation, the CIO/comptroller division of responsibility and measurable completion deadlines. Without that, a press release promising 'modernization' is not evidence that controls were implemented. Congress can demand a dated follow-up; GAO can close its recommendation only when it verifies sufficient corrective action.

A third record would connect actual obligations and outlays to each program, contract, vendor and fiscal year. The Defense Health Agency's MHS GENESIS bridge should be tracked separately from the FY2024–2026 planned portfolio: its ceiling, orders, payments, transition deliverables, cybersecurity obligations and the scope moved to new providers are different financial quantities. A documented contractor failure, substantiated whistleblower disclosure, inspector-general finding or court judgment could materially change the conclusion about an individual beneficiary. None should be invented in anticipation.

The observable verdict as of October 31, 2026 is therefore bounded. Congressional auditors found an important, remediable mismatch between the Pentagon's digital spending ambitions and the fraud-risk controls its major program offices could demonstrate. The Trump administration's current defense leadership has the power to direct and coordinate a fix, while the deficiencies span a longer procurement history. The public cannot infer from the audit that eight programs were defrauded, that $10.3 billion vanished, or that a contractor bought political influence. The accountability question is whether named officials now turn an open recommendation into verified, program-level safeguards—and whether Congress insists on the evidence.

Factrail context and separate accountability mechanisms

The accountability chain ultimately reaches Defense Secretary Pete Hegseth, under the wider Donald Trump administration (opens in a new tab); the GAO program findings predate much of the current leadership. This record should be considered alongside institutional-corruption safeguards (opens in a new tab) as a governance issue, not a finding that the eight programs suffered fraud.

Source notes and methodological limits

The principal original record is GAO-26-108596, September 28, 2026 (opens in a new tab), supported by GAO's September 29 public explanation (opens in a new tab) and its earlier financial-management audit (opens in a new tab). The contemporary leadership chain is checked against the Pentagon's CIO announcement (opens in a new tab) and secretary's official biography (opens in a new tab). Independent reporting comes from MeriTalk (opens in a new tab), Govly (opens in a new tab), GovConWire (opens in a new tab) and HigherGov (opens in a new tab). These are not nine independent confirmations of every allegation: several summarize the same GAO release, and the two contract reports describe the same award. No interviews, unpublished contract files, authenticated payment exports or right-of-reply responses were obtained for this draft. No finding of individual fraud or corruption is established in the reviewed program-level audit.

Sources

1. GAO — IT Systems Annual Assessment: DOD Should Improve IT Fraud Risk Management Practices (28 September 2026) (opens in a new tab)
2. GAO WatchBlog — Fraud Risks in Defense IT Systems Are Costing Taxpayers Billions (29 September 2026) (opens in a new tab)
3. GAO — Earlier Defense Financial Management Audit (2025) (opens in a new tab)
4. Department of Defense — CIO Announces New Principal Deputy CIO (2026) (opens in a new tab)
5. Department of Defense Historical Office — Secretary Pete Hegseth Biography (opens in a new tab)
6. MeriTalk — GAO Flags Fraud, Cyber and Performance Gaps Across $10.3bn of DOD IT Programs (2026) (opens in a new tab)
7. Govly — GAO Flags Oversight Gaps in DOD IT Programs (2026) (opens in a new tab)
8. GovConWire — Leidos $318m Defense Health Agency MHS GENESIS Bridge Contract (2026) (opens in a new tab)
9. HigherGov — Leidos Wins $318m MHS GENESIS Bridge Contract (2026) (opens in a new tab)