© National Audit Office 2025

Investigation into the management of contracts by the Ministry of Defence on behalf of the Kingdom of Saudi Arabia

Ministry of Defence

Session 2024–2026
10 September 2025
HC 1289

The National Audit Office (NAO) scrutinises public spending for Parliament and is independent of government and the civil service. We help Parliament hold government to account and we use our insights to help people who manage and govern public bodies improve public services.

The Comptroller and Auditor General (C&AG), Gareth Davies, is an Officer of the House of Commons and leads the NAO. We audit the financial accounts of departments and other public bodies. We also examine and report on the value for money of how public money has been spent.

In 2024, the NAO’s work led to a positive financial impact through reduced costs, improved service delivery, or other benefits to citizens, of £5.3 billion. This represents around £53 for every pound of our net expenditure.

We are the UK’s independent public spending watchdog.

We support Parliament in holding government to account and we help improve public services through our high-quality audits.

Report by the Comptroller and Auditor General

Ordered by the House of Commons
to be printed on 8 September 2025

This report has been prepared under Section 6 of the National Audit Act 1983 for presentation to the House of Commons in accordance with Section 9 of the Act

Gareth Davies
Comptroller and Auditor General
National Audit Office

28 August 2025

The material featured in this document is subject to National Audit Office (NAO) copyright. The material may be copied or reproduced for non-commercial purposes only, namely reproduction for research, private study or for limited internal circulation within an organisation for the purpose of review.

Copying for non-commercial purposes is subject to the material being accompanied by a sufficient acknowledgement, reproduced accurately, and not being used in a misleading context. To reproduce NAO copyright material for any other use, you must contact copyright@nao.org.uk. Please tell us who you are, the organisation you represent (if any) and how and why you wish to use our material. Please include your full contact details: name, address, telephone number and email.

Please note that the material featured in this document may not be reproduced for commercial gain without the NAO’s express and direct permission and that the NAO reserves its right to pursue copyright infringement proceedings against individuals or companies who reproduce material for commercial gain without our permission.

Links to external websites were valid at the time of publication of this report. The National Audit Office is not responsible for the future validity of the links.

015444 09/25 NAO

Investigations

We conduct investigations to establish the underlying facts in circumstances where concerns have been raised with us, or in response to intelligence that we have gathered through our wider work.

This report can be found on the National Audit Office website at www.nao.org.uk

If you need a version of this report in an alternative format for accessibility reasons, or any of the figures in a different format, contact the NAO at enquiries@nao.org.uk

The National Audit Office study team consisted of:

Ian Hart and Will Kellen, under the direction of Helen Holden.

For further information about the National Audit Office please contact:

National Audit Office
Press Office
157–197 Buckingham Palace Road
Victoria
London
SW1W 9SP

020 7798 7400

www.nao.org.uk

@NAOorguk

What this investigation is about

1 For more than four decades, the Ministry of Defence (MoD) has run two major programmes through which it manages the supply of military equipment and associated support services on behalf of the Kingdom of Saudi Arabia (KSA).

The Ministry of Defence Saudi Armed Forces Projects (MODSAP), which began in 1986 as the Al Yamamah programme. Through MODSAP, the prime contractor, BAE Systems Plc (BAE), supplies military aircraft, naval vessels, weapons, training and associated support services to the Saudi Armed Forces. The main MODSAP programmes run on five-year cycles, and the current ones began in 2022.

The Saudi Arabia National Guard Communications Project (SANGCOM), which started in 1978. SANGCOM delivers telecommunications capability for the Saudi Arabian National Guard (the National Guard). The current work programme runs from January 2020 until September 2025.

2 In 2012, the Serious Fraud Office (SFO) began investigating the prime contractor for SANGCOM, GPT Special Project Management Ltd (GPT), about alleged irregular payments from GPT to a subcontractor made between 2007 and 2012. The SFO investigation and subsequent prosecution resulted in two outcomes.

In April 2021, GPT accepted its guilt in respect of one offence under the Prevention of Corruption Act 1906.

In March 2024, two senior staff (a former managing director at GPT and a former part-owner of the subcontractor) were acquitted of one count of corruption, although one was convicted of a separate offence.

This court case related to SANGCOM, and the SFO made no allegations regarding MODSAP.

3 During the court case, the defence raised questions about the MoD’s knowledge and involvement in the payments made to the subcontractor which led to the prosecutions. In April 2021, the judge imposing GPT’s fine expressly reduced it on the basis that he was satisfied that the UK government was “substantially involved in the historic corrupt arrangements which led to GPT’s offending conduct”.

Scope of this report

4 In response to the interest generated by the conclusion of the court case, the National Audit Office undertook an investigation to bring transparency to the MoD’s current arrangements and activities for managing the MODSAP and SANGCOM programmes. We examined:

the arrangements the MoD has agreed with the KSA government to manage programmes on its behalf;

the controls and processes the MoD operates to manage the programmes it runs through these government-to-government agreements;

the controls and processes the MoD has for making payments under these programmes; and

the arrangements the MoD has in place to ensure that the controls and processes are working as intended.

5 Our investigation did not examine previous arrangements, including those in place during the period covered by the SFO investigation, which have been superseded. It did, however, consider the extent to which the MoD has applied lessons learned from issues raised during the court case. We did not evaluate the value for money of the arrangements, because they are fully funded by the KSA government.

6 In addition to MODSAP and SANGCOM, the MoD also runs one further, smaller programme on behalf of the KSA – the British Military Mission – through which the UK provides advice and training to the National Guard on infantry and explosive ordnance disposal capabilities. We did not include the British Military Mission in our scope because it does not involve the MoD managing the supply of equipment to the KSA.

7 We conducted our fieldwork from July 2024 to May 2025. Our audit approach is set out at Appendix One.

Summary

Key findings

Background to the programmes

8 The UK government has two government-to-government agreements with the Kingdom of Saudi Arabia (KSA) to manage programmes for the supply of military equipment and support services. Under these agreements, the Ministry of Defence (MoD) is responsible for ensuring that the programmes are delivered in accordance with requirements agreed with the KSA government. This includes, for example, delivering commercial, safety and quality assurance of equipment provided through the programmes and monitoring the performance of contractors. The KSA government is responsible for funding all the costs of the programmes (paragraphs 1.2 to 1.4 and 2.2).

9 The MoD considers that the programmes provide mutual benefits for the UK and the KSA. The MoD’s aim is to operate these programmes to strengthen and enhance the defence and security relationship between the UK and the KSA, and to support the UK’s prosperity, defence industry and regional influence. In the year ended 31 December 2024, BAE Systems Plc’s (BAE’s) total revenue from its activities in the KSA, including the Ministry of Defence Saudi Armed Forces Projects (MODSAP), was £2.9 billion. The KSA benefits from accessing the MoD’s skills and experience in managing major projects (paragraphs 1.5, 1.8 and 2.2).

Organisation of the programmes

10 Both programmes have clearly defined and structured governance arrangements, including oversight by senior MoD officials. Since 2023, an MoD Director General has overseen MODSAP. Its governance and strategic management include an internal management board chaired by the Director General and joint board-to-board meetings with BAE. The MODSAP team discusses the delivery of the programme with the Saudi Armed Forces and BAE at programme review meetings. The Saudi Arabia National Guard Communications Project (SANGCOM) team is overseen by the MoD’s Chief Information Officer, supported by the Director Delivery: Intelligence and Expeditionary Services. SANGCOM’s work is overseen by two internal committees, and the delivery of the work programme is monitored by a series of joint bodies which include representatives of both the Saudi Arabian National Guard (the National Guard) and SANGCOM team (paragraphs 1.7 to 1.9 and 2.4 to 2.7).

11 The KSA government funds all the MoD’s operating costs for running the programmes. Both programmes incur operating costs such as for personnel and facilities management. The MoD’s costs of running MODSAP are paid for by a levy from the KSA government based on the amount paid to BAE each month. Because the monthly levy income fluctuates, the MODSAP team manages its expenditure to accommodate these fluctuations. In 2010 the KSA government approved £1.6 billion funding for SANGCOM, including £0.1 billion for operating costs. The SANGCOM programme is still being funded by this budget, although the National Guard has agreed to increase the amount it pays for operating costs. This is because SANGCOM has not used a prime contractor since January 2020 and is now managing suppliers itself (paragraphs 1.14, 2.8, 2.12 and 2.13).

12 The MoD lets the programmes’ contracts with suppliers under English law. The contracts for delivering the MODSAP programme are between the MoD and BAE. These contracts are negotiated and operate under English law, and mirror work packages agreed between the KSA government and the MoD. The MoD has designed the contracts with the aim of ensuring that the UK government will not suffer any loss or liability if BAE fails to deliver its obligations. For SANGCOM, the MoD currently has contracts with nine suppliers across 13 projects, including with local KSA suppliers which may be subject to Saudi Arabian commercial law. The MoD has sought to mitigate any risk associated with contracting directly with local suppliers by letting each contract under English law and including provisions for dispute resolution between it and its suppliers in the UK (paragraphs 1.11 to 1.13 and 2.14).

The MoD’s controls and processes regarding the programmes

13 The MoD relies on its prime contractor, BAE, to manage MODSAP’s subcontractors. BAE can appoint subcontractors to undertake work funded by MODSAP through one of three routes.

BAE directly appoints and manages subcontractors from its approved list of suppliers to deliver the core projects. This route accounts for most of the value of the programme.

BAE manages a small proportion of the programme through ‘directed procurement’ when a project funded using the MODSAP budget does not fall within BAE’s core product lines or project areas. The Saudi Armed Forces instruct the MODSAP team that BAE should either appoint a specific supplier through a single source appointment or run a limited competition to identify a supplier for the task.

A very small proportion of the programme is through a ‘paymaster’ route, through which the Saudi Armed Forces contract directly with a supplier and instruct that BAE pays the supplier from the MODSAP budget. The Saudi Armed Forces use this process for purchases including stationery and some defence equipment (paragraph 1.15).

14 Since 2020, the MoD has contracted directly with its suppliers for SANGCOM rather than using a prime contractor. Between 1978 and 2019 the MoD engaged a prime contractor to deliver the SANGCOM programme. However, when the latest incumbent ceased operating at the end of 2019, the MoD decided that the cost of appointing a replacement outweighed the benefits. The National Guard has the right to require the MoD to modify its procedures, including when procuring and awarding contracts. This includes allowing the National Guard to direct how procurements managed by the MoD are run and to mandate that specific companies should be included or excluded from these competitions. The National Guard has added suppliers, for example when it has a better understanding of potential local suppliers than SANGCOM (paragraphs 2.3, 2.13 and 2.15).

15 The MoD has processes in place to ensure that payments made to the contractors are appropriate. The MODSAP team is responsible for monitoring the programmes’ progress and providing assurance to the Saudi Armed Forces that the work undertaken by BAE and its subcontractors has been performed to the required standard and at the agreed contractual rate. Following these checks, designated staff in the MODSAP team and the Saudi Armed Forces authorise the payment to BAE each month. SANGCOM follows operating procedures based on standard MoD practice for processing invoices and making payments to third parties. The SANGCOM finance office is responsible for authorising the payment of purchase invoices raised under the contracts, in conjunction with approval by the commercial and project management teams (paragraphs 1.4, 1.15 to 1.22 and 2.16).

16 Our observations of the processes that the MoD operates over payments to contractors under the MODSAP and SANGCOM programmes did not identify any significant control weaknesses. We reviewed the processes for making payments and carried out transaction and controls testing to examine how the MoD’s processes and controls were operating. We found on both programmes that the MoD was operating controls to ensure that payments were properly authorised. For payments made through MODSAP the programme team checked to ensure that work had been completed to the required standard, prices charged agreed with contractual rates, and payments were correctly authorised. In relation to SANGCOM, control activity is manual and relies primarily on segregated authorisations subject to delegated authority limits (paragraphs 1.18 to 1.23 and 2.16 to 2.19).

17 In recent years, the MoD has strengthened its wider assurance framework around the management of the programmes, including learning lessons from the court case. Both the MODSAP and SANGCOM teams have implemented the recommendations from internal audit reviews looking at their governance arrangements. This has resulted in improvements in how both programmes operate. MODSAP’s current business plan focuses on its internal governance, security and working practices. It aims to comply with MoD best practice, rules and regulations. The MoD completed an exercise in October 2024 for MODSAP to learn lessons from the court case. In response to its findings, the MODSAP team has initiated quarterly audits of paymaster payments, continued quarterly audits of programme funding transactions and upskilled its staff with bespoke fraud training. The SANGCOM team checks the appropriateness of its decisions with crown legal officers who are on retainer. The programme director discusses issues with his superiors in Defence Digital to ensure he makes appropriate decisions (paragraphs 1.22 to 1.24, 2.4, 2.5 and 2.18 to 2.20).

Concluding remarks

18 We undertook this investigation to bring transparency to the current arrangements relating to the MoD’s management of contracts on behalf of the KSA. We found that the MoD has a clear set of controls to manage and oversee expenditure relating to the contracts it manages on behalf of the KSA and that its actions are currently compliant with those controls. It has sought to learn lessons from the court case with which it has been involved and has strengthened its processes. We identified no significant areas of concern.

Part One

The Ministry of Defence Saudi Armed Forces Projects

1.1 The Ministry of Defence Saudi Armed Forces Projects (MODSAP) programme fulfils the UK government’s obligations under a government-to-government agreement with the Kingdom of Saudi Arabia (KSA) to supply equipment and support services to the Saudi Armed Forces. In this part we describe:

the background to the MODSAP programme;

the organisation of MODSAP’s programme team;

the legal and commercial framework under which MODSAP operates;

the funding of MODSAP’s operating costs; and

the controls and processes that the Ministry of Defence (MoD) operates in relation to the contracts managed by MODSAP.

Background to the MODSAP programme

1.2 In 1985, the UK and KSA governments signed a formal understanding that the UK government would supply the Saudi Armed Forces with equipment and support services. In 1986, the two governments signed a government-to-government agreement which established MODSAP.

1.3 Through MODSAP, the MoD supplies military aircraft, naval vessels, weapons and associated support services to the Saudi Armed Forces. There are two main MODSAP sub-programmes.

The Saudi-British Defence Co-operation Programme (SBDCP). This links back to the 1986 agreement. It provides ongoing support for equipment supplied under the Al Yamamah programme, which ran from 1986 to 2006; the enhancement of existing capabilities; and the acquisition of new equipment for the Saudi Armed Forces.

The Salam Project, which was established in 2007 to supply Typhoon aircraft for the Saudi Armed Forces. It also provides advice, assistance and assurance to the Saudi Armed Forces regarding its Typhoon force.

1.4 The 1986 agreement set out the responsibilities of each government. The UK government’s obligations include:

delivering commercial, safety and quality assurance of all capability, material and services provided through MODSAP;

monitoring the performance and delivery of the prime contractor, BAE Systems Plc (BAE), to the satisfaction of the Saudi Armed Forces and in accordance with contractual and government-to-government agreements; and

ensuring that all other UK government obligations and dependencies under the government-to-government agreement – including managing MODSAP’s finances and providing seconded personnel to BAE – are delivered to the satisfaction of the Saudi Armed Forces.

The KSA government, as the beneficiary and funder of the agreement, ensures that the programme runs smoothly, both technically and financially. Both parties acknowledge that the agreement is a statement of intent and not a contract under law. The MoD considers the agreement to be politically and morally binding for both governments.

1.5 The MoD’s vision is that MODSAP will:

sustain, strengthen and enhance the defence and security relationship between the Saudi Armed Forces, the Saudi industrial base, and the UK government; and

support the UK’s prosperity, sovereign defence industry and regional influence.

BAE’s annual reports from 2020 to 2024 show that its total revenue from the KSA for these five years, including the MODSAP programme, was £13.2 billion, and in the year ended 31 December 2024 it was £2.9 billion. BAE uses this revenue to fund its workforce of around 6,800 based in the KSA and to pay suppliers in the UK, Europe and the KSA.

1.6 In 2016 the KSA government launched its Vision 2030 strategy, which aims to transform and diversify the KSA’s socio-economic landscape. As part of this, the KSA government aims to spend 50% of its military equipment budget with local suppliers by 2030. It plans to achieve this through direct investments and strategic partnerships with leading companies in the defence sector to transfer knowledge and technology, and build national expertise in manufacturing, maintenance, repair, research and development. The MoD and BAE aim to support this strategy by facilitating investment in and development of the KSA’s defence industry. Accordingly, where practicable, the MODSAP and BAE teams aim to involve and enhance the KSA’s supply base through their procurement activity.

Organisation of the MODSAP programme

1.7 The MODSAP team is a self-funding, non-profit making standalone business unit which manages its own resources and operates within the government’s financial regulatory framework. The senior MoD manager who oversees the MODSAP programme is the Chief of the Saudi Armed Forces Projects, who since 2023 has been an MoD Director General.1 MODSAP’s senior leadership team is headed by a two-star military officer as director.2 The director is supported by four one-star staff (both military and civilian) heading commercial, policy and strategy, programmes and naval programmes.3 Responsibility for managing MODSAP’s operating cost budget and governance is delegated by the MoD’s Director General Finance to the senior finance officer who reports to MODSAP’s head of commercial. Figure 1 sets out MODSAP’s management structure.

1.8 The MODSAP team provides advice, assistance and assurance to the Saudi Armed Forces. It provides a range of skills, including in relation to commercial, digital, engineering, finance, operational delivery, policy, project management and quality assurance. In 2024-25, the team’s budgeted complement was 89 military and 100 civilian staff. About half its staff are spread across five sites in Saudi Arabia, with the other half in the UK.

1.9 The governance of MODSAP involves various stakeholders, including the UK and KSA governments, BAE, and the MoD’s head office.

MODSAP’s overall direction and priorities are informed by the UK and KSA governments’ bilateral relationship, which since March 2018 has been developed through the Strategic Partnership Council.4

The MoD provides strategic management of MODSAP through an internal, twice-yearly MODSAP management board meeting, chaired by the Chief of the Saudi Armed Forces Projects, and by monthly joint board-to-board meetings with BAE (Figure 2).

The MoD discusses the delivery of the MODSAP programmes at annual programme review meetings with the Saudi Armed Forces and BAE.

The MODSAP senior leadership team provides day-to-day management, supported by other MODSAP team members as required.

The legal and commercial framework under which MODSAP operates

1.10 The 1986 agreement defined the relationship between the KSA and UK governments for the supply of equipment, sustainment, and support services to the Saudi Armed Forces. It established MODSAP as the UK programme office for this agreement and designated BAE as the prime contractor. The KSA government and the MoD agree MODSAP’s work programme in a series of Letters of Offer and Acceptance (LOAs) for major packages of work, such as aircraft, naval equipment, weapons, logistics and workforce support (Figure 3).

1.11 The MoD works with the Saudi Ministry of Defence to agree proposals for MODSAP’s work programmes within budgets set by the Saudi Finance Ministry. MODSAP’s largest work programmes are funded on a five-year basis, although a few work programmes are funded ad hoc, based on KSA requirements. For those work programmes which have begun since 2022, the parties have negotiated an LOA for each workstream, which included statements of work for the goods or services that the workstream should provide, along with price and payment terms.

1.12 The MoD’s relationship with BAE is governed by a heads of agreement, which was signed soon after the 1986 government-to-government agreement. BAE has no contractual relationship with the KSA government. All the work packages set out in the LOAs are mirrored by contracts between the MoD and BAE. These are negotiated and operate under English law.

1.13 Because the MoD acts on a non-profit basis, both the KSA government and BAE include ‘hold harmless’ provisions in their agreements with it. These provisions mean that they will not hold the UK government responsible for any loss or liability arising from its participation in the arrangements, subject to the MoD fulfilling its obligations set out in the agreements. The provision, therefore, is not a blanket indemnity for the MoD; for example, it would not apply if BAE incurred costs because the MoD had failed to meet its obligations.

Funding MODSAP’s operating costs

1.14 Under the 1986 agreement, the KSA government pays the MoD a management fee which fully covers MODSAP’s running costs such as for personnel and facilities management. The fee is a monthly levy based on payments to BAE, and MODSAP forecasts the income using BAE’s projections of the work it expects to be paid for each month. Because monthly income fluctuates, and income is often front loaded in a five-year programme, the MODSAP team manages its expenditure to accommodate these fluctuations.

The controls and processes that the MoD operates in relation to the contracts

The MoD’s controls over the appointment of contractors

1.15 BAE appoints subcontractors to undertake work funded by the MODSAP programme through three different routes.

Directly appointed by BAE: This route delivers the core MODSAP projects and accounts for most of its spending. BAE appoints subcontractors from its approved list of suppliers, and the MoD relies on BAE to manage its relationship with the programme’s subcontractors. However, the MoD’s contracts with BAE incorporate its standard commercial terms and conditions relating to BAE’s supply chain, and any specific terms arising from the contract. BAE does not need MODSAP’s approval to appoint subcontractors, and it can let subcontracts using local rather than English law. However, MODSAP staff meet with the largest subcontractors to understand their pricing and supply chains.

Directed procurement: BAE manages a small proportion of MODSAP’s spending through ‘directed procurement’. This is used to supply goods and services that the Saudi Armed Forces want to pay for out of its funding for the MODSAP programme, but which are not part of BAE’s core product lines or project areas. The MoD and BAE can refuse to undertake a directed procurement if it is unable to establish with the Saudi Armed Forces what the proposed contract is for. Directed procurement can occur through two distinct processes. Either the Saudi Armed Forces direct BAE to appoint a specific supplier through a single source contract, or the Saudi Armed Forces ask BAE to run a limited competition on its behalf to identify a supplier for a task. BAE only appoints suppliers that have passed its due diligence processes to become an approved supplier.

Paymaster: This is used when the Saudi Armed Forces have contracted directly with a supplier but want the payment to come from its funding for the MODSAP programme. The purchases made through this process can include goods such as stationery and some defence equipment. In this route, neither the MoD nor BAE have had any involvement in negotiating the terms of the contract. The MoD authorises BAE to pay the supplier on the Saudi Armed Forces’ behalf. The MoD makes a very small proportion of the value of MODSAP payments through this route.

The MoD’s controls over the operation of the contracts

1.16 The MODSAP team has two main roles regarding the core programme: it assures the equipment, material and services delivered by BAE to the KSA government through the main procurement route; and it monitors the performance of BAE throughout the delivery process in both the KSA and UK.5 Wherever applicable and practical, it ensures that all equipment, materials and services conform to relevant UK legislation and MoD standards as follows.

Up to the point that the MoD transfers the equipment to the Saudi Armed Forces, MODSAP’s director ensures that its quality, safety and environmental management are identical to those applied to the MoD’s own programmes. The MoD assesses BAE’s quality, safety and environmental management activities during the design of equipment, material and services.

Once the MoD has transferred ownership to the Saudi Armed Forces, MODSAP’s director assures the safety of equipment and services using a risk-based approach and BAE’s safety management arrangements.

1.17 In addition to the assurance role, the MODSAP team also advises and assists the Saudi Armed Forces on the through-life capability management and operational effectiveness of equipment supplied through the programme. MODSAP guidance stipulates that only staff with suitable qualifications and experience, and who are authorised to do so in their roles’ terms of reference, undertake advisory and assistance activities.

The MoD’s controls over payments to contractors

1.18 MODSAP’s current business plan focuses on its internal governance, security and working practices. It aims to ensure that it complies with MoD best practice, rules and regulations. We reviewed the process agreed between the Saudi Armed Forces, the MoD and BAE for making payments from the MODSAP budget.

1.19 The main procurement route (Figure 4), which accounts for most of the payments, involves the following steps.

Purchase orders are raised under their respective LOAs which set out specific project requirements. These are generally drafted collaboratively by MODSAP staff and Saudi officials.

Purchase orders are agreed between the Saudi Armed Forces, the MoD and BAE and are signed off by the MoD’s Chief of the Saudi Armed Forces Projects and a senior Saudi official.

Purchase orders are matched to the subsequent purchase invoice. The MoD is responsible for undertaking assurance activity over the purchase invoices. This involves an internal three-stage review to confirm the amount and that there is evidence that the work has been completed, followed by the approval process.

Subject to successful checks being completed, the MoD collates the purchase invoices and submits them to the Saudi authorities in an agreed format.

The Saudi Ministry of Defence reviews and approves the contents of the MODSAP submission.

The MoD and the Saudi Armed Forces counter-sign the submission, and officials included on an authorised signatures list for the MoD’s MODSAP bank account make a disbursement of funds request in writing and sign it.

The bank then makes the payment to BAE on a monthly basis.

1.20 The MoD operates simpler processes for making payments under the two other payment routes that exist.

Under directed procurement, the MoD has no role in managing the contract. Once it has received an invoice and confirmation from the Saudi Armed Forces that the work has been done, it directs BAE to pay the supplier on the Saudi Armed Forces’ behalf. BAE must confirm that the supplier has passed its internal due diligence checks.

Under paymaster, the MoD receives a letter from the Saudi Armed Forces confirming the allocation of MODSAP funds to the relevant contract and then another letter from the Saudi Armed Forces instructing payment by this route.

1.21 The MoD recognises that it has less control over the paymaster route than the other two processes because BAE does not appoint the contractors. However, the MoD has processes in place to mitigate this risk. The MODSAP finance team reviews each invoice to check that it is supported by a valid payment certificate and to confirm that it includes details of the transaction and the work done. It is the Saudi Armed Forces’ responsibility to confirm that the goods or services have been delivered. The MoD then approves the payment to the supplier, which is made by BAE. Prior to making the payment, BAE also conducts due diligence on all paymaster invoices to meet its legal obligations, such as the UK Bribery Act 2010.

1.22 We carried out transaction and controls testing to examine how MoD’s processes and controls were operating. This included documenting and performing walk-through tests of system and control processes and testing a sample of transactions for each of the three payment routes.6 We found that the MoD was operating the following controls to ensure that payments were properly authorised.

The MoD undertook the necessary checks to ensure that work has been completed to the required standard. This included ensuring that milestone criteria have been met, and that the work has been certified.

The MoD checked that prices charged agreed with contractual rates.

Payments were correctly authorised.

The senior finance officer has undertaken quarterly audits of transactions passing through the bank accounts, including sample testing of backing documents that support disbursements.

Lessons learned and internal audit

1.23 As a result of the Serious Fraud Office’s investigation into GPT Special Project Management Ltd, the MODSAP team completed a lessons learned exercise, led by its head of commercial, in October 2024. This focused on whether the MoD understands what it is paying for, is taking direction from appropriate Saudi officials, and provides staff with the appropriate training. In response to the key findings the MoD has done the following.

Initiated quarterly audits of paymaster payments, in conjunction with BAE: In 2024, the MODSAP team started undertaking these audits to ensure payments made through the paymaster route follow the payment approvals process and that the Saudi Armed Forces have provided the required supporting documentation to substantiate the value of the invoice.

Continued quarterly audits of programme funding transactions: These began in 2020 and involve the senior finance officer reviewing a sample of transactions from across different months, funding streams and currencies and agreeing them to appropriate backing documentation.

Upskilled its staff with bespoke fraud training.

1.24 Internal audit has reviewed MODSAP’s operating activity several times in the last decade; it has not examined activities relating to programme funding. Internal audit first reviewed MODSAP in 2014, when it issued a ‘no assurance’ conclusion. In 2019, internal audit reported that several weaknesses remained, including poor cash management, a lack of segregation of duties and an absence of internal and external checks, but noted that the director and senior finance officer had identified and started to address these issues. A follow-up review in 2020 found that MODSAP had made significant progress rectifying the previously identified weaknesses. In 2024, internal audit concluded that MODSAP’s control frameworks and compliance have significantly improved during the last decade. It said that, although a need for some further improvement remained, governance structures were clear and well communicated, enabling effective reporting, escalation and decision making.

1 From 2023 until 31 March 2025, this was the Director General for Industry, Trade and Economic Security, who reported to the MoD’s Permanent Secretary. On 1 April 2025, the MoD’s senior management structure was reorganised as part of its Defence Reform programme. The Director General’s role was redesignated the Director General for International Cooperation and Exports, and it reports to the newly created National Armaments Director.

2 In the UK military, a two-star rank is a Rear Admiral (Royal Navy), Major General (British Army) or Air Vice Marshall (Royal Air Force) and is equivalent to a Senior Civil Service Pay Band 2.

3 In the UK military, a one-star rank is a Commodore (Royal Navy), Brigadier (British Army) or Air Commodore (Royal Air Force) and is equivalent to a Senior Civil Service Pay Band 1.

4 The Strategic Partnership Council was established in March 2018 to underpin relations between the United Kingdom and the Kingdom of Saudi Arabia. The Council comprises two pillars: Economic and Social, and Political and Security.

5 MODSAP guidance states that assurance is a risk-based approach designed to provide adequate confidence and evidence that the contractor is satisfying the work requirements set out in the relevant LOA, and that monitoring involves tracking a project’s metrics, progress, and associated tasks to ensure everything is completed on time and according to project requirements and standards. It also includes recognising and identifying issues that might arise during the project’s execution and taking action to rectify these problems.

6 See Appendix One for further details.

Part Two

The Saudi Arabian National Guard Communications Project

2.1 The Saudi Arabian National Guard Communications Project (SANGCOM) provides support from the Ministry of Defence (MoD) to the Saudi Arabian National Guard (the National Guard). In this part we describe:

the background to the SANGCOM programme;

the organisation of SANGCOM’s programme team;

the legal and commercial framework under which SANGCOM operates;

the funding of SANGCOM’s operating costs; and

the controls and processes that the MoD operates in relation to the contracts managed by SANGCOM.

Background to the SANGCOM programme

2.2 SANGCOM began in 1978 when the UK government signed a government-to-government agreement with the Kingdom of Saudi Arabia (KSA) to acquire and support telecommunications capability for the National Guard. The current agreement was signed in 1997. This sets out the respective roles and responsibilities of the National Guard and the MoD. The MoD’s obligations include:

developing, implementing and administering a plan to modernise and develop the National Guard Communications Network in the most effective and economical manner;

applying to an appropriate and necessary extent the same standards, procedures and conditions to the control and administration of SANGCOM’s contracts as it does to its own; and

monitoring the progress and performance of the contractors.

The MoD’s participation depends on the KSA reimbursing its operating costs. Under the agreement, the MoD operates on a no-profit-or-loss basis.

2.3 Between 1978 and 2019 the MoD engaged a prime contractor to deliver the SANGCOM programme, which from 1995 was GPT Special Project Management Ltd (GPT). In March 2007 GPT was bought by a subsidiary of Airbus S.E. GPT’s only customer since its formation has been the National Guard. GPT’s last 10-year programme expired on 31 December 2019, Airbus having informed the MoD beforehand that GPT would not continue operating beyond that date. GPT’s 2022 annual report stated that it was in the process of closing its operations and would eventually voluntarily liquidate.

Organisation of the SANGCOM programme

2.4 SANGCOM is part of Defence Digital.7 It is overseen by the MoD’s Chief Information Officer, supported by the Director Delivery: Intelligence and Expeditionary Services. The programme director is a one-star military officer.8 The programme director discusses issues with his superiors in Defence Digital to ensure he makes appropriate decisions.

2.5 In July 2024, the MoD agreed that the SANGCOM team to September 2025 would comprise 40 staff, 17 of whom were military personnel. Nearly all SANGCOM staff are based in Saudi Arabia. SANGCOM’s staff are organised into three portfolios: programme operations, programme enabling, and commercial. SANGCOM also has two crown legal officers on retainer, who provide legal checks on the appropriateness of its decisions.

2.6 SANGCOM’s work is overseen by two internal committees, both of which are chaired by the programme director.

The weekly management board meeting reviews and discusses SANGCOM’s operations, including risks and issues that might impact its strategic objectives.

The monthly programme board meeting reviews the progress of all projects in the programme.

2.7 The delivery of the work programme is monitored by a series of joint bodies, which include representatives of both the National Guard and SANGCOM team (Figure 5). The SANGCOM representatives are accountable and responsible for specific tasks relating to the procurement strategy, and programme and supplier management.

The legal and commercial framework under which the SANGCOM programme operates

2.8 The MoD and the National Guard have agreed the work programme delivered by SANGCOM through a series of Letters of Offer and Acceptance (LOAs). In these LOAs, the UK government offers to undertake various tasks and activities for the National Guard. The current work programme is the fourth phase of the LOA agreed in 1997. Both the second phase (agreed in 2004) and third phase (agreed in 2010) added further items to the work programme and increased the funding for SANGCOM. In 2010, the Saudi government approved a £1.6 billion work programme, comprising £1.5 billion for project costs and £0.1 billion to fund SANGCOM’s operating costs. The SANGCOM programme is still being funded by this 2010 budget (Figure 6).

2.9 In December 2019, when GPT’s agreement expired, some elements of the work programme agreed in 2010 remained outstanding. Factors that delayed the completion of these tasks included:

a significant increase in the work required resulting from National Guard structural changes;

delays in financial approvals by the National Guard;

SANGCOM optimism bias and under-estimation of the scale and complexity of the programme; and

the delivery performance of GPT and other supply chain issues.

2.10 In accordance with the government-to-government agreement, the National Guard extended the existing LOA and added the acquisition of additional capabilities to it. This resulted in a new £0.4 billion programme running from January 2020 to September 2025, covering telecommunications capability. Sufficient budget remained in the funding package agreed in 2010 to pay for this additional programme.

2.11 Between 2019 and 2022, the MoD also had a £240 million contract to support the National Guard by providing telecommunications capability. The National Guard has now taken on responsibility for these tasks. The MoD has closed all elements of this agreement, including contract and commercial obligations.

Funding SANGCOM’s operating costs

2.12 All SANGCOM’s operational costs, such as for personnel and facilities management, are funded through a budget agreed with the National Guard. The 1997 agreement stated that the UK government would charge 2% of the total programme costs to cover administrative costs in the UK and would charge separately for the cost of the MoD team in Saudi Arabia. As part of the negotiations for extending the SANGCOM programme beyond December 2019, the National Guard and the SANGCOM team reviewed the programme’s entire funding arrangements, and the National Guard agreed that the SANGCOM programme could draw down a monthly fee of £0.9 million for its team costs. As of 31 May 2025, the MoD had spent £185 million on SANGCOM operating costs since January 2010.

The controls and processes that the MoD operates in relation to the contracts

The MoD’s controls over the appointment of suppliers

2.13 Since January 2020, the MoD has operated SANGCOM by contracting directly with suppliers, rather than through a prime contractor. The MoD considered appointing a new prime contractor but concluded that the complexity of the programme was now manageable for it and the National Guard, and that the cost of having a new prime contractor outweighed the benefits. However, SANGCOM’s operating costs have been higher than originally budgeted (see paragraph 2.12) because the MoD is now managing suppliers itself.

2.14 The MoD currently has contracts with nine suppliers across 13 projects forming the SANGCOM programme. This includes local KSA suppliers. The MoD has been advised that contracting directly with local providers does present a risk that Saudi Arabian commercial law may be applied. While the MoD cannot remove this risk entirely, it has sought to mitigate it by letting each contract under English law and including provisions for dispute resolution between it and its suppliers in the UK. The contracts include the MoD’s standard terms and conditions. The MoD does not specify which legal framework suppliers should use in their contracts with subcontractors.

2.15 The 1997 government-to-government agreement requires the MoD to modify its procedures, including when procuring and awarding contracts, to the extent that is required by the National Guard. This includes allowing the National Guard to direct how procurements managed by the MoD are run and, in particular, to mandate whether specific companies should be included or excluded from these competitions. The MoD told us that the National Guard has added suppliers, for example when it has a better understanding of potential local suppliers than SANGCOM.

The MoD’s controls over payments to contractors

2.16 Our review established that SANGCOM follows operating procedures based on standard MoD practice for processing invoices and making payments to third-party contractors (Figure 7). Control activity is manual and relies primarily on segregated authorisations subject to delegated authority limits.

The contractor submits evidence of work completed under the contract to the SANGCOM project manager, who reviews and confirms that it has been completed in line with the evidence provided.

Following this confirmation, the contractor raises a purchase invoice with the SANGCOM project finance office and provides supporting evidence in accordance with the relevant standard operating procedure.

The finance office undertakes an internal review process in conjunction with the project manager. This involves an internal three-stage review and approval process, confirming that the work has been accepted and is in accordance with the contract.

The finance office authorises payment via Defence Business Services.

Defence Business Services reviews and submits a payment request to the bank. Only individuals listed as authorised signatories for the SANGCOM account with the bank can submit a payment request.

The bank then makes payment to the contractor.

The MoD’s arrangements to ensure that the controls are operating as intended

2.17 We carried out transaction and controls testing to examine how the MoD’s processes and controls were operating. This included documenting and performing walk-through tests of system and control processes, and testing a sample of transactions to ensure they had been subject to the processes and controls identified.9

2.18 We found that each transaction requires relevant project, commercial and finance managers to sign-off a ‘minute sheet’. This control is designed to ensure that SANGCOM is satisfied that work has been delivered by the contractor. The SANGCOM teams undertake the following steps.

Commercial: Checks that the invoice received is consistent with the associated contract milestone.

Project: Confirms that the work covered by the invoice has been delivered, which includes checking with the National Guard.

Finance: Confirms that the invoice is accurate, including sales tax.

The portfolio manager has sight of each invoice and the corresponding minute sheet. The involvement of the portfolio manager provides additional assurance regarding the progress of work against overall contract delivery.

2.19 We found the following controls were operating to ensure that payments were properly authorised.

Transactions were approved by all relevant SANGCOM team members in advance of payment requests being made.

The MoD checked that prices charged agreed with contractual rates.

Approvals given by individuals were all within SANGCOM delegated authority limits.

Payment requests were submitted to the MoD by appropriate individuals and accurately reflected the underlying purchase invoice.

2.20 In 2016, internal audit undertook a governance review of SANGCOM. This found that, during the previous 18 months, the SANGCOM team had done a significant amount of work to align the programme with MoD policy, processes and procedures, but that there were some weaknesses. A follow-up review in 2017 found that the SANGCOM team had implemented the earlier review’s management actions for which it was responsible, and that process changes had resulted in significant improvements to controls.

7 Until 30 June 2025 Defence Digital was an organisation within UK Strategic Command. On 1 July 2025 it transferred to the National Armaments Director Group as part of the MoD’s Defence Reform programme.

8 In the UK military, a one-star rank is a Commodore (Royal Navy), Brigadier (British Army) or Air Commodore (Royal Air Force), and is equivalent to a Senior Civil Service Pay Band 1.

9 See Appendix One for further details.

Appendix One

Our investigative approach

Scope

1 We conducted this investigation in response to interest generated by the conclusion of the court case arising from a Serious Fraud Office examination of alleged irregular payments from the then prime contractor for the Saudi Arabian National Guard Communications Project (SANGCOM) to a subcontractor made between 2007 and 2012.

2 Our report aims to bring transparency to the Ministry of Defence’s (MoD’s) current arrangements and activities for managing the two main programmes that it operates on behalf of the Kingdom of Saudi Arabia (KSA) – the Ministry of Defence Saudi Armed Forces Projects (MODSAP) programme, and SANGCOM. Our investigation examined the current arrangements and did not consider the arrangements in place during the period covered by the court case, which have been superseded. It did, however, consider the extent to which the MoD has learned lessons from issues raised during the court case. The report does not evaluate the value for money of the arrangements, because they are funded by the KSA government.

3 Our report examines:

the arrangements the MoD has agreed with the KSA to manage programmes on its behalf;

the controls and processes the MoD operates to manage the programmes which arise from these government-to-government agreements;

the controls and processes the MoD has for making payments under these programmes; and

the arrangements the MoD has in place to ensure that the controls and processes are working as intended.

4 We conducted our fieldwork between July 2024 and May 2025.

Methods

Interviews

5 We interviewed key officials at the MoD to understand the rationale for why the MoD is managing programmes on behalf of the KSA, the current arrangements that are in place, and the risks and opportunities that these arrangements provide. Those we interviewed included:

the MoD’s Director General for International Cooperation and Exports;

MODSAP’s director and officials from its commercial and finance teams; and

SANGCOM’s director and officials from its commercial and finance teams.

Document review

6 We reviewed unpublished documents from the MoD to understand the objectives of its agreements with the KSA; the organisation, governance and management of MODSAP and SANGCOM; the commercial and legal framework under which the programmes operate; and the controls and processes that both programmes have in place. The documents include:

documents relating to the agreements between the UK and KSA governments regarding MODSAP and SANGCOM;

documents relating to the relationship between MODSAP and SANGCOM and their suppliers;

briefing papers for senior officials and ministers relating to MODSAP and SANGCOM;

documents setting out the organisation, governance and management arrangements at MODSAP and SANGCOM;

guidance and policies regarding the processes and controls that operate at MODSAP and SANGCOM;

internal audit reports relating to MODSAP and SANGCOM; and

bank statements and supporting papers for both MODSAP and SANGCOM.

Transaction and controls testing

7 We carried out transaction and controls testing to examine how the MoD’s processes and controls at MODSAP and SANGCOM were operating. The testing included:

documenting the systems and control processes for the processing of invoices from contractors and carrying out a walk-through test to confirm our understanding;

documenting the systems and control processes for the payment of invoices from contractors and carrying out a walk-through test to confirm our understanding;

selecting a sample of transactions and testing, by reference to supporting documentation and records, whether they have been subject to the process and controls identified and whether the controls have been implemented effectively;

comparing the systems and processes to those similarly documented for the MoD departmental audit;

understanding the basis of and documenting the process by which the MODSAP running costs levy is recognised; and

understanding the budgeting and control processes over the operating expenditure of MODSAP and SANGCOM, and testing a sample of expenditure, expenses and payroll charges to confirm that the controls had been implemented effectively.

Design and Production by NAO Communications Team
DP Ref: 015444-001