U.S. federal agencies are failing to properly manage supply chain security risks, Government Accounting Office (GAO) audit report finds.