Under U.S. law in almost every U.S. jurisdiction this would be illegal conduct. Arnie would be a co-conspirator with Bob in money laundering and in embezzlement of government funds. These would usually be criminal felonies.
The government (or a private whistleblower called a "relator" in what is called a "qui tam" action, conducted in a procedurally proper way which afford the government an opportunity to sue itself before bringing the private qui tam action) could also sue Arnie and Bob and hold them liable, jointly and severally, for the funds diverted to Arnie and Bob in this scheme, and probably for punitive damages and/or civil penalties as well.
If the role played by Arnie was instead played by a U.S. publicly traded multinational company doing business in another country (or by an official of such a company who has knowledge of or is involved in the transaction with Bob), and it was also illegal to do this in that country (whether or not that law was enforced in that country), then the U.S. multinational company involved would also have violated the U.S. Foreign Corrupt Practices Act (FCPA). As noted at the link:
The FCPA is jointly enforced by the Department of Justice (DOJ) and
the Securities and Exchange Commission (SEC), which apply criminal and
civil penalties respectively.
So, in that case, it would be a violation of both U.S. and the other country's laws, in all likelihood giving rise to liability to both criminal and civil consequences in both countries.
It isn't patently obvious that this conduct would be illegal under the law of every country, although it seems likely.
For example, a sheriff operating a prison in Alabama can do something very similar (skim money off prison operation funds by obtaining low bids for prison service contracts) legally.
Similarly, if Arnie had actually gone out and purchased metal parts from a third party at Bob's direction and then delivered those metal parts to Bob's government employer, that would be entirely legal almost everywhere (although any kickback to Bob, if that was what was really happening would still probably be some form of embezzlement in which Arnie might be conspiring).
Also, while this is considered corrupt in most of the developed world, in many developing and undeveloped countries, civil servants are paid almost nothing and kick backs for supervising government contracts are tolerated at a minimum as a matter of unstated official policy by senior managers of the government entities that unofficially sanction or encourage this conduct by their subordinates. This reality is one of the main reasons that the U.S. FCPA is heavily criticized politically and in academic commentary.
what would be the legal consequences of someone
unconnected to the transaction who knows about it reporting or not
reporting it? For example, does not reporting it give rise to a risk
of civil or criminal liability?
Normally, someone not involved in Arnie's company, like a family member of Arnie, would have no legal duty to report this conduct upon learning of it, and would face no legal consequences for failing to report it, if the person not reporting it wasn't actually involved in the scheme.
Someone who cared about Arnie might want to counsel him that he is engaged in very risky conduct that could have catastrophic consequences if discovered and prosecuted. They might advise him that while this scheme does generate funds for Arnie that might not be worth the risk. Ultimately, as a practical matter, if that person didn't want to harm Arnie, however, that person would have to let Arnie decide for himself what to do.
If subpoenaed to serve as a witness, someone who knew about Arnie and Bob's conduct (other possibly than Arnie's spouse and his lawyer if his lawyer learned about the conduct only after the fact), could be compelled to testify in a court of law against Arnie about what the person who knew about this scheme knew, possibly contributing to Arnie going to prison and facing monetary penalties.