Section 809 Panel - Replace Single Deficiency with Tiered Approach to Better Describe Severity

Today we are continuing our discussion of the recently released Volume 3 report published by the Section 809 Panel. We have been focusing on recommendations 71 through 73 which sare the common theme of adopting a Professional Practice Guide (PPG) to assist oversight agencies and independent public accountants (IPAs) to better meet the needs of contracting officials who rely on oversight activities. Today we are covering Recommendation No. 73; replace the DFARS (DoD FAR Supplement) definition of "business system deficiency" with a tiered rating system to more closely align with generally accepted auditing standards (GAAS).

As most Defense contractors know, there are six business systems that the Government considers essential to protecting its interests and essential for contractors to ensure good internal control systems are in place. These are (i) accounting system (ii) purchasing system, (iii) estimating system (iv) property management, (v) material management and accounting system (MMAS), and (vi) earned value management system (EVMS). Various oversight agencies (usually DCAA and DCMA) will take the lead in reviewing internal controls for these systems and issue reports as to their conclusion on the adequacy of those controls. If the controls are found to be deficient, the Government will expect corrective action  plans and perform follow-up reviews to ensure those plans are in place and effective.

The definition of the term significant deficiency for contractor  business systems (based on Section 893 of the Fiscal Year 2011 NDAA (National Defense Authorization Act) and carried over into the DFARS (DoD FAR Supplement)) does not align with generally accepted auditing standards for evaluating and reporting on internal control deficiencies. This lack of consistency creates confusion regarding the identification, severity, meaning and resolution of deficiencies.

According to DFARS, a significant deficiency describes it as materially affecting DoD officials' and contractor's ability to rely on information produced by the business system that is needed for management purposes.

The term in GAAS for a weakness of this severity is a "material weakness. GAAS also uses the term "significant deficiency" but in a way to describe a deficiency that is less severe than a material weakness. The use of the same term to mean different levels of severity of a deficiency creates confusion about the meaning of significant deficiency among contractors, independent public accountants performing internal control audits, government auditors, and the acquisition community.

The Section 809 Panel believes that contractor business systems could have a number of deficiencies that range from trivial to severe. Reporting deficiencies by different levels of severity, and in a manner that aligns with established auditing standards, will allow contracting officers to make informed decisions on the acceptability of the business system.

• Material weakness: A deficiency, or combination of deficiencies, in internal control over risks related to Government contract compliance or other shortcomings in the system, such that there is a reasonable possibility that a material noncompliance will not be prevented, or detected and corrected, on a timely basis. A reasonable possibility exists when the likelihood of an event occurring is either reasonably possible, meaning the chance of the future event occurring is more than remote but less than likely, or is probable.
• Significant deficiency: A deficiency, or combination of deficiencies, in internal control over risks related to Government contract compliance or other shortcomings in the system that is less sever than a material weakness yet important enough to merit the attention of those charged with governance
• Other deficiency: A deficiency or combination of deficiencies, in internal control over Government contract compliance or other shortcomings in the system that have a clearly trivial or inconsequential effect on the ability of the business system to prevent or detect and correct, material noncompliances on a timely basis.

The "other deficiency" acknowledges the possibility that a business system deficiency, or combination of system deficiencies, may have a clearly trivial effect on the quality of information produced by the contractor's business systems. The Section 809 Panel believes that "other deficiencies" should not impact the audit opinion or be included in the audit report. Such deficiencies would be communicated to the contracting officer via email or other method of communication. It should be noted that trivial deficiencies sometimes turn into significant deficiencies if not corrected.