Independent CPA Audits of Contractor Business Systems - New DoD Proposal

Last March, we alerted readers to the impending DoD proposal that would require contractors to go out and get their own independent audits of their business systems. At that time, we didn't know the extent of the new rule or when that proposal would be published. We do now -a proposed rule was published last week in the Federal Register.

This proposed rule is rather lengthy but we'll do our best to summarize the key points over the next few days. Small businesses can rest easy on this one - they are exempt for the most part. The proposed rule includes provisions for the contracting officer to flow the requirements down to small businesses in some limited situations but it seems unlikely to us that contracting officers would do so. Additionally, the proposed rule applies only to three of the six DoD designated contractor business systems; Estimating Systems, MMAS (Material Management Accounting Systems), and Accounting Systems.

According to DoD, contractor business systems and internal controls are the first line of defense against waste, fraud, and abuse. We don't know about the "first line of defense" argument but we do agree that weak control systems increase the risk of unallowable and unreasonable costs on Government contracts. In response to a 2011 GAO report, DoD agreed to consider alternative approaches to audit contractor business systems. At that time, GAO noted that audits of contractor business systems were not being conducted in a timely manner and laid the blame squarely on DCAA's (Defense Contract Audit Agency). The GAO reported:

Several factors may affect DCMA’s ability to meet its missions going forward. One significant source of external risk stems from DCMA’s reliance on the Defense Contract Audit Agency (DCAA) to conduct audits of certain contractor business systems. Business systems—such as accounting and estimating systems—are the government’s first line of defense against fraud, waste, and abuse. Because of its own workforce struggles, DCAA has lagged in completing a number of such audits and is currently focusing on other high priority areas.  

GAO found, however, that DCMA contracting officers maintained their determination of many contractor business systems as adequate despite the fact that the systems had not been audited in a number of years—in many cases well beyond the time frames outlined in DCAA guidance. Further, based on a recent DOD policy change, DCAA is no longer auditing contractor proposals below certain cost thresholds, and DCMA will need to use newly-hired contract cost/price analysts to help pick up this increased workload. Internal risks are also present, such as uncertainty on the part of CMOs about whether funding will be available to retain personnel hired using the Defense Acquisition Workforce Development Fund.

So, neither the GAO nor DoD had any confidence that DCAA could ever deliver audits of contractor business systems in a timely manner. The alternatives were to augment the audit staff or make contractors hire independent CPA firms to perform the reviews. This proposed regulation requires the latter - make contractors responsible for securing (and paying for) independent audits.

DCAA is not left out of the process however. Under the proposed regulations, DCAA will be reviewing the independent CPA firms plans and risk assessments as well as assessing their reports for adequacy. That process, we suspect, will generate a lot of concerns and negative comments to the proposed rule.

Click here for Part 2 of this series.