Independent Audits of Contractor Business Systems - Part 7

We recently finished up a six-part series discussing the DoD's new proposal for ensuring the adequacy of certain contractor business systems; namely the estimating system, the MMAS (material management and accounting system), and the accounting system. If you missed it, you can read them through by starting with Part 1. In short, DoD's proposal, if adopted, will require contractors to self-assess three of their business systems and engage an independent CPA firm to audit those systems every three years.

We haven't been the only one writing about the proposal. There have been numerous published blogs and articles on the subject. Today, we want to recap some of the concerns and insights expressed by various authors and organizations. Some of these comments express concerns and offer insights that we hadn't considered as we were reviewing and writing about DoD's proposed regulation.

In its Federal Register Roundup Blog, SheppardMullin looks at the rule with a "legal" spin. Contractors will be offered no favorable credit or "safe harbor" for disclosures made in their reports. That's true. Under current rules, system deficiencies will result in billing withholds until the deficiencies are corrected. That doesn't change under the new rule. It doesn't matter whether the deficiencies are disclosed by the Government or by the contractor's independent CPA firm. Withholds will still result.

SheppardMullin further writes that the new rule places a substantial administrative and monetary burden on contractors (which we previously discussed) but because the Government won't conduct any audits until the contractor and/or its CPA has completed their own audits, the statute of limitations on Government claims will begin to run at a much later point in time then would be the case if the audit process were initiated by the Government. They also expressed concerns that DCAA criticisms of contractor audits could easily prompt False Claims Act allegations based on alleged misstatements in the private audits or other alleged inadequacies in the audit process. We agree with SheppardMullin that no one should be deluded into believing that DCAA will accept those self-assessments or those prepared by the contractors' CPAs.

Law360 quotes a representative of PSC (Professional Services Council) stating that this new rule is more than what contractors wanted. Contractors want the option of getting their own independent CPA audit or waiting for the Government to get around to doing one. PSC is currently withholding comment on the proposed rule. Law360 also warns that the new rule "...tries to recapture some of the access to information, work papers, internal audits that would be traditionally off limits to the government if they were to do this review themselves.

WileyRein expressed concern about the efficacy of the proposed rule. "Since these contractor and CPA reports are subject to DCAA review, it remains to be seen how long DCAA takes to review the reports and whether DCAA will accept CPA audits or review them so critically that the anticipated efficiencies are lost."

The National Law Review expresses the same concern: "It is not clear however, whether this new proposed framework would realize meaningful time efficiencies. Government auditors who review third-party CPA audits may not be inclined to rubber stamp those findings".

JDSupra Business Advisor lists a number of concerns including i) the qualifications of CPA firms to perform the business system examinations, ii) extent to which independence of the CPA firms will be determined, iii) effectiveness of CPA firm examination in the eyes of a follow-on DCAA assessment and iv) liability borne by both the CPA firm and the contractor if a system found to have no deficiencies by the CPA is later determined to have deficiencies based on subjective criteria.

This proposal is such a radical departure from the way that DoD has conducted its business ever since there were contract auditors that no one really knows how it will turn out. The biggest unknown right now is how DCAA intends to review the work of contractor internal assessments and external CPA reviews. It would be useful if DCAA were to publish those procedures and timelines now, rather than wait until the rule goes final.