New Professional Practice Guide (PPG) for Performing Incurred Cost Audits

Section 809 of the 2016 NDAA (National Defense Authorization Act) established the Section 809 Panel to research and recommend improvements to the acquisition process. Section 803 of the 2018 NDAA required the Defense Department to adopt commercially accepted standards of risk and materiality in the performance of incurred cost audits. The Section 809 Panel, with the help of DCAA (Defense Contract Audit Agency) and others, drafted a Professional Practice Guide (PPG) to develop a risk assessment framework intended to 'manage' DoD's risk and materiality approaches to incurred cost audits.

DCAA has now uploaded part of the the PPG to its public website. The Agency included only Chapters 1 and 2 plus Appendix A. It did not include Chapter 3 which deals with internal controls. The PPG has been publicly available for many months but has been buried in the Section 809's 600-page volume 3 final report. DCAA intends to adopt the new risk-based sampling framework for sampling incurred cost proposals and to adopt the materiality standards for performing the incurred costs audits found in the PPG. The first materiality criteria involves the selection of contractors to audit. Once the selection has been made, the second materiality criteria involves what cost elements withing the incurred cost proposal should be audited.

The Professional Practice Guide can be found under the Guidance tab at dcaa.mil. Or, go directly there by clicking here.

Contract Auditors to Work Under New Professional Practice Guide

Government contractors (and subcontractors) should become familiar with DoD's 'Professional Practice Guide for Audits and Oversight of Defense Contractor Costs and Internal Controls (First Edition - January 2019). We've covered this guide previously (see for example Section 809 Panel - Recommendation to Adopt an Audit Professional Practice Guide). This guide is intended to provide consistency in the way DCAA and Independent Professional Accounting (IPAs) firms consider risk and materiality in the conduct of their audits and other oversight activities. The PPG is included in the Panel's Third Report beginning on Page 79).

How does DCAA intend to use the Guide? DCAA provides that answer in its latest Annual Report to Congress. DCAA states:

This guide will provide consistency in the way DCAA and Independent Professional Accounting Firms consider risk and materiality. The guide will be important to IPAs when they perform select incurred cost audits for contractors previously audited by DCAA. Internal to DCAA, we plan to use the PPG to meet Congressional requirements to establish, codify, and implement these new materiality thresholds.

What are these new materiality standards that DCAA, and by extension IPAs, must adhere to? The new materiality standards are addressed in the PPG and include 'materiality' in audits of incurred costs and 'materiality in audits of internal controls. This is where the quantification of materiality becomes complex and formulaic driven. But since they are formula driven, contractors (and subcontractors) should be able to replicate materiality thresholds calculated by contract auditors.

The PPG however cautions that the application of quantified materiality is not limited to certain thresholds as "auditor judgment  with consideration of qualitative factors, risk, and variability have an impact".

You can learn more about quantifiable risk or materiality factors in Chapters 2 and 3 of the PPG.

DoD Professional Practice Guide (Audit) - Part 1

Back in January when the Section 809 Panel issued its third and final report, we briefly touched on their recommendation to develop a PPG (Professional Practice Guide) to guide Government auditors and commercial audit firms in conducting audits of Government contractors. This week we will dig deeper into the new guidance to see what it may portend for Government contractors. The guide itself is included in Vol 3 of the Section 809 Panel's report.

The PPG is intended to supplement existing guidance for auditors involved in DoD Procurement contract auditing. It provides additional information regarding how to interpret and apply specific auditing concepts for Government contract audits to assist auditors, contracting officers, and other stakeholders involved in the audit process.

Eventually, the PPG will address seven areas although the current draft version contains just coverage of the first three. Due to its limited statutory term, the Panel did not have time to address them all.

1. Risk assessment
2. Materiality
3. Audits of Internal Controls
4. Independence
5. Objectivity
6. Sufficient evidence
7. Reliance on the work of others

Risk Assessment

The risk assessment framework provides incentives for contractors to achieve and maintain compliant cost accounting and internal controls over Government contract compliance. It also provides disincentives for those contractors who have not.

The framework provides for three levels of risk: low, medium, and high risk strata based on a contractor's ADV (auditable dollar volume). ADV is the total costs charged to flexibly priced (i.e. CPFF, CPIF, FPI, T&M, etc) each year. For contractors with ADV of $1 billion or more, an annual incurred cost audit is mandatory. At the other end of the spectrum, contractors with ADV of less than $5 million, get dumped into a sampling pool if there were no significant questioned costs in the last completed incurred cost audit and there are no "concerns" expressed by someone in the Government acquisition community concerning the particular submission. Contractors with ADV between $5 and $100 million are also in the low-risk sampling pool if they have approved accounting systems. Contractors who don't make it to the "sampling pool" are audited.

Medium risk strata include contractors with ADV between $100 million and $500 million. To make it to the sampling pool, the contractors must meed the three criteria previously discussed  plus not have any business system deficiencies on the books, nor have had any accounting practice or organization changes. Contractors in this strata, even if they make it to the sampling pool, must be audited every four or five years.

The high risk strata includes contractors with ADV between $500 million and $1 billion. It uses the same criteria as the previous strata to determine whether it makes it to the sampling pool. The only difference is that contractors in this strata must be audited at least every other year.

Tomorrow we will discuss the PPG concept of materiality.