GAO Issues Exposure Draft of New "Yellow Book"

Earlier this month, The GAO (Government Accountability Office) published proposed changes to its Yellow Book, also known as Generally Accepted Government Auditing Standards or GAGAS and invited public comments. These Government Auditing Standards are followed by auditors performing audits of Government programs including contract audits performed by the Defense Contract Audit Agency (DCAA). Whether Government contractors realize it or not, whenever they are being audited, the auditors are following the auditing principles embodied in GAO's "Yellow Book".

Because of the requirement for auditors to adhere to the Yellow Book, contractors should be aware of the requirements and should also become cognizant with any changes that might impact audits, especially requirements that will result in additional time and company resources. Contractor support for audits and auditors is not free. There is a cost associated with supporting an audit and those costs are usually passed on to the Government. So it is to everyone's benefit (including taxpayers) to make the audit process as efficient as possible

Here are some of the proposed changes:

1. Tightens up and clarifies independence requirements. Contractors should be alert for situations where the auditor may have "independence" issues.
2. Clarifies impairments to independence rules. Don't expect auditors to offer free advice.
3. More CPE (Continuing Professional Education) requirements - probably a good thing.
4. Enhancing peer review program - the prospect of peer reviews cause auditors to gild the lily.
5. New definition of "waste" and new requirement to report "waste". Previously, the focus was on fraud. Waste is something that cost the Government a lot of money but does not necessarily rise to the level of fraud.
6. Enhancements to the requirement for evaluating the sufficiency of internal controls. This has the potential of increasing auditor time at the contractor facility.

Read more about the changes here.

New Emphasis on the Sufficiency of Audit Evidence

Most long-time Government contractors have faced situations where over-zealous contract auditors or contracting officers make spectacularly wild conclusions based on little or no evidence to back it. It happens way too often and once the Government has dug in its heels on a matter, it takes a lot of time and energy to resolve.

This shouldn't happen. For audits performed by DCAA (Defense Contract Audit Agency), auditors are required by GAGAS (Generally Accepted Government Auditing Standards, aka Yellow Book) to obtain sufficient, appropriate evidence to provide a reasonable basis for their findings. Appropriateness is the measure of the quality of evidence that encompasses its relevance, validity, and reliability while sufficiency is the measure of the quality of evidence used to support the findings and conclusions (GAGAS 6.57).

The DoD Inspector General has, from time to time, called into question the sufficiency of the audit evidence used by DCAA to back up its findings. In fact, in its latest peer review of DCAA, the DoD-IG criticized DCAA because of a lack of documented supervisory review of the sufficiency of audit evidence. Seemingly, no one in the supervision and management chain of command was validating the sufficiency of auditors' work to support their conclusions and recommendations.

Thankfully, DCAA has now amended its internal procedures to require supervisors to make affirmative statements that the  audit evidence gathered during the audit is sufficient to support the objectives of the audit and the resulting conclusions and recommendations. Perhaps this change will reduce the occurrence of audit findings that have no merit.

The new guidance can be viewed or downloaded here.

Independence of Mind vs Independence in Appearance

We do not write often on details of auditing standards. We have mentioned Generally Accepted Government Auditing Standards (GAGAS) in a broad sense such as Monday's posting where a Government solicitation for GAGAS audit services required offerors to have had a peer review or where a contract auditing agency is being criticized for not complying with GAGAS in the performance of an audit. Government contractors don't often concern themselves with why an auditor decides to sample 10 transactions in an account or interview a certain number of employees in a floorcheck - they're usually focused on satisfying and responding to auditor requests for data, information, and analyses.

There is one GAGAS requirement that contractors should be aware of because it could affect the outcome of an audit. The requirement is the first of the "General Standards" found in Section 3.02 of the GAO Yellow Book (a.k.a GAGAS). The General Standards establish a foundation for the credibility of the auditors' work. The first standard is the Independence standard and requires that in all matters relating to the audit work, the organization and the individual auditor, whether government or public, must be independent.

Independence comprises independence of mind and independence in appearance. Independence of mind is the state of mind that permits the performance of an audit without being affected by influences that compromise professional judgment, thereby allowing an individual to act with integrity and exercise objectivity and professional skepticism.

Independence in appearance is the absence of circumstances that would cause a reasonable and informed third party, having knowledge of the relevant information, to reasonably conclude that the integrity, objectivity, or professional skepticism of audit organization or member of the audit team had been compromised.

There are many threats to audit independence including

1. Self-interest (or the presence of financial interest)
2. Familiarity and complacency
3. Social bonding
4. Economic bonds
5. Management and employment
6. Litigation

Auditors are required to self-assess their independence with every audit they perform. Often times, such self-assessments are perfunctory and there could be situations where contractors are very aware of threats to an auditor's independence. One contractor brought up the fact that it employed a close relative of an auditor assigned to perform an audit. While the auditor may have been independent in mind, she certainly was not independent in appearance (and she was re-assigned to another audit).

Contractors should be aware of the GAGAS independence requirements and question any impairments or potential impairments by any audit organization.

What are "Fraud Indicators"

Following our posting on Courtesy Bids last week and how such bids might be considered a fraud indicator to a contract auditor, the Inspector General (IG) or the General Accountability Office (GAO), we were reminded that a fraud indicator does not necessarily lead to a fraud referral or an investigation. According to the DoD-IG who publishes listings of fraud indicators tailored to the type of audit being performed or the nature of the cost incurred, fraud indicators are designed to get auditors thinking - thinking for one, about the circumstances under which a fraud referral may be made.

Why do auditors concern themselves so much with fraud when fraud is not the objective of their audit? Generally Accepted Government Auditing Standards (GAGAS) require them to do so. It is "baked" into the auditing standards (a.k.a Yellow Book). In fact, the word "fraud" shows up 117 times in the GAO Yellow Book. GAGAS requires the following:

when performing a GAGAS examination engagement, auditors should design the engagement to detect instances of fraud and noncompliance with provisions of laws, regulations, contracts, and grant agreements that may have a material effect on the subject matter or the assertion thereon of the examination engagement. Auditors should assess the risk and possible effects of fraud and noncompliance with provisions of laws, regulations, contracts, and grant agreements that could have a material effect on the subject matter or an assertion about the subject matter of the examination engagement. When risk factors are identified, auditors should document the risk factors identified, the auditors’ response to those risk factors individually or in combination, and the auditors' conclusion.

In other words, auditors cannot perform an audit that is compliant with Generally Accepted Government Auditing Standards without considering the potential for fraud and the impact of fraud on the audit subject.. To assist contract auditors in fulfilling its responsibilities, the DoD Inspector General's Office (DoD-IG) has published a listing of fraud indicators to help auditors understand the risks. According to the DoD-IG,

Auditors should familiarize themselves with the basic knowledge provided by the scenarios and creatively use it while performing any audit or review. ... auditors should review the full scenarios at least initially as they provide other valuable information such as examples of analytical procedures, management inquiries, and audit procedures and/or expanded audit procedures to address potential fraud indicators.

Built into every one of DCAA's standard audit programs is a requirement for the auditor to affirmatively consider and document the potential or existence of fraud. For example, the standard audit program for audits of incurred costs, states:

Based on the team's understanding of the criteria, subject matter, and the contractor and its environment, hold a planning meeting with the audit team (at a minimum, Supervisor and Auditor) to discuss and identify potential noncompliances, due to error or fraud, that could materially affect the subject matter. The discussion should include: 

• relevant prior audit experience (e.g., questioned cost, relevant reported estimating or accounting system deficiencies)

• relevant aspects of the contractor and its environment

• risk of material noncompliance due to fraud (e.g., the extent of incentives, pressures and opportunities to commit and conceal fraud, and the propensity to rationalize misstatements)

• other known risk factors

• the audit team’s understanding of relevant internal controls. 

Document fraud risk factors/indicators that are present and could materially affect the subject matter. If fraud risk factors are present, document specific audit procedures designed to address the increased risk of material noncompliance due to fraud. Communication among audit team members about the risk of material misstatement due to error or fraud should continue as needed throughout the audit.

Back in the day, auditors did not specifically look for or consider fraud. If they stumbled across fraud during the course of their work, they were encouraged to report it as a suspected irregularity. Now however, they must affirmatively design audit procedures to detect fraud.

Contractors should be aware that every time an auditor steps through the door of their facility, they are actively engaged in considering whether fraud is occurring or has occurred.

DCAA Once Again Chastised for Poor Auditing - Part 1

Late last year, the Defense Department's Inspector Generals Office (DoD-IG) issued a report on its investigation of a Hotline Complaint regarding the examination of DCAA (Defense Contract Audit Agency) audit of subcontract costs at an unspecified contractor.

In this case, the auditor used a 20 percent decrement factor to question subcontract costs that, in her opinion, were not adequately supported by the contractor. The DoD-IG found that DCAA had not followed Generally Accepted Government Auditing Standards (GAGAS) in performing the audit because the auditor had not obtained sufficient evidence to conclude the costs were unallowable. In addition, the 20 percent decrement factor was arbitrary and unsupported and inconsistent with DCAA policy. The DoD-IG recommended that DCAA withdraw its audit report and consider re-evaluating subcontract costs at this particular contractor. The Director of DCAA concurred with the IG's findings.

The complainant alleged that a DCAA office did not comply with GAGAS or DCAA policy when it questioned $6.6 million of a DoD contractor's claimed fiscal year 2008 subcontract costs. Specifically the complainant alleged that the office failed to comply with GAGAS when the auditor concluded that the contractor did not adequately support its claimed subcontract costs, and inappropriately applied a 20 percent decrement as a basis for questioning subcontract costs.

There was a total of $33 million in subcontract costs incurred during 2008. DCAA sampled 70 subcontractor invoices representing $13.5 million of the claimed amount. DCAA claimed that the contractor did not provide adequate documentation to support the allowability of any of the 70 invoices but rather than question costs based on the statistical sample (which would have been 100 percent of the costs based on DCAA's rationale for not accepting sampled costs), the auditor chose to question 20 percent based on its consideration of "contractor performance and product delivery" (whatever that is supposed to mean).

The IG found DCAA's methodologies fundamentally flawed. The IG reported that DCAA failed to comply with GAGAS by not obtaining adequate evidence to support its conclusion that $33 million in subcontract costs were unsupported. In fact, the IG noted that the audit working papers contained additional evidential matter submitted by the contractor that DCAA didn't even review or at least there was no evidence that DCAA considered it in its opinion.

The IG also noted that DCAA's use of the 20 percent decrement was inappropriate. DCAA guidance clearly states that the 20 percent decrement is advisory in nature (advisory to the contracting officer) when a contractor fails to timely submit required annual incurred cost submissions. In this case, the contractor did not fail to submit timely incurred cost submissions so the factor should not have been applied. The IG also drew the distinction between using the factor to question costs (inappropriate) versus recommending it to the contracting officer as a  tool to spur recalcitrant contractors into submitting their required incurred cost submissions (appropriate).

Click here to read Part 2 of this story.

You can read the entire DoD-IG report by clicking here.

The Auditors are Starting to Ask Contractors Whether They Have Engaged in Fraudulent Activity

In a policy memorandum issued late July, DCAA announced a major policy shift in detecting and reporting fraud. GAGAS (Generally Accepted Government Auditing Standards) have long required auditors to consider the risk of fraud when designing audit steps. DCAA made it a little more formal about a year ago when it made a policy to require team-planning meetings to discuss the risk of fraud and other noncompliances with applicable laws and regulations that could have a material effect on the audit. Now, DCAA is expanding on its previous efforts to provide, what the Agency terms, a comprehensive approach to detecting and responding to the risk of fraud.

This new guidance is already controversial and you will be hearing a lot about it in the coming months as contractors assess what is being asked and determining whether they will or should respond. Here's the controversial matter:

The audit team should make the following inquiries of contractor management responsible for the subject matter under audit:

• Whether management has knowledge of any fraud or suspected fraud affecting the subject matter under audit;

• Whether management is aware of allegations of fraud or suspected fraud affecting the subject matter under audit, for example, received in communications from employees, former employees, regulators, or others;

• Management’s understanding about the risks of fraud relevant to the subject matter under audit, including any specific fraud risks the contractor has identified or account balances or classes of transactions for which a risk of fraud may be likely to exist.

The audit team should make these inquiries in every audit. The audit team should use information obtained at annual planning meetings about the contractor’s programs and controls that mitigate fraud risk in order to facilitate additional inquiries related to the subject matter under audit. When possible, the audit team should conduct inquiries as part of face-to-face discussions. 

Now as far as we know, there is no contractual or regulatory requirement that contractors respond to these kinds of questions. Our sense is that DCAA is out-of-line in making such requests. It wouldn't surprise us if DCAA will have to retract it sooner rather than later. In the meantime, we suggest you consult with counsel as to the advisability of responding to these series of questions.

GAO Revises "Yellow Book" Auditing Standards

Late last year, the U.S. Government Accountability Office (GAO) published an update to Government Auditing Standards. This version, called the "2011 Revision", replaces the 2007 Revision. Government auditors are required to adhere to these standards (usually referred to as Generally Accepted Government Auditing Standards or GAGAS) whenever they perform audits or attestation engagements. If you've ever looked at a Government audit, you would see something like the following: "This audit was performed in accordance with GAGAS..."

From a Government contractor's perspective, there should be little, if any impact from this new revision. There are some major changes involving the independence of the auditor and the audit organization to the entity under audit. The added concepts address personal, external, and organizational impairments to independence. This reminds us of an incident that happened a number of years ago. A Government contractor notified an audit agency performing audits at their plant that the auditor assigned to the engagement had a close relative employed by the contractor. The audit agency swiftly reassigned that particular auditor so as to avoid any real or perceived independence issues.

The new revision contains requirements for the audit agencies to assess whether management possesses suitable skills, knowledge, and experience for a particular audit. Sometimes it seems that auditors are in over their heads on certain audits. Often this is due to a lack of experience, training and/or supervision. The revision requires auditors to now document this determination.

Another change to the 2011 revision involves the reporting requirement for fraud. The GAO is trying to put it into perspective by restricting reports to only those occurrences that are significant within the context of the audit objectives. Evidently, the previous requirement did not allow judgment or common sense and investigative agencies were flooded with immaterial and trivial reports of "suspected" fraud.