DCMA and DCAA Criticized for Lack of Progress in Auditing Contractor Business Systems

Here's a post that will be of interest to major contractors - those contractors charging $100 million or more to cost type (CPFF, CPIF, FPI, T&M, etc) contracts annually.

DCAA (Defense Contract Audit Agency) is about to shift 250 auditors from performing incurred cost audits to performing audits of contractor business systems. DCAA's responsibility for oversight of contractor business systems (CBS) include (i) accounting, (ii) estimating, and (iii) MMAS or material management and accounting systems.

GAO (Government Accountability Office) recently published a report critical of the progress made by DCAA in completing these audits and of DCMA's oversight in ensuring that issues raised in those audits are resolved in a timely manner. In fiscal years 2015 through 2017, DCAA completed only three accounting system audits (none of those reported deficiencies) and nine estimating system audits (seven of which reported significant deficiencies). Some of these reviews took two to three years for DCAA to complete. Some took four and five years to resolve reported deficiencies.

According to the GAO Report, the effort expended by DCAA in auditing contractor business systems has been negligible. Normally these reviews are to be conducted on a three-year cycle however DCAA has abandoned any pretense of maintaining such a schedule. Instead, the Agency has focused on completing incurred cost audits - arguably a higher priority for the contracting community.

GAO noted that DCMA and DCAA do not have mechanisms to monitor and ensure that CBS audits are conducted in a timely manner. DCMA relies on the DCAA offices that perform the reviews of the three systems (accounting, estimating, and MMAS) to maintain the information on the reviews completed and to plan for future reviews, but DCMA does not centrally track its reviews or whether audits conducted by DCAA are being completed within the required time-frames (i.e. 70 days).

GAO recommended that DCMA and DCAA collaborate to develop a mechanism to monitor and assess whether contractor business systems reviews are being completed in a timely manner. DoD concurred.

What is CBAR (Contract Business Analysis Repository)?

The Contract Business Analysis Repository (CBAR) is Defense Department database that collects business system information on its contractors. The information is not available to the public and even contractors, baring a FOIA request (Freedom of Information Act) have difficulty in finding out exactly the information that DoD is collecting on them.

The CBAR system was created prior to 2010 but significantly enhanced in 2012 to collect the following information.

• Indirect and direct cost information (e.g. forward pricing rates).
• Status of contractor business systems (e.g. accounting and estimating systems)
• Status of compliance with CAS (Cost Accounting Standards)
• Information about costs and financial condition of the parent entity of major corporations

It also includes contracting officer's negotiation experiences with contractors so that those experiences can be shared among contracting officers negotiating with the same contractor. DoD feels that sharing experiences will result in contracting officers being better prepared for realizing better deals for the Government.

We don't know the number of DoD personnel with access to CBAR. In 2013, the number was reported at 1,900 users though by now, that figure has probably grown.

There have been instances where CBAR information is not up to date. Like all databases, procedures need to be in place to ensure that data is current, complete, and accurate. So, for example, the Government might identify deficiencies in a contractor's estimating system and report those deficiencies in the CBAR system. Meanwhile, the contractors makes the required corrective actions and the Government considers those actions to be responsive but fails to update the CBAR system. Whatever procedures DoD has in place to ensure the accuracy of CBAR data does not always work in a timely manner.

Contractors should know what information is being collected about the company to ensure its accuracy. Start by asking your contracting officer to provide you such information. Many contracting officers will oblige. If that fails, try the FOIA route.

Contractors May be Required to Have Third Party Audits Performed on their Business Systems

Yesterday we discussed DOE's decision to withdraw its proposed rules for ensuring contractor business systems are capable of providing timely, reliable information for the management of contracts and programs by contractors and the Department (see Department of Energy Withdraws its Proposed "Business System" Rules). The Department of Defense (DoD) has had similar rules in place through its FAR Supplement (DFARS) for a number of years and although the expectation by now was that DCMA (Defense Contract Management Agency) or DCAA (Defense Contract Audit Agency) would have reviewed or audited those systems for compliance with the standards laid out in the rules, not much has happened. A previous proposal that would require contractors to hire outside auditors to conduct those compliance reviews under the eyes and direction of DCAA were previously withdrawn as unworkable.

The Senate version of the 2017 National Defense Authorization Act (NDAA) contains a provision that would require DoD to develop a program to ensure contractor business systems are reviewed and comply with the standards established in DFARS. Key to this provision is that whatever program DoD comes up with, must result in reduced burden and price to the Government and the contractor. The program must meet five criteria:

1. It must include system requirements for each type of contractor business system covered by the program. The system requirements already established in the DFARS should satisfy this goal.
2. It must establish a process for reviewing contractor business systems and identifying significant deficiencies in such systems;
3. It must identify officials of the DoD who are responsible for the approval or disapproval of contractor business systems.
4. It must provide for the approval or conditional approval of any contractor business system that does not have a significant deficiency and
5. It must provide for the disapproval of any contractor business system that has a significant deficiency and reduced reliance on, and enhanced and effective analysis of data, provided by a contractor business system that has been disapproved.

The draft NDAA provision contains an element that is bound to be problematic and controversial. In the event that a contractor business system is conditionally approved or disapproved, DoD will be available to work with the contractor to develop a corrective action plan defining specific actions to be taken to address the significant deficiencies identified in the system and a schedule for implementation of such actions ("Hi, we're from the Government and we're here to help). We can't imagine DCAA wanting to do this as it would undoubtedly impair auditor independence if it were to become involved in helping contractors implement corrective action plans. DCMA could "work with the contractor" perhaps but currently, the Agency does not have the CPA type skills that would give corrective action plans credibility, especially concerning deficiencies in contractor accounting systems where deficiencies are most likely to occur.

This new program will apply to contractors where its Government contracts (not just DoD contracts) are 30 percent or more of its commercial sales and having a cost-type contract accounting for one percent or more of its commercial sales. That seems like a very low bar for implementation.



Provide for the approval or conditional approval
.  that would require contractors to

Department of Energy Withdraws its Proposed "Business System" Rules

Department of Energy Withdraws its Proposed "Business System" Rules

Back in 2014, not to be outdone by the Defense Department, the Department of Energy proposed its own Contractor Business System rules (see 79 FR 18415). These proposed rules were similar in scope to those being considered and ultimately adopted by DoD. They covered five of DoD's six business systems: accounting, estimating, purchasing, EVMS and property management. DOE's contractor business systems did not cover MMAS (Material Management & Accounting Systems), perhaps because DOE's contractors are not typically in the manufacturing business. The proposed rules included compliance enforcement mechanisms that would, like the DoD rules, allow contracting officers to withhold a percentage of payments when one or more of the business systems contained significant deficiencies.

Yesterday's Federal Register included the announcement that the Energy Department has withdrawn its proposed rules (see 81 FR 43971) . It gave no explanation for withdrawing the proposed rules other than a terse statement that read "... the Department has determined that it will not proceed with the rulemaking and, as such, is withdrawing the proposed rule.".

Perhaps DOE learned something from DoD's implementation problems. Although the rules exists, there are scarcely any audits being performed to determine the state of contractor compliance with those rules. DCAA (Defense Contract Audit Agency) is not making such audits a priority and some proposed rules a year or so ago that would require contractors to hire outside audit firms to perform the reviews (under DCAA supervision) was withdrawn as unworkable.

Notwithstanding the starts and stops, DoD has not given up on auditing contractor business systems. Tomorrow, we will discuss a provision in the FY 2017 NDAA (National Defense Authorization Act) that attempts to restore audit coverage of the six DoD contractors' business systems.

Audits of Business Systems at DoD Contractors - Update

This is a follow-up to a posting last July concerning DoD's decision to kill the proposed rule that would allow Government contractors to go out and hire independent auditors to perform reviews of the three business systems that DCAA normally audits (i.e. accounting, estimating, and material management and accounting). Under Generally Accepted Government Auditing Standards, DCAA has not been able to keep pace with demands and needs some help to maintain currency. (See DFARS Proposal to have CPA Firms Audit Contractor Business Systems - Dead.)

The proposed rule received many comments. While some supported the idea, many were wary of the implementation. Supporters liked the idea that their systems could get audited in a timely manner but the implementation appeared onerous with too much involvement and oversight by DCAA. DCAA for its part, considered that the design of the oversight process would result in fewer audit resources expended then if it were to perform the audit themselves.

While the proposal has been withdrawn, DCAA is not giving up. The rule was withdrawn so that the Agency could consider the comments received and determine a path forward. Its possible that the proposed rule will be resubmitted with modification or some other alternative will be pursued.

In the meantime, DCAA is experimenting with an Agency-wide Business System Audit Team that will be performing business system audits at high risk contractors. High risk contractors are generally the largest contractors. The team is comprised of experienced auditors who are specifically trained to perform business system audits. As they travel from contractor to contractor, the teams will be augmented with local audit staff who are familiar with the particular contractor business systems. DCAA admits that this team approach is not the ultimate answer. It only covers the highest risk contractors and will not cover all the business system audits that need to be performed.

Contractors Need Not Worry About Cited Business System Deficiencies

The Department of Defense, Office of Inspector General (DoD-IG) issued its report last week on how well the Defense Contract Management Agency (DCMA) has complied with DFARS (DoD Federal Acquisition Regulation Supplement) requirements when business system deficiencies are reported at DoD Contractors. The six contractor business systems that are of the most interest to the Government are Accounting (obviously), estimating, material management, purchasing, earned value management, and government property. The focus of the DoD-IG report was on accounting system deficiencies identified by the Defense Contract Audit Agency (DCAA).

The DoD-IG reviewed 21 audit reports issued by DCAA that identified deficiencies in contractors' accounting systems. In every single case, the DoD-IG found that DCMA contracting officer actions did not comply with one or more DFARS requirements when deficiencies were reported. For example, the audit found that DCMA contracting officers did not

• Issue timely initial determinations,
• Issue timely final determinations,
• Obtain contractor responses,
• Adequately evaluate contractor responses, and
• Withhold a percentage of contractor payments.

In 17 of 21 cases, the contracting officer did not issue final determination letters within 30 days as required. On average, contracting officers took 252 days to issue final determinations. In 8 of 21 cases, contracting officers did not withhold a percentage of contractor payments as required by regulation. 

It didn't take a DoD-IG audit to tell us there are systematic deficiencies in DCMA's resolution process. Talk to just about any DCAA auditor and they'll have stories about how seriously audit reports sent over to DCMA are taken. "Like shooing flies off the dinner plate", according to one former DCAA auditor. There are many reasons for contracting officer ambivalence toward contractor business system deficiencies. For one thing, contracting officers do not usually appreciate the importance of sound internal controls to the extent that auditors do. It is not intuitively obvious to them that strong internal controls will result in cost savings and reduced oversight. Second, contracting officers have a lot on their plates. The listing on contract administration functions in FAR 42.302 is 71 items long.

DCMA's response to DoD-IG's cited deficiencies was to hold more training. Yep, we're sure that will take care of the problem. You can read the entire DoD-IG report by clicking here.

DFARS Proposal to have CPA Firms Audit Contractor Business Systems - Dead

A year ago, we published a seven-part series on the proposed DFARS (DoD FAR Supplement) rules to have contractors go out and procure their own independent audits of certain required business systems including accounting systems, estimating systems, and MMAS (materials management and accounting systems). See "Independent CPA Audits of Contractor Business Systems". This proposal was designed to relieve the Defense Contract Audit Agency of some of its required audit workload until the Agency could get caught up on its incurred cost audit backlog. The independent audits would be performed under DCAA's oversight with the Agency weighing in on the sufficiency of procedures employed by the independent CPA firms to attest to the adequacy of the systems and the related internal controls.

A public meeting was held in August 2014 and the public comment period ended September 15, 2014 with 23 submissions including ones from the AICPA (American Institute of Certified Public Accountants), the American Bar Association, the Aerospace Industries Association, and many other organizations and private individuals. The common theme among the respondents was that the proposal, as written, was unworkable and not viable.

The powers-that-be obviously agreed or had second thoughts themselves because on February 4, 2015, the DFARS Case was quietly closed without further action. That's not the end of the story however. The system reviews still need to be performed and the audit responsibility continues to reside with DCAA. Perhaps someday, DCAA will get around to auditing contractor business systems again.

Contractor Business Systems - Advisory Panels

DCMA (Defense Contract Management Agency) and DCAA (Defense Contract Audit Agency) have co-responsibility for assessing the adequacy of six business systems; accounting, estimating, material management, purchasing, property management, and EVMS. DCAA is responsible for the first three and DCMA is responsible for the last three. There are changes making their way through the regulatory process that would require contractors to hire outside CPA firms to take over the systems that DCAA currently audits (i.e. accounting, estimating, and material management). You can read more about the proposed regulations here).

So now, we have DCAA auditors and DCMA "functional specialists" running around performing reviews of Contract Business Systems (or CBSs to use the Government parlance). Sometimes these reviews result in no deficiencies and the contracting officer can recommend approval of a system. Other times however, deficiencies are disclosed and the contracting officer makes a recommendation to disapprove a system.

There are varying degrees of deficiencies but only "significant" deficiencies rise to the level where a contracting officer can disapprove a system or potentially withhold funds. A significant deficiency is a shortcoming that materially affects the ability of Government officials and the contractor to rely upon information produced by the system.

Before a contracting officer can disapprove a system however, he/she must take the matter before a special panel within DCMA Headquarters. This special panel, called the CBS Advisory Panel, reviews the contracting officer's recommendation. The recommendation must be accompanied by

• a concise chronology of events, a copy of the Business System Analysis Summary
• a copy of the functional specialist's report or DCAA audit repot
• a copy of the initial determination issued to the contractor
• the contractor's response to the initial determination 
• the proposed  final determination.but other times, deficiencies are identified. 

To provide a perspective on how often auditors and functional specialists are convincing contracting officers to make inadequacy determinations, since its inception, the CBS Advisory Panel has convened 121 times, 65 times for cases originated by DCAA and 54 times for cases originating from DCMA functional specialists. Of the 121 panels, 48 or almost 40 percent related to accounting system deficiencies. Surprisingly (to us) the next highest frequency related to contractor systems used to track Government property. Of the 121 CBS Advisory Panels convened, 109 resulted in concurrence with the contracting officer's proposed system disapproval. 73 of those are currently in a disapproved state while 36 have moved to an approved status following remediation actions to achieve compliance. Statistics concerning the number of cases where funds were withheld from contractors are not available although we do know of several cases where that occurred. See, for example, here.

Independent Audits of Contractor Business Systems - Part 7

We recently finished up a six-part series discussing the DoD's new proposal for ensuring the adequacy of certain contractor business systems; namely the estimating system, the MMAS (material management and accounting system), and the accounting system. If you missed it, you can read them through by starting with Part 1. In short, DoD's proposal, if adopted, will require contractors to self-assess three of their business systems and engage an independent CPA firm to audit those systems every three years.

We haven't been the only one writing about the proposal. There have been numerous published blogs and articles on the subject. Today, we want to recap some of the concerns and insights expressed by various authors and organizations. Some of these comments express concerns and offer insights that we hadn't considered as we were reviewing and writing about DoD's proposed regulation.

In its Federal Register Roundup Blog, SheppardMullin looks at the rule with a "legal" spin. Contractors will be offered no favorable credit or "safe harbor" for disclosures made in their reports. That's true. Under current rules, system deficiencies will result in billing withholds until the deficiencies are corrected. That doesn't change under the new rule. It doesn't matter whether the deficiencies are disclosed by the Government or by the contractor's independent CPA firm. Withholds will still result.

SheppardMullin further writes that the new rule places a substantial administrative and monetary burden on contractors (which we previously discussed) but because the Government won't conduct any audits until the contractor and/or its CPA has completed their own audits, the statute of limitations on Government claims will begin to run at a much later point in time then would be the case if the audit process were initiated by the Government. They also expressed concerns that DCAA criticisms of contractor audits could easily prompt False Claims Act allegations based on alleged misstatements in the private audits or other alleged inadequacies in the audit process. We agree with SheppardMullin that no one should be deluded into believing that DCAA will accept those self-assessments or those prepared by the contractors' CPAs.

Law360 quotes a representative of PSC (Professional Services Council) stating that this new rule is more than what contractors wanted. Contractors want the option of getting their own independent CPA audit or waiting for the Government to get around to doing one. PSC is currently withholding comment on the proposed rule. Law360 also warns that the new rule "...tries to recapture some of the access to information, work papers, internal audits that would be traditionally off limits to the government if they were to do this review themselves.

WileyRein expressed concern about the efficacy of the proposed rule. "Since these contractor and CPA reports are subject to DCAA review, it remains to be seen how long DCAA takes to review the reports and whether DCAA will accept CPA audits or review them so critically that the anticipated efficiencies are lost."

The National Law Review expresses the same concern: "It is not clear however, whether this new proposed framework would realize meaningful time efficiencies. Government auditors who review third-party CPA audits may not be inclined to rubber stamp those findings".

JDSupra Business Advisor lists a number of concerns including i) the qualifications of CPA firms to perform the business system examinations, ii) extent to which independence of the CPA firms will be determined, iii) effectiveness of CPA firm examination in the eyes of a follow-on DCAA assessment and iv) liability borne by both the CPA firm and the contractor if a system found to have no deficiencies by the CPA is later determined to have deficiencies based on subjective criteria.

This proposal is such a radical departure from the way that DoD has conducted its business ever since there were contract auditors that no one really knows how it will turn out. The biggest unknown right now is how DCAA intends to review the work of contractor internal assessments and external CPA reviews. It would be useful if DCAA were to publish those procedures and timelines now, rather than wait until the rule goes final.

Independent Audits of Contractor Business Systems - Part 6

We've been discussing DoD's recent proposal to require contractors to perform annual self-assessments of certain of their business systems and to have those systems audited by a CPA firm every three years. If you haven't been with us for the entire series, it would be a good idea to start at the beginning:

     Part 1
     Part 2
     Part 3
     Part 4

     Part 5

The proposed rule, according to DoD, will have no impact on small businesses. That's because the Department has set the applicability at a pretty high level. For estimating systems, the criteria applies to contractors that had negotiated contracts of $50 million or more in their previous fiscal year. That doesn't necessarily exclude small businesses as we've seen contracts awarded to small businesses that exceed that amount. But, that threshold would certainly exclude most small businesses. For MMAS (Material Management Accounting Systems), the annual assessment and audit requirements specifically excludes small businesses and applies to contractors with qualifying sales to the Government of $50 million or more and an affirmative determination by the ACO that an MMAS review is needed (based on various risk factors). For Accounting Systems, the requirement applies to CAS-covered contractors (Cost Accounting Standards). (For CAS coverage requirements, click here).

The system criteria for these business systems are not changed by this proposed regulation nor are the penalties (billing withholds) for having a system that does not comply with the stated criteria.

There are several aspects of this new regulation that we believe will become problematic during implementation.

• Cost - these self-assessments and independent audits will cost contractors dollars that they wouldn't have otherwise incurred.
• Cost allocation - the cost will need to be allocated somewhere. Contractors will make the case that since these costs are required by contract, they are allocable to those contracts and not to commercial work. The Government will probably try to make the case that these internal control systems benefit all the work of the contractor and should be allocated broadly.
• Timeliness - there doesn't seem to be any penalty for failing to meet the annual assessments or triennial audit requirements. 
• Timeliness of Government Involvement - The proposed regulations require that the Government be afforded the opportunity to review the CPA risk assessment and audit planning documents. The Government does not have a good track record of turning out responses in a timely manner. This could impede the efficient and effective accomplishment of the CPA's efforts.
• Resolving disagreements - while the proposed regulation contains processes to resolve deficiencies raised as a result of assessments and audits, it does not cover disagreements that might arise between the CPA and the auditor who will be overseeing the CPA effort. This could become a contentious area.

There is more to this proposal than we've covered in these blog posts. The proposal itself takes up nearly 14 Federal Register pages - a laborious read to say the least. Most likely, this will not be a case were the proposed rule is adopted as final, without change. A change of this magnitude will undergo significant revision before adoption - perhaps even a second draft for public comment.

If you care to provide comments to this proposed regulation, you have until September 15th to do so. You can submit those comments electronically to regulations.gov. So far, not too many comments have been submitted.

Click here to read Part 7 in this series.

Independent Audits of Contractor Business Systems - Part 5

For the past few days, we've been discussing DoD's proposed rule that would require contractors to perform their own self-assessments of compliance with DoD's business system criteria and a further requirement that contractors commission an audit every three years by an independent CPA to test the contractors compliance with those system criteria. The proposed rule affects three of the six business systems covered in the DFARS (DoD FAR Supplement); estimating, accounting, and material management and accounting systems. It applies primarily to larger contractors, small businesses being exempt. If you're just joining this series, you may want to start at the beginning and read forward.
     Part 1
     Part 2
     Part 3
     Part 4

As discussed, the new rule would require contractors to provide the CPA's audit strategy, risk assessment, and audit plan to the Government auditor for review. Presumably, the Government auditor render his assessment, saying it is adequate or it needs refinement. Once the CPA's audit is finished, the contractor must maintain and make the CPA's working papers available to the Government auditor for review. This will be interesting to watch - it seems to us that a lot of CPA firms will be reluctant to expose their working papers to Government review and oversight (second-guessing). In any event, the way that this new rule works, is that the Government auditor will review the CPA's audit report and working papers and advise the contracting officer on what it thinks.

The contracting officer then must make a decision as to the acceptability of the estimating, accounting, and/or MMAS systems for Government contracting purposes. In evaluating the acceptability of these systems, the contracting officer, in consultation with the Government auditor or functional specialist, shall determine whether the contractor's system complies with the DFARS system criteria. In making that determination , the contracting officer shall consider;

• the contractor's annual report and the CPA audit.
• any other findings and recommendations reported by the Government auditor including the assessment of the contractor's CPA audit report and related documentation.

To summarize, the contractor's documentation requirements include:

1. Documentation to provide reasonable support for its annual assessment. 
2. Information considered in the selection of a CPA
3. Arrange for Government access to the working papers supporting the CPA audit reports

Click here to read Part 6 in this series where we discuss a few miscellaneous items included in the proposed regulation.

Independent Audits of Contractor Business Systems - Part 4

We're in the midst of a discussion on DoD's new proposal that will require contractors to perform their own self-assessments of compliance with the standards for business systems and to have a full CPA audit performed every three years on those systems. This proposed rule was published in the Federal Register on July 15th and applies to large DoD contractors. If you haven't read the previous postings, it would be a good idea to start from the beginning:
     Part 1
     Part 2
     Part 3

Yesterday we discussed the hoops that contractors will have to jump through just to get a CPA firm on board. The contractor is going to have to assess the CPA's independence, objectivity, and qualifications. Not only will the contractor have to make those assessments, but will need to be prepared to turn over its assessments for Government review. But what is to happen after that is perhaps more insidious (in a way).

What follows might seem arcane to non-CPAs but it is a big deal. When undertaking any audit, CPAs must plan out their strategy. They have to understand the objective of the audit, the criteria against which performance is to be assessed, the inherent risks associated with the audit engagement, considerations of fraud, and a step-by-step program for accomplishing the audit. These are often referred to as the planning and risk assessment phases of the audit. Often, hours associated with these activities represent a significant portion of audit engagements. These activities must be completed before field work (e.g. testing) begins.

DoD's proposed regulations will require that these preliminary documents be provided to the Government:

The Contractor shall provide the Contractor's CPA's audit strategy, risk assessment, and audit plan (program), upon completion ... to the cognizant contracting officer and Government auditor.

What is the contracting officer and Government auditor supposed to do with the CPA's audit strategy, risk assessment, and audit program? According to the proposed rule, the contracting officer must,

Upon receipt of the contractor's CPA's audit strategy, risk assessment, and audit plan (program), request a review from the Government auditor, and notify the contractor of any potential issues identified by the Government auditor regarding their reasonableness. Early notification of potential issues may decrease the likelihood of the contractor incurring unreasonable costs. However, review of the contractor's CPA's audit strategy, risk assessment, and audit plan (program) does not constitute the contracting officer's approval.

So here you have it. The Government auditor (DCAA), the same organization that cannot find the time and resources to audit contractor compliance with DoD's business systems criteria, and whose abject performance in this area led to this new regulation in the first place, is now tasked with overseeing the strategy,  risk assessment, and audit plans of the contractors' CPAs. What's more, DCAA is expected to turn around its assessment in a timely manner in order to reduce the likelihood that the CPA will become inefficient in its work. We see this as a major stumbling-block to efficient and effective execution of audits and we know of no other instances where such a requirement is imposed on the performance of audits conducted in accordance with GAGAS (Generally Accepted Government Auditing Standards).

Click here to read Part 5 in this series.

Independent Audits of Contractor Business Systems - Part 3

For the past two days, we've been discussing the proposed DFARS (DoD FAR Supplement) rule that will require contractors to perform their own annual assessments of compliance with business system criteria and to have an independent CPA audit of those business systems performed every third year. The business systems covered by the new rule include estimating systems, accounting systems, and MMAS (Material Management and Accounting Systems).  This new rule applies primarily to large contractors (small businesses are exempt) and marks a significant departure in the manner in which the Government administers its oversight functions. It will also cost contractors (and the Government) a lot of money.

The cornerstone of the new procedure is the requirement for a triennial audit by independent CPAs. By definition, the CPA must be an independent certified public accountant, in public practice and not directly employed as an employee by the contractor, performing audits for the contractor in accordance with GAGAS (generally accepted government auditing standards). It is the contractor's responsibility to ensure that whatever CPA firm is selected, is independent and qualified. To ensure the CPA firm meets these conditions, the contractor must do a little homework:

First of all, the contractor must reasonably ensure that the CPA firm performing the audit is independent and objective with respect to the audited entity by obtaining and reviewing a written representation from the CPA firm that the firm and the assigned engagement team is:

1. independent and objective with respect to the audited entity
2. will remain independent throughout the audit
3. has not performed any non-audit services for the audited entity that impair the auditors' independence for the subject audit, and
4. will disclose any independence issues discovered

Next, the contractor must ensure that the CPA firm is qualified to perform the audit by obtaining and reviewing

1. information about key engagement team members regarding professional qualifications and experience, including valid CPA licenses or certificates in good standing, and current knowledge and experience in the type of work to be done, and
2. the firm's most recent peer review report, in accordance with the American Institute of Certified Public Accountants (AICPA) Peer Review Program or equivalent.

It is almost a certainty that someone in the Government, most likely the contract auditor (i.e. DCAA) will request information to assess whether the contractor has performed due diligence in assessing their selected CPA firm's independence, objectivity, and qualifications.

Click here for Part 4 of this series where we discuss additional requirements related to the triennial audit including the requirement to furnish interim data to the contracting officer and the auditor.

Independent Audits of Contractor Business Systems - Part 2

Big changes may be coming in the way that the Government conducts oversight of its larger contractors. Yesterday we began a series on a proposed rule that will require DoD contractors to hire independent CPAs to conduct compliance reviews of three major business systems; estimating systems, accounting systems, and material management and accounting systems (MMAS). Heretofore, these audits have been conducted, albeit irregularly, by the Defense Contract Audit Agency (DCAA) and/or the Defense Contract Management Agency (DCMA). One thing for certain, this proposal, if it is enacted in its current form, is certain to cost contractors a lot of money. Audits don't come cheap and the process imposed by the new rule, where Government auditors must review planning documents and risk assessments before independent audits can proceed, will certainly impede efficiency and further increase costs to the contractor. And, there is no certainty that these costs can be allocated exclusively to Government contracts. Most likely, the Government will argue that these costs be allocated over a contractor's G&A base.

The stated purpose of this new regulations is to improve efficiency and effectiveness of audit:

To improve the efficiency and effectiveness of auditing contractor business systems, DoD is proposing to amend the DFARS (DoD FAR Supplement) to entrust contractors with the capability to demonstrate compliance with DFARS system criteria for contractors' accounting systems, estimating systems, and material management and accounting systems, based on contractors' self-evaluations and audits b y independent Certified Public Accountants (CPAs) of their choosing. Government auditors will perform overviews of the results of contractor self-evaluations and CPA audits.

The applicability of the standards are not changed. Contractors subject to the business system criteria now will still be subject to those standards under the new regulations. For example, contractors, other than small businesses are subject to the estimating system disclosure and maintenance if they received $50 million in (certified cost or pricing data) DoD prime contracts and subcontracts the previous year. That threshold drops to $10 million if the contracting officer determines it to be in the best interest of the Government.

What does change are added requirements for annual reporting and triennial CPA audits.

Annual reporting. Each year, within six months after the end of the contractor's fiscal year, the contractor must provide the contracting officer and the Government auditor, a report regarding compliance with the system criteria. The report is to be signed by an individual at a level no lower than VP or CFO. The report for each of the three business systems covered by this proposed regulation varies slightly in content depending on the system covered. For estimating systems, the report must include:

1. a statement that the contractor has evaluated the estimating system's compliance with the system criteria contained in the DFARS.
2. the contractor's assessment of the estimating system's compliance with the system criteria, including a statement as to whether or not the system complies in all material respects, and disclosure of any significant deficiencies with sufficient information for the Government to understand the deficiencies; and
3. the status of any significant deficiencies disclosed as part of the contractor's assessment, or, if applicable, in the CPA's triennial audit. This mus include a corrective action plan with milestones and actions to eliminate any significant deficiencies that have not bee corrected as of the date of the report.

Click here for Part 3 of this series where we discuss the triennial CPA audit requirements.

Independent CPA Audits of Contractor Business Systems - New DoD Proposal

Last March, we alerted readers to the impending DoD proposal that would require contractors to go out and get their own independent audits of their business systems. At that time, we didn't know the extent of the new rule or when that proposal would be published. We do now -a proposed rule was published last week in the Federal Register.

This proposed rule is rather lengthy but we'll do our best to summarize the key points over the next few days. Small businesses can rest easy on this one - they are exempt for the most part. The proposed rule includes provisions for the contracting officer to flow the requirements down to small businesses in some limited situations but it seems unlikely to us that contracting officers would do so. Additionally, the proposed rule applies only to three of the six DoD designated contractor business systems; Estimating Systems, MMAS (Material Management Accounting Systems), and Accounting Systems.

According to DoD, contractor business systems and internal controls are the first line of defense against waste, fraud, and abuse. We don't know about the "first line of defense" argument but we do agree that weak control systems increase the risk of unallowable and unreasonable costs on Government contracts. In response to a 2011 GAO report, DoD agreed to consider alternative approaches to audit contractor business systems. At that time, GAO noted that audits of contractor business systems were not being conducted in a timely manner and laid the blame squarely on DCAA's (Defense Contract Audit Agency). The GAO reported:

Several factors may affect DCMA’s ability to meet its missions going forward. One significant source of external risk stems from DCMA’s reliance on the Defense Contract Audit Agency (DCAA) to conduct audits of certain contractor business systems. Business systems—such as accounting and estimating systems—are the government’s first line of defense against fraud, waste, and abuse. Because of its own workforce struggles, DCAA has lagged in completing a number of such audits and is currently focusing on other high priority areas.  

GAO found, however, that DCMA contracting officers maintained their determination of many contractor business systems as adequate despite the fact that the systems had not been audited in a number of years—in many cases well beyond the time frames outlined in DCAA guidance. Further, based on a recent DOD policy change, DCAA is no longer auditing contractor proposals below certain cost thresholds, and DCMA will need to use newly-hired contract cost/price analysts to help pick up this increased workload. Internal risks are also present, such as uncertainty on the part of CMOs about whether funding will be available to retain personnel hired using the Defense Acquisition Workforce Development Fund.

So, neither the GAO nor DoD had any confidence that DCAA could ever deliver audits of contractor business systems in a timely manner. The alternatives were to augment the audit staff or make contractors hire independent CPA firms to perform the reviews. This proposed regulation requires the latter - make contractors responsible for securing (and paying for) independent audits.

DCAA is not left out of the process however. Under the proposed regulations, DCAA will be reviewing the independent CPA firms plans and risk assessments as well as assessing their reports for adequacy. That process, we suspect, will generate a lot of concerns and negative comments to the proposed rule.

Click here for Part 2 of this series.

Contractors Should Love This Contracting Officer

Two days ago, we discussed a recently published report by the DoD Inspector General (DoD-IG) on its investigation of a hotline complaint alleging that high level management from DCAA (Defense Contract Audit Agency) and DCMA (Defense Contract Management Agency) had exerted undo influence in settling a case for $500 million less than the Government's estimate of damages. The charge was that the Government chose to settle for an amount that was agreeable to the contractor, not what was fair to the taxpayer. Click here if you missed that posting.

While we're on the subject of DoD-IG reports, the Agency issued another report last week involving DCAA and DCMA and a hotline complaint. In this case, the "large DoD contractor" was not named. Here's what happened.

The complainant alleged that the DCMA contracting officer did not take timely or appropriate action on several DCAA audit reports covering the business systems of a large DoD contractor. (any doubt that the complainant was a frustrated DCAA auditor?)

The hotline complaint was substantiated. Even though DFARS (DoD FAR Supplement) states that the contracting officer should make a final determination with 30 days, the contracting officer has so far take up to 1,373 days and still counting. As of the date of the report (June 20, 2014), the contracting officer had still not issued a final determination. Additionally, the DoD-IG investigation revealed that the contracting officer had not implemented withholdings for significant deficiencies. But DCAA also shared some blame. The DoD-IG reported that DCAA did not obtain sufficient evidence in support of a memorandum that stated the contractor "appeared" to have implemented adequate controls for the remaining estimating system deficiencies.

The DoD-IG recommended that the Director of DCMA instruct the contracting officer to make a final determination on the compensation system, ensure the contracting officer implements withholding for any disapproved business systems and develop a written corrective action plan for improving DCMA quality assurance procedures to help ensure timely final determinations and implementation of monetary withholds for significant deficiencies. DCMA agreed.

The DoD-IG recommended that the Director of DCAA rescind its "appearance" memorandum and initiate follow-up audits of the reported business system deficiencies. DCAA did not agree with most of the DoD-IG recommendations.

We've seen many cases like this. As former auditors ourselves, we were often frustrated by the contracting officer's lack of responsiveness in resolving audit issues and identified deficiencies. In most cases, that reluctance was primarily because the contracting officer remained unconvinced that the deficiencies were material or the deficiencies were backed up with adequate facts and data.

Billing Withholds - Now We're Talking About Real Money

We've written a lot about DoD's business system rules that were put into place a couple of years ago - rules that define the attributes for what constitutes adequate business systems and provides for billing withholds when those contractor systems do not measure up.

The six business systems include: accounting, estimating, purchasing, EVMS (earned value management) MMAS (material management and accounting), and Government property management.

In a hearing last week of the Senate Armed Services Committee, the Air Force disclosed that it had withheld $25.7 million through February 2014 (or five percent of payments) to Pratt & Whitney for the jet engines it is building the F-35 (Joint Strike Fighter) program because it failed to meet the criteria for an adequate EVMS system. This money, which will be held back by DCMA (Defense Contract Management Agency) until Pratt and Whitney fixes their internal business system used to track cost and schedule performance.

Pratt and Whitney reported that it had received approval from DCMA on 95 percent of its corrective action plans and expects to receive approval for all corrective action plans "soon". At that time, presumably, DCMA will release the withhold and Pratt and Whitney will get its money back.

We don't know the extent to which the Government is withholding funds for inadequate business systems. As far as we know, this information is not made public. Its only at Congressional hearings such as this one where we get a peak at how the system is working. Twenty-five million is a lot of money, no matter how deep a company's pockets are. A company relying on payments for its working capital will need to find other sources for that capital when the Government withholds funds. Those other sources will cost the company money.

Contractors Might Soon Have to Pay for Contract Audits

There's a new proposal from DoD about to be published as in DFARS (DoD FAR Supplement) as a proposed rule that will have a significant impact on contractors subject to the "business system" rules (estimating, material management and accounting, earned-value, property, purchasing, and accounting systems).

Although the proposed rule has not been published and is not yet available on the internet (as far as we know), there have been snippets of information flowing from DoD sources as to what is being considered. This proposed rule will require contractors to hire CPA firms to audit and express opinions on the adequacy and sufficiency of business systems. This would no doubt cost contractors a lot of money - costs that were not included in forecasts and budgets and estimates of future costs. It would significantly impact DCAA (Defense Contract Audit Agency) who now spends a significant portion of its resources auditing contractor business systems. Perhaps these soon-to-be unemployed auditors can go work for CPA firms who will get this new workload.

The contracting community will most likely be in favor of the proposed rule. Contractors will insist on timely audits and reports. After all, they're paying for the service. DCAA on the other hand, takes months and sometimes more than a year to issue a business system audit report. Additionally, as is characteristic of CPA internal control audits, they won't find any material weaknesses anyway. That means the contracting officers' jobs get a whole lot easier because they don't have to resolve any audit findings.

Sadly, yet another nail in DCAA's coffin.

Keep your eyes open for DFARS Case No. 2012-D042. It's coming soon.

New Business System Rules Affecting More Contractors than the Old Rules

The new DFARS business system rules that became effective last February apply to CAS covered contracts. There was a collective sigh of relief from non-CAS covered contractors when this threshold was announced. However these rules will apply to more contractors than did the old rules.

The new business system rules covering the accounting, estimating, purchasing, EVMS, MMAS, and property management essentially replace DCAA's old ICAPS (Internal Control Assessment Planning System). The ICAPS were performed at contractors with revenues from flexibly priced (e.g. CPFF, CPIF, CPAF, FPI, and T&M) contracts exceeding $100 million.

That $100 million ICAPS threshold has now dropped to $50 million and now includes fixed price contracts in addition to all of the contract types listed above. That lower threshold and the expanded base of contracts will subject many more contractors to rigorous internal control requirements than before.

We should caution non-CAS covered contractors that even though they may not be subject to the new DFARS business system rules, these rules are now the standard for measuring whether contractor's systems are adequate for Government contracting purposes. DCAA and DCMA will use these rules to measure whether systems are adequate. The only difference is that non-CAS covered contractors will not be subject to withholdings on billings.

Government Withholding Payments for Inadequate Business System

Aviation Week and Space Technology reported this week that the Defense Contract Management Agency (DCMA) has increased the amount being withheld from Lockheed Martin on the F-35 program from two to five percent because the company has not made satisfactory progress in correcting deficiencies in its EVM (Earned Value Management) system.

EVMS is one of the six business systems that must be adequate or contractors face potential withholds on their billings to the Government. The other five are accounting, estimating, purchasing, MMAS and Government property (in the hands of contractors).

Lockheed was awarded a $4 billion LRIP (low rate initial production) contract for 30 F-35 aircraft last December. The contract included the EVMS clause which requires compliance with 32 different EVM guidelines. The Government's review of Lockheed's compliance with those guidelines disclosed significant deficiencies in 19 of them. Lockheed had promised to have them corrected by June. In June however, the Government found that Lockheed had not made sufficient progress in correcting the deficiencies which led to the 5 percent withhold.

Five percent is a significant withhold. One estimate we read stated it would cost Lockheed $2 million per month. That might be underestimating the amount since the contract is $4 billion. Regardless, it represents a significant amount and is sure to affect the company's bottom line.

This incident is evidence that the Government is serious about enforcing the business system requirements laid out in the DoD FAR Supplement and is willing to invoke the withhold provisions when significant deficiencies go uncorrected.