Adequate Support and Record Retention

On Wednesday, we reported on a DoD-OIG (Department of Defense, Office of Inspector General) audit report that found contracting officers had not sustained the findings in DCAA audit reports based on claimed costs that were not adequately supported (see DCMA May Have Reimbursed Contractors $219 Million without Any Support for Amounts Claimed). The basis for the DCAA (Defense Contract Audit Agency) findings was FAR (Federal Acquisition Regulation) 31.201-2(d) which reads as follows:

A contractor is responsible for accounting for costs appropriately and for maintaining records, including supporting documentation, adequate to demonstrate that costs claimed have been incurred, are allocable to the contract, and comply with applicable [FAR] cost principles … The contracting officer may disallow all or part of a claimed cost that is inadequately supported.

This particular provision was added to the cost principles in 1996 (FAC 90-39). The drafters commented that although the requirement, and the contracting officer's authority to disallow inadequately supported costs were considered to be implicit in the cost principles, explicit guidance was necessary because agencies were having difficulty because the FAR was silent on the issue.

FAR 4.7 contains contractor record retention requirements. It requires contractors to make available records and other supporting evidence to satisfy contract negotiation, administration and audit requirements for three years after final payment, or the period specified in FAR 4.705, whichever period expires first. So, for example, FAR 4.705-2(a) requires contractors to maintain payroll records for four years. Obviously, for most contracts, four years will lapse before the "three years after final payment" milestone. The minimum period can also be extended by contract clause. So, for example, the Allowable Cost and Payment clause at FAR 52.216-7 provides for an extension to record retention minimums when a contractor fails to meets its due date for submitting incurred cost proposals.

Contract auditors sometimes apply FAR 31.201-2(d) inappropriately. We have seen situations where this clause was cited, not because the contractor failed to retain records, but because the auditor was not satisfied with the sufficiency of the supporting data that was provided. Most of the time this involved a judgment call by the auditors because they don't want to take the time or make the effort to consider "alternative evidence" that may be available. The thing to keep in mind here however, is that if the Government invokes 31.201-2(d), it is well established that the burden is on the Government to prove that inadequately unsupported costs are unallowable.

More on Electronic Record Retention

In the last two postings, we have discussed the FAR requirements for scanning your original source documents and saving them electronically and the Government's (namely DCAA's) procedures for ensuring that contractors meet those requirements. The Government's concern is primarily three-fold. Are the images accurate representations of the original, are they conveniently and readily retrievable, and are they secure.

Concerning the first point, accurate representations of the original document, the Government is worried about potential alterations somewhere along the line. In its latest audit guidance on the subject, DCAA makes the following point:

Without testing internal controls (access and storage controls) related to the contractor's imaging process, there is going to be a risk that the records to be reviewed could have been altered since the time the testing was performed. This risk is similar to the risk that the contractor has altered their hardcopy documents from the time of creation to the time of audit. Therefore, if no IT system audit has been performed to test the contractor's internal controls, the auditor must consider fraud risk indicators and other know risk factors in determining whether there is a material chance that the scanned images have been altered since the time of testing (similar to the thought process that would take place in considering the risk that hardcopy documents have been altered). Based on this determination, the auditor will need to make a decision as to whether a qualification relevant to the lack of testing access and storage controls will be necessary.

So, what will happen if the auditor finds fault in the scanning/archiving/retrieval process? In theory, the auditor won't be able to rely on the integrity of the scanned records. The auditor will then ask to review the original documents. If those are no longer available (i.e. its past one year after the scanning process), the auditor will complete the audit but "qualify" the report.

Funny thing about qualified reports. The contracting officer that receive qualified reports, absolutely don't care about qualifications. They just want to award their contract or settle some incurred costs. Qualifications might make the auditor more comfortable but qualifications have no impact on the ultimate resolution of the audit report.

Compliance Reviews for Scanned Records

Last Friday, we wrote about the FAR (Federal Acquisition Regulations) requirements for contractors who which to preserve their original source documents in an electronic format. Briefly, these requirements include:

1. Established procedures to ensure that the imaging process preserves accurate images of the original records
2. An indexing system to permit timely and convenient access to the imaged records, and
3. Retention of the original records for a minimum of one year after imaging (to permit periodic validation).

A question arises as to who is going to test contractors' compliance in this area? Well, DCAA (Defense Contract Audit Agency) will, for one. We don't know if DCAA was somehow assigned to task of testing for compliance or they took it upon themselves since (with DCMA's (Defense Contract Management Agency) ascendancy, DCAA is finding itself with reduced functionality) the Agency has extra time to do those things. But, DCAA recently issued guidance to its auditors on the need to validate contractor practices EVERY YEAR!.

The guidance provides that auditors should test the contractor's scanned images annually. The testing will cover the previous 12-month period and allow auditors to make easy determinations on whether reliance can be placed on the scanned images. If the auditors perform tests and do not identify any deficiencies, they can rely on the veracity of the scanned images.

Here are some of the steps that the auditor will perform as part of their annual testing.

• Test a sample of the images to original documentation from the preceding 12-month period
• Ensure the contractor is able to provide timely access to the imaged records to test whether the contractor maintains an effective indexing system to permit timely and convenient access.
• Ensure the scanned image accurately reflects the original record, including signatures and other written or graphic images.
• Ensure the contractor's transfer procedures maintain the integrity , reliability, and security of the original computer data
• Ensure the contractor retains an audit trail describing the data transfer.

To Scan or Not to Scan

There is no shortage of companies offering stand-alone, add-on, or "cloud" based applications that facilitate the task of scanning, archiving, and the ability to retrieve electronic (usually PDF) copies of original source documents. Their advertisements are everywhere. Some of you have probably forayed into this often hostile territory without a lot of success. Some of you have probably realized that the benefits of archiving records electronically exceed the cost of doing so. Electronic record archival might save storage space but it will do so at a cost.

FAR (Federal Acquisition Regulations) allows contractors to scan their original source documents and dump their hard-copy records. The policy is laid out in FAR 4.703(c).

FAR 4.703(c) allows contractors to duplicate and store original records in electronic form. Contractors are not required to maintain or produce original records during an audit if they provide photographic or electronic images of the original records and meet certain requirements. Those requirements include

• Established procedures to ensure that the imaging process preserves accurate images of the original records, including signatures and other written or graphic images, and that the imaging process is reliable and secure so as to maintain the integrity of the records.
• An effective indexing system to permit timely and convenient access to the imaged records
• Retention of the original records for a minimum of one year after imaging to permit periodic validation of the imaging systems.

The biggest problem in meeting the foregoing requirements is the second bullet; maintaining an effective indexing system to permit timely and convenient access to the imaged records. Contractors will need to put a lot of thought and consideration into an indexing and retrieval system well before embarking on a record scanning program.

Take vendor invoices for example. In a traditional accounting system, vendor invoices are probably organized in a filing cabinet by name or by year then name. If an auditor asks to see Invoice 12345 from ABC Company dated January 1, 2011, it a simple matter to go to the file and find the invoice. Now consider how you would find an electronic (scanned) copy of the same invoice. You make a PDF copy of the invoice, you give it a descriptive name and put it into a folder (the electronic version of the filing cabinet). That, to us, sounds labor intensive and for small companies, not very practical. Its much easier to, at the end of the year, put your hard copies in a couple of storage boxes and throw those boxes into your back room for the next few years.

Some accounting software applications make this a little easier. QuickBooks, for example, allows you to link a scanned vendor invoice to a specific transaction. Third party add-ons make the process a little easier. Larger companies (where paper record storage can be a problem), can afford some of the higher-end (and costly) applications that streamline the electronic storage and retrieval process but even these require a fair amount of in-house labor.

If you are contemplating an electronic record storage and retrieval system, make sure you do your homework and decide whether there is a business-case for doing so.

Record Imaging

We've discussed record retention requirements from time to time, most recently here. Contractors should become intimately familiar with FAR 4.7 because that section lays out in detail the time periods for which various types of records must be retained and made available for Government review.

Frequently, questions arise about whether those records may be imaged and stored electronically. Auditors routinely ask for "original" documents and there is good reason for that. They want to insure that they are not reviewing "altered" documentation. But sometimes, their insistence goes beyond what is legally required. Lets take a look.

10 USC Section 2313 is the statute that gives the Government the authority to examine contractor records. Paragraphs (g) and (h) of that section discusses the medium used to store records.

Paragraph (g) unequivocally authorizes contractors to storing "original" records in electronic form.

(g) Forms of Original Record Storage. - Nothing in this section shall be construed to preclude a contractor from duplicating or storing original records in electronic form.

Paragraph (h) then sets forth a few conditions/requirements.

(h) Use of Images of Original Records. - The head of an agency shall not require a contractor or subcontractor to provide original records in an audit carried out pursuant to this section if the contractor or subcontractor provides photographic or electronic images of the original records and meets the following requirements:

(1) The contractor or subcontractor has established procedures to ensure that the imaging process preserves the integrity, reliability, and security of the original records
(2) The contractor or subcontractor maintains an effective indexing system to permit timely and convenient access to the imaged records
(3) The contractor or subcontractor retains the original records for a minimum of one year after imaging to permit periodic validation of the imaging systems.

By the way, most modern accounting software allows users to attach or link electronic copies of invoices or other documentation directly to the transaction. So, for example, if you're paying an invoice for Rent, you can attach a PDF copy of the invoice to the transaction. If you want to retrieve or view a copy of the bill later on, you click on an icon and the copy opens up. That meets criteria No. 2 above.

The next time auditors give you grief over having to view scanned copies of documents, you might want to refer them to 10 USC Section 2313.

The Meaning of "Final Payment"

Our February 11th blog posting discussed record retention requirements for Government contractors. Essentially, contractors are required to maintain books and records supporting costs incurred/claimed/billed on Government contracts for three years after final payment or a shorter period as specified in FAR 4.7. You can read that posting here.

Today's posting focuses on the meaning of "final payment". 

While DCAA and DCMA will usually consider that "final payment: occurs when the contract is closed, contractors often consider that final payment occurs when the Government pays the invoice just after the work is completed. Unfortunately, because DCAA is so far behind in auditing incurred costs, years can elapse between those two dates.

While the guidance is far from clear, we take a conservative position and recommend that contractors maintain their books and records for three years following contract closeout, unless, of course, those books and records fall under one or more of the exemptions found in FAR 4.705.

However, we understand why many contractors believe a shorter retention is appropriate.

Government Contracts at §7.110 (Examination of Books and Records) at [1] (Statutory Authority) states final payment “means the date when the contract is completed substantially and the agreed payment made with the exception of items usually reserved for future determination and settlement.  Unpublished Opinion B-100489, 1962 U.S. Comp Gen. LEXIS 2191 (Oct. 11, 1962).”

The "exception of items usually reserved for future determination and settlement are further defined as insurance, warranties, sales taxes, patent royalties, claims on appeal, and similar items. Records for these items must be maintained until "finally determined".

Well, this listing doesn't specifically include final determination of direct and indirect costs but there is that catch-all phrase; "and similar items". Since costs on a cost-reimbursable contract are not finally determined for (i) indirect costs until the Government (usually DCAA) and the contractor sign a final rate agreement and (ii) directs costs are not finally determined until final acceptance by the Contracting officer, it seems logical to conclude that these "items reserved for future determination and settlement."

Contractor Records Retention

This is a reminder that the Federal Acquisition Regulations (FAR) contains very explicit policies and procedures for retention of records by contractors to meet the records review requirements of the Government (see FAR 4.7).

Sometimes, even Government auditors do not know the rules.

Most Government contracts contain one of two "Audit and Records" clauses, depending upon how the contract was awarded. FAR 52.241-26 applies to sealed bids and FAR 52.215-2 applies to negotiated contracts. In either case, the Government has up to three years following final payment under the contract to come in and review books and records or a shorter period specified in FAR 4.7. This is important as auditors often cling to the three year rule and conveniently forget the "shorter period" rules. We'll look at some of these shorter periods but first, we should define "records" as used in these clauses.

The definition of "Records" as used in these clauses is very broad. It includes books, documents, accounting procedures and practices, and other data, regardless of type and regardless of whether such items are in written form, in the form of computer data, or in any other form. While this definition is broad, the records must still pertain to "costs claimed to have been incurred" under a particular contract. Sometimes, auditors tend to broaden the scope of their data requests. When they do, contractors must be prepared to challenge any request that doesn't specifically pertain to the contract under audit.

The "shorter periods" records retention requirements are found in FAR 4.705. These periods are measured from the end of the contractor fiscal year (e.g. calendar year), not from the final payment under the contract. Contractors should be familiar with these regulations when establishing their formal record retention policies and procedures. For example, concerning timekeeping, labor cost distribution, and payroll records, FAR 4.705 provides for the following:

• Labor cost distribution cards or equivalent documents: Retain 2 years (FAR 4.705-1(f).
• Payroll sheets, registers, or their equivalent of salaries and wages paid to individual employees for each payroll period, change slips; and tax withholding statements: Retain 4 years (FAR 4.705-2(a)).
• Clock cards or other time and attendance cards: Retain 2 years (FAR 4.705-2(b)).
• Paid checks, receipts for wages paid in cash, or other evidence of payments for services rendered by employees: Retain 2 years (FAR 4.705-2(c)).

If a contractor is unable to support audit requests for records on a 2006 incurred cost submission, for example, it may be because the contractor was following FAR requirements for record retention periods.

Can't Find Your Old Accounting Records?

About two and a half years ago, we posted a topic called How Long Should I Keep My Records? It laid out the FAR (Federal Acquisition Regulations) requirements for how long Government contractors were required by regulation, to keep certain books and records. It might be useful to read that posting before proceeding further.

Negotiated contracts have (or should have) the clause at FAR 52.215-2, Audit and Records - Negotiation. This is a lengthy clause but the relevant portion for this discussion is Section (f), Availability. This section states:

The Contractor shall make available at its office at all reasonable times the records, materials, and other evidence described (earlier), for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in Subpart 4.7, Contractor Records Retention, of the Federal Acquisition Regulation (FAR), or for any longer period required by statute or by other clauses of this contract.

So, the basic record retention rule is 3 years after final payment or a shorter period as prescribed by Subpart 4.7.

Note, the three year requirement begins after final payment, not after contract completion. Some contractors mistakenly believe, to their detriment, that the three year period begins after contract completion.

Flipping back to FAR 4.7, you will find the record retention requirements for most types of documentation that might be required in connection with an audit of an annual incurred cost proposal including cost accounting records (4 years), payroll records (4 years), timesheets (2 years), etc. For a full rundown on other record types, refer to FAR 4.7 or read our previous blog post on the subject.

This brings us to the reason we're alerting you to the FAR requirements. As most contractors know, DCAA (Defense Contract Audit Agency) is chronically behind in auditing incurred costs. There are a lot of reviews going on right now covering 2006, 2007, and 2008 and we've seen one audit covering the years 2004 and 2005.

Some contractors are finding it very difficult, and in some cases impossible, to support costs for those years because, in following the FAR 4.7 requirements, did not retain documents beyond the regulatory retention periods. From DCAA's perspective, this is a problem. Without contractor records, the Agency has no basis to render an opinion on the propriety of incurred costs. This lack of documentation however, is not the contractors' problem. It just moves the resolution of final incurred costs from the auditor up to the Contracting Officer level where, they are not bound by audit standards in settling incurred costs.

How to "Plug" Data Holes

"Data Hole" is a term used to describe financial information for which source documentation is missing. This could be a vendor invoice, a timecard, electronic media, or any of a host of other source documents. Data Holes are seemingly unavoidable and occur within any organization, regardless of size. Yesterday we discussed how Government auditor's might view claimed costs for which there is no tangible supporting documentation. Government auditors have different objectives and lower materiality thresholds than would your IPA (Independent Public Accountant) auditing your financial statements. They also have FAR 31.201-2(d) to buoy their case. See yesterday's post for further discussion. Today we want to provide some tips for dealing with the absence of supporting documentation.

First, you need to know where your "data holes" are. In preparing for an audit, you need to take inventory of what is likely to be requested by the auditor and ensure that it is complete, up-to-date, and accurate. It is usually unsettling when you cannot find data that has been requested.

Once you know your data holes, you can begin developing alternative documentation that might satisfy the reasonableness test. Reasonableness is very subjective however and even Government auditors will disagree on what constitutes reasonable support under the circumstances.  Whether the Government auditor will accept your alternative supporting documentation is problematic but you need to be looking ahead to possible appeal processes. You can always appeal to the contracting officer and if the costs are significant enough, you can appeal to the ASBCA or higher courts.

Here's an illustration of alternative documentation that might satisfy the reasonableness test. Suppose that one timecard for one employee for one pay period is missing. How do you satisfy the auditor that hours charged to a Government contract by that employee for that pay period was actually worked? You could produce a leave and earnings schedule to show that person did not take vacation, sick or holiday leave. You could peruse travel documentation to show that employee was not traveling somewhere. If you have timeclocks, you can show in and out times. If the incidence was fairly recent, you could have other employees and his supervisor prepare written statements. You could refer to email traffic and note whether he/she sent email during that week related to the Government contract. If he/she were a manufacturing person, there might be travelers, work authorizations, or other documentation that required signatures/initials and dates. Phone records might help.

Now, you might conclude that this is a lot of nonsense for one timecard. You might be tempted just to write the cost off rather than go through the process of generating alternative support. And you might be right. A cost benefit analysis is a good step. However, keep in mind that auditors do not perform 100% reviews of all transactions. They sample items and project the results of the sample to the entire universe. So, a seemingly minor cost can result in significant questioned costs.

What To Do About Data Holes

The term "data hole' is used to describe financial information for which supporting documentation is no longer available. Missing invoices, misplaced time cards, or electronic media that's been wiped out are all examples of data holes. Sometimes data holes can be patched with duplicate sources. Often times, not. The older the information, the less likely it will be to plug those holes. This is no small matter as Government auditors are significantly in arrears in completing required incurred cost reviews. The existence of data holes is nothing new - they've existed forever and affect both small and large companies alike. One would expect that with electronic media that the incidences of missing data would diminish but that is not the current trajectory.

When it comes to financial reporting, data holes are often glossed over without so much as a mention. If a contractor is making monthly payments to lease some equipment and can locate all but one of the monthly invoices but all twelve cancelled checks, a CPA will reasonably conclude that the payment was made. The CPA can review subsequent invoices and see that there are no delinquencies on the account and gain reasonable assurance that the cancelled check did indeed represent the monthly lease payment.

That's not necessarily the case for a Government auditor. A Government auditor must contend with the provisions of FAR 31.201-2(d) which states:

A contractor is responsible for accounting for costs appropriately and for maintaining records, including supporting documentation, adequate to demonstrate that costs claimed have been incurred, are allocable to the contract, and comply with applicable cost principles in this subpart and agency supplements. The contracting officer may disallow all or part of a claimed cost that is inadequately supported.

The Government's position is that the contractor bears the burden of documenting its costs. If it cannot do so, then it has failed to meet its burden and the costs are unallowable. Auditors who take such a strict interpretation in all cases, such as the lease payment example mentioned above, have abandoned a key element of auditing, that being "judgment". But, these situations are happening with increasing frequency and will ultimately lead to unnecessary disputes.

Tomorrow we will look at some steps that contractors can take proactively when it discovers data holes in its books and records.

How Long Should I Keep My Records?

As a general rule, contractors must make available records, which includes books, documents, accounting procedures and practices, and other data, regardless of type and regardless of whether such items are in written form, in the form of computer data, or in any other form, and other supporting evidence to satisfy contract negotiation, administration, and audit requirements of the contracting agencies for three years after final payment (see FAR 4.7) or, for certain records delineated below, the period specified or three years, whichever comes first. If a particular contract specifies a longer period, the longer period applies.

If a contractor does not meet the original due date for submission of its final indirect cost rate proposals (six months after the end of its fiscal year) the retention periods are automatically extended one day for each day the proposal is not submitted after the original due date.

Retention periods are calculated from the end of the contractor’s fiscal year in which an entry is made charging or allocating a cost to a Government contract or subcontract. If a specific record contains a series of entries, the retention period is calculated from the end of the contractor’s fiscal year in which the final entry is made. Typically, contractors cut off the records in annual blocks and retain them for block disposal under the prescribed retention periods.

When records generated during a prior contract are relied upon by a contractor for cost or pricing data in negotiating a succeeding contract, the prescribed periods shall run from the date of the succeeding contract.

Following are the FAR required retention periods for specfic records.

Financial and cost accounting records.

• Accounts receivable invoices, adjustments to the accounts, invoice registers, carrier freight bills, shipping orders, and other documents which detail the material or services billed on the related invoices: Retain 4 years.
• Material, work order, or service order files, consisting of purchase requisitions or purchase orders for material or services, or orders for transfer of material or supplies: Retain 4 years.
• Cash advance recapitulations, prepared as posting entries to accounts receivable ledgers for amounts of expense vouchers prepared for employees’ travel and related expenses: Retain 4 years.
• Paid, canceled, and voided checks, other than those issued for the payment of salary and wages: Retain 4 years.
• Accounts payable records to support disbursements of funds for materials, equipment, supplies, and services, containing originals or copies of the following and related documents: remittance advices and statements, vendors’ invoices, invoice audits and distribution slips, receiving and inspection reports or comparable certifications of receipt and inspection of material or services, and debit and credit memoranda: Retain 4 years.
• Labor cost distribution cards or equivalent documents: Retain 2 years.
• Petty cash records showing description of expenditures, to whom paid, name of person authorizing payment, and date, including copies of vouchers and other supporting documents: Retain 2 years.

Pay administration records.

• Payroll sheets, registers, or their equivalent, of salaries and wages paid to individual employees for each payroll period; change slips; and tax withholding statements: Retain 4 years.
• Clock cards or other time and attendance cards: Retain 2 years.
• Paid checks, receipts for wages paid in cash, or other evidence of payments for services rendered by employees: Retain 2 years.

Acquisition and supply records.

• Store requisitions for materials, supplies, equipment, and services: Retain 2 years.
• Work orders for maintenance and other services: Retain 4 years.
• Equipment records, consisting of equipment usage and status reports and equipment repair orders: Retain 4 years.
• Expendable property records, reflecting accountability for the receipt and use of material in the performance of a contract: Retain 4 years.
• Receiving and inspection report records, consisting of reports reflecting receipt and inspection of supplies, equipment, and materials: Retain 4 years.
• Purchase order files for supplies, equipment, material, or services used in the performance of a contract; supporting documentation and backup files including, but not limited to, invoices, and memoranda; e.g., memoranda of negotiations showing the principal elements of subcontract price negotiations (see 52.244-2): Retain 4 years.
• Production records of quality control, reliability, and inspection: Retain 4 years.

Transferring Records from Hard Copy to Computer Medium

Companies that offer solutions to transfer records from hard copy to electronic are proliferating and with good reason. It makes perfect sense to save records electronically as it reduces archival and storage costs and in most cases, facilitates the retrieval process. The offerings range from companies who will come in to your firm and do it for you to "add-ons" to your accounting software that will store and link electronic copies of documents to specific transactions. For government contractors contemplating a move to electronic archiving and storage, the key question to ask vendors is whether their offering is compliant with FAR 4.7. If they do not know what you are talking about, find someone that does. There are lots of them out there.

FAR 4.703(d), which was effective February 27, 1995, and Public Law 103-355 allow contractors to retain records in any medium or any combination of media if the following requirements are met:

1. The requirements of FAR Subpart 4.7 are satisfied.
2. The process used to create and store records must reproduce the original document, including signatures and other written or graphic images, completely, accurately, and clearly.
3. The procedures for data transfer, storage, and retrieval protect the original data from alteration.

 

To comply with this FAR requirement a contractor's system of transferring records from hard copy to computer medium should contain the following elements:

 

1. A reliable computer medium (typically, this includes vendor supported benchmark data). You don't want to copy your data to cheap CDs that last just a few years.
2. Documented procedures for data retention and transfer which provide reasonable assurance that the integrity, reliability, and security of the original hard copy data will be maintained.
3. An audit trail describing the data transfer.
4. A computer medium which cannot be destroyed, discarded, or written over. The contractor will need to consider appropriate transition, after exception reporting, to non-eraseable storage.
5. A transfer process that includes all relevant notes, worksheets, and other papers necessary for reconstructing or understanding the records (this also includes appropriate back-up procedures).
6. Adequate internal control systems, including segregation of duties, particularly between those responsible for maintaining the general ledger (and related subledgers) and those responsible for the transfer process.
7. A procedure prohibiting record destruction during the implementation phase until it can be shown that the system is actually providing acceptable copies of the records being transferred.
8. An acceptable system of continuing surveillance over the computer medium transfer system. This includes comparisons of the original records and the computer generated copies, as well as periodic internal control audits. The policies and procedures should provide for the maintenance of adequate evidence to support the nature and extent of the continuing surveillance.
9. A requirement to maintain all original records for a minimum of one year after the date of transfer.
10. Adequate procedures for periodic internal and external audit.
11. Adequate procedures for labeling and storing the computer medium in a secured environment. The storage procedures should meet the minimum standards prescribed by the National Archives and Records Administration for maintenance and storage of electronic records.
12. Adequate procedures for the random sampling and testing of all records retained in accordance with the requirements of the National Archives and Records Administration. Procedures should include provisions for notifying the contracting officer of any significant data losses on a timely basis.
13. Procedures for retrieving retained records at the time of audit. Procedures should include provisions for printing a hard copy of any record. In addition, policies should include provisions for access by Government representatives, at the time of examination, to the necessary computer resources (terminal access, printer, etc.) that are necessary for the production of the retained records.
14. Procedures for preventing the destruction of any hard copy records that are required to be maintained by existing laws or regulations.

Obviously, setting a temp worker down with a scanner to copy everything to .pdf format is not going to meet these requirements.

Although the foregoing requirements sound onerous, many vendor's offerings are already compliant. The price entry point for the major players in this industry (e.g. Iron Mountain) seems to be somewhat high for many smaller Government contractors but there are less costly alternatives. We haven't had enough experience with such offerings to make any recommendations. If your company is spending too much time to track down and retrieve hard copy records and spending too much money to maintain and store those documents, you might be able to build a business case to switch over to electronic media.