$100 Thousand Overpayment Resulting from 'Alleged' Timecard Fraud

There are two fundamental ways of engaging in timecard fraud. One method is charging hours to something other than is actually being worked. This isn't that uncommon, unfortunately. It usually involves the cooperation of management at some level and a breakdown in internal controls designed to keep that from happening. Having employees charge time to a cost-type contract when they are really working on a fixed-price contract is one example.

The second type of timecard fraud is charging time but not showing up for work, or arriving late, or leaving early. One well documented case involved a Government contractor who's employees charged overtime on their timesheets but were no where to be found at the work site. The increasing trend to allow employees to work at home is concerning here and employers (contractors) need to ensure robust internal controls and ways to measure performance (remember, 'trust' is not an internal control).

An example of a case involving the second type of timecard fraud was reported by the Justice Department yesterday in one of their press releases. The case involves a subcontractor employee who worked in a sensitive compartmented information facility (SCIF). On several occassions over a two-year period, this subcontractor employee reported to her employer that she was working inside the SCIF. However, the badge reader to gain access to the SCIF showed that she was not where she said she was. As a result, investigators estimate that the Government was overcharged by more that $100 thousand. That figure is likely significantly understated.

The unusual aspect of this case is that the indictment was handed down by a Federal grand jury. Hundred thousand dollar fraud does not usually involve a grand jury. Perhaps there is some national security implications involved here. The fact that the employee was also detained pending a detention hearing also suggests that there is more involved here than just timecard fraud.

Identifying "Holes" in Your Timekeeping System

Throughout the eight + years of this blog's life, we've discussed, in various fashions, the critical importance of timekeeping systems as well as contract auditors' floorchecks and labor interviews used to test the adequacy of those systems. An adequate timekeeping system is perhaps the most important system of internal controls for a contractor with cost-type contracts. One could argue that an accounting system is more important but an accounting system can be recreated whereas a timekeeping system which captures employee time charges contemporaneously with the work performed, cannot be accurately recreated.

The first thing a contract auditor needs to do when performing floorchecks and other timekeeping reviews is to develop an understanding of the system as it currently exists. To do this, contract auditors will gather a lot of information. This data gathering phase helps them to establish their audit scope; obviously, more robust controls will require less transaction testing. This series of "determinations" include the following:

1. Determine how attendance is controlled; through electronic systems, clock cards, timecards, or other suitable time and attendance records.

2. Identify the process for controlling employee time records at each timekeeping station or the electronic timekeeping input and related records. Electronic timekeeping should include procedures to ensure that employees do not share their access credentials.

3. Determine the procedures for notifying the employee of the assigned job number and whether the procedures provide that all changes are properly initialed/approved by the employee and the designated approving supervisor. This is extremely important to ensure that labor charges get tot he proper cost objective.

4. Determine whether hours shown on the timecards or input electronically are reconciled periodically with hours recorded on attendance and payroll records. Many contractors fail to include this reconciliation.

5. Determine whether there is a division of responsibility within the company between personnel responsible for the preparation and or approval of time and attendance records and those responsible for the preparation and distribution of payroll.

6. Determine whether there is a division of responsibility between personnel having a part in the preparation and/or approval of time and attendance records and those responsible for operating within budgets. If a division of responsibility does not exist, the risk increases for affecting payroll in proportion to the number of personnel the employee/manager can influence.

7. Determine whether procedures have been established for coding and recording idle time. The Government will insist that idle time be prorated among all work.

8. Determine whether records of piece work and work performed under wage incentive plans are checked and controlled independently from production counts, approvals for allowances, and other operations.

At this point, the contract auditor is only gathering information and not making any assessments as to the adequacy and sufficiency of a timekeeping system. That comes later in the audit. Contractors can use this listing however to identify where weaknesses might exist in their own timekeeping system.

Memo to Employees: Save All Information Related to Time Charging

The Department of Energy is building a $17 billion vitrification plant at its Hanford site in order to turn 56 million gallons of radioactive waste into a stable glass form. The waste is left from the cold war production of plutonium for America's nuclear weapons program. The contract is cost reimbursable and projected costs have grown significantly over its initial budget.

A recent article appearing in the hometown newspaper, the Tri-City Herald, stated that the paper had obtained copies of emails sent to workers at the vitrification plant instructing them to preserve all information and emails regarding charging for labor, recording time worked, overtime and related matters. The article went on to not that the preservation request was related to a civil investigative demand issued by the Justice Department to the prime contractor on the project, Bechtel National (see Feds may be investigating timecard issues at Hanford vit plant for the complete article). We're not sure what types of timekeeping records might exist. The company uses an electronic timekeeping system and employees do not normally retain paper.

This sounds serious though. Another email from a Bechtel attorney instructed employees that if they were contract by federal investigators they could speak with them, they could decline to speak with them, they had a right to have their attorney present, or could request that a Bechtel attorney be present.

The Justice Department, the Department of Energy, and Bechtel all declined comment on the matter (of course).

There have been serious timecard problems among contractors at Hanford. In 2013, one contractor paid $18.5 million to resolve civil and criminal allegations of defrauding taxpayers through timecard fraud. Earlier this year, another contractor forked over $5.3 million to settle allegations of timecard fraud.

Contractor Employee Pleads Guilty to Timecard Fraud

Last December, we reported on a Justice Department announcement that it had indicted a Government contract employee for falsifying her timecard (see Falsified Timecard Leads to False Claim  Against Contractor Employee). Yesterday the Justice Department that the Government contract employee has pled guilty to the charges (see Government Contractor Pleads Guilty To Making False Claims and False Statements).

Our previous post details the crime so we will not repeat the details here. Essentially, the person was a full-time Government employee and also moonlighted as a security guard for a Government contractor at a SCIF (sensitive compartmentalized information facility). While supposedly on duty, she left the premises. The fraud went on for about a year from what the investigators were able to piece together.

The reason we bring this up again is to illustrate the importance of internal controls. Presumably this Government contractor had an adequate accounting system that had been approved by an ACO (administrative contracting officer). Inherent in an adequate accounting system is a timekeeping system that internal controls of its own. So a supervisor had to have been signing off on the employees timecard certifying that the employee had been at work and had charged to the appropriate final cost objective.

So what happened? Where were the internal controls that should have detected and/or prevented this from occurring? Was there a massive failure in the contractor's internal controls over timekeeping? Was there collusion?

Which brings up the question for Government contractors reading this blog. Could this have happened at your facility? How certain are you that your "trusted" employees are at work and/or charging to the proper contract? And we're not referring to the games that contractors play when auditors show up at their facility to perform floorchecks. We're talking about the day-to-day operations when no one is really looking.

Falsified Timecard Leads to False Claim Against Contractor Employee

We've discussed the importance of maintaining an adequate timekeeping system many times on this blog. Whether using a manual (paper or Excel) or an automated timekeeping system (tons of them out there at nominal cost), the basic requirements are the same; employees record their time at least daily, supervisors, or someone that has first hand knowledge of the employees' activities reviews and signs (manually or electronically) certifying that the hours are accurate, and any changes to original entries are documented. Beyond that, contractors must implement some kind of monitoring process to ensure that employees are adhering to established timekeeping policies and the results of those monitoring activities must be sent to management for corrective action, if any.

Those fundamental requirements seem fairly straight-forward and simple to understand and implement, yet throughout Government contracting, there is a very high rate of noncompliance. Where internal controls are weak, where the contractors' monitoring process is absent or ineffectual, or where there are no consequences for failing to comply with timekeeping policies and procedures, the rate of noncompliance is even higher.

With this in mind, consider the Department of Justice (DoJ) press release from late last week. A federal grand jury charged a contractor employee for falsely representing to her employer that she was working as a security guard at a government facility, when she was actually elsewhere. The indictment alleges that for nearly a year, from September 2015 to August 2016, the employee regularly abandoned her work station and falsely represented to her employer that she had been working as a security guard when she was actually elsewhere. This cost the Government about $40 thousand for work that was not performed.

An indictment is not a finding of guilt. An individual charged by indictment is presumed innocent unless and until proven guilty at some late criminal proceeding.

The press release was bereft of details concerning the manner in which the fraud was uncovered and reported. It could have been a result of a whistleblower or perhaps a voluntary disclosure by her employer. It is possible that someone began to notice that the security guard was regularly no where to be found.

The fact that the fraud continued for a full year suggests to us that the employer, the Government contract, had weak internal controls over its timekeeping practices. Someone had to be reviewing and certifying the employee's timecard - certifying that the work had been performed. Also, the company should have been performing its own internal audits of timekeeping practices to ensure compliance. Obviously, its oversight was not as robust as it should have been.

You can read the full DoJ press release here.

Automated Timekeeping - Still Haven't Made the Jump?

There is really no reason any longer for Government contractors to use paper timesheets or timecards. The cost for a robust, DCAA compliant, automated timekeeping system is negligible and the benefits (more about benefits later in this post) far outweigh those costs. If your accounting system does not already include an integrated timekeeping system, you can sign up for one that integrates into most entry-level accounting systems (like QuickBooks) and most payroll programs for $25 per month plus $4 or $5 per employee and perhaps cheaper than that.

There are dozens of automated timekeeping systems on the market and there is not too much that differentiates one from another. Its considered a mature application and there's probably not much R&D money being spent there these days. To be considered adequate for Government contracting, the application must, at a minimum, have unique login/password combinations for each user, a feature where supervisors/managers can review and approve employee timecharges, and an audit trail. Most systems today have smartphone apps that allow users to complete their timecards from anywhere as well as automatic email notification to employees and supervisors when timecards have not been completed on a daily basis.

The biggest advantage that automated timekeeping systems have over manual systems is the elimination of manual, time-consuming processes, finding, penciling, collecting, reviewing, collating, tallying, distributing costs, etc. Such processes are streamlined with automated systems. Accuracy is improved - don't have to worry about transposing numbers and letters on a charge-line. Review and approval is expedited resulting in dramatically reduced time and effort. The integration with accounting and payroll systems offer additional accuracy and time savings. Finally, with the mobile apps capabilities, the process of submitting completed timecards is a one-click event.

 Automated timekeeping systems are easy to find (google "dcaa compliant timekeeping systems). There are plenty there that should fit your needs. For QuickBooks users, "tSheets" and "Replicon" seem to be very popular though neither one is optimized for a manufacturing environment. Most of these applications operate as SAAS (Software as a Service) so if you choose one and decide you don't like it or it doesn't do what you need, just cancel the service and move on to another - you won't be losing a big investment.

Guilty Plea for Filing False Timesheets

Labor costs charged to Government contracts represents the single biggest cost element on most contracts. It is the cost element that represents the highest risk to the Government, not only because of its significance but because it is not generally subject to third party verification. Unlike material costs where support includes purchase requisitions, purchase orders, vendor invoices and receiving reports that corroborate the charge, labor is supported only by a time sheet. That is why Government auditors spend so much time and energy performing floorchecks (interviewing employees at their place of work) and that is why auditors spend so much effort in reviewing policies and procedures over timekeeping and testing contractor/employee compliance with those policies and procedures.

Falsifying time cards (to use the old vernacular) is serious business. People have been reprimanded, suspended, fired, fined, and some have even gone to prison for falsifying timecards. Their employers (e.g. Government contractors) have had to pay restitution and fines. Falsification takes many forms. It might be that an employee charges time to one project and works on another. It might mean that the employee charges time for hours not worked. It could be that an employee charges hours to tasks that they are not qualified to perform. Whatever the case, the Government is not getting what it paid, or is paying, for.

Yesterday, for example, the Department of Justice issued a press release announcing that an employee of a Government contractor had plead guilty of filing false time sheets. In this case, the employee, working as a linguist, made false statements concerning the number of hours worked for a NSA (National Security Agency) contractor. Over a two year period, this employee charged 736 hours on his time sheet than he actually worked, resulting in overcharges to the Government, by the time indirect costs were added, of $69 thousand. He now faces a maximum five year prison sentence and a $250 thousand fine in addition to paying restitution (he'll probably be put on probation).

DoJ's press release did not say how the fraud was uncovered. As a linguist working in an NSA facility, he probably did not have a significant amount of management oversight from his employer, a significant internal control weakness in itself. His supervisor was probably signing off on timecards without having first-hand knowledge of his work habits and patterns.

You can read the full DoJ press release here.

Eight Ways to Improve Your Internal Controls Over Labor Charging

Almost every Government contractor with cost-type contracts has experienced or is at least aware of the possibility of "floorchecks". That's is the process where Government auditors interview contractor employees to determine whether they are familiar with and are following the contractors' timekeeping policies and procedures.

Before an auditor conducts interviews however, he/she must have a very good understanding of the timekeeping system itself and the system of internal controls necessary to ensure accurate recording of time. To accomplish this, there are eight considerations an auditor will undertake to establish whether the timekeeping, payroll, and labor distribution systems are sufficient for ensuring that the hours worked are converted to dollars and recorded against Government contracts.

These eight considerations include:

1. Determine whether employee attendance is controlled by clock cards, timecards, other suitable time and attendance records, or are input and captured electronically.
2. Identify the process for controlling employee time records at each timekeeping station or the electronic timekeeping input and related records. Employees should maintain their own timecards and if using an electronic system, should access with user identifications and passwords that are not shared.
3. Determine the procedures for notifying the employee of the assigned job number and whether the procedures provide that all changes are properly initialed/approved by the employee and the designated approving supervisor.
4. Determine whether hours shown on the timecards or input electronically are reconciled periodically with hours Master Document recorded on attendance and payroll records. Someone in the company needs to be assigned responsibility for this reconciliation.
5. Determine whether there is a division of responsibility within the company between personnel responsible for the preparation and/or approval of time and attendance records and those responsible for preparation and distribution of payroll. Ensure a proper division of responsibility exists within the payroll department.
6. Determine whether there is a division of responsibility between personnel having a part in the preparation and/or approval of time and attendance records and those responsible for operating within budgets. If a division of responsibility does not exist, the risk increases for affecting payroll in proportion to the number of personnel the employee/manager can influence.
7. Determine whether procedures have been established for coding and recording idle time.
8. Determine whether records of piece work and work performed under wage incentive plans are checked and controlled independently from production counts, approvals for allowances, and other operations. 

The sufficiency of these controls will greatly influence the number of interviews auditors will need to conduct in order to satisfy themselves as to the propriety of labor charged to Government contracts. Contractors will do well to implement systems to reduce the risks of improper labor charging.

Man Convicted of Time-card Fraud Going to Prision

We were planning to continue our series on BBP 3.0 (Better Buying Power) today but have chosen instead to highlight an news article appearing in yesterday's Tri-City Herald about an individual going to jail on account of timecard fraud. Its not that this particular employee engaged in timecard fraud mind you - the Judge stated his crime was one of omission, not commission. He was in a position where he should have known that timecard fraud was occurring and he had a responsibility to report it, but didn't.

This case is an old one involving a lot of employees working for a contractor performing cleanup work at one of DOE's clean-up sites. We've reported on it several times as individual cases have moved through the legal system. The essence of matter was employees charging overtime for hours never worked. One of the most troubling aspects of this case, in our mind, was that Government investigators installed GPS devices on employee vehicles to track where their actual locations when they should have been at their work site. It is somewhat surprising to us that the Government's GPS caper hasn't gotten more publicity.

In any event, according to the news article, one of the supervisors of the 10 defendants who have pleaded guilty and awaiting sentencing was sentenced to 30 days in prison, three months of home detention and a fine of $34 thousand after pleading guilty to timecard fraud.

The Judge in the case said she was surprised that the Justice Department reduced its recommendation from the federal sentencing range of eight to 14 months. Then she added that the supervisor's crime was one of omission rather than commission. He know there was a high probability of timecard fraud occurring at the Hanford tank farms. Workers are required to report suspected fraud involving federal funding.

Last December, the Justice Department dropped criminal charges on another manager at this contractor in a plea deal where he agreed to pay $44 thousand in civil penalties.

Contractors need to understand that the Government can be very serious about timecard accuracy - especially when it comes to large dollar cost-type contracts. Costs under those contracts are passed right along to the Government so the expectation is that contractors will have robust internal controls, policies, procedures, practices, and monitoring to preclude this type of fraud, and other types of irregularities from occurring in the first place.

Read more here: http://www.tri-cityherald.com/2015/04/14/3511162_former-hanford-supervisor-sentenced.html?rh=1#storylink=cpy

Do You Have a Work-at-Home Policy?

We were recently perusing the updated audit program for conducting floorchecks and came upon the section dealing with contractor employees who telework, i.e. work from their homes or from alternate work sites and it got us to wondering just how prevalent this practice has become. At one time, telework was one of the hottest HR trends. It was believed that teleworking would lead to higher job satisfaction and companies could reduce the footprint of their facilities thereby saving money. There would be societal benefits as well; less highway congestion and cleaner air. Despite its benefits, there was always some level of skepticism as to the impact of teleworking on employee productivity. Nevertheless, a lot of companies jumped on the bandwagon and fully endorsed a work-at-home program.

Even the Federal Government jumped on the telework bandwagon. In 2000 legislation was passed that required federal workers to telework to the maximum extent possible. By 2013, 3.3 percent of federal workers teleworked on a regular basis and actually lead the way among different classes of workers. By comparison, the percentage of private sector employees was only 2.6 percent (these statistics come from Global Workplace Analytics). Local government employers ranked last with only 1.2 percent teleworking).

Over the past several years, we have observed a number of contractors who have rolled back their work-at-home programs including a very large Government contractor. Obviously, those firms must have conducted some kind of cost/benefit study and determined that there wasn't a sufficient "business case" to be made to continue the programs.

If you are one of those contractors that still allow employees to work from home, and you have flexibly priced contracts (e.g. CPFF, T&M), the contract auditor will have some very specific questions concerning how that employee is monitored, supervised, and his/her productivity is assessed. Obviously the auditor is not going to show up at the employee's home to conduct a floorcheck but the auditor will be interviewing the employees' supervisors and ask for documentary evidence of supervisory control that will most likely include questions as to how productivity is measured and assessed. The auditor may even decide to interview the employee by phone.

The objective of a floorcheck audit is to test compliance with timekeeping internal controls and procedures , the reliability of timesheets, and to verify that employees are actually at work, performing in their assigned job classifications and charging to the proper contract. Although it is difficult to meet these audit objectives when employees are working at home, the auditor will find some way to satisfy such requirements.

Timecard Fraud Trial Set to Begin this Month

Regular readers of this blog will recall our coverage of the alleged timecard fraud that occurred at DOE's nuclear cleanup site in Washington State. You can read here and here and here for a refresher. The local newspaper for that area reported this week that the first five defendants are scheduled to go to trial beginning September 29th. We've been watching this story with keen interest because its the first time, to our knowledge, that employees are being held personally accountable, in court, for participating in timecard fraud. Usually contractors that get caught get a slap on the wrist and maybe the employee is terminated or suspended for a period. The contractors promises to improve its internal controls and after a short period, life returns to normal.

In this case, the contractor has already repaid $18.5 million and several employees have plead guilty and were fined. Other participants are going to trial. The crux of this case involved the payment of overtime for hours not worked. Employees (with the support of their union) refused to work overtime unless they were guaranteed eight hours. In many cases, the work requiring overtime did not take eight hours so the employees were allowed to go home after their tasks were completed, yet they were paid eight hours of overtime.

The first five going to trial were supervisors who did not review and approve timecards but were responsible for getting work completed. These supervisors would go out and solicit volunteers for overtime even though they knew that workers would only volunteer if overtime was offered in eight hour shifts. They knew that the work to be performed would not take eight hours and they told the workers that they could go home after the work was completed and they knew that those employees would be paid for eight hours of work. In addition, they claimed eight hours of overtime for themselves. One of these defendants was paid $64 thousand in overtime in one year. Others earned between $12 and $20 thousand in overtime.

The prosecution's case will be supported by the testimony of nine subordinate employees who have already plead guilty to timecard fraud and punished, plus testimony from other employees as well as timekeeping records.

Timekeeping went wrong on so many levels. There was the contractor with a big cost-type contract with little or no incentive to control costs. There were the employees with their powerful union that pushed its weight around - threatening production. There were employees, supervisors, and managers who benefited monetarily from the scheme. There was a lack of Government oversight that allowed the scheme to fester for such a long period.

For contractors and contractor employees alike, this should be a significant wake-up call that the Government will pursue timecard fraud as far as necessary.

Plea Agreement in Timecard Fraud

The Tri-City Herald reported last week that a former DOE contractor employee has plead guilty to timecard fraud. That former employee, according to the plea agreement now faces four months in prison, three years of probation, a $20 thousand fine, and has agreed to cooperate with prosecutors in trials of other defendants in a huge timecard fraud scheme.

The timecard fraud is not a new story. We reported on it more than a year ago when the allegations were first reported. See here and here, for example. The contractor has already settled up with the Government on its role by paying back $18.5 million. However, the Justice Department is pursuing criminal fraud charges against 10 employees who also participated and personally benefited from the scheme.

This case involved payments of overtime for hours not worked. At the DOE site, overtime was voluntary but in order to get workers to volunteer for overtime, the contractor promised them eight hour shifts, regardless of how long it took to perform the actual work. In many cases. the work did not require the full eight hours so employees left their work sites early, while still charging the Government for eight hours of overtime work. Additionally, timecard fraud occurred during regular shifts when it was noted that a "steady stream of workers" began leaving work at 2:30 p.m. for shifts that should have lasted until 4:30 p.m.

One very interesting disclosure that wasn't reported earlier (or at least we didn't pick up on it from earlier news accounts and DOJ press releases), was the Government's use of GPS devises. The Tri-City Herald reported:

Global positioning system surveillance showed the workers were not at Hanford during those hours.

That can only mean one thing - Government investigators planted tracking devices on the individuals or their automobiles - most likely their automobiles. That, in our mind, is a little bit scary. There must have been probably cause for a judge to approve that tactic.

One of the failures in this case was the lack of effective oversight by contract auditors. DOE representatives told us that DCAA, who had been performing contract audits on behalf of DOE for many years, completely botched their risk assessment. Even at DOE's behest, DCAA would not focus on areas where DOE felt the highest risk. This was a contributing factor into DOE effectively firing DCAA for its contract audit effort. Instead, DOE now contracts primarily with commercial firms for its contract audit services.

Timecard Fraud - One Employee May Be Facing Jail

The Department of Justice (DoJ) announced yesterday that a Government contractor employee had plead guilty to submitting false timecards. That employee now faces a maximum sentence of five years in prison and a $250 thousand fine.

In 2008, the employee was hired by a DoD subcontractor to perform work on a specific contract. She was required to submit timesheets to both her employer and the prime contractor. The prime contractor paid the subcontractor a fixed amount for every hour this employee worked.

Beginning in 2010, this employee began working full time for another contractor while, at the same time, continued to submit timecards as if she were still working full time for her previous employer. The Government's investigation revealed that she was working full time for her new employer yet at the same time, continued to submit timecards to her previous employer. Her former employer continued to bill the prime contractor who in turn, billed the Government. Before the scheme was halted nine months later, the Government had been overbilled by $65 thousand.

There are so many internal control deficiencies in this story that we don't know where to begin is describing them or ranking them in importance. First of all, where was the supervisor? One of the elements of an adequate timekeeping system is that after employees submit their timecards, the supervisor, with first-hand knowledge of what the employee was working on, reviews and approves the timecard. Secondly, the same question. Where was the supervisor? How can this fraud go on for nine months before someone wises up and notices that the employee is not performing her assigned tasks. This is one reason why contract auditors sometimes asks whether supervisors observe the comings and goings of their subordinates. Thirdly, this illustrates one of the big problems with cost-reimbursable contracts. Everyone, the employee, her employer and the prime contractor have no real incentive to control costs. Those costs are just passed along to the Government and everyone goes home happy and rich. Fourthly, was this job even necessary in the first place? If you can go on for nine months and not even notice that a position was not producing any output or deliverable, you have to question the necessity of that job in the first place.

Contractors (and subcontractors) really need to beef up their timekeeping procedures when they have employees assigned to remote sites or to a Government facility. "Trust" is not an internal control.

Timekeeping Systems - Regulatory Requirements

This isn't exactly a re-post but it might seem like one because we have discussed timekeeping systems many times in this blog. Today we want to answer the question about where, in FAR (Federal Acquisition Regulations), is there a definition of what constitutes an "adequate" timekeeping system for Government contracting purposes.

Well, the short answer is there isn't a definition in FAR. The criteria for what constitutes an adequate timekeeping system has been subordinated to DCAA (Defense Contract Audit Agency). FAR provides kind a generic requirement in FAR 31.201-2(d):

A contractor is responsible for accounting for costs appropriately and for maintaining records, including supporting documentation, adequate to demonstrate that costs claimed have been incurred, are allocable to the contract, and comply with applicable cost principles."

The Standard Form (SF) 1408, Preaward Survey of Prospective Contractor - Accounting System, used by the Government to assess the adequacy of a contractor's accounting system, provides a little more specificity on what constitutes an adequate timekeeping system:

Does the accounting system provide for a timekeeping system that identifies employees' labor by intermediate or final cost objective?

Still, not too helpful. So, we have to turn to the DCAA Contract Audit Manual (CAM) for the most detailed definition of an adequate timekeeping system. There are standards for manual timekeeping systems and automated timekeeping systems. The automated system is the only way to go, in our opinion. There are so many cost-effective and DCAA compliant systems on the market today that no contractor should be on a manual system. The DCAA standards for automated systems include

• Only the employee uses their labor charging instrument to access the labor system. 
• Employee records his/her time at least once a day.
• Employee and supervisor electronically sign certifying accuracy
• Employee badge issuance is sufficiently controlled so that no number is duplicated and badges are not issued to unauthorized persons. 
• Procedures are in place which require the employee to report lost badges promptly. 
• Changes are initialed, authorized, and dated by the employee and supervisor and include a description of the reason for the change. This may be done electronically. 
• A verifiable audit trail process is in place that collects all initial entries and subsequent 

There are more but these are the main criteria. Since these are not "regulatory" requirements, there is some flexibility on the part of contractors to convince the Government that their particular system can ensure the propriety of labor charges to Government contracts.

Contractor Employees Indicted for Timekeeping Fraud

In a case surely to grab a lot of people’s attention and become a case study in contractor and employee ethics, a Federal Grand Jury indicted 10 current or former upper managers and supervisors at Hanford’s nuclear clean-up site, accusing them of enabling timecard fraud (reported by the Tri-City Herald).

One Vice President was indicted on 34 counts, including conspiracy, submission of false claims, major fraud against the United States, wire fraud, violation of the anti-kickback act, and document alteration. A director of the contractor was indicted on 32 counts, a manager was indicted on 34 counts and two supervisors were indicted on 34 counts each. Five other “field” supervisors were indicted on 34 counts each (and also charged with claiming overtime pay for hours they did not work).

Earlier this month, the contractor, CH2M Hill paid $18.5 million back to the Government to settle civil and criminal allegations related to this particular timecard fraud. Now the Government is going after individuals.

In this case, overtime was voluntary but in order to get workers to volunteer for overtime, the contractor promised them eight hour shifts regardless of how long it took to perform the actual work. Additionally, timecard fraud occurred during regular shifts when it was noted that a “steady stream of workers” began leaving work at 2:30 p.m. for shifts that should have lasted until 4:30 p.m.

Typically in cases involving timekeeping irregularities, the contractor pays back some money and perhaps gets suspended or debarred for a short period from new Government contracts. In this case, contractor employees are going to find out firsthand the cost of playing loose with the rules and contravening internal controls.

Huge Timecard Fraud Settlement

Last week, the Department of Justice (DoJ) announced a settlement in which CH2M Hill Hanford Group (CHG) admitted to federal criminal violations by engaging in widespread timecard fraud over a ten year period. In order to resolve CHG's civil and criminal liability, CHG agreed to pay a total of $18.5 million, commit an additional $500 thousand towards accountability systems, consent to a corporate monitor, and to continue to actively cooperate with the ongoing fraud investigation. There are many fascinating aspects to this case.

First, the discovery of the fraud came from a whistleblower who himself, had engaged in the fraud (however, the whistleblower was not allowed to share in the recovery). The discovery did not come from any Governmental oversight even though the Government spent untold thousands of hours auditing CHG's contracts. The Defense Contract Audit Agency was on-site, so was the DoE Inspector General, and so were DoE's financial analysts. Makes one wonder whether the audit risks were properly identified.

Secondly, it seems like the employees were controlling the supervisors and managers. Employees were refusing to work overtime unless they were guaranteed eight hour shifts. As stated in the agreed statement of facts, the inability of CHG's upper management to secure the necessary overtime volunteers for various jobs threatened CHG's ability to complete various projects linked to performance incentives. This in turn threatened CHG's ability to earn certain fees, and therefore profits under the contract. The inability to obtain performance based incentives would have directly impacted the personal corporate bonuses of certain members of CHG's upper management. Consequently, these upper management folks as well as direct supervisors of the hourly workers and other supervisory personnel, accepted the practice of hourly workers only working until the particular overtime job was completed, leaving the project site but falsely claiming a full eight hours even when the job took less than eight hours.

One would think that under normal circumstances, employees' refusal to work overtime would be a cause for separation. But, Hanford workers have a very strong union. Every few years, DoE brings in a new contractor to oversee the nuclear clean-up effort but all the incumbent employees keep their jobs.

Thirdly, the DoJ press release makes no mention of any consequence for the fraud committed. No one was fired, no one went to jail, no one, except the corporation, paid a fine. There was not even the proverbial slap on the wrist. In fact, the press release stated that there was no discipline, formally or informally. What kind of message does that send?

As we've stated here many times, contractors must have strong ethics, core values, and codes of conduct. It begins at the top and must permeate the entire organization. It is pretty obvious from the DoJ press release that top management knew the fraud was ongoing but rather than stop it, allowed it to continue in order to pad their own pockets.

Work-at-Home (WAH) Programs

Many Government contractors have programs that allow employees to perform their work from home or from an alternative work site. There are advantages to such programs, reduced commuting time, less stress, and for the contractor, reduced overhead (assuming they can jettison some of their facilities). But with these WAH programs, comes a real need for internal controls to determine whether the program is effective. Government auditors are always concerned about potential abuse under WAH programs - many of them do it themselves and so, have first hand knowledge of potential risks, ineffective controls, and abuses.

Good internal controls over WAH programs should, at a minimum, address the following:

• Eligibility and Status - Adequate policies should include a description of the type of work that may be performed at home. For example, work that must be closely supervised, requires access to non-portable equipment or depends on the frequent interaction with others, cannot be performed at home. Policies should also include the status of employees working at home (e.g. full time, part-time, temporary, etc.) and the employees' eligibility for benefits such as insurance and leave.
• Approval policy, employee performance, work schedule and attendance. Contractor policies and procedures should require
• proper advance approval by appropriate management officials,
• continuing evaluation of the participating employee's performance in completing assigned tasks,
• written documentation of the specific tasks to be performed along with the expected completion dates
• that WAH employees attend periodic meetings at the contractor's work site to allow the employee and supervisor to discuss work progress, assign new tasks, and evaluate work performed, and
• that WAH employees work a mutually agreeable set of core hours to allow management to have access to the WAH employee at designated times.
• Timekeeping requirements - WAH employees hshould be required to submit timecards in accordance with the company-wide timekeeping system.

Contractors without the foregoing minimum controls will undoubtedly be cited for an accounting system deficiency with the potential for billing withholds.

Improving Compliance with Timekeeping Policies

Government contractors are required to maintain timekeeping systems that provide for the accurate and complete recording of direct labor hours as well as appropriate controls to ensure corrections to labor records are accurate and authorized. The DCAA Contract Audit Manual (Chapter 5, Section 9) lists a number of attributes that timekeeping systems must possess in order to meet those requirements. Among the attributes, whether you have a manual or automated timekeeping system, is a requirement that direct labor employees record their time no less often than daily. Elsewhere, the Manual states that employees should prepare their timecards as work is performed meaning that when they perform multiple tasks in a day, they record their hours multiple times in a day.

Most contractors can attest to the difficulty in getting their employees to regularly comply with these requirements. Contractors might have great timekeeping policies and procedures. They might regularly train employees and highlight the requirements during team meetings and periodic written communications. Many contractors perform their own compliance checks to see how well employees are following procedures. But in the end, it seems like every time the auditors show up to perform "floorchecks", some yahoo is sitting there with a timecard that hasn't been completed for the previous day or days. And then, you hope that the auditor doesn't find more instances of incomplete timecards so that you can argue that the failure was an isolated case rather than a systemic problem.

More and more companies are moving to automated timekeeping systems. With so many cost-effective, scalable, web-based offerings out there, even the smallest companies can afford to automate their timekeeping practices. Google "dcaa compliant timekeeping" and you'll find plenty to evaluate and choose from. There is a feature that is becoming increasingly popular among these web-based offerings that can help improve compliance rates. This feature scans the timekeeping databases during non-work hours and identifies employees that did not complete their timecards for that day. Then, the system automatically notifies the employee by email that it found an incomplete timecard. Most systems can be configured to also send the supervisor a copy of the same message. Then, the next time the employee checks his/her email, he/she is reminded to go on-line and complete the previous day's timecard.

This process is completely automated and has been shown to significantly improve compliance rates. If you are evaluating new timekeeping systems, don't commit to one that doesn't have this feature.

"DCAA Approved" Timekeeping Systems

We read about them, we hear about them, we see the advertising and press releases, many we've seen in practice and we're frequently asked advice about them. We saw another new one advertised just last week. What are we talking about? We're talking about vendors who are promoting "DCAA approved timekeeping systems" or DCAA compliant timekeeping systems. There are at least a couple dozen competing products out there, probably many more. One thing they all have in common however, is that none of them have been "approved" by DCAA (Defense Contract Audit Agency). DCAA does not "approve" commercial timekeeping software/systems. (The same goes for  commercial accounting software). DCAA is a Federal Government audit organization and follows strict guidelines (i.e.Generally Accepted Government Auditing Standards) for maintaining their independence in fact as well as appearance. The Agency does not endorse products.

So what's going on here? What are all these claims touting DCAA's approval? At best, these electronic or web-based timekeeping systems have been bought, installed, and used at one or more Government contractors who, after an audit by DCAA of their timekeeping system, received an audit opinion that their timekeeping system was "adequate" (By the way, "adequate" is as good as it gets when it comes to audit opinions. There is no higher rating than that). So these vendors can claim that since no deficiencies were found during the audit, their systems must be good enough for Government work. Or perhaps vendors compared the features of their product to DCAA audit guidance (see DCAA Contract Audit Manual 5-909.2) on what to look for in an electronic timekeeping system and were able to self-assess the sufficiency of their product.

In reality, the software used to collect employee hours is only part of a timekeeping system - usually the simplest part. Most of these electronic timekeeping systems are very similar in the way they work. They are very simple databases with a user interface. The employee logs on with a user ID and password and enters his/her time for the day. Later, supervisors review and approve the employees' electronic timesheets. Then the hours are tallied according to the needs of the organization (usually by project, work order, task, etc). Most of these products include an audit trail so that one can determine who made entries and whether any changes were made and by who and for what reason.

But, as we stated, the software component is only one part of the timekeeping system. The most significant part of the system and the most difficult to implement is the policies, procedures, and practices and the internal controls. Perhaps the most difficult aspect of all is getting employees to record their hours on a timely basis (daily, according to DCAA). This requires policies, procedures, training, compliance reviews, and reporting. It probably necessitates some form of disciplinary action when employees do not comply (e.g. progressive from oral reprimand all the way to removal). It requires a genuine commitment from management who must set the "tone at the top".

We know of contractors who have implemented these so-called DCAA approved software products yet have failed audits of their timekeeping systems, not because of the software but because the implementation was not adequate or was adequate but compliance was not sufficient. Do not be misled by the claims of software publishers. Do not become complacent in thinking that your timekeeping systems is fine just because you have purchased or licensed a product that claims to be "audit proof".

The Importance of Accurate Timekeeping

We are going to take a break from our series on defective pricing but we will get back to that subject next week. There are a few other important points we need to cover. Today though, we want to use a recent press release from the Department of Justice to illustrate the importance of strong internal controls over timekeeping and labor charging practices. Unfortunately, the press release is bereft of details and our calls to DOJ's press line for more information have not yet been returned. Nevertheless, the information that has been published is certainly worth reporting.

On Tuesday of this week, a woman, working on a cost-reimbursable subcontract under a cost-reimbursable prime contract with the National Security Agency, pleaded guilty to making false statements arising from the number of hours she claimed she claimed she worked. She falsely claimed she worked 752 hours during a two-year period and as a result, was overpaid by $81,859 (that would work out to almost $109 per hour, an amount that seems rather high for delivering documents. Perhaps the $82 thousand included fringe benefits, overhead, and profit).

NSA contracted with The Titan Corporation to obtain document delivery services. Titan in turn contracted with Dragon Development Company to work on the services contract. Dragon was acquired by CACI International, Inc. In November 2007 and CACI assumed responsibility for the performance of the services contract.

The employee worked full time for Dragon and CACI, exclusively on the services contract. From approximately January 30, 2006 to December 28, 2007, Mitchell submitted timesheets to Dragon and CACI falsely claiming that she had worked 752 hours more than she had actually worked on the Services Contract. Mitchell represented in some of the timesheets that on 24 days she worked an average of eight hours, when in fact, she did not work at all on those days.

As Titan invoiced NSA for the hours that Mitchell falsely claimed to have worked on the services contract, NSA paid Dragon and CACI for those hours. The overpayment for Mitchell’s unworked hours was approximately $81,859.

We don't know how this fraud was uncovered. The fact that the subcontractor was not implicated in the matter suggests to us that the subcontractor uncovered the fraud and reported it to the Government (e.g. the Inspector General's office). But it could have been from a number of sources including a whistle-blower or a hotline tip.

Internal controls are important and internal controls over timekeeping are absolutely critical in order to ensure the propriety of labor costs charged to Government contracts. Companies with dispersed workforces are especially vulnerable to this kind of fraud. Companies place a good deal of trust in employees working at alternate worksites (including working at home). Companies with lax management control and oversight are equally at risk. Contractors should be assessing their risks and vulnerabilities in this area and decide whether the existing controls are satisfactory for protecting the company's interests as well as the Government's interests. Once those controls are in place, it is also necessary to test through internal reviews whether those controls are working as designed.