When "Adequate" is the Best that You Can Be

The following is a slightly edited version of an article we published in our June 2007 Government Contracting Update newsletter. We discontinued the newsletter format in 2009 in favor of this blog.

Many times during our years as Government auditors, we would sit down with contractors at the conclusion of an audit of one or more of their internal control systems and proclaim that their system was “adequate”. 

“Adequate, only adequate?” they would ask. “We’ve done this and we’ve done that, we have great policies and procedures, we have superb internal controls, we test for compliance and we have other checks and balances. How can you say our system is only adequate?”

We would then explain that “adequate” was as good as it gets. Under Generally Accepted Government Auditing Standards (GAGAS), an internal control system is declared adequate when no significant deficiencies are found. The only other reporting option is that the system is "inadequate". 


An "inadequate" opinion arises whenever a significant deficiency or material weakness is disclosed by the audit. A significant deficiency is a control deficiency, or combination of deficiencies, that adversely affects the company's ability to initiate, authorize, record, process, or report Government contract costs in accordance with applicable Government contract laws and regulations, results in a reasonable possibility that unallowable costs will be charged to the Government, and the potential unallowable cost is not clearly immaterial. A material weakness is a significant deficiency, or combination of significant deficiencies that results in more than a remote likelihood that unallowable costs will be charged to the Government.


Sometimes audits disclose conditions that do not materially affect the adequacy of the system but if corrected, would enhance the system of internal controls. Until 2008, these would have been reported as “Suggestions to Improve the System” rather than deficiencies and would not have affected the overall audit opinion. In 2008, DCAA discontinued its practice of reporting "Suggestions to Improve the System" since such reporting was not required by GAGAS.


Some internal control audits are required by FAR (e.g. purchasing system and estimating system) while others are based on perceived risk to the Government (e.g. accounting system and labor system). Generally, contractors should not fear internal control audits. Fundamentally, the goals and objectives for both contractors and the Government are the same. Good internal controls are fundamental to good business practices and provide the government with some assurances that its procurement dollars are well spent.


The audit programs that DCAA and other governmental audit agencies use to assess the adequacy of contractor internal controls are available on DCAA’s website, 

"DCAA Approved" Timekeeping Systems

We read about them, we hear about them, we see the advertising and press releases, many we've seen in practice and we're frequently asked advice about them. We saw another new one advertised just last week. What are we talking about? We're talking about vendors who are promoting "DCAA approved timekeeping systems" or DCAA compliant timekeeping systems. There are at least a couple dozen competing products out there, probably many more. One thing they all have in common however, is that none of them have been "approved" by DCAA (Defense Contract Audit Agency). DCAA does not "approve" commercial timekeeping software/systems. (The same goes for  commercial accounting software). DCAA is a Federal Government audit organization and follows strict guidelines (i.e.Generally Accepted Government Auditing Standards) for maintaining their independence in fact as well as appearance. The Agency does not endorse products.

So what's going on here? What are all these claims touting DCAA's approval? At best, these electronic or web-based timekeeping systems have been bought, installed, and used at one or more Government contractors who, after an audit by DCAA of their timekeeping system, received an audit opinion that their timekeeping system was "adequate" (By the way, "adequate" is as good as it gets when it comes to audit opinions. There is no higher rating than that). So these vendors can claim that since no deficiencies were found during the audit, their systems must be good enough for Government work. Or perhaps vendors compared the features of their product to DCAA audit guidance (see DCAA Contract Audit Manual 5-909.2) on what to look for in an electronic timekeeping system and were able to self-assess the sufficiency of their product.

In reality, the software used to collect employee hours is only part of a timekeeping system - usually the simplest part. Most of these electronic timekeeping systems are very similar in the way they work. They are very simple databases with a user interface. The employee logs on with a user ID and password and enters his/her time for the day. Later, supervisors review and approve the employees' electronic timesheets. Then the hours are tallied according to the needs of the organization (usually by project, work order, task, etc). Most of these products include an audit trail so that one can determine who made entries and whether any changes were made and by who and for what reason.

But, as we stated, the software component is only one part of the timekeeping system. The most significant part of the system and the most difficult to implement is the policies, procedures, and practices and the internal controls. Perhaps the most difficult aspect of all is getting employees to record their hours on a timely basis (daily, according to DCAA). This requires policies, procedures, training, compliance reviews, and reporting. It probably necessitates some form of disciplinary action when employees do not comply (e.g. progressive from oral reprimand all the way to removal). It requires a genuine commitment from management who must set the "tone at the top".

We know of contractors who have implemented these so-called DCAA approved software products yet have failed audits of their timekeeping systems, not because of the software but because the implementation was not adequate or was adequate but compliance was not sufficient. Do not be misled by the claims of software publishers. Do not become complacent in thinking that your timekeeping systems is fine just because you have purchased or licensed a product that claims to be "audit proof".

"Fatally Flawed" Compensation Audit - Part 2

Yesterday, we reported on a recent ASBCA decision that calls into question the methodology used by the Government to assess the reasonableness of contractor compensation levels. The Government of course could appeal that decision. But in the meantime, we have a new methodology, accepted by the ASBCA, for determining "reasonable" compensation levels. The Board's methodology generally results in higher benchmark compensation level when compared to the Government's methodology, We recommend you use it. The methodology is somewhat technical and beyond the scope of this blog but if you are in a situation where your compensation levels are being reviewed and/or questioned, we recommend you seek out expert help in that field.

Compensation for each employee or job class of employees must be reasonable for the work performed. Compensation is reasonable if the aggregate of each measurable and allowable element sums to a reasonable total. In determining the reasonableness of total compensation, contractors must consider factors determined by the contracting officer (who has the ultimate responsibility for deciding whether compensation is reasonable) to be relevant. According to FAR 31.206.b.(2), this would usually entail a comparison with compensation practices of other firms of the same size, in the same industry, in the same geographic area, and engaged in similar non-Government work under comparable circumstances. Making such comparisons, indeed finding the raw data with which to make such comparisons is very difficult. Such work has often been called an "art" rather than science or analysis.

There are a few, benchmarking surveys on the market. Their cost however is often prohibitive for small contractors. Even though the Government relies on them to perform benchmarking studies, these surveys have limitations because its often difficult to find enough companies of the same size, industry, geographical area, doing commercial work under comparable circumstances to make meaningful comparisons. Also keep in mind that there is no FAR requirement for contractors to purchase these surveys, even though the Government often tries to push them into doing so.

"Fatally Flawed" Compensation Audit

In a decision likely to affect the methodology by which the Government assesses the reasonableness of contractor compensation levels in the future, the ASBCA (Armed Services Board of Contract Appeals) issued a decision last week stating that the methodology used by DCAA (Defense Contract Audit Agency) to assess the reasonableness of compensation was "fatally flawed statistically and therefore unreasonable". The methodology that DCAA used in this case followed the guidance in its Contract Audit Manual (Chapter 5) and the same one used in thousands of compensation reviews over the years. If you have ever had employee compensation questioned by the Government, you will want to read this decision.

In the present case, the contractor challenged DCAA's methodology for determining reasonable executive compensation based on four discrete arguments. The first argument contended that the Government's methodology was fatally flawed as a matter of basic statistical analysis. The Board found that the contractor's first argument was sufficient to prove its case so it did not need to address the contractor's other arguments.

The Government didn't help itself in this case either. In its decision, the Board wrote:

The government made no effort at the hearing or in its brief, to respond to the statistical arguments made by appellant and thus we are left with unrebutted evidence that the methodology used by DCAA was fatally flawed statistically and therefore unreasonable. Moreover, the government effort to support its own methodology was supplanted by an expert witness of questionable judgment. Consequently, we conclude that there are statistical flaws in the government methodology for determining reasonable compensation and that the computations performed by (the contractor's expert) to overcome those flaws are reasonable.

Order of Precedence - Contract Modifications

The Department of Defense is proposing to amend its FAR supplement (the DFARS) to establish an order for application of contract modifications to resolve any potential conflicts that may arise from multiple modifications with the same effective date. Although it does not happen frequently, there are enough cases involving contract modifications with conflicting contract provisions that have the same effective date, to make such a regulation desirable.

Currently there are no rules to describe in what order to apply modifications to determine the actual content of a resulting modified contract. In order to determine the sequence of modifications to a contract or order, a method for determining the order or application for modifications will resolve any conflict arising from multiple modifications with the same effective date.

Under the new regulations, modifications will be applied in the following order:

1. Modifications will be applied in order of the effective date on the modification.
2. In the event of two or more modifications with the same effective date, modifications will be applied in signature date order.
3. In the event or two or more modifications with the same effective date and the same signature date, procuring contracting office modifications (contract modifications beginning with the letter "P") will be applied in numeric order, followed by contract administration office modifications (contract modifications beginning the the letter "A") in numeric order.

Proposed Change to Definition of Cost or Pricing Data

DoD is moving to replace all references to "Cost or Pricing Data" to "Certified Cost or Pricing Data in its FAR Supplement (DFARS).  This is not a significant change to the procurement regulations but it should clear up some confusion by making it clear when cost or pricing data submitted in response to a Government solicitation must be certified. The change should also improve consistency between DFARS and FAR. FAR was amended several months ago to add the word "certified" to the definitions of Cost or Pricing Data.

Under existing regulations, contracting based on the submission of certified cost or pricing data is considered a last resort. If there is adequate price competition, if prices are set by law or regulations, or if acquiring commercial items, etc, contracting officers are precluded from requiring certified cost or pricing data. The contracting officer can however request "information other than cost or pricing data" necessary to make a determination that proposed prices are reasonable. Sometimes this "information other than cost or pricing data" is required to be submitted in a format and detail that looks just like regular cost or pricing data. And that's where the confusion set in. There was anecdotal evidence that contracting officers were requiring prospective contractors to certify the "information other than cost or pricing data.

By the way, the threshold for requiring certified cost or pricing data (FAR 15.403-4) remains at $700 thousand.