Internal Controls Over Approving and Issuing Company Credit Cards

How are your internal controls over the issuance of company credit cards? Does it rest with a single company employee or are there approvals required by someone higher up in the organization. We're reminded to consider these questions after learning of a scheme within the Drug Enforcement Agency (DEA) where an employee had too much power and authority over the approval and issuance of credit cards to DEA employees and abused it.

According to a plea agreement, the DEA employee was a program manager and responsible for the approval and issuance of government credit cards to DEA employees. She admitted that while serving in that position, she submitted dozens of fake credit card applications for fictitious DEA employees, using names and identifying information of individuals who did not work at the DEA. Through this scheme, she obtained at least 32 fraudulent credit cards which she then used to withdraw more than $113 thousand from ATMs. What was she thinking? The chances of getting caught is likely to be 100%. The common denominator of these credit card bills, the phony employees and the approval thereof points right back to the DEA employee.

The (former) employee will now serve two years in prison and must repay the $113 thousand. (Something tells us there was a lot more money involved than just what the Government happened to catch). You can read more about the case here.

This was not a very sophisticated fraud scheme but if the DEA had instituted even the most rudimentary internal controls, it should never have happened. How about verifying the application to a current listing of employees? How about verifying that the employee needed the card? How about a supervisor approving his/her subordinate's need for a card. Nothing fancy, just some common sense controls.

Government Sets Record for Service-Disabled Veteran-Owned Small Business Contracts

Late last week, the U.S. Small Business Administration announced the the Federal Government had met its goal for awarding federal dollars to Service-Disabled Veteran-Owned Small Businesses (SDVOSBs). Better yet, they announced that a record had been set - in fiscal year 2014, 3.68 percent of all federal contracting dollars went to SDVOSBs. That 3.68 percent works out to $13.5 billion.

The SBA has a number of programs to help SDVOSBs and VOSBs (Veteran-Owned Small Business). Most of the SBA's area offices have a PCR (Procurement Center Representative) to assist small businesses in obtaining federal contracts. The PCRs can help by initiating small business set-asides, reserving procurements for competition among small business firms, providing small business sources to Federal buying activities and most importantly for SDVOSBs, counseling services.

There are other SBA sources and services as well. A very good place to start is SBA's site for veterans, the Office of Veterans Business Development.  Also, for local hands-on help, there are Veteran Business Outreach Centers,

Regular readers of this blog will recall several fraud cases prosecuted recently where contractors obtained SDVOSB set-asides under false pretense. The SBA is beefing up its activities to validate the status of prospective contractors bidding and in some cases winning contracts reserved for SDVOSB companies. Usually the schemes involve finding a front company that would qualify for SDVOSB status. The front company usually secures a small commission for allowing a non-SDVOSB company to use its name.

Costs Related to Defending Against Employee Whistleblower Complaints

The Department of Defense made permanent an interim rule from 2013 regarding the allowability of legal costs incurred by contractors defending against employee whistleblowers.

Specifically, costs related to legal and other proceedings incurred by contractors in proceedings submitted by a contractor employee submitting a complaint under 10 USC 2409 (Whistleblowing) are unallowable if the result is an order to take corrective action, even if the proceeding does not involve an allegation of fraud or similar misconduct.

This rule represents a potentially significant liability for contractors. Sometimes contractors settle complaints without admitting guilt to minimize their financial exposure. It seems to us that contractors might resist settlements that require corrective action if they cannot recover their legal and other related costs.

On the other hand, this new regulation is good for whistleblowers. It encourages contractors to settle early as a means of minimizing legal costs that cannot be recovered.

You can read more about this new regulation and its genesis in the NDAA (National Defense Authorization Act) for 2013 by clicking here.

Former DCAA Director Hits the Revolving Door

One of our very first postings when we started this blog back in 2009 was to announce that DCAA had selected a new Director to replace the one that was dethroned after running afoul of Senator McCaskill. Patrick Fitzgerald with 30 years of Army Audit experience stepped in amid turbulence and ran the Agency for the next five years, retiring last Fall.

It was announced yesterday on Business Wire that Mr. Fitzgerald has joined the accounting and advisory firm of Baker Tilly Virchow Krause, LLP (Baker Tilly) in their specialized government contractor advisory services practice.

Meanwhile, the Director he deposed toils away as the COO (Chief Operating Officer) of DOE's Loan Programs Office.

Fitzgerald was succeeded by Ms. Anita Bales, who was previously DCAA's Deputy Director.

OPM Data Breach - Contractor Employees at Risk

The number of individuals affected by the Office of Personnel Management's (OPM) data breach continues to grow and grow. Initially, OPM estimated the breach affected 4.2 million Government workers. Since then, the estimate rose to 14 million people and yesterday, CNN reported the breach has reached 18 million people - current and former Government employees, applicants for Government jobs, and contractor personnel applications for security clearances.

Yesterday, the OPM Director Katherine Archuleta, testifying before Congress stated that no one at OPM was responsible for the breach. She blamed a Government contractor who performed background checks on people applying for security clearances of carelessly guarding the keys to data. She also blamed antiquated computer systems in OPM that are badly in need of upgrades. Don't know how far those excuses are going to get the Director - many in Congress are calling for her resignation.

The actual number of people affected by the data breach is undoubtedly much higher than any current estimate. The hacked database that stores information used for security clearances (e.g. the SF86 questionnaires) contains private information of family members and other associates for every Government official affected.

Government contractors need to be cognizant of the fact that they too are at risk. Not only do they have "cleared" employees but their ranks are full of former Government employees whose personal information has probably been compromised. One of the great fears expressed by various pundits expounding on the matter is the fact that Government workers and contract employees holding security clearances might be susceptible to blackmail if those purloined records contain any compromising information.

Contractors should consider what, if any, actions they need to take to mitigate possible adversities from having employees' information compromised.

Make Sure Your SAM Profile is Current, Complete, and Accurate

We've heard of companies - contractors and prospective contractors - who give short shrift to the accuracy of data submitted to SAM (System for Award Management). Everyone knows that you need to be SAM registered in order to be considered for award. SAM can be confusing and even intimidating for some. If you can somehow plow through the many layers of data, representations, and certifications and be presented with "completed", you might consider yourself a victor. The question is, did you get everything right? Did you enter the correct NAICS codes? How about socio-economic status? One might be tempted to think, made it through, close enough, good to go.

A recent Comptroller General (GAO) bid protest decision underscores the importance of making certain your information is accurate, current, and complete. Nationwide Value Computer (Nationwide) protested a Navy award to a competitor alleging that it had the lowest price and should have received the contract. The solicitation was a small-business set-aside acquisition.

The Navy, in evaluating the offers, consulted Nationwide's SAM profile and found that Nationwide had certified itself as a non-small-business. As a result, the Navy disqualified Nationwide from the procurement. Nationwide objected to the Navy's determination that it was not an eligible small business concern. Nationwide noted that its Dun and Bradstreet listing noted its small business status.

Since the record reflects that at the time the Navy checked SAM, Nationwide had affirmatively represented that it was not a small business, the GAO had not basis to conclude that the Navy acted unreasonably when it eliminated Nationwide from the competition on the basis that it was not a small business.

SAM will prompt administrators to update their profiles once per year. It may be advisable for companies to establish procedures to update their profiles more frequently.