On September 30, 2016, DCAA issued the following MRD (Memorandum for Regional Directors): Update – Audit Guidance on the Impact of the National Defense Authorization Act on DCAA’s Audit Support to Non-Defense Agencies. For the record, there isn’t anything captioned “the” National Defense Authorization Act; in this case, it happened to be referring to the 2016 Act, which was presumably “the” Act (to DCAA) because it included Section 893, which prohibits DCAA from providing audit support to non-defense agencies.
The MRD proudly stated that DCAA would begin to provide full audit support for non-Defense Agencies because it had successfully reduced its incurred cost backlog to less than an 18-month inventory. A second “for the record”, DCAA’s ability to provide full audit support to non-Defense Agencies is not a unilateral action; it requires a bilateral agreement, wherein a non-Defense Agency agrees to provide reimbursable funds for purposes of DCAA’s “full audit support”. Some non-Defense Agencies may have found alternative solutions to DCAA.
Regarding DCAA’s novel solutions to reducing the incurred cost backlog, the most widely known involves DCAA’s low-risk universe, dating back to Fiscal Year 2012, and updated in Fiscal Year 2013. The low risk policy, apparently reviewed and approved by DPAP (Defense Procurement Acquisition Policy), permits DCAA to close low-risk contractor indirect cost rate proposals (ICPs) without audit (i.e. acceptance of the rates as submitted and certified). The success of that policy is self-evident in DCAA’s Annual Report to Congress, which lists the number of incurred cost years (submissions or ICPs) that were dispositioned and the number of those dispositioned with an audit report. Starting 2012, the number of ICPs dispositioned significantly exceeds the number of reports; the difference represents the approximate number of ICPs dispositioned without audit (a small number of reports are related to multi-year audits; thus in a few cases, multiple ICPs dispositioned with one audit report). At any rate, the high-water mark for ICPs dispositioned without audit (low-risk) was 2014 when 11,101 ICPs were dispositioned with only 1,925 audit reports (as many as 9,000 were low-risk). The moral to this story is that years of inefficient audits can be eliminated (sort of) by simply writing-off thousands of audits and billions of dollars.
Another, more subtle, approach has been DCAA’s definition of an 18-month inventory. Most accountants would automatically think in terms of inventory value; in this case that an individual ICP is valued based upon its auditable dollars and that an 18-month inventory would be appropriately weighted. Not so with DCAA, which counts each ICP as “one” regardless of the auditable dollars. It doesn’t take a rocket scientist (or a highly competent auditor) to recognize that one can audit low dollar ICPs much faster than high dollar ICPs. The only problem is that the residual inventory (“backlog”) is disproportionately “top heavy”. Give DCAA credit for using the definition which best suits their objective, even though it isn’t the measure accountants would otherwise use for inventory valuation.
The most recent approach has been the proliferation of ICPs selected for audit, yet deemed by DCAA to be un-auditable. This leads to one of two options; an audit report with an audit disclaimer of opinion; or the far more expeditious solution of disengaging from the audit once the auditor uncovers one or two examples of inadequate documentation. Disengaging from the audit (aka ‘walking away from an unauditable ICP”) is absolutely the swiftest and novel way to continue to reduce the ICP backlog. Any marginally competent auditor can uncover a transaction whose documentation is not up to DCAA’s subjective (and non-regulatory) standard for adequacy. A recent example is time sheet corrections for which the employee did not re-sign the corrected time sheet. Not only is this DCAA requirement miles beyond anything explicitly required by FAR, it summarily ignores auditing standards which dictate that the auditor consider all relevant documentation and where necessary, obtain corroborating information through inquiry. Apparently DCAA continues to view auditing standards as discretionary; using those that fit the predetermined objective and while applying professional judgment to avoid using those which would unnecessarily delay the audit by obtaining the “rest of the story”.
As DCAA continues to march towards a single objective of reducing its ICP backlog, its most successful strategies are nothing more than avoiding auditing whenever possible, while making sure that attempted (but failed) audits are superficially attributed to the failings of contractors. There are some contractors and some ICPs, which might be difficult to audit, but that does not make them un-auditable; it only makes them difficult and more time consuming to do so. In the end, DCAA is transferring its failure to timely audit to contracting officers who will be left with audit disclaimers, which is the equivalent of giving a contracting officer nothing more than a parting “Good Luck” by dispositioning an ICP which was just too darn hard to audit.