Not only do you get to pay for the audit, you get pay for the CPA to support an audit of the audit!
On July, 2014, the DoD published its proposed changes to DFARS Business System Rules (DFARS Case 2012-042) for contractor Accounting Systems, Estimating systems, and Material Management and Accounting Systems (MMAS), the systems traditionally audited by DCAA. The proposed changes do not impact contractor Earned Value Management Systems, Purchasing Systems, or Property Management Systems. The contractors covered by the business rules did not change. Accordingly, the new rules primarily only apply to large CAS covered contractors and do not apply to small businesses. Comments on the proposed changes are to be submitted on or before September 15, 2014.
As discussed in my May 29, 2014 blog “New Proposed Business System Rules – Continuing to Shift the Burden to Contractors”, the proposed change is clearly being driven by DCAA’s inability to timely complete contractor business system audits. In that blog, I advised contractors to be prepared for the worst. Unfortunately, the worst has arrived!
Not only does the proposed rule, as expected, increase contractor costs by requiring the contractor to hire and pay an independent CPA to perform audits of business systems previously audited by DCAA, it also requires the contracting officer to have the government auditor (presumably DCAA) audit the independent CPA audit. For contractors, that means they also get to pay for the hours required for the CPA to support the DCAA audit of the audit. DCAA, who based on numerous General Accountability Office (GAO) and Inspector General (IG) reports, has been repeatedly unable to perform audits in compliance with generally accepted government auditing standards (GAGAS) themselves, is going to audit independent CPA audits for compliance with GAGAS.
Obviously, government contractors will have to pass these costs back to the taxpayer in the form of increased contract costs. If that is not enough, the government will then pay the IG and/or GAO to audit the DCAA audit of the CPA audit. I only point this out because the reason for the proposed change as published in the Federal Register is to “improve the efficiency and effectiveness of auditing contractor business systems…”
General Requirements
A short summary of the new requirements (for each applicable system) related to the proposed change are below:
- Annual reporting requirement. The Contractor shall provide to the Contracting Officer and Government auditor within the 6-month period following the expiration of the Contractor's fiscal year, and annually thereafter, a report regarding compliance with the system criteria signed by an individual of the Contractor’s organization at a level no lower than a vice president or chief financial officer of the reporting business segment. The report will include:
- A statement that the Contractor has evaluated the estimating system’s compliance with the system criteria;
- The Contractor’s assessment of the estimating system’s compliance with the system criteria, including a statement as to whether or not the system complies in all material respects, and disclosure of any significant deficiencies;
- The status of any significant deficiencies disclosed as part of the Contractor’s assessment or, if applicable, in the Contractor’s CPA audit report, including a corrective action plan with milestones and actions to eliminate any significant deficiencies that have not been corrected as of the date of the Contractor’s report.
- Triennial CPA audit requirement. In the first year and every three years thereafter, or more frequently if directed by the Contracting Officer, the Contractor’s annual report shall include an audit report on the Contractor’s CPA’s GAGAS compliant examination of the Contractor’s compliance with the system criteria as of the end of the most recent fiscal year.
- CPA requirements. The CPA(s) must meet specified independence and qualification requirements with active licenses in good standing and submit the firm’s most recent peer review report.
- Documentation requirements. The contractor must:
- Submit the Contractor’s CPA’s audit strategy, risk assessment, and audit plan (program), upon completion, for the audit;
- Submit information considered in selection of the CPA;
- Arrange for Government access to the working papers supporting the CPA audit reports and documentation supporting the Contractor's CPA’s independence, objectivity and qualifications.
The failure to comply with reporting or audit requirements is subject to the same withholding penalties as an inadequate system determination in the proposed rule change.
Challenges
- Finding a qualified Independent Certified Public Accountant – Finding a qualified CPA firm presents significant challenges. While there are thousands of CPA firms with the capability to conduct financial statement audits, relatively few have the government contracting experience needed to properly conduct the accounting system, estimating system, and MMAS audits for compliance with DFARS business system rules and in accordance with GAGAS. We have already seen significant negative effects at our clients that resulted from independent audits of incurred cost submissions performed by auditors who were clearly unfamiliar with government contracting and GAGAS. Conducting these audits is not simply a matter of having your financial statement auditors add a few additional compliance steps.
- DCAA Oversight – DCAA will presumably want to use the same standards; such as 60+ page risk assessments that did not actually assess risk, they applied in their failed business system audits to evaluate the acceptability of the CPA audits. If that is the case, you can expect numerous form over substance issues such as a continued emphasis on system procedures instead of practices, systems being considered deficient regardless of whether there is evidence that any actual errors occurred, and efforts to assist the contractor to correct deficiencies being considered an independence issue.
Interestingly, the DoD apparently wants contractors to believe the proposed change actually empowers them by “entrusting contractors with the capability to demonstrate compliance with the Defense Federal Acquisition Regulation Supplement (DFARS) system criteria for contractors’ accounting systems, estimating systems, and material management and accounting systems, based on contractors’ self-evaluations and audits by independent Certified Public Accountants (CPAs) of their choosing.” This of course is followed with “Government auditors will perform overviews of the results of contractor self-evaluations and CPA audits.”
At Redstone GCI, we have over 160 years of combined DCAA experience performing, teaching, and managing accounting, estimating, MMAS audits. We have the knowledge, experience, and tools needed to help you mitigate your risk and ensure your systems are fully compliant with DFARS business system rules. We frequently serve as subject matter experts to internal audit teams and external auditors in the conduct of financial and business systems audits related to compliance with U.S. Government procurement regulation.
