I recently delivered a presentation at the National Contract Management Association (NCMA) World Congress on the July 15, 2014 DoD proposed changes to DFARS business system Rules (DFARS Case 2012-042) for contractor accounting systems, estimating systems, and material management and accounting systems (MMAS). A public hearing on the proposed changes is scheduled for August 18, 2014 and comments are to be submitted on or before September 15, 2014. As noted in previous blogs, the new rules do not apply to small businesses or to other DFARS defined business systems (purchasing, EVMS, Government property).
Major requirements of the proposed rule changes include:
- An annual contractor reporting requirement on the contractor’s self-assessment of its compliance with the DFARS business system criteria for each of the three systems and the status of any significant deficiencies and corrective action plan, if applicable;
- A triennial audit conducted, in accordance with Generally Accepted Government Auditing Standards, by an independent CPA examining the contractor’s compliance with the system criteria as of the end of the most recent fiscal year;
- Government auditor (presumably DCAA) review of the independent CPA’s audit strategy, risk assessment, audit plan (program), and audit report;
- Government access to the working papers supporting the CPA audit reports and documentation supporting the Contractor's CPA’s independence, objectivity and qualifications; and
- Inadequate system determinations, including withholding penalties, for failure to comply with reporting or audit requirements.
Here at Redstone, we plan to submit comments on the proposed change and are preparing a comprehensive positon paper with our recommendations that we will be sharing with you at a later date. However, I wanted to share some of the more significant questions/concerns expressed by participants (primarily defense contractor representatives) during the NCMA presentation as follows:
Timing
Questions were raised regarding the timing of the final rule and when contractors would be required to comply. The proposed rule requires the contractor to report on its self-assessment within 6 months of the end of its fiscal year, and requires an independent audit by a CPA in the first year. It is not clear whether the independent CPA review results must be included in the first annual report and there was significant concern as to whether a CPA firm would be able to perform the audit, particularly with the requirement for government audit of the CPA’s audit strategy, risk assessment, and audit program, within the required timeframe. In addition, the wide range, historically, in the between issuance of a proposed rule and the final rule makes it difficult to predict when the change is likely to go into effect for planning purposes.
DCAA Review
A significant number of concerns were raised regarding the requirement for government auditor oversight of the independent CPA audit. Participants were concerned that this requirement simply added an additional layer of oversight to the process that would result in increased costs with no real value added. Participants indicated that similar Sarbanes Oxley requirements for independent CPA audit did not require an additional layer of government oversight and seemed to be working and did not understand why an additional layer of oversight was necessary in this case. There were also concerns regarding the expectations for an acceptable independent CPA audit. The proposed rule only specifies a GAGAS audit. The question is how DCAA will determine compliance and whether DCAA would restrict the independent CPA to use of DCAA standard audit programs and risk assessment documentation in order to be considered to be in compliance with GAGAS. There were also concerns, given DCAAs record, about whether DCAA would be able to timely complete the reviews and whether DCAA was qualified to determine GAGAS compliance. There was also a question as to whether a government auditor review of the independent CPA audit effort was optional as reported in some other blogs and publications. The current language in the proposed rule is that the contracting officer “shall” request review by a government auditor. Based on this language the requirement for government review appears to be mandatory.
Independent CPAs
There were also a significant number of concerns raised with respect to the requirement to hire an independent CPA to conduct audits the business systems. There is a question as to what criteria the contractor is expected to use when selecting an independent CPA. There were also significant concerns raised as to the availability of CPA’s that are qualified to conduct the business system audits. Concerns were expressed that the CPAs that conducted their financial statement audits did not have the government contracting expertise to perform the audits, particularly with respect to estimating systems and MMAS systems where few CPAs had experience. Participants were also concerned that the government oversight requirements and requirement to make working papers and other audit documentation available to the government auditor would result in many CPA firms either declining to perform the engagement or charging a significant premium to perform the engagement. There were also concerns regarding how disagreements between the independent CPA and Government auditor would be handled.
Cost
Significant concern was expressed that the proposed rule change was going to add significant additional costs to both the Government and the contractor. Concerns were raised as to whether the Government would modify current contracts to provide for recovery of the significant cost of the independent CPA audits or if the contractor would be required to go through and expensive equitable adjustment claim process to recover the costs. There was also concern raised as to whether, in the event of a deficiency, the contractor would also be required to obtain an independent CPA review the corrective action to verify the deficiency had been corrected.
I agree with participants that the issues identified above need to be addressed prior to issuance of a final rule. That said, I also believe, with modification, the proposed rule change can be a significant improvement to the current system. The current process is clearly not working and DCAA is never going to be able to timely complete business system audits. Providing for independent CPA’s to perform business system audits can greatly increase both the timeliness and effectiveness of business system audits. However, I strongly disagree with the requirement to have the government auditor (DCAA) review the independent CPA.
The whole point of the proposed rule change is to provide for contractor accountability and improve the efficiency and effectiveness of auditing contractor business systems. Adding an additional layer of oversight for DCAA to second guess the independent CPA simply adds cost and does not improve either contractor accountability or the efficiency and effectiveness of the audit. DCAA was unable to timely compete business system audits and are also unlikely to be able to timely complete reviews of the independent CPA’s audit strategy, risk assessment, audit plan (program), and audit report. In fact, DCAA’s attempt to control the scope of the independent CPA’s examination could impair the CPA’s independence in direct violation of GAGAS requirements. DCAA needs to let the contractors and CPAs do their job without unnecessary interference and stop trying to manage the contractors’ business. In many ways, the independent CPAs are much more qualified to assess internal controls than DCAA. DCAA should only be involved when there is evidence that significant errors or noncompliances are actually occurring (not could possibly occur) that indicate there is high risk the business system is not working.
I agree that the majority of independent CPA’s do not have the government contracting experience necessary to properly conduct business system reviews in accordance with GAGAS requirements. However, I believe there are resources available for them to obtain the expert advice and assistance they will need to comply with GAGAS requirements.
We have unparalleled expertise in government contracting at Redstone GCI, including over 160 years of combined senior level DCAA experience. We have the knowledge, experience, and tools needed to assist independent CPAs with accounting, estimating, and MMAS system audits to ensure compliance with GAGAS requirements. We can also help contractors ensure systems fully comply with DFARS business system rules in order to avoid problems in the audit and mitigate the risk of withholding. We can also help contractors map their policies and procedures to the various business system rules and develop documentation to ensure the audit can be conducted as smoothly and efficiently as possible in order to minimize the costs of the audit.
