Redstone Government Consulting Blog | DCAA Audit Support (19)

Requirement for Improved Auditing of Contracts

In late November, President Obama signed the 2016 NDAA (National Defense Authorization Act, S.1356)) which includes a number of sections related to Acquisition Policy or Acquisition Management.  Of particular note for those subject to DCAA contract audits, a requirement for improved auditing which is focused on the so-called incurred cost audit backlog (contractor indirect cost rate proposals (ICPs), submitted annually as required by FAR 52.216-7(d)).   Section 893 prohibits DCAA from performing any audits for non-defense agencies (e.g. NASA) unless DOD certifies that DCAA is current on the ICP backlog.  “Current” is defined as 18 months of incurred cost inventory, further defined as “the level of contractor incurred cost proposals in inventory from prior years that are currently being audited by DCAA”.  As a point of clarification, the inventory should include ICPs currently being audited or those in the queue awaiting audit.  Based upon DCAA’s 2014 report to Congress, DCAA had approximately 18,185 ICPs valued at $822 billion (on hand as of 9/30/2014).  Based upon May 2015 public comments made by DCAA’s Deputy Director, the annual inventory is approximately 7,500 ICPs which would implicate an approximate annual value of $339 billion.

DFARS 252.242-7006(c)(8) specifically requires management reviews or internal audits of the system to ensure compliance with the contractor’s established policies, procedures.

One of the first things a DCAA auditor looks at when auditing a contractor’s accounting system is its policies and procedures. Policies and procedures represent control activities that are essential for an adequate system of internal controls. Good policies and procedures help ensure consistent operations in accordance with management objectives. DCAA cites policy and procedure inadequacies or the failure to comply with policies and procedures in virtually every deficiency report it issues related to internal controls.

The Foreign Corrupt Practices Act prohibits payments made directly or through intermediaries to foreign government officials to assist in obtaining business, retaining business, or directing business to any person.

The Foreign Corrupt Practices Act (FCPA) continues to be a high priority of enforcement for the Securities Exchange Commission (SEC) and the Department of Justice (DOJ). The U.S. Government’s aggressive approach to transactional bribery of foreign government officials will be anything but relaxed as companies and business people can expect a continued prioritization of FCPA cases. The DOJ has added more prosecutors and more resources than ever before. Additionally, U.S. regulators have stated that penalty amounts are not going down.

DCAA has had MMAS (Material Management and Accounting System) audit cognizance or review responsibility for DOD contractors since the advent of the DFARS Business Systems Rule in 2012. DCAA’s scope of audit is to determine if a contractor’s MMAS complies with the ten criteria or standards set forth in DFARS 252.242.7004.

A common misconception occurs when the term “DCAA-compliant accounting system” is used to describe a particular brand of accounting software. Sure, some accounting software systems and its components are designed specifically to address compliance with government regulatory requirements. But just because you buy it and use it does not mean you automatically have a compliant accounting system. There are several requirements of the accounting system and its environment that must be in place to ensure DCAA compliance, and there are a multitude of ways to meet these requirements without a significant investment in the purchase, implementation, training, and maintenance of a really expensive accounting system. Small businesses looking forward to bidding on prime, cost-type contracts must maintain DCAA compliance while also being as cost effective as possible to keep indirect rates at a competitive level. There are many options to choose from, and business owners must determine the best fit for their company. Be sure to consider all of the options:

In 2014 DCAA quietly rolled out its new audit report format which generated some obvious questions:

In more than a few instances, government contractors receive a DCAA inquiry which is not directly related to any particular audit. In many cases, the request involves a Contractor Survey (or a Contractor Internal Control Questionnaire) which is requested annually to facilitate DCAA’s audit planning (at least for the moment given DCAA’s propensity to routinely change audit priorities).   For repetitive annual requests which are essentially the same set of questions received every October as DCAA begins its new fiscal year, the tendency is to complete the questionnaire without asking DCAA to explain what contractual clause requires this action (don’t ask, there is none).

The judgments rendered by the ASBCA in the Raytheon Co., Space & Airborne Sys, ASBCA Nos. 57801, 57803, 58068 resulted in the resolution of a number of issues concerning CAS (Cost Accounting Standards) cost impacts associated with unilateral changes in a contractor’s cost accounting practices. There were five basic issues; the Government prevailed on three, the contractor prevailed on one, and one was undecided (to be decided in the actual trial given that the current decisions were in reference to the parties’ cross-motions for summary judgment).

Estimating System Deficiencies

In its recent report (DODIG 2015-139), the DOD-IG (Inspector General) found that DCMA Contracting Officers failed to comply with DFARS timing requirements related to contractor business systems (DFARS 215,407-5-70 and DFARS 252.242-7005. In this case, the IG evaluated actions (or more accurately inactions) on 18 DCAA audit reports related to contractor estimating systems which are subject to the criteria in DFARS 252.215-7002. The DFARS Business Systems rule includes no time frames concerning government audits of contractor systems; however, once a government audit report is (finally) issued, DFARS has the following time-requirements (“requirements” used loosely because due dates applicable to the government are routinely ignored as evidenced in the IG report):

In its report dated March 25, 2015, DCAA issued its fourth Annual Report to Congress including a number of self-accolades for numerous accomplishments in spite of a huge disconnect between DCAA’s audits and its statutorily required audits.  DCAA provides an overview wherein it reports that its “cost-effective” approach examined $182.6 billion, issued 5,688 audit reports, identified $4.5 billion in savings with a 6.9 to 1 return on investment (ROI).   DCAA now represents that its ROI is based upon a “conservative approach” because the savings only include realized savings and not future potential savings if DCAA recommendations are implemented.   However, DCAA fails to mention that future potential savings will be reported when realized; hence, if in any given year DCAA did report future savings as well as realized savings, DCAA would be duplicating reported net savings (coincidentally an issue reported in a 2014 DOD-IG report because two different DCAA audit offices reporting the same net savings for the same audit exceptions).