Redstone Government Consulting Blog | DCAA Audit Support (20)

DCAA’s Inevitable Link with an Inadequate Accounting System

There is no specific regulatory authority that can be cited which requires work authorizations as a part of a contractor’s Labor/Timekeeping System. This argument, although accurate, is not the rationale which will be used by a DCAA auditor when “disclosing” deficiencies in a contractor’s labor system during a routine labor floor check. The auditor will ultimately render an opinion of inadequacy with respect to the accounting system citing DFARS 252.242-7006(c)(1), which states “The contractor’s system will provide for a sound internal control environment, accounting framework, and organizational structure”. You may and, probably will, ask where is there a mention of work authorizations anywhere in DFARS 252.242-7006 Accounting System Administration? The short answer; there isn’t. The DCAA answer, and the only one it thinks matters, is that the regulation it cites does not have to specifically address work authorizations but a link can be inferred within the highly general requirement for a “sound internal control environment”.

“A sound internal control environment, accounting framework, and organizational structure” is criteria number one in DFARS 252.242-7006 Accounting Systems. In fact, all six of the business systems identified in DFARS 252.242-7005 Contractor Business Systems, or commonly known as the “DFARS Business Systems Rule”, references adequate internal controls and the reliability of data. Even more far-reaching than DFARS is that FAR, adhered to by most, if not all US Federal Government agencies, requires adequate contractor internal controls over financial data relied upon for acquisitions. For the purposes of this blog, we shall focus primarily on the DFARS Business Systems Rule as it applies to defense contractors because of the activities of DCAA.

Although FAR 42.202(e)(2) states that prime contractors are responsible for managing subcontracts, DCAA has launched or relaunched a strategy which presumes that prime contractors are responsible for “auditing” subcontractors.   Unfortunately, DCMA seems to have embraced this concept with respect to closing out cost-type subcontracts. Specifically DCMA Instruction 135, section 3.2.3.2 states that prime contractors are responsible for auditing subcontracts and closing subcontract using procedures similar to those used by the government.

2016 NDAA (National Defense Authorization Act)

As reported in our December 3, 2015 blog,2016 Defense Authorization Act Section 893, the 2016 National Defense Authorization Act (NDAA) includes a requirement, ostensibly for improved DCAA auditing, but more narrowly focused on the so-called incurred cost audit backlog (contractor indirect cost rate proposals (ICPs), submitted annually as required by FAR 52.216-7(d)).   Section 893 prohibits DCAA from providing “audit support” for non-defense agencies (e.g. NASA) unless DOD certifies that DCAA is current on the ICP backlog.  “Current” is defined as 18 months of incurred cost inventory, further defined as “the level of contractor incurred cost proposals in inventory from prior years that are currently being audited by DCAA”. 

DCAA has recently released a new version of the ICE Model, which is the electronic version of the “Model Incurred Cost Proposal” that provides contractors with a standard ICE submission for preparing adequate incurred cost proposals in accordance with FAR 52.216-7, “Allowable Cost and Payment.”  This version 2.0.1e released in December 2015, may be downloaded from DCAA website.  There were no computational changes to the newly released version, however, additional information will be required for Schedule J.  Schedule J provides DCAA with the Subcontract Information such as contact information, subcontract value, period of performance, costs incurred for each subcontractor, and award type.  In the 2.0.1e version, additional information such as prime contract value and subcontractor’s duns number has been added to the required information for this schedule.  This is the second version of the ICE Model released this year.  ICE Version 2.0.1d released in August 2015, had no computational or functional changes to the previous Version 2.0.1c (June 2012).

Requirement for Improved Auditing of Contracts

In late November, President Obama signed the 2016 NDAA (National Defense Authorization Act, S.1356)) which includes a number of sections related to Acquisition Policy or Acquisition Management.  Of particular note for those subject to DCAA contract audits, a requirement for improved auditing which is focused on the so-called incurred cost audit backlog (contractor indirect cost rate proposals (ICPs), submitted annually as required by FAR 52.216-7(d)).   Section 893 prohibits DCAA from performing any audits for non-defense agencies (e.g. NASA) unless DOD certifies that DCAA is current on the ICP backlog.  “Current” is defined as 18 months of incurred cost inventory, further defined as “the level of contractor incurred cost proposals in inventory from prior years that are currently being audited by DCAA”.  As a point of clarification, the inventory should include ICPs currently being audited or those in the queue awaiting audit.  Based upon DCAA’s 2014 report to Congress, DCAA had approximately 18,185 ICPs valued at $822 billion (on hand as of 9/30/2014).  Based upon May 2015 public comments made by DCAA’s Deputy Director, the annual inventory is approximately 7,500 ICPs which would implicate an approximate annual value of $339 billion.

DFARS 252.242-7006(c)(8) specifically requires management reviews or internal audits of the system to ensure compliance with the contractor’s established policies, procedures.

One of the first things a DCAA auditor looks at when auditing a contractor’s accounting system is its policies and procedures. Policies and procedures represent control activities that are essential for an adequate system of internal controls. Good policies and procedures help ensure consistent operations in accordance with management objectives. DCAA cites policy and procedure inadequacies or the failure to comply with policies and procedures in virtually every deficiency report it issues related to internal controls.

The Foreign Corrupt Practices Act prohibits payments made directly or through intermediaries to foreign government officials to assist in obtaining business, retaining business, or directing business to any person.

The Foreign Corrupt Practices Act (FCPA) continues to be a high priority of enforcement for the Securities Exchange Commission (SEC) and the Department of Justice (DOJ). The U.S. Government’s aggressive approach to transactional bribery of foreign government officials will be anything but relaxed as companies and business people can expect a continued prioritization of FCPA cases. The DOJ has added more prosecutors and more resources than ever before. Additionally, U.S. regulators have stated that penalty amounts are not going down.

DCAA has had MMAS (Material Management and Accounting System) audit cognizance or review responsibility for DOD contractors since the advent of the DFARS Business Systems Rule in 2012. DCAA’s scope of audit is to determine if a contractor’s MMAS complies with the ten criteria or standards set forth in DFARS 252.242.7004.

A common misconception occurs when the term “DCAA-compliant accounting system” is used to describe a particular brand of accounting software. Sure, some accounting software systems and its components are designed specifically to address compliance with government regulatory requirements. But just because you buy it and use it does not mean you automatically have a compliant accounting system. There are several requirements of the accounting system and its environment that must be in place to ensure DCAA compliance, and there are a multitude of ways to meet these requirements without a significant investment in the purchase, implementation, training, and maintenance of a really expensive accounting system. Small businesses looking forward to bidding on prime, cost-type contracts must maintain DCAA compliance while also being as cost effective as possible to keep indirect rates at a competitive level. There are many options to choose from, and business owners must determine the best fit for their company. Be sure to consider all of the options: