Redstone Government Consulting Blog | DCAA Audit Support (21)

The new DFARS business system rule requires audits by CPA’s, with DCAA approving the risk assessment and the audit program and reviewing the working papers afterwards.      

The obvious reason for this proposal is that DCAA is unable to perform the audits themselves.  At least not on a timely basis.  When DCAA was performing the audits, it was taking over 2 years to perform 1 system audit.  This rule requires it to be done within 6 months after the close of the contractor’s fiscal year.  In contrast, DCAA was not completing the risk assessment in that length of time.

So now let’s take CPA firms that are used to performing financial statement reviews in a timely manner and handcuff them to DCAA, an Agency that is notorious for missing due dates.

And THEN let that same Agency, in essence, audit the audit.  And furthermore, there are no provisions to limit DCAA to a reasonable time frame for approval of the risk assessment and audit program. 

Contractors who have analyzed the proposed rule released July 15, 2014, which places the responsibility on contractors to support the adequacy of certain business systems via utilization of Independent Public Accounting (IPA) CPA organization audits, have mixed reactions to the rules requirements: reactions ranging from total agony due to added and redundant audit oversight plus administrative strife in dealing with those redundancies, to a real opportunity to achieve some control over obtaining a reasonable and objective analysis of their systems the outcomes of which just might be completed timely. 

As published in the Federal Register on May 6, 2014 the Department of Defense has issued a final rule amending the DFARS to require certain qualifying contractors to adequately address the detection and avoidance of counterfeit electronic parts.  This was done to implement those sections of the NDAA for fiscal years 2012 and 2013 respectively dealing with the same subject and is effective May 6, 2014.

On April 21, 2014, the DAR editor submitted a proposed new DFARS rule (DFARS Case 2012-042) for Business Systems Compliance to OMB’s Office of Information and Regulatory Affairs (OIRA).  Generally, this is the last step prior to the publication of the new rules.  The full body of the proposed rule has not been published; however, OIRA has published the following abstract on May 23, 2014 as part of its semiannual compilation of all pending federal regulations:

Robert Eldridge and Michael Steen, Director and Senior Director of Redstone Government Consulting, have been selected to speak at the prestigious National Contract Management Association’s World Congress (NCMAWC). This annual training event for contract management, procurement and acquisition professionals is the largest training event of its kind and will be held at the Gaylord National Hotel and Convention Center in Washington D.C., from July 27-30.

In responding to contractor criticisms that DCAA has far too many criteria within their “adequacy checklists”, DCAA has now developed and is pilot testing a new adequacy checklist which involve the same criterion, but each criterion is individually weighted to yield a true risk and materiality based adequacy determination.   Additionally, in developing the weighted criterion, DCAA has implicitly acknowledged that contractor proposals do not have to be 100 percent adequate to be auditable.

Government contractors having undergone DCAA incurred cost proposal audits during this past year have learned several important trends and lessons, some of which will likely continue into 2014, and produce added administrative hardships for most contractors. Some initiatives undertaken by DCAA in conjunction with the DCMA may mitigate the level and duration of audit effort and hasten contract close-outs for some contractors.  For example, more contractors will most likely be subject to low-risk determination criteria and expand the number of companies who could escape those audits.  

On September 5th, DCMA issued a letter to the National Defense Industrial Association (NDIA) addressing industry concerns raised at a meeting with DCMA on April 25, 2013.  We will highlight some key points in the letter that will help contractors deal with DCAA’s assertions which often times are not supported by regulations. The letter reinforces that it is DCMA that determines if a contractor’s business system is compliant or not and if a Corrective Action Request (CARs) is necessary.

I recently watched an amazing video of an F-16 fighter jet being flown without pilots.  Watching this video helped me figure out what’s wrong with DCAA.  This fighter jet flew and worked properly without a pilot.  Unfortunately, DCAA HQ has been without pilots for quite some time but unlike the F-16 the audit agency can't do its job.