Post-award Accounting System audits exist somewhere in the gray area between (1) pre-award Accounting System surveys, (2) audits of Accounting System internal controls, and (3) reviews of the Accounting System as a contractor business system. Accordingly, it’s challenging to prepare for one, even if you have the DCAA’s audit program.

Everybody knows (or should know) that having DCAA determine that your Accounting System is adequate (or, perhaps more accurately, recommending to a contracting officer that your accounting system be determined to be adequate) is a critical step for a government contractor. Yet the subject is surprisingly complex. DCAA devotes an entire chapter in the Contract Audit Manual (CAM)—Chapter 5, “Audit of Policies, Procedures, and Internal Controls Relative to Accounting and Management Systems”—to the topic.

If you are a smaller contractor—a “non-major” in DCAA’s parlance—then you are probably not subject to the Contractor Business System administration and oversight regime defined by DFARS contract clause 252.242-7005. And even if you are a “major” contractor, you still may not be subject to the DFARS Contractor Business System administration and oversight regime, because it is only enforced on the largest contractors. (Why? Because neither DCAA nor DCMA have the resources to enforce the contract clause requirements on all contractors subject to the rule.) Therefore, if you are a “non-major” contractor, then you are likely to be subject either to a very light analysis of your Accounting System internal controls or else be subject to the post-award Accounting System survey.

When DCAA wants to evaluate the Accounting System internal controls at a “non-major” contractor it tends to do so via having the contractor fill-out a questionnaire. The CAM states (at 5-111)—

The process for obtaining an understanding of a contractor's internal controls and assessing control risk at most nonmajor contractors is accomplished by using the Survey of Contractor's Organization, Accounting System, and System of Internal Controls (ICQ) and the Internal Control Matrix, Control Environment and Overall Accounting Controls (ICM-ACTG) which are available on the DCAA Intranet and the APPS.

Obviously, the larger and more complex the contractor’s accounting system, the more rigor that DCAA will use in its evaluation of the ICQ. As the CAM states—

Smaller entities with active management involvement may not need extensive descriptions of accounting procedures, sophisticated accounting records, or written policies. Communications may be less formal and easier to achieve in a small or midsized company than in a larger enterprise due to the smaller organization’s size and fewer levels as well as management’s greater visibility and availability. However, when small or midsized entities are involved in complex transactions or are subject to the same legal and regulatory requirements as larger entities, more formal means of ensuring that internal control objectives are achieved may be necessary.

The CAM further states, “if the nonmajor contractor has one or more of the accounting and management systems listed in 5-102d that generate significant costs, the auditor can use the CAM guidance in Chapter 5, the audit program related to the system, and the related ICAPS with the ICQ to audit the internal controls.”

If the contractor has a contract that contains the DFARS contract clause 252.242-7006 (“Accounting System Administration”) but the 252.242-7005 Business Systems clause is missing (because either the contract or the contractor didn’t qualify for its inclusion), then DCAA will use the official post-award Accounting System audit program (link in the first paragraph). According to the CAM (at 5-203), the post-award audit should be initiated when a pre-award Accounting System survey was not performed or else it was performed but a follow-up review was recommended at that time. Either a contracting officer or a DCAA auditor can initiate the post-award audit.

According to the CAM—

The post award accounting system audit program includes comprehensive steps to gain a detailed understanding of the contractor’s accounting system (e.g., tracing costs billed to source documentation) sufficient to render an opinion on compliance with the DFARS 252.242-7006, Accounting System Administration, requirements. [But if] the procedures in the audit program are not sufficient to render an opinion on the key control activities and objectives that comprise an audit of internal controls. If the auditor determines that the nonmajor contractor's accounting system is so complex, it requires audit procedures contained in the audit program for a major contractor, the auditor should discontinue the audit under 17741 and use the Activity Code 11070, Accounting System Audit.

Again, we see that the nature of the contractor’s accounting system should determine the type and depth of audit. It’s interesting to see that a contractor with a complex enough accounting system can actually be subject to the full-scope Accounting System Review audit program, even if it is a non-major contractor that (presumably) would not normally be subject to that level of scrutiny. Obviously, if the audit results in adverse findings and a recommendation to the contracting officer that the Accounting System not be found to be adequate, there would be no mandatory payment withholds (as would be the case with a large contractor subject to the requirements of the 252.242-7005 clause). That said, we would expect a contractor—of any size—that received such an adverse audit report to make it a high priority to immediately initiate corrective actions to address the audit findings.

Thus, if you think your accounting system is so complex that DCAA may use its formal audit program, then you would be well-advised to go find that audit program and prepare for it.

Only you won’t find it on the DCAA website.

It’s missing.

DCAA is currently preparing a new revision of that Accounting System Review audit program, and you can’t see it until it’s officially published on the DCAA website. In the meantime, any older audit programs have been removed.

Readers may recall that the Accounting System Review audit program was one of the first significant audit programs revised after (1) GAO and DODOIG criticism of DCAA audit quality, and (2) implementation of the 2011 DFARS Contractor Business System administration and oversight regime. Then-Director Fitzgerald discussed it at the time, and pointed to it as one of his most important accomplishments. Indeed, in accordance with its importance, a few of the largest defense contractors were chosen to “pilot” the new audit program to make sure it was effective. (Readers may not be aware that the results of that pilot program were … mixed. In hindsight, the fact that it took DCAA auditors literally years to issue the resulting audit reports presaged the agency’s current challenges with audit timeliness and auditor productivity.) It was a Big Deal.

DCAA is now in the process of rejiggering that Big Deal audit program, and most of us don’t know what it’s going to look like. Thus, it is difficult to prepare for any post-award Accounting System Review audits that may use that as-yet-unpublished audit program. (FYI: We’ve seen a draft of the new program, but there’s no guarantee that the contents won’t change between the draft and the final audit program.)

So what is a contractor to do in the meantime?

Our best advice is to go directly to the Accounting System adequacy criteria found in the DFARS, at 252.242-7006. There are eighteen criteria. DCAA auditors must address each of those criteria in performing their audits. Do a self-assessment and see how well you comply with each criterion. Look at your policies and procedures. Do you have written documentation that addresses each criterion? To the extent you see gaps, you know where you have work to do.