Before getting into the September 23, 2009 hearing by the Senate Committee on Homeland Security and Governmental Affairs (which will be the subject of an upcoming article), we want to spend some time on the 148-page GAO audit report on which most of the testimony centered—GAO Audit Report GAO-09-468 (September 23, 2009) entitled “DCAA Audits: Widespread Problems with Audit Quality Require Significant Reform.” This was a follow-up report to last year’s now-infamous GAO report (GAO-08-857), and was designed to (1) conduct a “broad assessment of DCAA’s management environment and quality assurance structure,” (2) evaluate corrective actions taken in response to last year’s report (as well as internal reports by the Defense Business Board and other DOD stakeholders), and (3) identify potentials actions that might be taken by Congress (and others) that “could improve DCAA’s effectiveness and independence.”  As the title of the report indicates (and as was previously leaked), DCAA did not fare well in the GAO’s investigation.

The GAO looked at DCAA Contract Audit Manual (“CAM”) guidance and DCAA’s quality assurance program.  It examined internal quality assurance reviews. It examined the 2007 DOD Inspector General external quality “peer review” of DCAA audit quality (but did not review any DOD IG working papers). And it also reviewed 69 audit assignments from the period Government Fiscal Years (GFYs) 2004 through 2006, focusing on reports issued by “DCAA offices that reported predominantly adequate (‘clean’) opinions on contractor systems and related internal controls ….”  The 69 audit assignments that GAO reviewed were comprised of 37 audits of contractor internal controls and 32 “cost-related audits” issued from seven “geographically disperse DCAA field offices within the 5 DCAA regions.”  Notably, the GAO did not review assignments from DCAA’s Field Detachment (which audits classified contracts) nor did GAO review assignments from offices that issued reports with predominantly adverse contractor findings.  Consequently, GAO’s findings are admittedly “not statistical” in nature; the review covered less than 10 percent of the 76 offices in which contractor internal control-related audit reports were issued during the review period.

To summarize, the GAO examined a biased sample of reports from a small fraction of DCAA’s offices, issued in historical periods prior to the July 2008 GAO report (and thus prior to implementation of any DCAA corrective actions in response to that report).  Moreover, the management activities the GAO examined were issued prior to the issuance of Defense Business Board recommendations on changes to DCAA organizational strategy (and implementation of same).  Further (and more to the point with respect to certain Senators’ angry and pointed questions during the recent hearing), all of the audit reports and activities, and related findings, in the GAO report occurred prior to Ms. Stephenson assuming her current position as Director of DCAA.  These limitations didn’t stop GAO from generalizing from the findings, nor did they stop GAO from making sweeping generalizations and major policy recommendations for the Department of Defense and Congress. For example, the GAO report concluded “[we] found DCAA’s management environment and quality assurance structure were based on a production-oriented mission that put DCAA in the role of facilitating DOD contracting without also protecting the public interest.”

Notwithstanding the foregoing caveats, the GAO report was rife with damning anecdotes and findings. It is hard to dispute the overall conclusions of the report, which were summarized thusly:  “we found audit quality problems at DCAA offices nationwide, as demonstrated by serious quality problems in the 69 audits … we reviewed, DCAA’s ineffective audit quality assurance program, and DCAA’s rescission of 80 audit reports in response to our work.”

The GAO report stated that “we found audit quality problems … with all 37 audits of contractor internal controls and the 4 incurred cost and the 2 request for equitable adjustment audits we reviewed at 7 FAOs across the 5 DCAA regions ….”  Detailed findings included:

• In 2004, a Western Region FAO planned a billing system audit of a federally funded research and development center (FFRDC)—a “grantee” that receives $1.5 billion annually for its research services.  The planning “did not take into account the fact that grantees are funded through letters of credit and do not actually bill the government.”  Despite this “obvious mistake,” DCAA auditors “issued a report stating that the grantee had an ‘adequate billing system’.”  Another report issued by the same office on the same FFRDC addressed cash management practices under the Single Audit Act.  According to the GAO, “the auditors could have simply forwarded this report to the DOD contracting officer—a task that would take an hour at the most to complete.  Instead [they] charged over 530 staff hours to generate documentation to meet DCAA’s billing system audit requirements, even though there was no related ‘billing system’.”  The GAO noted “DCAA has not rescinded the audit report even though it expresses an opinion on a nonexistent system.”

• In 2006, DCAA conducted a billing system review on a contractor generated approximately $76 million in annual sales to the U.S. Government; its last billing system review had been performed in 2000.  In the intervening six years, “the contractor had experienced significant downsizing and restructuring.”  The DCAA audit strategy was based on providing the contractor’s Information Systems Manager with six year-old audit documentation from its files and requesting that the documentation be updated and edited where necessary. Based on the contractor’s edited billing system internal control documentation and a walk-through, the DCAA auditor concluded that she could limit testing because the system was “strong.”  The GAO, however, that “the billing system was a software package that downloads accounting system data to spreadsheets [and] manual calculations were then used to develop invoice amounts—a process that is prone to errors….”  The contractor’s billing system internal controls were determined to be “adequate” even though no testing was performed on those controls.  Based on the GAO’s findings, the report was subsequently rescinded.

• In 2004, a contractor objected to draft findings and recommendations in a DCAA review of its accounting system internal controls.  In response to the contractor’s objections, “the auditors revised and deleted some workpapers and created new workpapers. …  GAO also found evidence … that the final supervisor instructed the final lead auditor to insert the signature of a prior supervisor on an electronic workpaper after it had been revised, thereby making it apper that the prior supervisor had approved the workpaper revisions.”  In 2006, DCAA issued its report recommending that the accounting system be determined to be “adequate”—even though it had “’scrub[bed]’ the audit documentation … dropp[ed] five significant deficiencies and drowngrad[ed] three significant deficiencies to suggestions for improvement.”  The GAO reported that “the audit supervisor, who authorized the electronic recording of the prior supervisor’s name on the audit documentation and supervised the issuance of the audit report, was subsequently promoted to Western Region Quality Assurance Manager, where he went on to act as a quality control check over thousands of audits ….”

Findings such as those summarized above were used to support broad, generalized conclusions such as:

• DCAA’s mission statement and strategic plan do not focus on the public interest
• DCAA’s performance metrics were designed to measure output
• DCAA’s audit quality assurance program was ineffective
• DOD IG’s peer review opinion on DCAA’s audit quality control system is inconsistent with the underlying deficiencies reported
• DCAA lacks a risk-based audit planning approach
• DCAA lacks effective human capital management

As a result, the GAO recommended several actions that it asserted would “improve DCAA’s effectiveness and independence.”  Among these recommendations were the following:

• Legislation should grant to DCAA “protections and authorities” equivalent to an agency Inspector General, such as “public reporting of audit results [and] rights to take statements from contractor and other personnel ….”
• Legislators should consider “changes in organizational placement” of DCAA, either by elevating DCAA within DOD, or by moving the audit agency out of DOD altogether—creating an “independent, Governmentwide contract audit agency.”

In addition, the GAO made 15 “recommendations for executive action” to the Secretary of Defense designed to “improve the quality of the agency’s audits and strengthen auditor integrity, objectivity, and independence ….”  Notable among these was the recommendation to “ensure that auditors who make direct bill [authority] decisions are independent of DCAA employees who perform a DOD management function … thereby reducing situations where DCAA auditors are encouraged to reduce their office workload by approving contractors for the direct-bill program.”

In conclusion, the GAO report included sensational, headline-grabbing findings that seemed to support the assertion that DCAA audit reports were poorly planned, poorly supervised, and were the result of an assembly-line production environment where quantity was valued more highly than quality.  However, as we noted above, the GAO review sample was biased and of insufficient size to support an agency-wide indictment of management inadequacy.  As many contractors would willingly agree, DCAA has considerable room for improvement with respect to audit planning and quality, and is badly in need of a cultural transformation.  We’re not necessarily convinced that the audit quality problems are as terrible (or as endemic) as the GAO asserts.

Next up:  what the Senators heard and how they reacted to the GAO report findings.