Each month DCAA publishes new or revised audit guidance, known as “open audit guidance.”  The form of the audit guidance is a “Memorandum for Regional Directors” or MRD.  Recently DCAA issued a couple of MRDs that we want to bring to your attention.

On February 16, 2010, DCAA issued MRD 10-PAS-003(R), entitled “Audit Guidance Related to Audits Performed by Foreign Auditors under Reciprocal Agreements.”  By way of background, the Defense Department has executed agreements with several countries, agreeing that audits of companies headquartered in those countries will be handled by local auditors.  As the MRD states—

The United States Department of Defense (DoD) has agreements with the Governments of certain foreign countries to provide contract audit services and other contract administration services without charge. Under these agreements, DCAA performs audits of U.S. companies performing or bidding on contracts of the foreign country. In return, the auditors of the foreign country perform audits of the foreign companies performing or bidding on U.S. Government contracts. The U.S. currently has reciprocal audit agreements with five countries: Canada, United Kingdom, France, Netherlands, and Germany.

The MRD directs its auditors that, notwithstanding such agreements, “the results of audits performed by foreign auditors are not to be incorporated into DCAA audit reports” because DCAA can no longer rely on the opinions of the foreign auditors.  The audit guidance recommends that the DCAA auditors tell the contracting officer to get the necessary audit reports directly from the foreign auditors, because DCAA won’t have anything to do with those foreign audit reports.

Another step in DCAA’s two-year long mission to paralyze the Defense acquisition process?  You be the judge.  But before you decide, remember that many large defense programs have large percentages of international suppliers in their supply chains.  Some major defense acquisition programs (MDAPs) are primed by the likes of BAE Systems (headquartered in the UK) or EADS or Thales or AugustaWestland.  We expect that making a contracting officer go through the assist audit process to negotiate forward pricing rates or a new business proposal will add months to an already overlong process.

Next, on February 18, 2010, DCAA issued MRD 10-PAS-005(R), entitled “Audit Guidance on Performing Internal Control Follow-up Audits and Limited Scope Audits.”  This MRD supersedes prior audit guidance regarding audits of contractor internal control system reviews (now called “business system” reviews) and, in particular, performance of limited-scope “follow-up” audits designed to confirm initial findings related to system deficiencies—i.e., failed control objectives.  The MRD confirms what we previously reported months ago, which is that DCAA is rewriting its entire approach to performing internal control systems reviews and has stopped performing any new audits until “the revised audit process is tested and distributed to the field audit offices.”  (Which, by the way, will take months to accomplish.)

The MRD tells auditors that, even though no new ICAPs reviews are being performed, “FAOs should perform follow-up audits to verify the contractor’s correction of previously-reported internal control deficiencies.”  The MRD states that “the scope of the follow-up audit will be limited to determining if the contractor corrected the previously-reported deficiencies.”  [sic]   Moreover, the MRD directs that—

If the contractor has not corrected all of the previously-reported deficiencies, the report should state that the examination noted significant deficiencies that are considered to be material weaknesses and provide details in the Statement of Conditions and Recommendations section of the report. The report should also recommend that the contracting officer pursue or continue the suspension of the percentage of progress payments or reimbursement of costs and, if applicable, disapprove the affected portions of the system.

DCAA may have a more prominent role to play in reviews of contractor “business systems” and imposition of mandatory payment withholds.  See the proposed DFARS rule here.  It is apparent that the audit agency is in the process of rethinking its approach to conducting such reviews.  Meanwhile, the House Armed Services Committee’s Panel on Defense Acquisition Reform has recommended that DOD consider “shifting the responsibility for certification of contractor business systems to independent teams within or outside of DCAA” and that DCAA should “allocate its audit resources on the basis of risk.”  Clearly this entire area—which is of paramount importance to contractors—because it can affect cash flow, competitive standing, and even lead to allegations of violations of the False Claims Act—is in flux and contractors need to keep a vigilant eye (or two) on changing DCAA audit guidance in this area.