Apogee Consulting, Inc. has been focused on the new DFARS Business Systems rule since its ill-begotten conception back in early 2010.  We submitted our comments and concerns to the DAR Council, and were disappointed that that interim rule (issued May 2011) addressed so few of our comments.  Nonetheless, our anxiety was ameliorated somewhat by DCMA’s policy addressing implementation of the rule, which created a Contractor Business Systems Review Panel for the purpose of performing “a higher-level review of the COs final determination to disapprove a Contractor’s Business System, prior to notifying the Contractor in writing that the system is disapproved.”

We also reported on early implementation efforts, noting that it seemed that enterprise-wide systems (e.g., Accounting or EVM) might carry more financial risk than segment-specific systems, since significant deficiencies at one segment might trigger payment withholds across the enterprise if those deficiencies led to the entire system being disapproved.

Since that time, we’ve gathered up a few more tidbits of information for sharing with our readership.

First, DCMA has issued a process flowchart, updated its OneBook guidance, and created training for its contracting officers.  You can find the Agency’s process flowchart and training slides on our site under “Knowledge Resources”—but only if you are a member.  (Remember, membership has privileges!)

Second, DCMA held an “Industry Day” to discuss the new Business Systems rule on December 15, 2011.  We weren’t invited (and couldn’t have attended even if invited), but we lucked into some good, detailed, notes from somebody who did attend that meeting.  We’re going to cut-n-paste (with a little editing) from those notes for you.

A representative of DCAA told the audience the following–

• DCAA’s system audits will be attestation compliance audits and will state whether the contractor is compliant or noncompliant with each of the system criteria listed in the applicable DFARS clause.  The DCAA report will connect the [alleged] deficiency to the purpose statements in the DFARS Clause – i.e., what does the system ‘provide for’.

• Any material weaknesses will be considered a system deficiency.  However, DCAA is still determining whether any noncompliance with an individual system criterion will be considered a ‘significant deficiency’ within the meeting of the regulation.  [Ed. Note: This was a concern that we raised to the DAR Council in our comments to the initial proposed rule.]

• Regardless of the foregoing, DCAA does not intend to be prescriptive or to dictate a contractor’s system policy and procedures.  DCAA acknowledges that the business system criteria are broad and there is more than one effective way to achieve the desired internal control objective.

• DCAA will no longer issue Flash Reports as a means of identifying potential system deficiencies - they will issue a complete noncompliance report with adequate supporting detail.  [Ed. Note:  Finally!  Good riddance to a terrible practice.]

Representatives from DCMA told the audience the following—

• DCMA’s view is that the new Business Systems rule is not to be applied as a punitive rule.  Audit reports and related withhold determinations need to address the government’s risk.

• To ensure consistency in administration, Contracting Officers have been instructed to escalate and coordinate at the CACO level to ensure CACO/DACO agreement on proposed actions.

• The contractor will receive a ‘substantial’ out-brief from the auditor (or DCMA functional specialist) before the audit report is issued.  The out-brief may be written and/or verbal; the focus will be on ‘meaningful’ engagement and/or discussion, not just an exchange of paper.

• If there is no reasonable expectation of harm to the Government then the deficiency would not be considered significant and the system would be approved.

• While it is true that ‘a corporate wide system or Shared Service disapproval could impact an entire corporation,’ the focus will be on identifying where the risk is to the government.  [Note:  In other words, the contractor may be able to argue that a significant deficiency at one segment should not lead to payment withholds across the enterprise.]

• While it is true that DCMA has established a Contractor Business System Review Panel, only ‘disagreements between the DCAA recommendation and the Contracting Officer determination’ will go to a DCMA Headquarters-level Board of Review.

• A Contracting Officer may not make an Initial Determination regarding the adequacy of a specific business system until the contractor receives a contract containing both the DFARS Clause 252.242-7005 and the specific clause related to the system at issue.

• If the contractor submits an effective Corrective Action Plan (CAP) as part of the contractor’s response to the CO Initial Determination, then the payment withhold could start at 2%.

• Contracting Officers ‘will – not may’ – reduce withhold upon submission of an adequate CAP with milestones.

• An adequate CAP must include discrete and measurable actions with realistic due dates and an explanation of how the corrective action plan will be monitored.  The DCMA CO, in consultation with auditor or functional specialist, will monitor the contractor’s progress on the CAP.  If the CO determines that the contractor is not making adequate progress, then the payment withhold will be increased.  The Contractor should notify CO when the entity believes that the identified deficiencies have been corrected.  The CO, with input from auditor/functional specialist, will determine whether all corrective actions have been completed, or whether there is a reasonable expectation (based on the evidence presented) to believe that the deficiencies have been corrected.  If so, then the CO will approve the system and release the payment withholds.

• DCMA’s Business System Instruction [in the OneBook] provides that  a payment withhold is only applicable to CAS covered contracts valued at $50M or more, that contain the DFARS Clause 252.242-7005;.  However, the CO can apply a payment withhold on one or more contracts valued at less than $50M with CMO Contracts Director approval.  The DCMA letter notifying the contractor of implementation of payment withholds will include a listing of the contracts for which it is to be applied.

• The Business System payment withhold is in addition to any fixed fee withholds because those withholds exist for different reasons

• If a system is not already “Approved”, “Adequate”, “Accepted” or “Disapproved”, then it is considered “not evaluated”.

Apparently, some disagreement emerged between DCAA and DCMA regarding the responsibilities of a prime contractor when its subcontractor has had a system disapproved and payment withholds initiated.  According to the meeting participant—

• DCAA opined that subcontractors should withhold costs on cost-type invoices before submitting to prime contractor

• DCMA stated that there is no provision in the rule to flow-down the withhold requirement from prime to subcontractor.  In any case, there is no ‘privity of contract’ between the prime contractor’s CO and the subcontractor.  According to the clause, the DCMA CO has the responsibility to implement payment withholds on Progress Payments and Performance Based Payments.  Thus, the prime contractor can’t really step into the role of the CO to implement payment withholds.  If this were even possible, how would it work in practice—would the prime contractor hold the money in its own bank account or somehow forward to the DCMA CO?

• DCMA noted that subcontractors who have disapproved systems will have withholds implemented on their prime contracts, so they are incentivized to correct their systems in any case.

• DCMA also noted that they still need to work out the implementation of payment withholds on Interorganizational Transfers.

From our perspective, it’s good to see that DCMA is figuring-out (and letting contractors know) how it will be implementing the new rule.  We recommend that our readers carefully review the bullet points above and consider “socializing” the new run rules with employees.  It would also seem desirable to review the “run rules” with government oversight officials in order to make sure everybody has the same understanding of how the payment withholds—should they be deemed necessary—will be implemented.

We note that DCAA has taken a hardline stance (as has become all too typical of the audit agency), asserting that the new rule applies to subcontractor invoices to prime contractors.  While we are pleased to see DCMA (quite correctly) disagree with that position, we worry that DCAA will apply its flawed logic to its system reviews.  DCAA might well assert that a prime contractor’s accounting system has a significant deficiency because subcontractors are not directed (by the prime) to implement payment withholds when the subcontractor’s business systems have been disapproved.

Despite potential problems we continue to be encouraged that DCMA is thinking through its process, and that the process appears reasonable (given the inherent problems in the rule itself).  Obviously, the reasonableness of the process turns on the subjective nature of the definition of “significant deficiency” and how the DCMA COs will link the alleged significant deficiencies to the government’s risk of making overpayments to contractors.

The proof, as they say, will be in the pudding.

In the meantime, we’ll stay focused on DOD’s implementation of this new rule.