On April 24, 2012, DCAA issued audit guidance via MRD 12-PAS-012(R), concerning performing reviews of contractors’ accounting systems pursuant to the new DFARS adequacy criteria and business system administration rules. You know, the stuff that we’ve incessantly blogged about here? Yeah, that stuff.

And yet, here we are, blogging about that stuff once again.

We suspected that the easiest way forward for DCAA was to mash several of its previous ICAPS audit programs into one, and call it the “accounting system” audit program. And that’s indeed what happened. It’s the logical move, since that’s essentially with the DAR Council did in establishing the 18 system adequacy criteria in its new DFARS contract clause regarding contractors’ accounting systems.

So the formerly separate ICAPS audits of Billing and Control Environment are now considered to be subsidiary assignments under the “controlling assignment” given Activity Code 11070. Other former ICAPS audits such as Labor Accounting and ODC Accounting are being completely incorporated into the Accounting System Audit procedures. In addition, some other formerly separate ICAPS-type audits (e.g., Timekeeping, purchase existence/consumption) will now be performed separately but “referenced and incorporated” into the controlling Accounting System Audit assignment, as will CAS compliance reviews.

Importantly, the new DCAA accounting system audit program asserted that, in order to comply with GAGAS, auditors cannot use the definition of “significant deficiency” found in the new DFARS rules. Instead of the definition mandated by regulation, DCAA auditors will use the following—

A deficiency, or combination of deficiencies, in internal control over compliance such that there is a reasonable possibility that a material noncompliance with a compliance requirement (e.g., applicable Government contract laws and regulations) will not be prevented, or detected and corrected on a timely basis.

Given that much of the controversy surrounding adoption of the business system administration rules concerned DCAA’s approach to the term “significant deficiency,” and the lack of clarity regarding application of the concept of materiality to the word “significant,” we think that contractors should be concerned with DCAA’s definitional flexibility. Very concerned.

The audit guidance devoted substantial verbiage to addressing materiality, perhaps in a proactive attempt to head-off contractors’ criticism of the audit procedures. Here is a snippet of that verbiage (emphasis in original)—

In evaluating whether a noncompliance is severe enough to be considered a material noncompliance and a significant deficiency/material weakness, the auditor should consider the likelihood that the identified noncompliance with the DFARS criteria will result in noncompliance with other applicable Government contract laws and regulations (e.g., with FAR Subpart 31.2, CAS, or applicable requirements in FAR Part 15) and the magnitude of those potential other noncompliances. If there is a reasonable possibility that the identified noncompliance with the DFARS criteria will result in a material noncompliance with other applicable Government contract laws and regulations, either individually or in combination, it is a significant deficiency/material weakness. Some of the specific factors that auditors should consider include:

• The nature and frequency of the noncompliance with the DFARS criteria identified with appropriate consideration of sampling risk (i.e., the risk that the conclusion based on the sample is different than it would be had the entire population been tested).
• Whether the noncompliance with the DFARS criteria is material considering the nature of the compliance requirements.
• The root cause of the noncompliance. (Understanding why the noncompliance occurred will help to determine if it is systemic and significant.)
• The effect of compensating controls.
• The possible future consequences of the noncompliance with the DFARS criteria.
• Qualitative considerations, including the needs and expectations of the report’s users. For Government contract cost issues, qualitative considerations also include serving the public interest and honoring the public trust.

Astute readers will notice that DCAA’s “specific factors that auditors should consider” are not especially helpful. We like the bit about taking into account the effect of compensating controls; however, we don’t care at all for the bit about taking into account “qualitative considerations.” We don’t think all the verbiage in the guidance regarding materiality really reduced industry’s concerns. We predict problems lie ahead in that area.

We also predict future challenges associated with this piece of audit guidance—

In addition, it is not necessary to demonstrate an actual monetary impact to the Government (e.g., unallowable or unallocable costs, or that the price the Government negotiated for a contract was unreasonable) to report a significant deficiency/material weakness. There only needs to be a reasonable possibility that the noncompliance with the DFARS criteria will result in a material noncompliance with other applicable Government contract laws and regulations, thus materially affecting the reliability of the data produced by the system. … If the audit team determines that a noncompliance is not a significant deficiency/material weakness, the team should consider whether prudent officials, having knowledge of the same facts and circumstances, would likely reach the same conclusion (i.e., that the official would conclude that he/she can rely on the information produced by the contractor’s system in the conduct of his/her duties and responsibilities).

(Emphasis in original.)

So, yeah. Based on the foregoing, you might be thinking that DCAA HQ is telling its auditors that they don’t actually need to find any significant deficiencies in order to report them. Instead, all they need is to demonstrate a “reasonable possibility” that the contractor’s practices might not comply with governmental laws and regulations. And if by chance the auditors conclude that there is no reasonable possibility of that actually happening, then they need to reconsider and think about whether “prudent officials” (e.g., senior policy-makers at Fort Belvoir) would agree with their conclusion.

Could the bar have been set any lower? Could the subtext have been made any clearer? We don’t think so.

Okay, moving on. In case you were wondering about this article’s title and have been waiting impatiently for us to get to the part about the end of the issuance of Flash Reports, well here you go.

The same MRD announced the demise of the poorly thought-out and poorly implemented Flash Reports. Those reports were intended to flag detected/suspected internal control failures, but (in our view) the whole concept was a failure. The problem, as many of us know all too well, was that DCAA never had the bandwidth to follow-up as its audit procedures required. And DCMA never cared about the Flash Reports in the first place; typically, the DCMA ACO wanted a full-scope audit report before taking action. So the Flash Reports themselves, which at first seemed so ominous and scary, lost all urgency after about the tenth one received. It became kind of a joke, really. So we will all be glad to see them disappear.

But The King is Dead/Long Live The King.

DCAA introduced a new type of audit report to replace the Flash Report—the Deficiency Report. Here how DCAA described the new report (emphasis in original)—

GAGAS … require auditors to include in the report deficiencies, or a combination of deficiencies, in internal control that are less severe than material weaknesses (and, hence, also less severe than a significant deficiency as defined by the DFARS), yet important enough to merit the attention of those charged with governance (i.e., responsible contractor management officials). …

Upon completion of the separate Billing Audit and Control Environment Audit sub-assignments, the results will be summarized in a memorandum for record (MFR) to be reported as a part of the … Accounting System Audit. If a significant deficiency/material weakness is identified as a result of those audits, auditors should generally not wait for the completion of the Accounting System Audit to report the deficiency…. Instead, a deficiency report should be issued under the Billing Audit and Control Environment Audit sub-assignment number …

Because of the importance of timely communication of deficiencies, it also may be appropriate in some cases to issue an audit report on a significant deficiency/material weakness identified in an in-process business system audit (e.g., prior to completion of the Billing Audit or Control Environment Audit sub-assignment). In those cases, the auditor will … set up a separate assignment using the new 11070 Deficiency Report subactivity. The new subactivity code also is used to report deficiencies identified in other than business systems audits ... The Deficiency Report Assignment should not be established until there is sufficient evidence that a significant deficiency/material weakness exists and the elements of a finding for the deficiency are fully developed in the originating in-process business system audit….

The Deficiency Report Assignment is an integral part of the originating GAGAS examination engagement (e.g., incurred cost audit), not a separate examination. As a result, it is not necessary to document in the deficiency report assignment many of the procedures generally required to comply with GAGAS for an examination, since the GAGAS procedures would be documented in the originating GAGAS examination engagement. The deficiency report assignment working papers will reference the originating assignment and include the working papers from that assignment that contain support for the noncompliance with the DFARS criteria. …

If the evaluation of the identified noncompliance with the DFARS criteria and the elements of a finding were not fully developed in the originating assignment … the auditor should perform procedures to accomplish that as part of the Deficiency Report Assignment so as not to delay issuance of the report on the originating examination. However, such effort should generally not be extensive since the objective is not to evaluate the contractor’s compliance with all aspects of the applicable DFARS criterion or criteria but only to establish whether the noncompliance identified in the originating audit is a material noncompliance; and, therefore, represents a significant deficiency/material weakness or is less severe than a significant deficiency/material weakness, yet important enough to warrant the attention of responsible contractor officials. In either case, the noncompliance will be reported in the deficiency report.

Whew. Sorry about that, readers. But we felt it best for you to see, first-hand, what DCAA intends for its new Deficiency Reports. As you can tell, there are only subtle differences between the old Flash Reports and the new Deficiency Reports.

So the bottom line is that DCAA is moving forward in implementing the new DFARS Business System administration rules in the manner that many of us feared and warned the DAR Council about. The audit agency is redefining “significant deficiency” in a manner that is contrary to the plain, explicit, definition promulgated by the DAR Council—in essence, revising Federal regulations illegally and without soliciting any public comment.

DCAA has published audit guidance that warns auditors to think—and then think again—before giving contractors’ accounting systems a clean bill of health. Yeah, so much for independence and objectivity.

Finally, DCAA has put a stake in the heart of its ill-advised Flash Report methodology; but, like a Frankenstein monster, the audit agency has resurrected and reconstituted its reporting into new Deficiency Reports.

We are disappointed and disheartened that, once again, DCAA has chosen an adversarial position that actually inhibits timely and accurate audit reports. Disappointed and disheartened, yes. Surprised? No.