Readers of this blog should not be surprised by the news that DCAA is going to stop auditing all the final indirect cost billing rate (“incurred cost”) proposals submitted by contractors and, instead, will adopt a “risk-based” approach that will involve waiving audits on a subset of those proposals. There have been many signs foreshadowing this new approach and it’s a fairly predictable tactic when one realizes just how ginormous of a backlog is crushing the file cabinets of DOD’s premier audit agency. So let’s not waste energy getting too upset about it; instead, let’s look at the new approach, which was spelled out in a July 6, 2012 memorandum from Pat Fitzgerald’s office to Richard Ginman (Director of Defense Procurement and Acquisition Policy). Mr. Ginman transmitted that memo along with an official DFARS Class Deviation marking his official approval of DCAA’s new approach and implementation within the DAR System.

Here’s a link to the various documents we’ll be discussing.

Let’s start with DCAA’s new approach. As detailed in the DCAA memo to Mr. Ginman, the new audit approach starts with an assessment of the adequacy of the contractor’s proposal to establish final billing rates. Unfortunately, the memo continues the usurpation of official Contracting Officer authority by blithely declaring, “if the incurred cost proposal is not adequate and the deficiencies cannot be remedied with minor effort, the proposal will be returned to the contractor with written instructions on required corrective actions, in accordance with CAM Chapter 6.”

Notice, readers, that no mention is made of the language found at FAR 42.705-1(b) that states—

The required content of the proposal and supporting data will vary depending on such factors as business type, size, and accounting system capabilities. The contractor, contracting officer, and auditor must work together to make the proposal, audit, and negotiation process as efficient as possible. … The cognizant auditor will review the adequacy of the contractor’s proposal for audit in support of negotiating final indirect cost rates and will provide a written description of any inadequacies to the contractor and contracting officer. If the auditor and contractor are unable to resolve the proposal’s inadequacies identified by the auditor, the auditor will elevate the issue to the contracting office to resolve the inadequacies.

We’ve ranted before about DCAA’s policy that effectively writes the Contracting Officer out of the picture, by making the adequacy determination on its own, despite the clear regulatory authority granted to the CO. This is more of the same, only this time Mr. Ginman appears to be endorsing DCAA’s claim of authority. We wonder what Mr. Williams has to say about that?

Anyway, once the DCAA auditor has determined that the contractor’s proposal is adequate, the next step is to look at the “auditable dollar value” (or “ADV”) being proposed. The term “auditable dollar value” has never (to our knowledge) been officially defined, but our understanding is that it means the value of all flexibly priced contract activity. In other words, if you add up the value of the cost-reimbursement and Time & Material type contracts (burdened at the proposed final billing rates), then that’s the ADV number. If the ADV is $250 million or more, then the contractor’s proposal definitely will be audited. If the ADV is less than $250 million, then the proposal will be “assessed for risk.” Some of those submissions will not be selected for audit. Ever.

The risk assessment is (apparently) primarily based on the amount of “exceptions” found in the audit of the contractor’s previous year’s submission. The term “risk assessment” is itself perhaps a bit misleading, since DCAA only classifies the submissions as either “high” or “low” risk. It’s a binary determination with no gradations of scale. So the “assessment” is simply putting the submission into one bucket or the other.

Being assessed as a “low risk” proposal is a good thing, because that will allow DCAA to treat the submission differently than it will be treating “high risk” submissions. Being assessed as “low risk” means that there’s a decent chance the contractor’s submission will not be audited, whereas all “high risk” submissions will be audited.

In order to be classified as a “low risk” proposal, the submission must meet all of the following criteria:

• DCAA must have performed at least one previous incurred cost audit on the contractor.

• DCAA must have no identified “significant audit leads” or “other significant risks” such as inadequate business systems whose identified deficiencies “would have a significant impact on the final indirect rate proposal” for the Fiscal Year being submitted.

• In the previous incurred cost audit(s), DCAA must not have questioned a “significant total exception” amount. The guidance includes a table that defines “significant total exception” amounts in terms of ADV. For example, for an ADV between $50 and $250 million, any questioned costs in excess of $100,000 would be considered to be a significant amount.

All submissions that do not meet the criteria for being assessed as “low risk” will be assessed as being “high risk”. As noted above, the key difference between “high risk” and “low risk” submissions is that not every low risk submission will be selected for audit. The lower the ADV, the less chance a “low risk” submission has of being audited by DCAA. For example, only one out of 5 low risk submissions with an ADV of between $50 and $250 million will be audited by DCAA. The other 4 submissions will not be audited. Ever.

(For the record, we noted that the memo states that every contractor submitting a proposal to establish final billing rates, where the ADV is between $50 and $250 million, must have a proposal selected for audit at least once every three years. That direction will tend to compensate for the otherwise 20% chance of being audited in any particular year.)

To continue, only one percent of submissions with an ADV of $1 million or less will be selected for audit. Yes, you read that correctly. Of all contractor submissions with an ADV of $1 million or less, only one out of a hundred will be audited. The other 99 will not be audited. Ever.

And for those particular low-value ADV submissions, that percentage is to be applied to contractor proposals received after 9/30/2011. Any proposals in that ADV range that were received by DCAA before that date, and for which field procedures have not yet started, will not be audited. At all.

None of them.

We encourage readers to review the DCAA risk sampling table found on Page 2 of the DCAA Process Description to determine the likelihood of your incurred cost submission being audited, based on ADV value (assuming you believe it might qualify as being “low risk”.)

If your submission is not selected for audit, how will your cognizant Administrative Contracting Officer negotiate final billing rates with your organization? How will you close-out your completed contracts? The DCAA Process Description includes a section covering “closure methods” to be used in such circumstances. There are two parts to the new DCAA closure method.

1. DCAA will issue a Memorandum to the cognizant Contracting Officer, listing the audit steps taken to assure that the contractor’s submission was “adequate”. (As if this had anything to do with the propriety of the claimed costs.)

2. DCAA’s internal records will record the ADV as “dollars examined” with a code that states “Assignment completed but no report issued.” Questioned costs and total exception dollars will be reported as zero.

And that’s it.

How DCAA will get from “was not selected for audit” to “dollars examined, assignment completed, but no report issued” is a bureaucratic mystery too impenetrable for us to fathom.

But we should note that we think the number of contractor final indirect billing rate proposals that will actually be classified as “low risk” is likely to be relatively low. The criteria DCAA has established for assessing a submission as “low risk” are actually going to be tough for many companies to meet. For example, former DCAA Director Stephenson once testified that as many as two-thirds of contractor business systems were inadequate. If that testimony was accurate, then none of those contractors will have their final billing rate proposals assessed as being “low risk” by DCAA. Thus, we expect that many contractors will see their submissions targeted for audit, regardless of the size of their ADV.

What is DCMA going to do with DCAA Memoranda it receives, the ones that have no questioned costs or total exception dollars? How is DCMA going to negotiate final billing rates with no DCAA audit report on which to rely?

Our sources tell us that DCMA is preparing guidance to its Contracting Officers even as we type these words. In the meantime, Mr. Ginman issued a DFARS Class Deviation that permits DCMA Contracting Officers to use the DCAA Memoranda “for purposes of satisfying the audit requirements at FAR 4.804-5(a)(12), 42.705-1(b)(2), and 42.705-2(b)(2)(i).” We’re not quite sure how a Contracting Officer will actually use the DCAA Memoranda as the basis to negotiate rates—since it will not be expressing any opinion on those rates—but, again, that’s a bureaucratic mystery too impenetrable for us to fathom.

Consequently, it seems that DCMA Contracting Officers are being directed to proceed with negotiating final billing rates whether or not they actually have an audit report to use. That ought to speed things up! The buying Commands might be able to finally close some ancient contracts. (And let’s be clear that this is direction with which we are in complete agreement. DCMA should stop relying on DCAA like a crutch and start negotiating regardless of what DCAA has said or not said.)

While DCMA is trying to figure out how to negotiate indirect rates with its contractors, DCAA has figured out how to reduce its incredible backlog in one fell swoop, and without performing any audits. That would seem to be a doubleplusgood outcome from a bureaucratic point of view, and no doubt many contractors will like the new approach as well. But we wonder what POGO and Congress and GAO will make of it?

Finally, we noted that Mr. Ginman stated in his Class Deviation that DCAA’s new approach was not really a change from DCAA’s past audit practices. He stated that “this DCAA policy represents a continuation of a risk-based sampling process in use since 1994.” Well, if that’s true, we wonder why his Directorate felt that a Class Deviation was necessary in order to implement it. Perhaps, like Mr. Fitzgerald, Mr. Ginman also believes that Oceania has always been at war with Eastasia?