We interrupt our series of articles on the structuring of indirect cost allocations to let our readers know that the DOD Inspector General has just issued its latest assessment of DCAA audit quality.

The reported results were consistent with historical findings reported by both the DOD IG and the Government Accountability Office (GAO).

In other words, they weren’t very pretty, folks.

The DOD IG used to be the “peer reviewer” that audited the quality of DCAA’s audits, so as to comply with the requirements of GAGAS (Generally Accepted Government Auditing Standards). According to the IG, GAGAS requires that “organizations performing audits or attestation engagements in compliance with GAGAS [must] have an external peer review at least once every 3 years. Based on the criteria, DCAA should have obtained a peer review on its work performed in [Government] FY 2009.” But DCAA didn’t do so. In fact, the last peer review opinion (covering audits performed in FY 2006) was withdrawn in August, 2009, because of the IG’s “significant findings … coupled with the results of the July 2009 Government Accountability Office (GAO) draft report, ‘DCAA Audits: Widespread Problems with Audit Quality Require Significant Reform’ (GAO-09-468).”

Many observers, including those here at Apogee Consulting, Inc., identify the withdrawal of the external quality opinion in August 2009 as the point in time where the organization that is DCAA went insane. In its subsequent attempts to comply with GAGAS and avoid criticism on the quality of its audit reports, the DCAA audit approach underwent a Kafkaesque metamorphosis into a bizarre and largely incomprehensible monstrosity, from which it has yet to recover.

The DOD IG explained DCAA’s reaction this way—

Prior GAO and DOD Inspector General (IG) reviews of DCAA reports identified significant deficiencies in audit work, including poor supervision, inadequate documentation, inappropriate changes to report opinions, and lack of sufficient testing to support report opinions. To address audit quality issues, DCAA implemented various corrective actions such as revised supervisory training; a required computer - based training course on working paper documentation; required training on GAGAS; revamped audit programs; and issuance of revised guidance on variable and attribute sampling with relevant training modules.

What the DOD IG did not state was that DCAA’s “corrective actions” included issuance of (let us say) questionable audit guidance and creation of multiple management review layers. (For an example of our thoughts on the new layers of audit review, see our article here.) The end result of DCAA’s corrective actions was an environment that, by any measure, was dramatically less productive. Audits took significantly more hours to conduct and took significantly longer to issue. That’s not an opinion: that’s an objective assessment based on DCAA’s own reported statistics.

Another one of the changes DCAA undertook was to exclude the DOD Inspector General from further peer reviews. In fact (as the DOD IG reported)—

In FY 2012, with the assistance of the Council of Inspectors General on Integrity and Efficiency (CIGIE) Audit Committee, DCAA started the process of obtaining an outside firm to perform its next peer review. DCAA stated that the peer review is to be performed in FY 2013 and cover [audit] reports issued in FY 2012.

DCAA’s attempt to find a more sympathetic external quality control auditor didn’t stop the DOD IG from performing further reviews on DCAA audit quality; it simply stopped those reviews from having any effect on the officially “expired” peer review assessment. In other words, the IG has declared that it cannot be shut out and that this latest report will not be its last on the topic of DCAA audit quality.

Before we get into the meat of the report, let’s note for the record (as the IG did) that though it reviewed audit reports issued in GFY 2010, most of the field work had been performed in GFY 2009—i.e., before DCAA had implemented many of its “corrective actions” that were ostensibly intended to address the audit quality issues identified by the DOD IG and GAO. Accordingly, the DOD IG report gives DCAA an out. The audit agency can (and did) claim that when the outside firm performs the external peer review in GFY 2013 (covering audit reports issued in GFY 2012), those corrective actions will have been digested and all will be well, quality-wise.

(Pause for skeptical throat-clearing.)

So here’s what the DOD IG auditors found, with respect to the 50 GFY 2010 DCAA audit reports they reviewed:

In 37 of the 50 assignments (74 percent) reviewed, the audit staff did not exercise professional judgment as evidenced by deficiencies identified in multiple standards areas. The 37 assignments had a high number of deficiencies, ranging from 6 to 9 deficiencies out of 9 standards areas excluding professional judgment. … The abundance of noncompliances with standards identified in the 37 assignments evidences the need for improvements in the area of competence at DCAA.

[Emphasis added.]

Some of the GAGAS noncompliances were tied to the use of inexperienced auditors coupled with inadequate supervision. The DOD IG wrote—

In 3 of the 50 assignments reviewed, auditors with limited experience or training were assigned to complex engagements. In two assignments, the auditors either did not possess the knowledge and skills required or did not receive appropriate supervision reflective of their limited experience to adequately perform the assignment. In the other assignment increased supervisor and audit manager involvement made up for the lack of experience and training of the audit staff. GAGAS 3.33 discusses the interrelationship between professional judgment and competence because auditors’ judgments are dependent upon the auditors’ competence. GAGAS 3.36 further links the determination of whether professional judgment was demonstrated in an engagement to the appropriateness of the consideration of the collective experience, training, knowledge, skills, abilities, and overall understanding required by the audit team and its members to properly perform the engagement. Without the appropriate mix, the audit team will not be able to properly assess the risks that the subject matter under audit may contain a significant inaccuracy or could be misinterpreted. Therefore, DCAA used inexperienced auditors under limited supervision, which contributed directly to the audit teams not demonstrating professional judgment. DCAA[‘s] use of inexperienced auditors and the associated lack of professional judgment also led to the noncompliances identified in the assignment with key standards such as planning, evidence, documentation, and reporting.

[Emphasis added.]

And despite the efforts of DCAA to keep the DOD IG from commenting on its audit quality control system (as described above), the DOD IG commented on the DCAA audit quality control system. It wrote—

In 46 of the 50 assignments reviewed, the DCAA quality control system was ineffective in ensuring that its attestation engagement and performance audit assignments complied with applicable professional standards. … The need for improvement in the DCAA quality control system was evidenced by the deficiencies identified in multiple standards areas; in engagements performed in all regions and Field Detachment; and in all engagement types reviewed.

DOD IG also reported that DCAA’s implementation of multiple quality reviews prior to issuance of reports did not significantly improve the quality of those audit reports. The DOD IG wrote—

The DCAA regional and Field Detachment quality control procedures were generally ineffective in ensuring that attestation engagements and performance audits complied with GAGAS and DCAA policies and procedures. The quality control procedures including regional and Field Detachment management pre-issuance reviews varied among regions and Field Detachment. The regional and Field Detachment pre-issuance reviews did not identify significant noncompliances with GAGAS and resulted in the regional or Field Detachment audit managers approving reports that should not have been issued. In addition, the regions and Field Detachment management did not have adequate procedures in place to ensure that audit offices complied with regional and Field Detachment quality control procedures for which the audit offices were assigned responsibility.

[Emphasis added.]

We could go on and on, just like the DOD IG audit report did, listing example after example of poor audit planning, poor communication, poor documentation, lack of professional competence, lack of adequate supervision, insufficient evidence, delayed reports, and other GAGAS violations. But why bother? The report is, unfortunately for DCAA, damning.

Just as the prior DOD IG and GAO reports on DCAA audit quality have been damning.

We’re not particularly surprised by the findings in the DOD IG report; nor do we suspect our readership is particularly surprised by them. We’ve asserted for some time that the DCAA initiatives intended to increase audit quality have not worked out as planned. As this report demonstrates, DCAA audit quality is still lacking.

In other words, DCAA has implemented its revised procedures and multiple reviews and, as a result, has dramatically delayed its audit report production for no good reason. They still suck.

So we think DCAA may as well just throw the audit reports over the transom to the customer just as quickly as it can. The quality will still be as poor; but at least the reports will be more timely.

But we can hear the chorus of cries from Fort Belvoir from here—“just wait until the next review!” Yes, things will be so much better then. Higher quality audit reports issued faster.

Sure.

We’ll be very happy to report on the assessed quality of DCAA audit reports when that next external peer review report is issued. If things have improved significantly, we’ll be first in line to say so.

In the meantime, we’re not so happy to be reporting on this assessment. Nor, do we think, should current and former DCAA auditors be happy to read about the quality of their agency’s audit reports, as assessed and documented by the DOD Inspector General.