For several years DCAA leadership has grumbled about contractors’ failure to give them online and real time access to accounting data. For example, in its GFY 2012 Report to Congress, DCAA stated—

Read-only access to the contractor’s books and records would greatly assist DCAA to effectively plan and perform all of the audit effort at a contractor location. This is especially important at contractors with highly complex Enterprise Application Integrations environments and Enterprise Resource Planning systems.

Contractors are increasingly generating and storing accounting data and records in a digital environment. Whether it’s an Electronic Timecard System, an Electronic Management Records system storing invoices/vouchers, or an automated General Ledger journal entry posting and reconciliation of accounting records within an enterprise accounting system, original accounting source data and records have become increasingly developed and available solely within electronic environments and formats. DCAA has always maintained that direct access to contractor original accounting ‘books of entry’ or source records, whether manually or electronically generated, is authorized under FAR 52.215-2 Audit and Records—Negotiation. Nonetheless, many contractors have denied DCAA the read-only access to their electronic accounting systems data. Accessing these source records is necessary for DCAA to efficiently perform its audit mission and support the Contracting Officer.

Specificity of the authority for direct and online access to contractor’s data would improve both the audit and DCAA’s ability to support the Contracting Officer. For example, direct, read-only online access would allow DCAA to respond more quickly to contracting officers because we could obtain the necessary data directly rather than having to repeatedly request the data from a contractor representative. Furthermore, the access would decrease the amount of costs and personnel resources needed by contractors to support audit requests for data. In addition, online access would advance DCAA audit efforts by allowing real time contract cost monitoring and continuous risk analysis, including the use of advanced data analytics. DCAA is continuing to determine what specific legislative proposal is necessary to ensure that DCAA has appropriate access to a contractor’s online data.

Permit us to respectfully disagree with the foregoing. We disagree with both the premise and conclusions put forth in the official report from DCAA to the U.S. Congress.

We disagree with the foundational premise that the contract clause 52.215-2 grants to DCAA auditors the right to access contractors’ electronic systems—including systems on which accounting data are stored—at their discretion and without limit. Indeed, a review of the clause language indicates that DCAA does have broad access, but certainly not unfettered access. For example, the clause grants DCAA access to the contractor’s physical plant—but only the parts of the plant “engaged in performing the contract” and only at “reasonable times.” Consequently, it seems unlikely that a court would interpret that clause as granting DCAA open access, 24 hours per day, seven days per week, into a contractor’s accounting system, to include those aspects of the accounting system unrelated to government contract costs.

Moreover, we disagree with the notion that online access to contractors’ accounting systems would permit DCAA auditors to “respond more quickly” or increase efficiency. We disagree with the implicit accusation that contractor audit liaison personnel are unresponsive to DCAA audit requests (“repeatedly request the data”). And we certainly disagree with the conclusion that, if DCAA had unfettered online real time access to contractors’ accounting systems, then those contractors could lay off their audit liaison personnel (“decrease the amount of costs and personnel resources needed by contractors to support audit requests”). We disagree with essentially every single word written by DCAA leadership to Congress.

We disagree because our experience has proven otherwise.

Now, we need to be careful here, because of client confidentiality. But following are some general statements based on our first-hand experience.

• Modern ERP accounting systems are expensive, complex, and difficult to learn. In order to learn the contractor’s individual, customized, implementation of Oracle Financials, PeopleSoft, SAP R/3 or whatever, employees often have to take multiple classes spanning many hours if not weeks of training. These multi-segment systems don’t come out of a box; nor are they birthed, like the goddess Venus, fully formed and riding in a seashell. So who’s going to train the DCAA auditors in the nuances of the contractor’s ERP? The contractor? Don’t be ridiculous. Show us that requirement in a contract clause; we are confident you will not be able to do so. (Truth be told we know of at least one contractor who’s spent tens of thousands of dollars training DCAA auditors in accessing its ERP system. The problem is that the auditor staff doesn’t stay the same, auditors forget how the system works because they only access it every so often, etc. Thus, the contractor spends more money every year retraining DCAA auditors.)

• Modern ERP accounting systems have rigorous security features, including individual roles, rotating passwords, and automatic account disablement based on too many login errors or a failure to access the system within a given time period. For example, if a registered user doesn’t access the system at least once every six or eight weeks, then the account is disabled. Thus, if an auditor doesn’t access the system every so often, then the account may be disabled and the auditor will be prevented from accessing the system thereafter, until the account is reset. In order to get the account reset, the auditor will have to call the contractor’s IT Security function. How will the auditor get the name/number of the right person to call? Don’t say the auditor should call the contractor’s audit liaison personnel, because they were laid off when DCAA was given their system access. The fact of the matter is that where DCAA auditors have been given access to contractors’ ERP systems, the contractor will subsequently spend a not-insignificant amount of time maintaining that access on behalf of the auditors. In other words, giving DCAA auditors access to the accounting system costs more money, not less.

• When DCAA auditors have been given access to contractors’ accounting systems, a new problem emerges. Suddenly, the auditors’ system reports don’t tie to the contractor’s reports, and now it is the contractor’s job to reconcile the two versions of the report. In other words, now the contractor has to diagnose the errors made by the auditor in running the report. So instead of giving DCAA access leading to a reduction in contractor audit support personnel, the reverse is actually true—the contractor has to add personnel who can review DCAA’s methodology and explain where the errors were introduced. (Yes. This presupposes the errors were on DCAA’s side. That’s not always the case; but it is the case in about 90% of the discrepancies we’ve seen.) Further, notice who is now performing the analyses and reconciliations: it is no longer the auditor and is now the auditee. Ironic, no?

DCAA leadership would like Congress and others to believe that DCAA’s inability to access contractors’ accounting systems in real time is a significant impediment that delays audits. That assertion is demonstrably wrong. Experience has shown that, the more access auditors are given, the more problems are created, the more work is generated for contractor support personnel, and the longer the audits take. Experience has shown that the most efficient way for DCAA auditors to get the accounting information they need for their audits is to simply and clearly request it from the contractor’s personnel who are trained in the system and know how to extract it.