New DCAA audit guidance, published June 30, 2014, heralded a change in the way auditors will report deficiencies in contractors' business systems. This is important for a couple of reasons.

First and foremost, the DCAA approach to reporting bizsys deficiencies has not corresponded to the approach mandated by Congress and codified in the DFARS. We pointed out that little nuance in this article. As we reported, DCAA stated that its unique approach to identifying and classifying deficiencies was mandated by GAGAS.

Second, the approach chosen by DCAA resulted in a flurry of "deficiency reports" issued to Contracting Officers, in which every deficiency tended to be classified as a "significant deficiency." That approach was founded in a theory that any deficiency identified at a major contractor was obviously a significant deficiency, a position that was contrary both to regulation and common sense. Because all reported deficiencies were equal, the CO had to handle them in a similar fashion, no matter how trivial the matter being reported. Obviously, this situation led to a number of Review Board cases where the CO had to submit an override package and receive approval to exercise the independent business judgment that comes with a Certificate of Appointment. That process took time and it took time away from other pressing matters.

DCAA's new audit guidance clarified that the previous guidance didn't really mean what it said. The new guidance stated:

[The DCAA HQ] Policy [Directorate] did not envision auditors reporting instances of the noncompliances less severe than significant deficiency/material weaknesses separately in an audit report without also reporting significant deficiencies as defined by the DFARS business system criteria (DFARS 252-242.7005). The MRD did not provide specific instructions on how to report noncompliances that are less severe than a significant deficiency/material weakness but warrant the attention of those charged with governance when no significant deficiency/material weakness needs to be reported.

As we parse the foregoing paragraph we are pleased to see that not all bizsys deficiencies are created equal. That was always the case, but it's nice to see an official DCAA acknowledgement.

Further, the audit guidance directs auditors to report non-significant deficiencies via Memo instead of via Deficiency Report. (Another Memo … sigh.) "The memorandum will include a statement of condition and recommendation (SOCAR) and provide the contracting officer with sufficient information to understand the condition and the severity of the deficiency (i.e., a fully-developed audit finding)."

But that's a good thing, because contractors and COs will be able to differentiate between a Deficiency Report that transmits "significant deficiencies" found in a business system from a less-than significant deficiency. That's going to reduce stress and workload all around.

The MRD doesn't say, but we suspect the Memos will not be reported in the DCMA Contract Audit Follow-Up (CAFU) system … which means time and attention can be focused on more pressing matters.