On October 15, 2009 the Defense Acquisition Reform Panel (DARP) of the House Armed Services Committee (HASC) conducted a hearing entitled “Can the Department of Defense Protect Taxpayers When It Pays Its Contractors?” Unsurprisingly, the hearing was another pile-on for DCAA where the Government Accountability Office (GAO) rehashed its prior testimony before the Senate, the Committee Members went off, and DCAA Director Stephenson tried to deflect the attacks onto both DCMA and DOD contractors.  In other words, it was just another day inside the Beltway.

DARP Chair Rob Andrews (D-New Jersey) opened the hearing with a “hypothesis” that “DOD will enter into risky contract types when they are not necessary” and that “DOD’s process for auditing and correctly paying bills submitted under riskier contracts will break down.” Chairman Andrews continued—

 

Today’s hearing is important not just because these problems have occurred, but because there is substantial disagreement between DOD and GAO over how best to mitigate risk in reimbursing its contractors. I anticipate that we will hear a vigorous debate today about how DOD can best organize its audit and contract management functions to both protect the taxpayer and serve the warfighter. And I should emphasize that this committee, as always, is highly attuned to the mission of serving the warfighter. In mitigating the risks of overpayment, we must not impede the timely delivery of critical war materiel. With the help of our witnesses today, we will try and find the right balance of these priorities.

Mr. Greg Kutz of the GAO added nothing new to his prior testimony before the Senate.  He testified, “GAO found substantial evidence of widespread audit quality problems at DCAA. In the face of this evidence, DOD, Congress, and American taxpayers lack reasonable assurance that billions of dollars in federal contract payments are being appropriately scrutinized for fraud, waste, abuse, and mismanagement.”

 

DCAA Director April Stephenson offered a mixed bag of testimony spanning 30 double-spaced pages.  She provided background on the audit agency, discussed “audit challenges,” and offered DCAA’s assessment on “vulnerabilities in the acquisition process.”  In addition, she discussed actions the audit agency is taking in response to the various findings contained in recent GAO and DOD Inspector General reports.  Following are some selected quotes that may be of interest.

• DCAA audit procedures include tests of key contractor internal controls that we believe a contractor business system should possess to ensure the Government’s interests are protected and the risk of contractor overpayments is minimized. DCAA performs these audits at contractor locations that charge significant contract costs to the Government. Generally Accepted Government Auditing Standards require DCAA to report all significant deficiencies identified during its review of contractor business systems and to determine whether the deficiencies are considered material weaknesses. Comment:  In fact, DCAA does NOT report all significant deficiencies in its internal control system review, nor does it distinguish between deficiencies and material weaknesses.  Instead, it considers all findings to be significant deficiencies and assigns a binary pass/fail rating to the control systems.  Its approach has been consistently criticized by GAO, DOD IG, and the Commission on Wartime Contracting.
• … of the top 100 DoD contractor segments that are audited by DCAA, approximately 69 percent have at least one business system with a significant internal control deficiency. Comment:  DCAA audit metrics expect that 45 percent of all audits will contain at least one finding.  Moreover, as GAO and DOD IG have both found significant issues with DCAA audit quality and support for its findings, such statistics should be considered suspect.
• During the life of cost reimbursable contracts, DCAA performs a number of audits covering contractor compliance with contract terms depending on the size of the contract and risk associated with the contractor. Comment:  Outside of testing of direct costs incurred by contractors in Iraq and other Southwest Asia battlefields, DCAA does not normally perform testing of contract costs.  Let’s repeat that for clarity:  The Defense Contract Audit Agency does not normally audit contract costs. The audit agency does not even have an activity code for such audits.
• Although contractors recognize the need for DCAA access to records, there is often a disconnect on the expectation for “timely” access and contractors often delay auditors access to information in an attempt to stall the timely completion of audits. Such delays are unacceptable. One of the more significant complaints contractors have with DCAA is that we request too much data and have unrealistic due dates. These complaints are without merit and represent an attempt to impede DCAA audits. DCAA needs to be given real-time access to contractor records and people in order to perform effective audits. Comment:  There is little evidence that DCAA’s lack of audit quality is tied to any attempt by contractors to “delay” or “impede” audits.  To the contrary, contractors often point to DCAA’s delays in issuing audit reports as a source of frustration.  Further, there is no evidence that DCAA’s audit quality would improve if it had “real-time access” to contractor records and personnel.  Lack of access has not been a critical issue cited by GAO and DOD IG; instead, lack of evidentiary support for conclusions and lack of documentation related to changes in audit findings have been reported as key concerns by those two oversight agencies.
• Commercial item procurements are exempt from the protection of cost overpayments and excessive contract prices under the acquisition regulations, the Cost Accounting Standards, and the Truth in Negotiations Act. … The situation cannot be rectified unless the statutory definition of “commercial item” is amended and clarified appropriately. … DCAA believes that this language is a contract pricing vulnerability where fair and reasonable prices may not be established due to the lack of competition and the lack of a requirement for cost or pricing data. Comment: Although there have been some well-publicized misclassifications of acquisitions as commercial items, Ms. Stephenson ignores recent revisions to the FAR designed to remedy those problems.  Moreover, the determination of what is (and what is not) a “commercial item” is a contracting officer determination, not an auditor determination – and there is no evidence of systemic misapplication of contracting officer judgment in this area.
• For example, a DCAA audit disclosed where a major contractor was earning profit in excess of 30 percent for a “competitively” awarded firm-fixed price contract. The contracting officer awarded the contract expecting to use full and open competition, which exempted the contractor from submitting cost or pricing data. However, the incumbent was the only contractor to bid on the contract. Due to the absence of other competitive bids and the absence of analysis of cost or pricing data, the contractor earned a windfall profit in excess of 30 percent. Comment:  According to the FAR 15.403-1(c)(1)(ii), the situation described met the definition of adequate competition.  If the contractor received a “windfall profit” it was not because of a lack of competition.
• We recognize the GAO’s concerns and initiated a project in 2009 to reassess the manner in which DCAA tests contractor business systems. Although the auditing standards do not require that DCAA express an opinion on the adequacy of the contractors’ internal control systems, we did so to provide contracting officials meaningful information to approve or disapprove a contractor’s system as stipulated under the Federal Acquisition Regulations (i.e., the adequacy of the contractor’s internal control systems affects the accuracy and reliability of the underlying data processed and generated by the accounting system). We are currently assessing the type of systems DCAA will need to audit and the type of opinion to be provided. … We anticipate our revised processes will be tested in early FY 2010 starting with the contractor’s system for preparing interim and final billings to the Government. We envision the revised processes will consolidate testing of contractor billings currently performed in three different types of audits into a single audit. Comment:  One of the most consistent criticisms of DCAA has been that the audit agency recently has created a binary pass/fail overall control system adequacy determination/recommendation without providing any discrimination between significant and insignificant findings.  Another criticism has been that DCAA’s list of 10 contractor internal control systems is not based on regulatory guidance.  Importantly, Ms. Stephenson did not address those concerns in her testimony; however, the potential reassessment of “the type of systems” and “the type of opinion” may lead to improvements in this area.
• In its recent review, the GAO concluded that DCAA’s independence was impaired primarily due to auditors providing input on draft corrections to internal control policies and procedures and then auditing the final policies and procedures. In several instances, the auditors issued a no-exception audit report when the contractor corrected the deficiencies during the audit. It is not uncommon for contractors with system deficiencies to seek input from the auditors while they are developing corrections to the systems. In many instances, providing feedback throughout the process expedites the correction of the deficiencies. However, the GAO has concluded that this “feedback” impairs the auditors’ objectivity as they will audit information that they have provided feedback on prior to implementation. We have corrected both of these issues. Auditors no longer provide feedback to contractors on draft corrections to systems and no longer remove deficiencies from audit reports when the deficiencies are corrected during the audit. Comment:  This is an area in which GAO pressure is impeding the audit process; the “independence” issues that GAO identified are nothing more than communication between auditor and auditee, and should not be considered to be GAGAS violations.  Performing a high-quality audit requires the exercise of discretion on the part of the auditor.  Despite GAO’s concerns, it is patently ridiculous to prohibit auditors from identifying deficiencies that require corrective action, identifying the necessary action(s) that would result in the deficiencies being corrected (and communicating them to the contractor), and then confirming that those corrective actions have been implemented effectively.  If the auditors can’t identify what corrective actions are necessary, how can they determine that the deficiencies have been corrected? Rather than acquiesce to GAO’s pressure, DCAA needs to rethink its position.  If necessary, it should stop asserting that such audits are performed according to GAO’s idea of GAGAS.

Finally, Mr. Shay Assad (Acting Deputy Under Secretary of Defense, Acquisition, & Technology) testified in a relatively reasonable and forthright manner.  Following are some selected quotes that may be of interest.

 

• Occasionally, there are differences of opinion between the DCAA auditor and the contracting officer on audit findings. That is to be expected as DCAA is accounting oriented, while the contracting officer is business oriented, and must balance many factors and considers input from many technical advisors, including DCAA, in his decision-making process. Comment:  Mr. Assad offered his office as arbiter between the two agencies.  It is unclear whether Ms. Stephenson has, or would, agree to that offer—she may consider Mr. Assad’s position to be biased in favor of DCMA.
• The [GAO] report adopts a position that because DCAA is serving the interests of Contracting Officers, that DCAA is not auditing in the interest of the public. DCAA is a service organization created to provide financial information, audits, and advice to support decision making by DoD Contracting Officers. DCAA serves the public interest by providing timely and useful information to Contracting Officers. It is erroneous to imply that contracting officers do not seek to protect the public interest. The contracting officer is bound by regulation to meet the public interest in the broadest sense, for the entire matter surrounding a contract. The contracting officer, in the award and administration of a contract, is the government official responsible for insuring that all requirements of law, executive orders, regulations, and all other applicable procedures, including clearances and approvals, have been met. Any logic that presumes that by focusing on supporting contracting officials, DCAA somehow failed to act in the public interest is inappropriate in our view. … In order to perform these responsibilities, contracting officers should be allowed wide latitude to exercise business judgment. Comment:  We agree with Mr. Assad’s assessment.  The DCMA contracting officers have warrants for a reason: to act as authorized acquisition agents on behalf of the Federal government.  To state (or imply) that they do not protect the public interest when they disagree with a DCAA audit recommendation betrays a fundamental misunderstanding of their role in the acquisition process.
• Timeliness is a critical element of quality. Delays in award have consequences to the warfighter.  Contracting officers are required to consider those consequences and hence, they are very concerned that DCAA has not been able to consistently deliver timely reports and advice.   … A contracting officer knows that delays can impact funding decisions and disrupt program management plans. Contracts are often interrelated and codependent, such that a delay in awarding one contract can delay an entire system and put off fielding dates, with consequences distributed and cascading through a range of other contracts and plans, and might ultimately result in mission failure.  The contracting officer, also by regulation, has to consider and respect the opinions of other specialists and not just that of the auditor. A good audit in time is better than an extraordinary audit that is late and never used. An audit is a tool the contracting officer uses to negotiate a contract, but in order to realize the benefits of the auditor’s work, the audit must be timely. (Emphasis in original.) Comment:  We agree with Mr. Assad’s comments; however, we are concerned that such sound bites will not play well and thus they may be ignored. DCAA has walked back from timeliness metrics imposed on its auditors, while focusing on timeliness standards imposed on contractors.  Meanwhile, it still has not found the formula to issuing high quality audit reports and instead imposed multiple layers of management reviews, thus delaying audit reports that are still of dubious quality and usefulness to its DCMA contracting officer customers.
• DCAA should use auditing standards and techniques that produce creditable information that can be relied upon by the contracting community in the awarding and administrating of contracting. However, we believe that all DCAA reports and reviews types should be examined to determine if the standard being applied and reported by DCAA is the appropriate standard given the requirement causing the audit or review to be performed. Comment: Again we agree and urge DCAA to consider excluding certain audits/reviews from GAGAS in order to permit auditors to exercise sound discretion and engage in open communication with those being audited, in order to minimize unnecessarily duplicative audits and follow-ups.
• The nature of the review program for any given contractor should not have changed due to placement on Direct Billing. … Where DCAA believed based on past performance or poor systems that there was a significant chance of improper billing, the contractor was not to be included in the Direct Billing program. The review program for the contractors should have been the same as it would have been based on risk factors even if there was no Direct Billing program. The problem with voucher reviews both before the Direct Billing program and after the initiation of the program is that DCAA did not have sufficient staff to perform the reviews required by the risk-based analysis. New contractors and problem contractors should have voucher reviews before payment just as required by DCAA policy. Established contractors with adequate past performance should have vouchers reviewed after payment using a reasonable plan tailored to the contractor’s circumstances just as required by DCAA guidance. Changing the decision authority for participation in Direct Billing should have no impact on what vouchers are reviewed. Taking a contractor off of the program does not ensure that the vouchers will be properly reviewed prior to payment if there is not sufficient staff to perform the reviews. Comment:  Again we agree but note that DCAA has not implemented this point of view in their audits of contractors who are not authorized for Direct Billing.  In our experience, DCAA auditors spend the majority of their time either auditing new business cost proposals or invoices/vouchers related to existing contracts, leaving little time to address contractor internal control systems, compliance with CAS, or other matters.

 

For those interested, we offer a video record of the hearing here.