DCAA can’t catch a break.

First, NASA’s Office of Inspector General voiced concerns about DCAA’s decision to use a “risk-based” approach to determining which contractor annual proposals to establish final billing rates it chooses to audit. Those annual proposals – also known as “incurred cost proposals” – are used by Contracting Officers to determine final contract prices for cost-type contracts (and some other types such as Time & Materials). The audit of those annual proposals, historically performed by DCAA, is the primary means by which the NASA Contracting Officers ensure that NASA is paying only allowable, allocable and reasonable direct and indirect costs.

Did we say primary means? We meant to say only means. Only. As in, the NASA IG found that “NASA contracting officers relied almost exclusively on DCAA’s incurred cost audit process to identify unallowable, unreasonable, and unallocable costs. Contracting officers we spoke with pointed to these audits as their only means of identifying questioned costs.” Only. That’s what we meant to say.

Without DCAA performing audits of the annual proposals submitted by NASA contractors, the NASA COs were simply not going to have the means to identify any unallowable costs. That was not a great position in which to find the Space Agency, according to its Inspector General.

The NASA OIG was concerned that DCAA’s new risk-based approach to audit triage was going to create more risk for the Space Agency. We agree with that assessment and, indeed, voiced similar concerns about 36 months ago. And we were not alone in noting some concerns. As we wrote in another blog article, GAO issued a report that rang some alarm bells. We noted that “… there are many parties—both within and outside of government—who think the current DCAA approach to managing its audits has left the Defense Department in an untenable position.”

So to recap the past 36 months of history, DCAA changed its audit approach such that certain contractor annual proposals to establish final billing rates would no longer be reviewed. The GAO issued a report voicing some concerns about that new approach. The DoD Inspector General issued a report voicing some concerns about that new approach. The NASA Inspector General issued a report voicing some concerns about that new approach. We wrote some blog article voicing some concerns about the new approach.

And now the Department of Energy Inspector General has issued a report voicing some concerns about the new approach.

Readers not familiar with DOE’s contracting environment should know that there are basically two types of DOE contracts. There are the humongous Management & Operating contracts and then there’s everything else. There are 28 M&O contracts, all of which are cost-reimbursable, and all of which are really, really large. The M&O prime contractors engage hosts of subcontractors to perform the required work. According to the DOE IG, the DEARS 970 regulations state that those M&O primes are responsible for auditing those subcontractors when the subcontract prices are dependent on costs incurred. In the words of the DOE IG –

When these subcontracts are structured as cost-type, including time and materials, and cost reimbursable subcontracts, M&O contractors are contractually required to ensure that associated costs incurred are audited to provide assurance that the costs are allowable. The M&O contractors may use their internal audit staff, engage contract auditors, or use the services of the Defense Contract Audit Agency (DCAA) to audit the subcontractors. Internally performed audits must, at a minimum, meet professional standards prescribed by the Institute of Internal Auditors. M&O contractors presumably rely on audits of subcontractors when completing required annual certifications that all of their incurred costs are allowable.

The DOE IG had concerns with the M&O primes’ lack of procedures to assure that their subs were being audited. But that’s not what we’re going to discuss in this article. Instead, we are going to discuss the rest of the DOE contract environment – the non-M&O contracts. Just to put things into perspective, the universe of non-M&O contracts includes (but is not limited to) “more than 40 prime contracts valued at more than $90 billion” which involves “annual expenditures of about $5 billion” within the DOE’s Office of Environmental Management. In addition, the National Nuclear Security Administration (NNSA) has “several” non-M&O contracts, “including the nearly $5 billion contract to construct the Mixed Oxide Fuel Fabrication Facility at the Savannah River Site in South Carolina.” So while the M&O contracts may get a lot of management (and Congressional) attention, the fact of the matter is that the non-M&O contracts are a non-trivial part of the DOE’s spending.

In its report on the non-M&O contract universe, the DOE IG stated –

Historically, the Department has met its non-M&O contract cost audit requirements through an agreement with the Defense Contract Audit Agency (DCAA). … However, over the past several years, as responsible Department officials confirmed, DCAA has been unable to perform many of its audits on a timely basis. In fact, DCAA itself reported delays from 1 year to more than 8 years for audits of the Department's non-M&O contracts and related Department-funded subcontracts. These delays resulted in a backlog of audits of contracts and subcontracts with incurred costs valued at billions of dollars per year.

DCAA has been unable to meet the non-M&O contract audit needs of the Department and has asserted that it simply does not have the resources to meet all Department of Defense and civilian agency audit requests. As it pertains to the Department, this situation was exacerbated by the fact that the Department lacked a comprehensive strategy to ensure that non-M&O contractor costs were subjected to necessary audits.

Looking inside the audit report, the DOE IG found that –

As the DOE IG noted, the Contract Dispute Act has a 6-year Statute of Limitations, the expiration of which makes recovery of improperly billed costs difficult, if not impossible. (We’ve written extensively on the CDA SoL.) The DOE IG found that DCAA’s inability to support the DOE’s audit needs with respect to non-M&O contractors impeded its ability to administer those contracts effectively. The DOE IG wrote –

Thus, significant delays in the contract audit process, such as the delays the Department has already experienced, would likely make it impossible to recover contractor incurred costs even if they are ultimately found to be unallowable. A recent Department contracting officer decision illustrates the impact of the statute of limitation issue: the Contracting Officer for the nearly $5 billion Shaw AREVA MOX Services, LLC (Shaw AREVA) contract recently suspended DCAA’s work on the 2005 Shaw AREVA incurred cost audit because she concluded that the statute of limitations had expired, rendering it impossible to recoup any questioned costs. Although DCAA is currently working on Shaw AREVA's 2006 incurred costs, the risks associated with exceeding the statute of limitations on this and other contracts remains.

The DOE IG discussed DCAA’s “risk-based” approach to choosing which contractors’ submissions to audit. It stated –

DCAA has initiated action to reduce its backlog of audits, but its actions to date have primarily targeted the Department of Defense and have not directly benefited the Department [of Energy]. … While DCAA's Low-Risk Incurred Cost Initiative has reduced the backlog of contract audits at the Department of Defense, its implementation at the Department in its current format would result in the failure to audit a majority of the Department's non-M&O contracts. Specifically, only about 20 percent of the Department's non-M&O contractors' incurred cost submissions would be subject to mandatory audit, with the other 80 percent identified as low risk and only subject to being randomly selected for audit. Thus, over time, as additional contracts are awarded, the Department's backlog of unaudited contracts would likely grow more severe. The practical impact of such action is to limit the Department's access to an important tool that helps detect and prevent contractor claims for questionable costs. In our view, this is an unacceptable risk going forward

The audit report discussed means by which DOE had “supplemented” the audit gaps left by DCAA’s inability to perform timely incurred cost audits. Those supplemental approaches included hiring a public accounting firm and hiring non-M&O contractors’ internal auditors to audit the submissions of other contractors. The IG also reported that “the Environmental Management Consolidated Business Center, which provides Environmental Management customers with business and technical support services, including contracting support, has explored the possibility of standing up its own audit function or utilizing independent public accounting firms to conduct incurred costs audits.” The DOE IG found those supplemental approaches “laudable.”

Nonetheless, the DOE IG made a couple of recommendations to address the gap in audit coverage of the non-M&O contractors. It recommended that the DOE –

1. Coordinate with DCAA to develop and implement an acceptable version of the risk-based audit approach to incurred cost audits.

2. Develop a comprehensive strategy to supplement DCAA’s [lack of] audit coverage until the backlog of unaudited contractor submissions is eliminated.

The DOE IG found management receptive to its recommendations. It reported –

Department and NNSA management concurred with each of the report's recommendations and indicated that corrective actions had been taken or were planned to address the identified issues. Specifically, Department management noted that it has stated its expectation that required audits must be obtained, whether from DCAA or KPMG; has issued guidance to that effect; has put a contract in place for audit services to ensure Contracting Officers have an alternative to DCAA to obtain quality audits; is coordinating closely with DCAA on its audits; and is following up with contracting activities to ensure they understand what is expected and have the appropriate support. Department management also noted that they believe it is important to recognize that whatever good intentions DCAA has, its track record makes it prudent to avoid assuming a marked change in DCAA's support. Additionally, they stated that all stakeholders, not just the report's addressees, have a role in ensuring required audit support is obtained.

To sum up, the Department of Energy seems to have recognized that it can no longer count on DCAA to provide the level of incurred cost audit support that it needs. It has developed alternatives, including awarding an audit support contract to KPMG. That’s all well and good.

But what is not being addressed is how DOE will implement its recent management decision to embrace the DFARS business systems administration regime. As we reported, “DOE has adopted a similar, yet subtly different, approach to contractor business system administration [than that used by DoD].” Though there are differences, the concept is much the same: non-M&O DOE contractors may be subject to payment withholds if their business systems are found to be inadequate.

Readers may recall that the DoD has experienced growing pains with its approach to administering the business systems rules – so much so that it has proposed to dramatically reduce DCAA’s role in the processes. Given the risks and concerns regarding DCAA’s audits of DOE contractors’ proposals to establish final billing rates, we wonder if DOE management is second-guessing its decision to embrace the DoD’s approach to administering contractor business systems, which at present is heavily reliant on DCAA’s participation.