• Increase font size
  • Default font size
  • Decrease font size
Home News Archive The 2018 National Defense Authorization Act—DCAA Stuff

The 2018 National Defense Authorization Act—DCAA Stuff

E-mail Print PDF

We don’t like to talk about pending legislation very much because things tend to change, and there’s no reason to get all excited about certain NDAA provisions until they become finalized into a public law. Thus, while others were getting upset about this thing or getting excited about that thing, we were laying back (as we do every year), waiting for Bob Antonio to publish his annual analysis of the final language.

Frankly, we count on Bob and his annual analysis, which is published on his essential WIFCON site. It’s a critical resource and we’d be lost at sea without it.

Obviously we care a lot about carefully scrutinizing the final NDAA. But why should you care about it? Why should you care about any NDAA provision? The answer to those questions is simple. If you want to know what Congress has directed DoD components (including the DAR Council) to accomplish in the next government fiscal year, you need to read the directions being provided to them. Or, to put it another way, if you wait for the DAR Council to issue a final rule, you are going to be surprised and you will have to scramble to any implement necessary changes to comply with that final rule. If you wait for the DAR Council to issue proposed rule-making, you’ll have some more runway to make the changes—but it won’t be much. But if you read the NDAA and see what proposed rule-making the DAR Council will be adding to its agenda of open cases, then you won’t be surprised and you’ll have plenty of runway to be ready for any new compliance requirements.

That’s why you should care.

As always, we are not going to talk about every single little thing. We’re going to talk about stuff that interests us. You may want to do your own research, using the link in the first paragraph, above. Today’s article is going to focus solely on DCAA stuff.

DCAA Stuff

Last year’s NDAA (Public Law 114-328) contained a requirement at Section 820 that would have permitted contractors to hire an independent auditor to audit their indirect costs for “allowability, measurement, assignment to accounting periods, and allocation.” If a contractor obtained such a report, then “the Defense Contract Audit Agency may audit direct costs of Department of Defense cost contracts and shall rely on commercial audits of indirect costs without performing additional audits, except that in the case of companies or business units that have a predominance of cost-type contracts as a percentage of sales, the Defense Contract Audit Agency may audit both direct and indirect costs.” (Emphasis added.)

That was an interesting notion, to say the least. And we’re not going to surprise you when we tell you that DCAA didn’t like it one bit. Director Bales told Congress that her audit agency was going to ignore that statutory requirement, and that she was confident Congress would repeal it in the next year’s NDAA.

Indeed, that is what happened.

Section 804 of the 2018 NDAA repealed that provision.

However, Section 803 of the 2018 NDAA added another, similar provision. It requires that DCAA change the manner in which it performs “incurred cost audits” (i.e., audits of contractors’ annual submissions of final billing rate proposals) and, if the changes don’t get the current backlog of unaudited proposals down to an acceptable size, then “the Secretary of Defense shall use qualified private auditors to perform a sufficient number of incurred cost audits of contracts of the Department of Defense.”

Early legislative provisions would have mandated that certain percentages of the proposal backlog be audited by “qualified private auditors” (QPAs) and, at one point, it looked like a contracting officer was going to have to discretion to compete DCAA against QPAs to select the auditor who would deliver the best audit value for the lowest price—but that exciting change was negotiated away during conference.

What does Section 803 require?

First, when performing incurred cost audits DCAA is to use “commercially accepted standards of risk and materiality.” The audit agency has until October 1, 2020, to implement conforming audit procedures. (This was a negotiated compromise from early language, which would have specified exact materiality thresholds to be used by DCAA.)

Second, DCAA must “eliminate, by October 1, 2020, any backlog of incurred cost audits of the Defense Contract Audit Agency.” (Emphasis added.) Currently, DCAA maintains the fiction that a two-year backlog of such audits is acceptable. This provision blows that up, confirming that no backlog is acceptable. To reinforce the issue, the NDAA requires DCAA to “ensure that incurred cost audits are completed not later than one year after the date of receipt of a qualified incurred cost submission.” In other words, once a contractor proposal is determined to be adequate, then DCAA has one year—12 months—to complete its audit. Another provision within Section 803 gives DCAA 60 days (after receipt) to perform its adequacy review.

Moreover, “Not later than October 1, 2020, and subject to paragraph (5), if audit findings are not issued within one year after the date of receipt of a qualified incurred cost submission, the audit shall be considered to be complete and no additional audit work shall be conducted.” (Emphasis added.) Paragraph (5) is the loophole: “The Under Secretary of Defense (Comptroller) may waive the requirements of paragraph (4) on a case-by-case basis if the Director of the Defense Contract Audit Agency submits a written request.”

DCAA began performing “multi-year” audits in the past couple of years, to leverage efficiencies. Director Bales testified that the audit agency realized a 40 percent efficiency savings from that approach. Contractors weren’t so sanguine about these audits and expressed concerns during their testimony. Section 803 limits DCAA’s use of multi-year audits. DCAA may only use multi-year audits when it cannot meet the 12-month completion requirement, or when a contractor requests them and provides a justification to the Defense Comptroller.

(Speaking of loopholes, that’s an interesting one—right? DCAA must complete ICS audits in 12 months but if they don’t, then they can use multi-year audits to catch up. Given that it currently takes DCAA nearly three years to perform an audit, it very much seems as if multi-year audits will continue to be the norm, despite contractor reservations about their use. Further that loophole seems to contradict the strict requirement found elsewhere in Section 803 that DCAA must complete its ICS audits in 12 months or else “no additional audit work shall be conducted.”)

Let’s summarize here:

  • DCAA must perform an adequacy review on contractors’ proposals to establish final billing rates within 60 days from receipt. No exceptions.

  • Once DCAA determines that the proposal is adequate, it must perform its audit within 12 months. No timeframe was given for issuance of a report, but the audit work must be completed within 12 months.

  • DCAA may request waiver of the 12-month rule “on a case-by-case basis”.

  • If DCAA doesn’t complete its ICS audit in 12 months, it may use multi-year audits to catch up. (It’s really not clear how, since additional audit work is prohibited. Perhaps Congress intended that multi-year audits may be used on >future> ICS audits at that contractor.)

But wait. There’s more.

The DoD must begin using QPAs to perform incurred cost audits. Therefore the ICS audit will no longer be the exclusive domain of DCAA. The Secretary of Defense must submit to Congress a plan to bring them on board by not later than October 1, 2018—which is quite quick by government standards. Further, by April 1, 2019, at least one contract or task order must have been issued to two or more QPAs for performance of ICS audits. “The Secretary of Defense shall consider the results of an incurred cost audit performed under this section without regard to whether the Defense Contract Audit Agency or a qualified private auditor performed the audit [and] the contracting officer for a contract that is the subject of an incurred cost audit shall have the sole discretion to determine what action should be taken based on an audit finding on direct costs of the contract.”

There are certain specific requirements associated with QPAs but, as Apogee Consulting, Inc., is not a QPA and we are not going to be hiring QPAs, we’re going to skip them. If you are interested in the details of how QPAs will be used to augment DCAA audit resources, feel free to visit WIFCON and do your own research.

But there’s more. We’re not done yet.

Recently we wrote about the 2017 DCAA quality system external peer review, performed by the DoD Office of Inspector General (OIG). We were surprised that DCAA passed its audit, given the number of findings. (Nearly 40 percent of all selected audit reports had deficiencies.) At the end of our article, we called for another entity to perform that external peer review, given that there was a reasonable perception of impaired independence and objectivity when a sister DoD entity performed it.

Well, the 2018 NDAA addresses our concern. Section 803 requires that—

Effective October 1, 2022, the Defense Contract Audit Agency may issue unqualified audit findings for an incurred cost audit only if the Defense Contract Audit Agency is peer reviewed by a commercial auditor and passes such peer review. Such peer review shall be conducted in accordance with the peer review requirements of generally accepted government auditing standards, including the requirements related to frequency of peer reviews, and shall be deemed to meet the requirements of the Defense Contract Audit Agency for a peer review under such standards. Not later than October 1, 2019, the Secretary of Defense shall provide to the Committees on Armed Services of the Senate and the House of Representatives an update on the process of securing a commercial auditor to perform the peer review ….

Oh, but there’s more.

Circling back to the start of this article, we noted that early NDAA language would have mandated certain numeric materiality standards. DCAA really didn’t like that, since it would have mandated by statute when costs were material in amount and when they were immaterial in amount. Conference negotiation softened the initial language significantly. Now Section 803 requires—

Not later than October 1, 2020, the Department of Defense shall implement numeric materiality standards for incurred cost audits to be used by auditors that are consistent with commercially accepted standards of risk and materiality. [and] Not later than October 1, 2019, the Secretary of Defense shall submit to the congressional defense committees a report containing proposed numeric materiality standards required under paragraph (1). In developing such standards, the Secretary shall consult with commercial auditors that conduct incurred cost audits, the advisory panel authorized under section 809 of the National Defense Authorization Act for Fiscal Year 2016 (Public Law 114-92; 129 Stat. 889), and other governmental and nongovernmental entities with relevant expertise.

Thus, while Congress is forebearing from imposing exact numerical materiality standards on DCAA, it is requiring DCAA to propose exact numerical materiality standards to Congress, after consultation with the Section 809 Panel and “other … entities with relevant expertise.”

It looks like exciting times are ahead for DCAA and its auditors!

In the meantime, there’s plenty more to discuss in the 2018 NDAA, and we’ll be getting to it in future articles.




Effective January 1, 2019, Nick Sanders has been named as Editor of two reference books published by LexisNexis. The first book is Matthew Bender’s Accounting for Government Contracts: The Federal Acquisition Regulation. The second book is Matthew Bender’s Accounting for Government Contracts: The Cost Accounting Standards. Nick replaces Darrell Oyer, who has edited those books for many years.