We recently wrote about DCAA guidance that ostensibly discusses changes to the FAR.  The changes mandate (among other things) contractor codes of ethics/business conduct, ethics compliance employee training programs, effective internal control systems, and disclosure of contract-related wrongdoing to the appropriate Government agency Inspectors General.  (We noted that DCAA used the opportunity of disseminating its audit guidance to attempt to expand auditor access to contractor records, notwithstanding both FAR Council promulgating comments and judicial decisions to the contrary.)  Now comes a September 22, 2009 Government Accountability Office (GAO) report card on DOD’s oversight of ethics programs, in which (unsurprisingly) GAO opines that DOD can do a better job.

We have written in the past, and will be writing quite a bit more in the upcoming days, about DOD oversight of its contractors.  Not only is this a topic of utmost interest to Apogee Consulting, Inc. and its clients, as they seek to comply with constantly evolving Federal Acquisition rules and judicial interpretations of existing language, but also because DOD contractor oversight (or lack thereof) is a topic of utmost interest to the Pentagon, the Obama Administration, Congress, and others.  This GAO report should be viewed in light of the overall context, in which reports of bribery, fraud, and contractor overcharging in Southwest Asia and elsewhere surface almost weekly and DOD is being accused of negligence for failing to better control its contractors.  That being said, the GAO report seems objective and straightforward, and its recommendations are well within the realm of reasonableness.

In its report, GAO noted that surveyed 57 contractors, 55 of whom reported having ethics programs “that include many of the practices consistent with [FAR-required] standards….”  (GAO noted that its survey was taken prior to the new FAR rules coming into effect.)  The 57 contractors included such well known names as Lockheed Martin, Boeing, Northrop Grumman, General Dynamics, Raytheon, United Technologies, DRS Technologies, General Atomics, SAIC, CSC, ITT, URS, and GE.  The findings from the report are summarized below:

• 55 of the contractors surveyed had codes of business ethics and conduct
• 52 had codes that provide examples of disciplinary action for misconduct
• 51 required ethics training for employees working on DOD programs
• 52 had an ethics office or single point of accountability for ethics programs
• 25 reported quarterly on ethics program matters to top company management
• 52 had internal reviews or audits that tested the ethics program
• 47 periodically “assessed risks” of improper or criminal conduct
• 55 have internal reporting mechanisms, such as hotlines
• 54 have a policy that permits employees to report anonymously or confidentially
• 34 had formal policies for voluntary disclosure of contracts-related violations

The GAO report notes that the new FAR contractor ethics and disclosure requirements are based on U.S. Sentencing Commission’s Federal sentencing guidelines.  Importantly, the GAO report notes on page 7 that “the sentencing guidelines … state that the failure to prevent or detect a particular offense does not necessarily mean that the program is generally ineffective in preventing and detecting criminal conduct.”

The GAO report also notes challenges that contractors face in implementing their ethics programs.  Among those challenges are:

• The overpayment provisions create operational difficulties “because (1) contracts are subject to reconciliation processes with payments [being] audited and adjusted over time and (2) the routine nature of contract payment issues, which are daily events, with errors on both sides, is simply unworkable.”
• Interpreting “vague language” may “tie up government resources in meaningless trivia.”
• Checking the existence of subcontractor ethics awareness programs and internal control systems.

The GAO report discussed the challenges facing contractors with overseas contract operations.  Forty-one of the 57 contractors surveyed reported such overseas operations, yet 26 of those reported “experiencing challenges implementing ethics programs overseas, including differences in legal and regulatory environments relating to, for example, employee privacy, cultural and language barriers, and technical or hostile conditions impeding computer-based training.”

The GAO report noted that DCAA had implemented its new audit guidance covering internal controls for contract integrity and ethical values, as we have previously noted.  Interestingly, the GAO report provided a history of DCAA’s approach to this audit area.  Initially, in February 2009 DCAA headquarters officials told GAO “that they planned to make only minor changes” to audit guidance, because “in their view … many of the new FAR requirements were already in the DFARS section upon which the earlier audit program was based.”  During subsequent discussions (in June 2009), “the Chief, Auditing Standards Division, told us that the agency had reconsidered its approach and was then proceeding to develop much more extensive audit guidance ….”  In July 2009, according to GAO, “Senior headquarters policy and planning managers “indicated that the impact of the FAR contractor ethics rules on DCAA contract audits has been to improve audit guidance.”

The GAO report concludes that the new FAR contractor ethics and internal control rules omit any discussion of who should provide oversight of the contractors’ programs during contract performance.  For example, the FAR fails to address how Government oversight officials should verify that a contractor has implemented a compliant business ethics program.  Because “the new FAR rules are silent with regard to contracting officer review or standards for examining contractor ethics programs during contract administration,” the GAO reported that “the impact of the new FAR rules on changing the CAO [contract administration office] function to include some degree of oversight … has been negligible.”  The GAO report concludes that, consequently, “CAO staff will continue as before the new FAR rules were implemented with limited oversight of contractors’ ethics programs.”  But the Defense Contract Management Agency (DCMA) was not as worried about the situation as GAO seemed to be, stating “that is it not their agency’s functional responsibility to verify compliance with the new contractor ethics requirements” and indicating that “it would be better to assign responsibility for this function to DCAA’s contract audit services that assess the adequacy of contractor internal controls for integrity and ethical values.”

Although the GAO concluded that DOD could improve its oversight, the report fails to address the role of the FAR Councils in promulgating revised FAR language that would address the administrative omissions it identified.  In other words, GAO recommended band-aids instead of addressing the root cause of the alleged problem(s).

Like many issues associated with contractor internal control systems (called by some “contractor business systems” and by others “contactor operational control systems”), the DOD is wrestling with how to provide effective oversight over its contractors while minimizing undue interference in contractor affairs.  The oversight “turf war” between DCAA and DCMA has been frequently reported on this site.  Both agencies have been criticized for failing to provide adequate oversight on its contractors, typically with incendiary language alleging all sorts of dire consequences resulting from such negligence.  In contrast to the finger-pointing of other parties, this GAO report appears restrained and professional.