Dear Mr. Fitzgerald,

Happy New Year!

The last time I wrote you a letter you had been in your position just about 60 days. As I noted, you came into your position with a clear mandate for change, but you had a huge challenge in front of you. In the spirit of helpfulness, I offered a couple of suggestions for your consideration. My suggestions included:

• Introduction of more flexibility into the audit process by creating a risk profile unique to each contractor, and then using that risk profile to drive the types of audits to be performed.

• Permit the contractor to review (and discuss) draft audit report findings before DCAA management review, so as to permit Supervisory Auditors and other management levels to review both sides of the story without having to “backstep” from a previously established position.

• Consider dividing DCAA audits into GAGAS-compliant versus non-GAGAS-compliant groupings, so as to avoid criticism when auditors act in their “advisory” capacity to DCMA.

• Bring back the concept of materiality into the audit process, and recognize that not all deficiencies are significant or material deficiencies.

• Empower auditors (with sufficient training and experience) to exercise discretion in the performance of their audits, so as to avoid “papering” audit files with worthless documentation that adds nothing except to demonstrate compliance with documentation requirements.

Well, Mr. Fitzgerald, I have to say that I’m disappointed that more of my suggestions weren’t implemented during 2010. I’m not saying you weren’t busy (you were) or that you didn’t accomplish some necessary reforms (you did). But I have to say that not enough was done. In particular, I don’t think your audit agency implemented enough of the right reforms and, in some cases, took a step or two in the wrong direction.

Let me elaborate, if you will.

First, you focused your efforts on overseas contingency contractors, effectively doubling the audit workforce assigned to the Southwest Asia area. Perhaps that was a necessary step, but it clearly took personnel and funding away from other areas. At the same time, you increased the number of “Field Audit Offices” (FAOs) rather significantly, causing a massive need for Branch Managers and ancillary administrative staff. And normal attrition took its toll on your senior staff. Although you added staff, the majority of the new hires were young, untrained and inexperienced. In other words, you needed a large influx of senior staff who could fill the ranks from Supervisory Auditor to FAO Manager, but what you got was a bunch of bright-eyed and eager-to-please kids.

But that’s not all, sir. You also created workload for your auditors in non-value-added areas such as reviewing interim vouchers (which would be subject to completion reviews in any case) because you took away contractors’ “direct billing authority”. You also created multiple layers of management review that focused on the amount of workpaper documentation (and not the workpaper quality), creating an unseemly focus on file documentation at the expense of timely and informative audit reports. And many of those reviewers were not permanently assigned and had no “skin in the game” of generating high-quality audit reports.

In fairness, you did replace the management of the Western Region, your “problem child” and the subject of several adverse GAO and DOD IG reports. But you also took some flack on that action, because the replacement appeared to be an old buddy of yours from the Army Audit Agency, who was (apparently) not required to have deep expertise in FAR or CAS. Critics wondered how the new leadership of the Western Region would ensure audit quality if they lacked sufficient expertise to properly review audit reports?

You also re-emphasized auditor “rules of engagement” with contractors and customers, and (in some limited circumstances) okayed the discussion of interim audit findings prior to release of the official draft report. Though (as we said at the time) we thought you should have done more in that area.

In order to solve the personnel problems you created, you created a domino-like series of rotating temporary assignments, moving people from position to position, and from office to office, so that there was no permanence in many auditor or management assignments. And with that lack of permanence came confusion regarding the chain of command, and a lack of accountability for results. As a result, audits were handed-off from auditor to auditor (and from SA to SA) like hot potatoes, with a corresponding loss of knowledge and degradation of audit quality. And did I mention the lack of audit completions during the year? As I reported on my website, in 2010 DCAA issued 45 percent fewer audit reports than it did in 2009. That is not a statistic of which to be proud, in my view.

Another action you took was to focus on the big guys, effectively ignoring the contract audit requirements of the smaller contractors. Your agency no longer expects to audit fixed-price proposals valued at less than $10 million or cost-reimbursement proposals valued at less than $100 million. And you drove a change in the direct billing authority rules that allowed you to permit small business contractors to retain their direct billing authority, even if (under the rules your agency established) they should have lost it. One might draw a trend line here and be tempted to forecast that, in the future, DCAA will only audit major contractors and the little guys will go scot-free from any audit oversight.

Unfortunately, the results of your initial efforts were noted by the DOD Inspector General. In its quality control review of your audit of The Aerospace Corporation, the DOD IG reported that—

DCAA did not comply with Circular A-133 reporting requirements. … We also identified deficiencies in the performance of fraud risk assessment procedures, information technology internal control testing and working paper documentation that need to be corrected in future audits.

Moreover, contractors provided some feedback for your consideration, as well. We quoted one knowledgeable critic as saying, “DCAA appears to be in chaos.” We found a survey from Deltek that reported that more than one-third of respondents hadn’t been audited on their internal control systems for at least one full year—while another 35 percent of respondents said that they had never been audited on their internal control systems!) Let’s be clear: about 70 percent of Deltek’s survey respondents reported that DCAA wasn’t auditing internal control (or “contractor business systems”) any longer. In addition, Deltek reported that “The number of firms reporting a decrease in government oversight spiked from 2% in 2009 to 20% this year—a tenfold leap.”

There you go, sir. That’s the report card for your first year, as provided by both the defense industrial base and by a peer audit agency. Let us both agree that DCAA did not receive the highest possible marks.

So where do you go from here?

1. Your Executive Steering Committee (ESC) has got to go. You need new blood, with a new vision and the drive to change for the better. The old guard has a vested interest in perpetuating the status quo. The old guard wants to point the finger at the contractors and blame them for the lack of timely and high-quality audits. While there may be some truth to that accusation, the reality is that contractors and their lack of responsiveness are not the big drivers of audit quality. High quality auditors, well trained and with sufficient resources and adequate supervision, are the big drivers of audit quality. Your ESC is part of the problem; a new ESC can be part of the solution.

2. You need to drive the concept of materiality back into audits. The lack of materiality in audit findings is perhaps the number one problem in your agency’s audit reports, leading to unwarranted recommendations for internal control system disapprovals, unnecessary CAS 405 noncompliances, and other similar disputes that require a lengthy (and expensive) adjudication by DCMA and/or the Courts. If your Assistant Director of Policy and Plans can’t get behind that concept, then see recommendation No. 1, above.

3. Stop the staff turnover. Auditors should be assigned to an audit and should be accountable for completing it. Supervisory Auditors should be assigned to an area of responsibility and should be accountable for it. FAO Managers should be assigned to offices on a permanent basis, and should be accountable for what happens in their offices. Sure, jury duty and unplanned sicknesses happen. But audit hand-offs should be the exception and not the rule. I believe you will never achieve high-quality audit reports until you address the churn and burn within the staff.

4. Stop the funding game. Too many FAOs have a disconnect between funding and headcount, or between funding and program plans. It’s a silly and completely unnecessary game, in my view. You get a budget; assign it. Assign it by Region. Let the Regions assign it by FAO if they must. But once budgets are assigned, don’t worry about assigning funding. Don’t track funding (or spending) at a level lower than the Region, and empower your Regional management to manage their finances—and then hold them accountable for results. You are wasting precious Agency resources on tracking this minutia. And what’s worse, funding “problems” are driving auditor reassignments (see recommendation No. 3, above).

Seriously, Mr. Fitzgerald. Everybody wants an effective DCAA. Even the contractors want to deal with high-quality audit findings that are performed and issued on a timely basis. You can do better. What’s more: you must do better. We are counting on you, sir. Please don’t let us down.