It’s here.

Much like a long-expected—yet dreaded—phone call from your oncology specialist, or your spouse’s divorce lawyer, on May 18, 2011, the new DFARS rule covering contractor “business systems” (aka internal control systems) was published in the Federal Register.

This item has to be among the top two or three issues we’ve been writing about on this website, since we first took issue with the “independent” (but not bias-free) Commission on Wartime Contracting in Iraq and Afghanistan (“CWC”). We’ve published many articles related to this topic, including this notification of the proposed DFARS rule, our comments on that rule (as submitted to the DAR Council), the DAR Council’s revised draft rule, and our additional comments on the revised draft.

Suffice it to say, we’ve been all over this issue like white on rice.

And now we have an interim rule, with additional public comments solicited. (As if those comments are going to affect the rule.…)

DCAA has been holding off on performing its “ICAPS” system reviews for nearly two years, ostensibly awaiting this new rule. (Which is wrong on several levels—including the situation where at least one contractor was left with an “inadequate” accounting system (which kept it from winning new work) because DCAA wouldn’t return to perform a follow-up system review to confirm that all corrective actions had been effectively implemented.) So this new rule permits DCAA to gear-up and get back out there into the field, reviewing and assessing contractors’ systems of internal controls.

(Since DCAA hasn’t been auditing too many contractor internal control systems, and hasn’t been auditing too many contractor incurred cost submissions, one wonders just what the hell they have been auditing … but perhaps that’s a rant better left for another day.)

Let’s summarize the interim rule, remembering that, as a DFARS rule, it applies only to DOD and NASA contractors. If you’re a civilian agency contractor, you need not worry overmuch—though we bet DCAA will assert that the DFARS rule establishes a basis for the adequacy of any contractor’s business systems. In fact, the rule’s promulgating comments assert that, “Because they are designed to be consistent with GAGAS, while are based on standards developed by the American Institute of Certified Public Accountants (AICPA), the system criteria are applicable equally to DoD, NASA, and civilian contractors.” So don’t rest too easy, civilian agency contractors: your time may be coming sooner than you think.

Anyway, here’s our take on the rule:

1. There are now six (6) contractor business systems of internal control, not 10. They are: Accounting, Estimating, Purchasing, Earned Value Management, Material Management and Accounting, and Property Management. But that’s somewhat misleading, because the adequacy criteria formerly associated with some of the other internal control systems (e.g., Billing System, Timekeeping/Labor Accounting, etc.) now have been consolidated into the adequacy criteria associated with the Accounting System.

2. A new DFARS clause (252.342-7005, Contractor Business Systems) will be inserted into solicitations and contracts when the contract is a “covered contract” and the solicitation or contract includes one or more of the individual business system clauses (e.g., 252.215-7002, Cost Estimating System Requirements; 252.234-7002, Earned Value Management Systems; 252.242-7004, Material Management and Accounting System; 252.242-7006, Accounting System; 252.244-7001, Contractor Purchasing System Administration; or 252.245-7003, Contractor Property Management System Administration).

3. A “covered contract” is defined as any contract subject to Cost Accounting Standards (CAS). If you are not a CAS-covered contractor or your contract is exempt from CAS—congratulations! You don’t have to worry too much about this new rule. For example, small businesses are exempt from CAS. (In addition, educational institutions and Federally Funded Research and Development Centers (FFRDCs) also are expressly exempt from the rule’s requirements.)

4. The administration of the new rule is found at DFARS 242.70 (Contractor Business Systems); between that direction and the language found in the 242-7005 clause, this is how we think it will operate.

1. 1. DCAA, or other “functional specialists,” will perform reviews of the six business systems. Any “significant deficiencies” will be identified to the cognizant Administrative Contracting Officer (ACO).

   2. A “significant deficiency” is defined as “a shortcoming in the system that materially affects the ability of the Department of Defense to rely upon information produced by the system that is needed for management purposes.” But that definition is somewhat misleading. According to the promulgating comments, “DCAA policy is to report only deficiencies determined to be significant deficiencies” as defined both in the rule and in the Generally Accepted Government Auditing Standards (GAGAS). The promulgating comments note that, “Based on the definition in GAGAS, a significant deficiency is a deficiency, or combination of deficiencies, that adversely affects the entity’s ability to initiate, authorize, record, process, or report data reliably.” So note there is a separate, more detailed definition of “significant deficiency’ that DCAA will be using.

   3. The ACO will make an initial determination to approve or disapprove the business system(s) based on the identification of significant deficiencies by auditor or functional specialist.

   4. The contractor will have 30 days to respond to the initial determination.

   5. The ACO will evaluate the contractor’s response and issue a final determination. If the contractor’s response is unpersuasive, then the final determination will notify the contractor that (i) its system is being disapproved, and (ii) that payment withholds are being implemented.

   6. The ACO will identify “one or more” covered contracts from which the payments will be withheld. When there are multiple systems with significant deficiencies, the ACO is directed to ensure “that the total amount of payment withholding … does not exceed 10 percent of progress payments, performance-based payments, and interim payments … under each of the identified covered contracts.” Similarly, when only a single system is involved, then the withholding limit is five (5) percent of such payments. The ACO has “sole discretion” to identify the covered contracts from which to withhold payments.

   7. Payment withholds will be taken against in-process payments by the DOD, and the ACO will direct that the contractor deduct the payment withholds from prospective invoices that it generates. Payment withholds are not subject to interest payments under the Prompt Payment Act.

   8. The contractor has 45 days to submit a corrective action plan to the ACO. If the ACO “in consultation with the auditor or functional specialist” determines that the contractor is effectively implementing the corrective actions, then the payment withholds “will” be reduced to two (2) percent.

   9. Payment withholds will persist until the ACO “determines that the contractor has corrected all significant deficiencies as directed by the Contracting Officer’s final determination.” The contractor must notify the ACO in writing when it has made all the necessary corrections. At that point, the ACO may discontinue payment withholds and direct the contractor to bill for outstanding amounts due, but only if there is agreement that the significant deficiencies have been corrected; otherwise, the payment withholds will continue.

   10. If the ACO has not made a determination within 90 days, then whatever payment withholds exist must be reduced by “at least 50 percent.”

Looking at the individual business system clauses, we see quite a bit of familiar adequacy criteria. It’s also interesting to see how the granularity of the adequacy criteria varies system by system.

Within the Accounting System Administration clause (for example) we see eighteen (18) criteria that must be met, but none of the criteria are new: they were previously associated with either overall Accounting System adequacy or with one of the subsidiary systems (e.g., timekeeping/labor accounting). But we were impressed to note that there are twenty-four (24) adequacy criteria associated with Purchasing System adequacy.

The single adequacy criteria associated with Property Management is “The Contractor’s property management system shall be in accordance with paragraph (f) of the contract clause at Federal Acquisition Regulation 52.245-1.” But we all know that a DOD Property Administrator expects a contractor to have detailed command media that addresses a multitude of detailed criteria.

There are five (5) adequacy criteria associated with Estimating System requirements. There are two (2) adequacy criteria associated with Earned Value Management Systems—although we note that one of the two criteria references ANSI/EIA-748, which contains 32 criteria. There are three (3) MMAS adequacy criteria.

So to wrap it up, this interim rule seems to be written in such a way that defense and NASA contractors—and perhaps all contractors (as we noted above)—can live with it. That’s not to say that it is without risk. Indeed, we see considerable risk associated with implementation of this new rule. We see two sides to the risk: (1) the known risk associated with the rule language, and (2) the unknown risk associated with how the rule will be actually implemented in the field.

The known risks include:

• Whether DCAA will comply with the requirement to report only “significant deficiencies,” or if the audit agency will continue the unfortunate trend of reporting every small mistake as a glaring systemic problem.

• Whether the significant deficiencies will be reported “in sufficient detail” to permit the ACO and contractor to understand both the problem and necessary solution, or whether the contractor will be left in limbo, trying to correct a problem that it doesn’t understand.

• Whether the ACO will exercise the FAR-provided authority to implement payment withholds only when required—and reduce those payments in line with the rule’s guidance; or if the ACO will timidly await DCAA’s concurrence/permission to take any action.

The unknown risks include:

• Whether DCAA will apply these criteria to contracts not officially covered by the rule.

• Whether DCAA will apply pressure to DCMA Contracting Officers to implement payment withholds for relatively insignificant findings.

• Whether DCMA Contracting Officers will be eager to disapprove contractor systems, knowing the immediate cash flow hit as well as the more long-term undermining of the contractor’s competitive position.

• Whether the cash flow hit will be of such magnitude to force some contractors out of business.

This is a significant regulatory development. Your company’s cash flow is at risk. DCAA will be issuing audit guidance to implement the rule in the near future. Stay tuned for further details.