Warning: The following conversation did not take place as written. Instead, what follows is a “reality-based” conversation that mashes-up several conversations and e-mail discussions that really, really, really did take place in real life. Details have been changed to protect client confidentiality. But seriously, this is as accurate as we could make it.

DCAA Auditor: Hi there! We are performing an audit of your client’s FY 2002 incurred cost proposal, submitted in June, 2003. We have a few questions; please see the attached Request for Information (RFI) which contains our initial data request. In addition, we would like to have an entrance conference with your client’s accounting management in order to discuss the go-forward plan.

Apogee Consulting, Inc.: Wait, what? Is this a typo? Do you really mean FY 2002 and not some other year? That was a decade ago! Plus, our client says that DCAA already performed the FY 2002 incurred cost audit several years ago. In fact, our client says that the work was performed and a draft audit report was generated (see attached draft audit report). There was an exit conference! In addition, our client provided comments, disagreeing with several of the findings (see attached client response to draft audit report). Our client has been waiting for six years for the final audit report to be issued and for negotiations with the Administrative Contracting Officer (ACO) to begin. Further, my client sent the Supervisory Auditor several emails over the past six years, inquiring as to the status of the final report. Each reply said the audit report was in “management review”. The last email from DCAA was dated two years ago (see attached email). What’s going on?

DCAA: Yes, well. DCAA discontinued working on incurred cost audits a few years ago, due to other priority assignments. We are now starting the process again for certain incurred cost audits, and your client’s FY 2002 assignment has been selected for audit (or, in this case, continuation of the audit). Though the audit was essentially completed by another auditor in 2006, it was never officially completed. So now I have to go back through the working papers and determine if additional work needs to be performed, based on our current Agency guidance.

Apogee: So you are going to evaluate the work done six or more years ago in light of your current HQ guidance regarding working paper documentation, sampling size, and other matters? Really? You do realize that a decade has passed, right? Most of the people who prepared the submission, or processed the accounting transactions, retired a while ago. What is the likelihood we are going to have the supporting documentation you now consider to be required, with a decade of hindsight? This makes no sense! Is this really what you are being told to do? Really?

DCAA: Yes, really. And my first question is: Where is your client located? I can’t find that in the working papers. And once I know where your client is located, we’ll schedule the entrance conference.

Apogee: Oh, this is so not going to go well.

*****

[Entrance Conference]

DCAA Audit Supervisor: So, as you can see, we have classified your client as “high risk” because this will be the first in-depth incurred cost audit performed by the Agency. As such, we will sample the maximum amount of transactions.

Apogee: What about the prior year’s costs? You audited those, didn’t you?

DCAA: Yes, but that was a desk audit. It doesn’t count.

Apogee: So you are saying that you will re-perform the work you’ve already performed, only more so?

DCAA: Yes, well. Not every account will be retested. We are only going to look at the accounts where we previously had findings.

Apogee: So if you didn’t have any findings, you will not re-perform the testing on those accounts?

DCAA: Yes, that’s correct.

Apogee (thinks to self, does NOT say out loud): Well, that’s just stupid. If the past procedures were inadequate, you should look where you didn’t find anything. Looking where you already had findings—and projected to the universe from those findings—shouldn’t generate very much more in questioned costs. This approach is flawed, but it makes us very happy.

Apogee (says out loud): We understand.

*****

[Field Work Commences]

DCAA Auditor: Hi, here is an RFI that requests all your policies and procedures related to accounting, billing, timekeeping, purchasing, estimating, and property control. In addition, please provide detailed information regarding the compensation of your top 5 most highly compensated executives, including a break-out of corporate revenue showing how much revenue each executive was responsible for. Plus, tell me if you had a Defined-Benefit pension plan.

Apogee Consulting, Inc.: Hi! No problem! Here are all the policies and procedures you requested. Here is the compensation information you requested. Our client did not have a Defined-Benefit pension plan.

DCAA: No, this won’t do. It won’t do at all. You provided current policies and procedures. We need to see policies and procedures from FY 2002. Plus you didn’t provide the revenue break-out we requested.

Apogee: We are trying to find the policies and procedures that were in effect a decade ago. Our client didn’t retain them. Plus nobody here knows or remembers how to apportion the revenue amongst the top 5 executives. That wasn’t how the company was managed at the time.

DCAA: What do you mean you don’t have FY 2002 policies and procedures? Doesn’t your client understand the FAR record retention requirements? What do you mean you can’t break-out the revenue the way we requested?

Apogee: Yes, our client understands the requirements of FAR 4.7. But you have to understand that our client thought the audit work on that year had already been completed. Our client thought that was the case because there was a draft audit report and an exit conference. So nobody thought there was any reason to keep the old policies and procedures. We are trying to see if somebody kept a set by accident. If we find them, we’ll provide them to you.

DCAA: This is going to be a problem. I need those policies and procedures to complete my risk assessment.

Apogee: Risk assessment? Didn’t your Supervisory Auditor say our client had been assessed as “high risk”? Doesn’t that mean you’ve already completed the risk assessment? Are you saying you are still working on the risk assessment even after you’ve concluded on the risk level?

DCAA: Well, our new audit procedures now include a new working paper entitled “Gain an Understanding of the Contractor’s Internal Controls.” We need to document our understanding so that we can show compliance with GAGAS 6.10. If you don’t have the policies and procedures, how am I supposed to document that I understand the applicable internal controls?

Apogee: Well, didn’t DCAA perform a full-scope post-award accounting system review in FY 2003, and found the client’s overall control environment and the accounting system to be “adequate”? Can’t you rely on that audit to document compliance with GAGAS 6.10?

DCAA: No, we can’t do that. The audit was in the wrong year. We are auditing FY 2002 and not FY 2003.

Apogee: You’re kidding us, right? You can’t rely on your own Agency’s work?

DCAA: No. I thought that if your client could document that there were no changes to the internal control systems between FY 2002 and FY 2003 that might work. But then I reviewed the working papers of the accounting system review and, unfortunately, they are not compliant with current working paper standards. So we can’t rely on that audit work, not even for the FY 2003 incurred cost audit—which we will be starting as soon as we wrap-up the details for FY 2002. In fact, our FAO told the Region that we would have both FY 2002 and FY 2003 finished by the end of September.

Apogee (thinks to self): Yeah, good luck with that. We’re not even sure we can find the transaction support once you identify what you want to see. Everything’s in storage. Everything, that is, that wasn’t purged years ago.

Apogee (says out loud): Well, our client will do the best it can.

DCAA: Let me discuss this with my Supervisor. We’re supposed to wrap-up 2002 and 2003 by September, and then start on FY 2004 and FY 2005.

Apogee: FY 2005?

DCAA: Yes. That’s the plan.

Apogee: There is no FY 2005. Our client was acquired by Mega-Defense Corp. in late 2004 and was consolidated into Mega’s accounting system effective FY 2005. There’s nothing to audit.

DCAA (quietly): Oh.

Apogee: In fact, Mega-Defense Corp. has already negotiated final costs on the majority of the flexibly priced contracts you are auditing.

DCAA: How could that have happened? Your client doesn’t have final indirect rates for those years!

Apogee: True. But the customers got tired of waiting and they didn’t like having obligations open … something about expiring funds. So they simply negotiated and closed the contracts. We think they may have used your draft audit report from FY 2002, but we’re not really sure. It was a long time ago and most of the negotiators retired last year.

DCAA (quietly): Oh. I need to let my Supervisor know this. It will definitely affect our risk assessment.

Apogee (thinks to self): Yeah, you mean the risk assessment that you already concluded was “high risk” because you didn’t have an audit history. An audit history that you couldn’t rely on in any case, because the working papers didn’t meet your current standards. That risk assessment?

Apogee (says out loud): Well, let us know if you need any more information.

*****

THE STORY CONTINUES