Recently the Defense Contract Audit Agency (DCAA) issued several new pieces of audit guidance (called Memoranda for Regional Directors, or “MRDs”). This one caught our eye. It discusses what DCAA auditors are supposed to do when the “mandatory annual audit” of a contractor’s labor accounting and timekeeping (called a “MAAR 6” audit) was not performed timely, as is required.

As the name implies, such testing is required to be performed annually (though official DCAA guidance says they are performed “continuously”.) Unfortunately, as with many such “required” testing procedures, DCAA has fallen behind and, more often than not, several years pass before an auditor gets around to actually testing the efficacy of the contractor’s timekeeping and labor accounting system.

Failure to perform MAAR audits on a timely basis is a bad thing, since official DCAA guidance says such audits are “core requirements”. In fact, the DCAA Contract Audit Manual (CAM) states—

MAARs 6 and 13 provide for the verification of the existence of prime costs (direct labor and direct materials, respectively) as they are incurred. Therefore, they can be accomplished only during the contractor fiscal year to which they apply.

(Ref. 6-105.3, emphasis added.)

The lack of performance of “mandatory annual audits” is both a symptom and a cause of DCAA’s current inability to issue high-quality audit reports on a timely basis. It’s a symptom in the sense that DCAA has taken a more-than-rigorous approach to performing such testing procedures, turning what used to be a rather straight-forward test into a GAGAS-compliant, massively sampled, workpaper documented, complex behemoth of a project that takes an auditor months to plan, perform, and (eventually) gently escort through multiple layers of management reviews. Thus, these MAAR audits aren’t treated any differently from DCAA’s now-standard approach to performing audits: they take many more hours than they used to and, while they may be bullet-proof from a GAGAS perspective, they add little if any value to anyone. By the time a MAAR audit report has been issued, the contractor has almost certainly closed its books and moved on to another year of contract performance.

In another sense, the lack of performance of the MAAR audits is a cause of DCAA’s problems. In the old days (which some would call the days of sanity), DCAA’s audits were intended to rely on each other. For example, if the MAAR 6 audit findings indicated that the contractor had strong internal controls related to timekeeping and labor accounting, then that finding could be relied on by other DCAA auditors, and thus testing related to labor accounting could be reduced in other audits. In DCAA’s new approach to conducting audits, each audit (generally) needs to stand on its own. No audit can rely on the findings of another; and thus there is little or no ability to reduce testing—which means that audit planning and testing and workpaper documentation take longer (much longer) than they used do.

DCAA has tried to address the timing problem by integrating MAAR audit performance with performance of the 10100 “incurred cost” audits. The CAM states—

During the incurred cost risk assessment process, auditors should determine whether a required MAAR 6 or 13 has been performed. When MAAR 6 or 13 have not been accomplished on a concurrent basis, auditors should ensure other procedures are performed in conjunction with the review of labor and material costs to satisfy the overall audit objectives.

(Ref. 6-106)

The recent MRD provides details regarding those “other procedures” that auditors will need to perform, when the MAAR 6 audits were not performed timely. The other procedures include:

• For employees still employed, physically observe employee and inquire as to start date with contractor to ensure the employee worked for the contractor in the year under audit.

• For employees no longer employed, review employee personnel records (e.g., copies of driver license, passport, contractor badge, etc).

• Validate payment of sampled employees to contractor bank statement, electronic funds transfer, or third party payroll processor records.

• Review other documents the employee may have created, processed, or approved during the period under audit (e.g., travel records/employee expense reports, W-4s, leave requests).

• Review statement of work and work orders/authorizations to ensure labor type (i.e., scientist) is required to perform the work.

• Determine if Contracting Officer has other evidence corroborating employee existence [or that an “employee’s labor is allocable to the contract”].

The problem is, of course, that those “other procedures” listed above are really no substitute for performing timely audit procedures. The MRD acknowledges this fact. It states—

In determining the overall opinion, auditors should consider such things as audit risk, significance of claimed labor costs, and contract mix. In most cases, when we have not performed real-time testing of labor, the audit team should issue a qualified opinion, even when performing alternate procedures. If the alternate procedures do not provide sufficient appropriate evidential matter, the audit team may not be able to opine on the labor cost element resulting in a qualified or overall disclaimed opinion.

If the audit team determines that they have to disclaim an opinion, they should report significant noncompliances that can be supported by sufficient appropriate audit evidence in the appendix (i.e., Other Matters to be Reported).

Thus, a failure to perform the MAAR 6 audit timely requires auditors to perform additional planning and testing during their audit of the contractor’s claimed direct and indirect costs. This will, quite obviously, delay issuance of the audit report even more than is currently the case.

And when the audit report is issued, some four or five years later, it may carry a qualified opinion—or even a “disclaimed” opinion. What does a “disclaimed” opinion mean? According to Deltak’s GovWin web site—

A disclaimer of opinion is issued when there are scope restrictions and the departures from GAGAS requirements are so significant that the examination has not been performed in sufficient scope to enable the auditor to form an opinion.

Thus, the audit report may be useless to a Contracting Officer seeking to use it as the basis for negotiating final billing rates pursuant to the requirements of the FAR and DCMA’s guidance.

Let’s say that again.

If the MAAR audits are not performed timely, DCAA is going to take longer than “the norm” to issue its audit report and, after performance of hundreds or thousands of hours of audit procedures, may issue a report that is of limited (or no) use to the Contracting Officer.

As is so often the case with DCAA audit guidance, we lack the adequate words to express our feelings regarding this latest approach to “serving the public interest as [the] primary customer.”