The Government contracting community was uneasy when DOD proposed to revise the Defense Federal Acquisition Regulation Supplement (DFARS) in 2011 to adopt a new approach to surveilling and evaluating contractors’ internal control systems. We shared the general apprehension. In fact, we wrote articles and even submitted comments to the DAR Council, in the hope that the members might reconsider the proposed approach.

Yeah, like that was ever going to happen.

And so the final rule was issued and now several Defense contractors have joined the 5 percent “withhold club”—which may be an amusing turn of phrase, since DOD now uses the threat of payment withholds as a club to beat contractors into agreeing with audit report findings (no matter how flawed) or to beat price concessions out of them when negotiations become rocky. And it’s no longer just Defense contractors who will be feeling the pain associated with the “business systems” oversight regime. As we told our readers, the Department of Energy has decided to adopt the DOD oversight approach. And thus, soon the lives of the DOE contractors—but not the M&O contractors, who were exempted from DOE’s new rules—will be filled with joy and rainbows. (Please read that previous sentence in a sarcastic tone of voice.)

Yet, as we look back on the original concerns and comments submitted by so many (including us), we are struck by their relevance. For example, we took the DAR Council to task because we thought the proposed rules would be “unworkable” since DCMA and DCAA would lack resources to support the new requirements. In particular, we thought DCAA’s role in the follow-up process (to confirm contractors had implemented the required system corrective actions) was going to be problematic. We told the DAR Council—

At its current workload, DCAA already takes years to resolve follow-up business systems audits. The author has personally been witness to follow-up audits that lay fallow for two or more years, because DCAA’s auditors constantly are reassigned to meet the needs of ‘demand audits’ and other internal priorities. Let us reiterate: DCAA cannot support timely audits of contractor business systems, issue its audit reports in a timely manner, and provide timely reviews of contractor corrective actions. It’s simply impossible and no platitudes from DCAA or the DAR Council will make it possible.

[Emphasis in original. Link to comments provided above.]

And now the Department of Defense Inspector General has told Patrick Fitzgerald, Director of DCAA, much the same thing. In a recent audit report, the DOD IG told DCAA its business system follow-up audits were not being performed timely.

The DOD IG was investigating a hotline allegation that DCAA auditors had negligently, in non-compliance with Generally Accepted Government Auditing Standards (GAGAS), issued an audit report concluding that a contractor in the Northeast had corrected previous findings of system deficiencies in that contractor’s Material Management and Accounting System (MMAS), which is one of the six “business systems.” In September, 2005, DCAA issued an audit report finding 30 individual deficiencies in the MMAS. In January, 2007, DCAA initiated a follow-up audit to evaluate whether or not the contractor had corrected those 30 deficiencies. DCAA issued its audit report in September, 2008, finding that the contractor had corrected 28 of the 30 deficiencies.

Note it took DCAA a full 18 months to start the follow-up audit, and another 21 months to issue it—meaning the ACO received the follow-up report more than three years after hearing about the contractor’s system deficiencies. In fairness, we also have to note that this all took place years before the promulgation of the revised DFARS rules. But similar anecdotal evidence of DCAA’s inability to issue timely audit reports abounded at the time—and informed the comments submitted to the DAR Council. Since then—as we’ve reported—the delays have gotten worse, not better. For example, the IG reported that the DCAA Field Audit Office (FAO) “initiated a second follow-up audit” to evaluate the two remaining deficiencies in August, 2011—nearly three years after the first follow-up audit report was issued. And according to the IG, that second follow-up audit was “still ongoing” two years after it started.

And therein we find the crux of this article.

We are much less concerned that the IG substantiated the original hotline allegation that the DCAA auditor (since retired) had concluded 28 of the 30 deficiencies had been remediated “without obtaining adequate evidence” and thus “the Government does not have a reasonable basis for relying on the accuracy of material costs charged by the DoD contractor.” Whatever. We all know that DCAA obtaining adequate evidence to support its audit findings is, by far, the exception and not the rule. The IG’s finding is but one of a host of similar findings they could make, if only they looked for them.

The big deal—and this is something that the DOD IG keyed on as well—is the untimeliness of the DCAA follow-up audits. The IG wrote—

In March 2010, the contracting officer requested that the DCAA FAO perform a second follow-up audit to review the contractor’s efforts to eliminate the two outstanding deficiencies and provide the results of the review by May 2010. Yet, more than 3 years later, the FAO has still not completed the second follow-up audit. The FAO told us that the completion of the audit was delayed because of other priority work. It is unreasonable for the FAO to take more than 3 years to complete a limited follow-up audit of two deficiencies.

In addition to be unreasonable, the DOD IG also found that the situation was noncompliant with the DCAA Contract Audit Manual (CAM). It wrote: “According to the [CAM], the auditor should place a high priority on conducting follow-up audits of previously reported business system deficiencies….” More importantly, the IG wrote—

The failure of DCAA to conduct a timely follow-up audit compromises the contracting officer’s responsibility in determining the adequacy of the MMAS, implementing withholdings in accordance with DFARS 252.242.7005, and reducing or eliminating withholdings to reflect the contractor’s progress in correcting deficiencies. Contracting officers might not withhold payments if DCAA does not uphold its responsibility to conduct timely follow-up audits of contractor corrective actions.

To address this concern, the IG recommended that DCAA should “assess the timeliness of follow-up audits on an agency-wide basis and make appropriate improvements in related quality assurance procedures.”

Readers may find it interesting that the DOD IG thought the DCAA Director’s comments to that recommendation were “non-responsive”. The IG wrote—

The Director, DCAA, agreed ‘in principle.’ DCAA recognizes that it can improve the timeliness of business system follow-up audits agency-wide. However, the Director stated that the requirements for DCAA services far exceed the available staffing and management must make decisions on which priority assignments take precedence. In addition, the Director does not believe ‘a detailed assessment of the timeliness of business systems follow-up reviews is a good use of DCAA’s limited resources.’

The DOD IG thought the Director, DCAA, could do better. The audit report stated—

We disagree that assessing timeliness is not a good use of DCAA’s limited resources. An assessment could identify opportunities, best practices, and lessons learned for improving timeliness

When DCAA reports that a major DoD contractor’s business system contains significant deficiencies as defined in DFARS 252.242-7005, DCAA asserts that the deficiencies materially affect the ability of DoD officials to rely on information produced by the system. If the contracting officer agrees with DCAA, the contracting officer must withhold payments until the contractor eliminates the deficiency. Therefore, DCAA plays a critical role in providing the contracting officer with timely information on the status of contractor corrective actions. If DCAA commits resources for conducting a full business system audit and reporting on significant business system deficiencies, then DCAA should place a high priority on performing a limited and timely follow-up of those deficiencies.

Although DCAA policy allows for the reporting of significant business system deficiencies in other audits, this does not address the need for performing timely follow-up audits of the deficiencies (including those identified in other audits).

Yeah.

We told the DAR Council this was going to be an issue under the new DFARS business systems rules. We were not alone in sounding that particular alarm. And the DAR Council ignored all those warnings, for which we believe its members ought to be ashamed.

As for DCAA’s part, we suspect that business system reviews and follow-up audits are going to come back into vogue sometime in the future. This audit report may help in that regard. In addition, the movement of CASB Disclosure Statement adequacy reviews from DCAA to DCMA should help as well—as will the dropping of DCAA from its formerly key role in the Forward Pricing Rate Proposal analysis process.

In other words, DCMA seems to be more than a little tired of receiving audit reports too late to be helpful and which are of dubious quality in any case. Consequently, they are carving DCAA out of their contract administration processes wherever possible. Sooner or later, DCAA will find itself with lots of time on its hands. Perhaps they’ll use that time to perform some business system reviews and follow-up audits.

What else are they going to do?