A recent poster on Bob Antonio’s supremely excellent website for all things related to government contracting asked, “Can a private firm or [independent] CPA audit, and find acceptable, an accounting system of a prospective federal contractor?”

Discussion followed, in which other posters explored whether an audit of a contractor’s costs or a contractor’s “business systems” would be an inherently governmental function or, even if not inherently governmental, whether that role was reserved exclusively for DCAA to perform with respect to DOD contracts. It was noted that non-DOD agencies might ask DCAA to perform such audits on a reimbursable basis, or perhaps have the agency Inspector General perform them. In some cases, prime contractors perform audits and/or reviews of their subcontractors, and only use DCAA (or other agency auditors) as a last resort, when the subcontractor objects to opening its books to the prime’s auditors. One poster noted that, as an independent CPA, s/he had been performing contract audits “for Primes and one Agency for approximately 12 years.” Apparently there had been no objection to having an outside entity audit a contractor’s costs during that long period.

Based on the various posts, the answer to the original question posed on the website discussion forum was “YES”. There is nothing in the FAR or DFARS or DOD policy that mandates all audits of contractor costs and reviews of contractor systems must be reserved solely and exclusively for DCAA to perform. Which is a good thing because, as we’ve noted before, DCAA is in over its head and it can’t get its audit workload performed timely.

In recognition of the hole that DCAA has dug for itself (and by extension for the rest of the Defense Department acquisition workforce), the DAR Council recently proposed a significant revision to the performance of business system reviews. While many commenters criticized the proposed rule (and for excellent reasons), there was a tacit recognition that something needs to be done. The current business system management regime, which relies on DCAA reviews of three of the six contractor business systems (as well as timely follow-up audits to evaluate the efficacy of contractor corrective action plans submitted in response to DCAA audit findings) is not working. The defense acquisition system is not functioning and the situation is getting worse instead of better.

Even though DCAA has been methodically reducing its audit workload for several years, primarily by foisting the workload onto the backs of DCMA Contracting Officers, the DOD audit agency is still hobbled by a ginormous audit backlog, by ridiculously burdensome bureaucratic audit procedures, and by a largely demoralized staff.¹ It is almost inarguable that, despite all reforms undertaken by DCAA in the past five years, audits are still too slow and do not give Contracting Officers much (if anything) of value to use in negotiations with contractors.

In response, the DAR Council has proposed revisions to the DFARS to address gaps in the business system oversight process, and DCMA has implemented revisions to when it requests (and how it uses) DCAA audits to support its contracting objectives. We believe it’s clear: the Defense Department is preparing to move on without DCAA. The Pentagon is preparing to conduct contract audits and business system reviews by entities other than DCAA.

In addition, as Darrell Oyer noted in his recent newsletter, the Department of Defense has already loosened the tight hold DCAA has had on contract audits, and has given Contracting Officers more discretion to use outside CPA firms to perform the audits once reserved exclusively for DCAA. On October 16, 2014, DOD Instruction 7600.02 (“Audit Policies”) was revised by the DOD Office of the Inspector General. The new DODI stated –

The DoD Components will contract for audit services when applicable expertise is unavailable within the DoD audit organization, augmentation of the DoD audit organization’s audit staff is necessary to execute the annual audit plan, or temporary audit assistance is required to meet audit reporting requirements mandated by law or a DoD issuance. Such contracts must comply with section 237.270 of the Defense Federal Acquisition Regulation Supplement.

The SOWs associated with procuring outside contract audit services must be reviewed by the OIG. But as we interpret the Instruction, the results of that review may not matter. In other words, our reading of the DODI is that while the OIG must review the proposed SOW, and that the OIG may make recommendations regarding that SOW, the Component does not have to accept the OIG recommendation.

In addition, the DODI stated—

The OAIG APO may give a DoD Component audit organization authorization to contract for multiple, similar audits, provided that the requesting agency presents sufficient justification. Once authorization is given for contracting for similar audits and the initial statement of work is reviewed, the requesting agency does not have to submit individual statements of work for review unless changes have been made to the statement of work. The requesting agency must report to the OAIG APO what audits were contracted for under the authorization.

We don’t want to read too much into this revised Instruction. Even so, it seems to foreshadow a greater use of outside auditors by DOD. It seems to be in response to a widespread recognition that the critical role once fulfilled by DCAA still needs to be fulfilled – just not by DCAA. Your mileage may vary, but that’s how it seems to us here at Apogee Consulting, Inc.