Those of us deep into DCAA audits of final billing rate proposals (also known as “incurred cost audits”) have learned that the audit agency recently updated its required transaction sample sizes, based on input from statisticians. Unsurprisingly, the sample sizes didn’t go down; they almost doubled in size. That means more work for both auditors and auditees.

Note: DCAA still has 12 months to complete its audit, regardless of sample size used. In other words, the auditors must now cram in nearly twice the transaction review effort into the same audit duration. One might almost feel sorry for them.

Almost.

Transaction samples primarily are used on audits of indirect costs. The auditors pull as sample that is statistically significant and then they use the findings from that sample to project to the sample universe. For example, assume a universe of $1,000,000 and a statistical sample of $10,000. In that sample, auditors find $1,000 (10%) in questioned costs. They then write the report to show total questioned costs of $100,000 (10% of the universe). That’s basically how it works. Therefore, it’s important that the sample be statistically valid, because the audit agency doesn’t want contractors arguing that the projected results were wrong on statistical grounds.

In December, 2019, DCAA issued revised audit guidance on when sampling may be used by auditors. The guidance (MRD 19-PIC-005), was published on DCAA’s website only recently. We have read it several times and, frankly, it’s not the clearest piece of writing that DCAA has ever issued. Fortunately, it references a Contract Audit Manual (CAM) section (6-104). The CAM has several revised sections, effective February, 2020—and this is one of those sections. We went to the revised section 6-104 in order to understand what the MRD was trying to say.

Here’s what we learned:

Effective with final billing rate proposals (which DCAA calls “incurred cost proposals” or “ICPs”) received after January 1, 2020, ICPs eligible to participate in the risk-based sampling process will be assessed for sampling eligibility. If the ICP is determined eligible for sampling it will be placed in the sampling universe subject to random selection for audit based on established sampling parameters. If the ICP is not randomly selected for audit, a risk-based sampling memorandum will be issued to the contracting officer indicating the ICP was eligible for sampling and not selected for audit.

(Remember, DCAA is using a “risk-based” stratification of contractor proposals, such that only the largest proposals (measured by Auditable Dollar Value or ADV) get audited every year. The smaller proposals get audited less often. Contractor proposals with an ADV of $5 million or less don’t get audited. Ever. We’ve written about the DCAA audit approach before—see (for example) this article. We have not been fans of DCAA’s “new approach” (we call it “new” even though its seven years old at this point) because it simply seems like another way of not fulfilling DCAA’s contract audit mission. Whatever.)

(Also, there are two type of ADV calculations. The first ADV addresses the overall contractor ICP risk, which is total flexibly priced contract dollars plus T&M billed dollars less subcontractor dollars. The second ADV (called “sampling ADV”) is defined as “total cost proposed on flexibly priced Government contracts, plus total cost billed on Government T&M contracts, less direct costs on non-DoD contracts in which the reimbursable agency does not participate.” The more you know ….)

Back to the CAM:

Well, it looks like we were wrong, because sometime between 2016 and 2020, DCAA changed its policy such that proposals with small ADVs can be audited. They can even be audited via statistical sampling methodology! The revised CAM now states that such ICPs may be audited via sampling when (1) there were no significant questioned costs in the last completed incurred cost audit, and (2) there are no Department (ACO, PCO, COR, DCAA, etc.) concerns with a significant impact on the ICP. So there.

For proposals with sampling ADVs between $5 million and $100 million, transaction sampling may be used when conditions (1) and (2) (as above) apply, plus a condition (3): “The contractor does not have a pre-award accounting system survey that resulted in an unacceptable opinion, or a disapproved accounting system based on a postaward accounting system audit.”

For contractor proposals with sampling ADVs between $100 million and $250 million, first thing is that they must be audited every 5^th year. Beyond that, transaction sampling may be used when conditions (1), (2), and (3) apply, plus the following additional conditions: (4) the contractor does not have any business system deficiencies relevant to the incurred cost year subject to audit, (5) the contractor does not have any significant accounting practice changes in the year subject to audit; and (6) the contractor has not experienced any significant organizational changes in the year subject to audit.

For contractor proposals with sampling ADVs between $250 million and $500 million, first thing is that they must be audited every 4^th year. Beyond that, conditions (1) through (6) (as above) apply.

For contractor proposals with sampling ADVs between $500 million and $1 billion, first thing is that they must be audited every other year. Beyond that, conditions (1) through (6) apply.

Contractor proposals with sampling ADVs greater than $1 billion must be audited every year.

What does it mean if a contractor’s proposal is subject to audit but, for whatever reason, sampling and projection cannot be used? As we understand it, a prohibition on using statistical sampling methodology simply means that the results cannot be projected to the universe. However, we may be wrong about that. Perhaps in those higher-risk situations, a super-high sample size is used because there is no ability to project. Neither the MRD nor the CAM is particularly clear on the issue.

Clearly, the auditors’ judgment must be used to develop appropriate audit techniques. Maybe some smart auditor who’s taken AUD 113 Risk-Based Sampling of Incurred Cost Submissions at DCAI can write us and let us know the official answer.

In the meantime, we trust we’ve decoded the latest MRD. At least, we did our best to do so.