DOE Inspector General Says M&O Contractors Should Not Audit Themselves

Tuesday, 04 May 2021 07:41 Nick Sanders

Prior to 1994, the Department of Energy Office of Inspector General (DOE OIG), with assistance from independent public accounting firms, was responsible for auditing the annual Statements of Costs Incurred and Claimed for DOE’s management and operating (M&O) contracts. The OIG conducted these audits pursuant to the United States Government Accountability Office’s Generally Accepted Government Auditing Standards (GAGAS), also known as the “Yellow Book.”

In 1994, that all changed. Starting in that year, the M&O contractors were told that they were responsible for auditing themselves and their subcontractors under what was called the “Cooperative Audit Strategy.” Instead of complying with GAGAS, the M&O audit teams would henceforward comply with the Standards of the Internal Audit Institute (IIA). The change was driven by a GAO report that documented the inadequacies associated with the DOE OIG’s audit approach (“Energy’s IG has had difficulty in auditing, in a timely manner, whether costs claimed by integrated contractors are allowable and have been recorded in accordance with Energy’s accounting policies.”) At that point, the DOE OIG’s role was limited to conducting a limited assessment of the contractors’ internal audit work. The Contracting Officers would then take corrective action on any findings that the DOE OIG unearthed.

As the DOE OIG recently reported, not everybody has been a supporter of the Cooperative Audit Strategy. “For the 26 years that the Cooperative Audit Strategy has been in place, interested stakeholders, including GAO6 and the Department of Defense (DOD), have expressed concerns about the appropriateness of contractors auditing their own costs.”

Apparently, though it doesn’t explicitly say so, the DOE OIG has also been concerned about M&O contractors auditing themselves. That concern led to the issuance of a “special report” that was, essentially, a polemic that both attacked the use of M&O internal audit teams and supported the notion that the DOE OIG should, itself, be performing those audits.

The DOE OIG offered as the primary rationale for moving away from the Cooperative Audit Strategy the assertion that M&O internal audit teams are not independent from the contractors for whom they work. That lack of independence, according to the DOE OIG, undermines public trust. (“… the IIA audit standards do not include these objectives because ‘internal’ auditors are embedded within a company and are chartered to serve that company’s best interest. Internal company auditors in the private sector do not have the same elevated duty to public interest as Federal auditors and external auditors performing audits under GAGAS.”) The DOE OIG concluded that “no amount of changes to the Cooperative Audit Strategy would cure the fundamental defect that the internal auditors cannot meet the independence standards required by GAGAS.”

Except they are not subject to GAGAS so that argument does not seem very strong to us.

As a corollary to the lack of independence, the DOE OIG asserted that the M&O internal auditors aren’t finding the levels of fraudulent activity that they should be finding, leaving it to the OIG to find and investigate such wrongdoing. (“These problems would likely have been identified, reported, and corrected in a timely way through a GAGAS-compliant, independent audit.”)

Um, maybe? We think that assertion is undermined by the historical fact that the DOE OIG was not performing the required audits in a timely manner, which is why the Cooperative Audit Strategy was created in the first place.

As an additional corollary, the DOE OIG asserted that the M&O internal auditors have not been performing appropriate audits of subcontractor costs. According to the DOE OIG, there were subcontracts whose costs were not audited, subcontracts that missed being included in the audit universe because the Purchasing function misclassified them, and there were audits performed (but poorly). The problem with the assertions is that they are largely based on unissued reports that are still in draft, to which the contractors have not yet formally responded.

Another issue is with the subcontracts that were not audited because the Purchasing function misclassified them. First, there is no linkage between the issue raised and the alleged lack of independence. Maybe the root cause is that the M&O contractors’ purchasing systems are inadequate. Second, it is not clear that, had the DOE OIG been performing the audits, the misclassification would have been discovered. It is just as likely that the DOE OIG would have skipped those audits as well.

With respect to poor audits, another draft report indicates that “the M&O contractor did not sustain subcontract costs that were questioned by its own contract audit office in 54 of 61 (88.5 percent) subcontract closeout files, with no documentation or justification as to the M&O contractor’s rationale.” Based on that finding (as well as some other findings), the DOE OIG concluded that “either internal audit’s work was superficial and that the recommendations could not be acted upon, or worse, that the M&O contractor’s management may have disregarded the internal audit report findings and billed the Government for the questionable subcontract costs despite the internal audit report findings.”

Our concern with the foregoing is that it is not internal audit’s responsibility to disposition the audit findings and, if appropriate, seek recovery of unallowable costs from subcontractors. That’s the role of subcontractor management. While the DOE OIG findings may be legitimate and call into question whether the M&O contractor is appropriately managing subcontracts, it honestly seems to have nothing to do with how internal audit performs.

After the litany of M&O contractor internal audit deficiencies, the DOE OIG concluded with the recommendation that things return to the way they used to be. Ignoring its own historical malfeasance with respect to performing audits of M&O contractor and subcontract costs, the DOE OIG recommended that independent audits, performed by either the DOE OIG, DCAA, independent CPA firms, or some combination of those approaches, be implemented. The DOE OIG noted that “additional appropriations will be necessary” in order to effectuate the new (old) independent audit strategy.

It is not clear to us that the DOE OIG complied with applicable GAGAS when preparing this “special report.” It seems that there may have been some self-interest involved here, a self-interest that taints some of the findings. While it may well be true that the current M&O contractor internal audit approach should be improved, it is not at all clear that the correct path forward involves a return to the way things used to be, before DOE OIG was removed from its role because of a documented failure to perform.