Many readers know that DCAA’s current audit procedures lead auditors to ignore Excel spreadsheets and the like and, instead, obtain original source data for evaluation. The rationale for that approach is that spreadsheets can be inaccurate or, perhaps, deliberately manipulated. Thus, they are no substitute for original source data from the accounting or purchasing systems.

It’s hard to find too much fault with that approach—though it is annoying and inefficient. It’s particularly galling to those many contractors who are being audited on information processed years (or perhaps even a decade) ago. In at least one case, we had to consider rehosting a legacy accounting system that that had been abandoned five years prior to the commencement of the audit, simply to provide original source data to the DCAA auditor. (Fortunately, when we pointed out the cost of that exercise to the auditor another approach was agreed-upon.)

So the more current DCAA is in performing its audits, the more the agency’s policy on original source data makes sense; conversely, the older the data being audited, the less the policy makes sense to us. Unfortunately, as many of us know all too well, DCAA is years behind and prospects for “catching up” by 2016 (which is the commitment date that the audit agency has made to Congress) are—shall we say?—dim. Consequently, too many audits deal with data that is too old.

What’s interesting is that the FAR prescribes some limits on the length of time a contractor is required to retain certain data. FAR 4.705-1 discusses retention periods for financial and cost accounting records; 4.705-2 discusses retentions periods for pay administration records; and 4.705-2 discusses retention periods for acquisition and supply records. It is quite possible that the prescribed retention periods will have expired before DCAA gets around to asking for the records.

In such circumstances, DCAA auditors (and others) point to FAR 31.201-2(d), which states—

A contractor is responsible for accounting for costs appropriately and for maintaining records, including supporting documentation, adequate to demonstrate that costs claimed have been incurred, are allocable to the contract, and comply with applicable cost principles in this subpart and agency supplements. The contracting officer may disallow all or part of a claimed cost that is inadequately supported.

We have not seen the apparent tension between the prescribed record retention periods found in FAR 4.705 with the requirement found at FAR 31.201-2(d) resolved by any legal decision … yet. We suspect that the DCAA audit backlog, combined with the audit policy that requires examination only of original records, may lead to a Court addressing that tension sooner rather than later.

But that’s not what we want to discuss today.

We want to discuss a related topic, which is the policy position found at FAR 4.703(c). At that section, we find the policy that permits a contractor to store its records electronically, rather than retaining original paper copies.

Nothing in this section shall be construed to preclude a contractor from duplicating or storing original records in electronic form unless they contain significant information not shown on the record copy. Original records need not be maintained or produced in an audit if the contractor or subcontractor provides photographic or electronic images of the original records and meets the following requirements:

(1) The contractor or subcontractor has established procedures to ensure that the imaging process preserves accurate images of the original records, including signatures and other written or graphic images, and that the imaging process is reliable and secure so as to maintain the integrity of the records.

(2) The contractor or subcontractor maintains an effective indexing system to permit timely and convenient access to the imaged records.

(3) The contractor or subcontractor retains the original records for a minimum of one year after imaging to permit periodic validation of the imaging systems.

Moreover, in the next section (4.703(d)), we find the following policy—

If the information described in paragraph (a) of this section is maintained on a computer, contractors shall retain the computer data on a reliable medium for the time periods prescribed. Contractors may transfer computer data in machine readable form from one reliable computer medium to another. Contractors’ computer data retention and transfer procedures shall maintain the integrity, reliability, and security of the original computer data. Contractors shall also retain an audit trail describing the data transfer. For the record retention time periods prescribed, contractors shall not destroy, discard, delete, or write over such computer data.

Accordingly, it’s made plain as day that contractors can shred, burn, or otherwise dispose of their original source documents, so long as they maintain electronic copies for the required retention periods—and otherwise comply with the FAR requirements quoted above.

DCAA has finally gotten around to acknowledging the public policy found in the FAR and, as a result, issued MRD 13-PPS-16(R) on August 15, 2013. We received an advance copy of the MRD, courtesy of a regular reader. You will be probably be able to find the same MRD on the DCAA website, sooner or later. In the meantime, we will discuss some of the salient points of the audit guidance.

The MRD directs auditors to “test the contractor’s scanned images annually as part of an ongoing audit being performed at the contractor (e.g., incurred cost, proposal audit, etc.).” In other words, the testing of the contractor’s ability to accurately scan images effectively became another Mandatory Annual Audit Requirement (MAAR)—even though no separate activity code for the annual testing was provided. We have an opinion on the MAAR audits, and we discussed that opinion here.

There’s some stuff about when to perform the testing and how the testing is not the same thing as testing a contractor’s internal controls. But in the accompanying FAQ, we found the following points that we think worth sharing. (Note: Italics indicate emphasis added.)

Question 2: The contractor scanned a depreciation schedule originally prepared in Excel, but did not keep the original Excel file for 12 months. Is this covered by the new guidance?

Answer: No. This guidance only addresses the scanning of paper invoices. It does not address the scanning of financial and cost accounting records.

Question 9: I am performing an incurred cost audit for FY 2008, and it has been determined that my audit will include testing of the contractor’s scanned images. Do I test documents for FY 2008, or for the last 12-month period?

Answer: If it is determined that you will include procedures to test the contractor’s scanned images as part of your audit, you are required to look at the scanned images for the preceding 12-month period. However, if testing of the scanned documents was not performed for the FY 2008 time period, you also should determine if the original documents for that time period are available. If they still are available, testing of the scanned images for FY 2008 also should be performed to allow reliance on the scanned images during the ongoing audit

We found it interesting (to say the least) that the guidance only addresses “scanning of paper invoices” and not scanning of financial and cost accounting records. We cannot think of a reason why the audit guidance wouldn’t address the entire spectrum of scanned images, since the FAR does exactly that. We also find it interesting that, according to the MRD, testing of scanned images would need to take place 5 years after the fact in order to rely on them during an audit.

Of course, the most important gap in the guidance is the one we raised at the beginning of this article. Contractors do not, in our view, need to retain source documents in perpetuity pending the commencement of a DCAA audit at some indeterminate date in the future. Rather, it seems quite clear to us that a contractor can dispose of its original documents after the retention period prescribed by the FAR has passed. Moreover, we noted that contractors are only required to retain the electronic data “for the time periods prescribed.” After those dates have passed, contractors would seem to be able to purge their electronic data—including but certainly not limited to scanned images—at their discretion.

If DCAA comes calling years later, asking for hard copy or scanned images, we would think the contractor should be able to say “not available” without any repercussions. On the other hand—as we noted—we know of no legal decision that says our analysis is correct. Thus, we suspect most contractors will be reluctant to be the first in line to tell a DCAA auditor, “Sorry; go fish.”

It seems that going paperless is a difficult thing to do when one is a Government contractor.