Mr. Mark
Gomersall
OUSD (AT&L) DPAP (DARS)
IMD 3D139
3062 Defense
Pentagon
Washington, DC 20301–3062.
Re: DFARS Case 2009-D038
Business
Systems—Definition and Administration
Dear Mr.
Gomersall,
This letter
provides comments in response to the proposed rule that would “clarify”
the definition of contractor business systems, and DOD’s administration
thereof. First, let me state
that I provide these comments as an individual and any opinions I
express are my own. Although I am employed by a Top 5 Defense
contractor, my opinions do not necessarily reflect the opinions of my employer. Moreover, although I
have provided consulting services to the defense industrial base for
more than a decade, my opinions do not necessarily
reflect the opinions of my clients.
As a threshold matter, I agree that
the existing regulatory framework governing contractor systems needs to
be updated and clarified. There has been little
in the way of guidance for contractors seeking to implement effective
systems of internal control since the publication of the Defense
Contractor’s Risk Assessment Guide (CRAG) in 1988. CRAG identified five
systems of contractor internal control: (1) preparation of indirect
cost “claims” (i.e., proposals to establish final indirect cost rates), (2) timekeeping and labor charging,
(3) material management and accounting systems (MMAS), (4) estimating,
and (5) purchasing. The Defense Contract Audit Agency (DCAA)
subsequently expanded the CRAG list to develop its list of ten key
contractor internal control systems, which included (in addition to those mentioned in the CRAG list): (1) Electronic Data Processing
general controls, (2) Billing, (3) Budgeting/Planning, (4) Compensation,
and (5) Indirect/Other Direct Costs.
More recently, in November 2008 FAR contract clause
52.203-13(c) implemented a requirement that
contractors have an internal control system that “facilitate[s] timely
discovery of improper conduct in connection with Government contracts;
and … [e]nsure[s] corrective measures are promptly instituted and
carried out.” The lack of guidance and, in
particular, the lack of an independent source for a
determination of what control activities constitute an “adequate”
system, has been a barrier to those contractors desiring to implement
effective systems of internal control that would provide assurance that
they are complying with applicable statutory, regulatory, and contractual requirements.
While I agree that it is past time
to update and clarify the existing regulatory guidance, I have several
objections to the proposed rule. Fundamentally,
the proposed rule is unnecessary, creates potential conflicts with
existing FAR language, and it would be applied to contract financing payments that are
expressly exempt from requirements of certain business systems. In its likely effect on contractors, it is punitive, arbitrary, and capricious.
Following are my specific comments:
1.
This should be a FAR rule and not a DFARS rule. Promulgating the rule within the DFARS will lead to confusion
as to which framework applies to contractors with both DOD and non-DOD contracts. DOD contractors
that are under the administrative cognizance of
another Executive Branch Department or agency, or that have both civilian and defense contracts, will be potentially
subject to multiple frameworks—i.e., they
may have to comply with the “business systems” requirements in their DOD contracts while concurrently having to comply with business
system adequacy rules of their cognizant non-DOD agencies. Subjecting contractors to multiple, potentially conflicting,
lists of standard “business systems”—and varying (potentially
conflicting) standards of adequacy—will
generate administrative confusion, create implementation problems, and
will increase compliance costs. The solution is to make this a FAR (i.e., government-wide) rule. If that is not feasible, then the
final rule should clearly state that a contractor are subject to the
“business system” rules of its cognizant agency; and that in the case of
conflict between the requirements of an
individual contract’s clause(s) and the
requirements of the cognizant agency, the requirements of the cognizant agency—and not the
requirements of the individual contract’s
clauses—shall prevail. Failure to address this potential requirements
conflict is a fatal flaw in the proposed rule.
2. Exempt contracting financing payments
from the final rule. Although I support the
notion that DOD implement payment withholds when a contractor ignores or
fail to implement actions to correct identified deficiencies, there is no need to implement contract financing payment
withholds via a new DFARS clause because the FAR already provides
sufficient protection for the Government. DOD contracting officers already have authority to
reduce or suspend such payments when it is determined that “the
Contractor’s records or controls are determined … to be inadequate for
administration” of contract
financing payments. (See, e.g., the
language at 52.232-32(h).) With respect to
progress payments, the relevant clause (52.232-16) provides that the
Contracting Officer may “reduce or suspend progress payments” when it is
determined that the contractor does not “maintain an accounting system
and controls adequate for proper administration of this clause.”
Consequently, it should be clear that adding the proposed language to
DFARS does nothing to provide additional protection
to the Government with respect to contract financing payments; doing
so merely sows confusion in the contract administration process and
creates potential conflict between the applicable DFARS and FAR clauses.
In
particular, linking contract financing payment withholds to accounting
system deficiencies defeats a
key benefit of Performance-Based
Payments (PBPs)—DOD’s “preferred method” of
contract financing for fixed-price contracts. One
of the Government’s key benefits when using PBPs is reduced government oversight because “the contractor’s
accounting system is not relied on to determine payment amounts.”
(Source: DOD User’s Guide to Performance-Based Payments, November, 2001, page 2.) In other words, the rule as drafted extends oversight into an
area in which there is no nexus between the Government’s risk of
improper payments and adequacy of the contractor’s business
system, and it also extends
oversight into an area that, by Congressional
intent and DOD policy, was expressly exempted from
such oversight. If the DAR
Council proposes to require
Contracting Officers to reduce PBP amounts based on deficiencies in the
contractor’s accounting system, it may as well eliminate use of PBPs
altogether—because will have defeated a key benefit from their use.
3. The proposed
rule is punitive, arbitrary, and capricious.
As previously stated, I applaud the notion that contractors should be
held accountable for the adequacy of their business systems. And as
previously stated, the existing FAR and DFARS language already provides
much if not all of the authority Contracting Officers need to implement
such withholds when it is appropriate to do so. The proposed rule would
mandate payment withholds ranging from 10 to 100 percent when the
Administrative Contracting Officer determines that one (or more) business system contains “deficiencies”. Glossing over my belief that such payment reductions would be
found by a Court to be excessive to the
Government’s risk and therefore punitive in
nature, I would like to focus on the proposed language.
The
term “deficiencies” is vaguely defined as “failure to maintain an
element” of an acceptable system. There is no mention of materiality,
or of risk, or of proportionality, or of use of judgment. There is no discussion of control objectives versus control
activities. There is no discussion regarding the fact that some system deficiencies can be “technical”
with no impact to payment amounts (e.g., a lack of formal policies and procedures), while others can be significant and
pose great risk to the Government. There is no acknowledgment that human error (i.e., a simple mistake) is not at all the same as a systemic flaw. Moreover, the proposed language
(e.g., “the contractor’s accounting system
shall be in compliance…”) actually
conflicts with the existing policy
at DFARS 242.7501, which states that the goal of an accounting system
is “reasonable assurance” of compliance—and not absolute assurance. Because the proposed language is vague
and conflicts with existing policy language, it should be withdrawn, or at least significantly
rewritten to address various types of deficiencies and the fact that no
control system is perfect (nor would DOD want to pay for a system that
achieved perfection, as it would be cost-prohibitive).
Moreover,
the system requirements are similarly ill-defined. For example, the
proposed rule would state that one requirement of an adequate accounting system is the ability to
provide “cost accounting information as
required.” Required by whom I wonder? Required by the contractor itself
(for its own use), or by DCAA auditors, or perhaps by DCMA functional specialists? And exactly what cost
accounting information is the requirement addressing? This is simply
one example of many that could be discussed. The conclusion is obvious: the proposed rule is vague,
lacks any linkage of system “deficiency”
to actual risk, and
simultaneously removes Contracting Officer discretion in favor of
mandatory withholds that are excessive to any
possible risk to the Government. As drafted, the
proposed rule is the very definition of “arbitrary and capricious”.
4. The proposed rule
fails to address key steps in the process.
The proposed rule lacks key details regarding the
administrative process—a process whose steps and overall duration will affect the financial
stability of the defense industrial base. (I note
that contractors must continue to perform their contracts, even if 100
percent payment withholds are imposed. Impacting contractor cash flow
so significantly, for an indefinite duration, surely will lead to
impacts on financial stability and financial capacity.)
For example, the proposed rule
states that “the ACO, in consultation with the
auditor or cognizant functional specialist, shall evaluate the
contractor’s response and make a final determination” regarding system
adequacy, but fails to define how the consultation will take place. Is a formal DCAA audit report required to determine that a
business system has a deficiency? Does an ACO
require another formal DCAA audit report in order to determine that a deficiency has been corrected by the
contractor? Can the
consultation take place via email, as current Defense Procurement and
Acquisition Policy (DPAP) guidance would suggest? Given
that DCAA frequently takes a full year to conduct a system review, and
that current audit guidance requires auditors to wait “several cycles”
before initiating follow-up reviews to determine whether corrective
actions have been implemented, this proposed process easily could lead
to contractors being forced to perform on DOD contractors for more than a
full year without being paid, simply because DCAA hasn’t scheduled the
follow-up audit or timely issued its audit report. The unintentional consequence of this open-ended process might
well be to force contractors into bankruptcy and terminations for
default—which will require buying commands to reprocure the goods and/or
services they need. Additionally, the proposed rule requires the ACO to
provide the contractor a report in sufficient detail to “allow the
Contractor to understand what actions are necessary to correct the deficiencies,” but what happens if the contractor
alleges the report lacks the requisite detail? The
administrative process, as drafted, could easily
lead to a contractor being caught in a kind of “Catch-22” wherein it
lacks sufficient information to correct a system deficiency, but cannot
receive payment until it corrects the ill-defined
problem to the satisfaction of the DCAA and ACO.
Surely this absurd and counterproductive result cannot be the intention
of the DAR Council.
The proposed rule states that payment withholds
will be withdrawn when the contractor has “substantially corrected”
them, but fails to define what that phrase means. For example, does
DCAA need to re-audit the
business system and reach that conclusion in order for an ACO to make
that determination? (See my
comment, above, regarding the lack of timeliness
associated with DCAA follow-up reviews. If the
contracting parties are waiting for DCAA to issue a follow-up
report—even from a “limited scope” audit—they will have a very long wait
indeed. A full year’s wait would be a good guess of the length of time
the parties would be awaiting DCAA’s input.) Moreover, what is the difference between
“substantially” corrected and “fully corrected” or even “partially
corrected”? Unless these terms are clarified for the benefit of the ACO and contractor, as well as DCAA
auditors, it is difficult to understand how and
when the payment withholds will be withdrawn. The
situation will create
uncertainty and risk, and contractors will seek to increase prices in
order to protect themselves from such uncertainty and risk.
Additionally, the proposed rule states that payment withholds will be
withdrawn when the contractor has “substantially corrected” its deficiencies (proposed policy
234.201 at (7)), when the contractor has “corrected
all deficiencies” (proposed direction at 242.70X1(b)(3)), and when the contractor has “corrected all
deficiencies” (proposed clause at 252.242-7xxx(e)(2)(ii)). Which
direction does the DAR Council intend that the parties follow? It is internal contradictions such as these that will impede
efficient contracting oversight and administration.
To
address these concerns, the DAR Council needs to clarify the process in great
detail, including how disagreements between the contractor and DCAA, or
DCAA and the DCMA ACO, will be handled in a manner that is fair to the
contracting parties.
5.
The proposed rule is premature and DOD is not ready to implement it
at this time. The
proposed rule as drafted imposes significant burdens on DCMA ACOs and
functional specialists, as well as on DCAA auditors. They are not ready to implement it. If implemented now, the results will be an
administrative paralysis that will harm the defense
industrial base and, ultimately, the warfighters.
All stakeholders agree that both DCMA and DCAA are under-resourced to execute their current
oversight missions, let alone the additional
burdens imposed by the draft rule. The Commission on Wartime Contracting in Iraq and Afghanistan
(CWC) reported—
Poor
alignment of personnel to meet wartime needs has resulted in a spiraling
down of business-system oversight in contingency contracting. There
have been too few experts to conduct reviews and too few personnel to validate that contractor corrective action was properly implemented. As a result of personnel
shortfalls, DCAA system reviews and follow-ups are not always timely; therefore, the real-time status of contractor business systems
cannot always be determined. (Source: CWC
Special Report No. 1, page 6.)
In
the same report (page 7) the CWC concluded that “DCAA is under-resourced
for comprehensively reviewing all contingency contractors’ business
systems on a timely basis.” If DCAA cannot
address the needs of a handful of contingency contractors, how can it
possible address the needs of each defense contractor this proposed rule
will affect? The CWC conclusion was confirmed in September 2009, when then-Director April Stephenson testified before the Senate
Committee on Homeland Security and Governmental Affairs that—
Based on the audits required under laws and regulations
and an estimate of the audits required to meet contracting officials’
demand requests, the field audit offices developed the hours necessary
to accomplish the workload, taking into consideration the risk of the
various contractors, the skill level of the audit staff and an estimate
of the additional hours required to comply with the auditing standards.
Based on the hours, we developed Agency-wide priorities. Since our funding provides for only about 65% of the
audits that are required to be completed, we based the FY 2010 priorities on the audits of
highest risk. [Emphasis added.]
It is not only DCAA
that is under-resourced. The CWC also
noted in its Special Report No 1 (page 7) that “The number of [DCMA] personnel assigned to perform CPSR reviews has decreased from
102 in 1994 to 70 in 2002, to 14 in 2009. … This
steep decline in personnel, combined with the exponential increase in
contracting activity, demonstrates a diminishing level of DCMA critical
analysis of contractor purchasing systems.” It is
well and good to require timely analysis (including follow-up analysis)
of contractor business systems; but the fact is that DCMA currently
(and for the foreseeable future) lacks the ability to do so.
In addition to the lack of resources, there is a real
question as to whether the DCAA is prepared to execute its role to
evaluate contractor business systems, to determine the risk associated
with system deficiencies, and to evaluate whether contractors have
implemented appropriate corrective actions.
In September 2009, GAO
issued audit report GAO-09-468 that reported “audit quality problems at DCAA offices nationwide, as
demonstrated by serious quality problems in the 69 audits … we reviewed,
DCAA’s ineffective audit quality assurance program, and DCAA’s
rescission of 80 audit reports in response to our work.” Almost simultaneously, the DOD
Inspector General issued Audit Report No. D-2009-6-009, that provided an
independent confirmation of GAO’s 2008 findings that DCAA audit reports
prepared in the Western Region lacked professional judgment, contained
inadequate documentation or insufficient evidence to support conclusions
reached, and/or lacked adequate supervision. Moreover, GAO also issued
audit report GAO-09-921 in September 2009, in which it advised DCMA
contracting officers not to rely on DCAA audit
procedures to implement contract cost surveillance. GAO warned DCMA
that “The effectiveness of DOD’s
cost surveillance process depends, to a large extent, on the adequacy
of [ ] DCAA procedures. Our recent work has raised concerns in this
regard.”
The proposed rule requires the
following—
The auditor or other cognizant functional specialist shall
document deficiencies in a report to the ACO. The report shall describe
the deficiencies in sufficient detail to allow the contracting officer
to understand what the contractor would need to correct to comply with
the applicable standard or system requirement, and the potential
magnitude of the risk to the Government posed by the deficiency.
The
proposed rule ignores the findings of GAO and the DOD Inspector
General, and blithely assumes that DCAA is capable of issuing reports
adequate to support DCMA contracting officer determinations. Quite
clearly, DCAA is not ready to do so at this time.
At the very least, the DAR Council should wait until GAO and/or the DOD
Inspector General report significant audit quality improvement at DCAA, before implementing a system
that is so dependent on the quality of DCAA audit reports.
Earlier this month, the House Armed Services
Committee’s Panel on Defense Acquisition Reform issued its interim
report after 12 months of effort. Among the Panel’s recommendations was
that the DOD should consider “shifting the
responsibility for certification of contractor business systems to
independent teams within or outside of DCAA” because of “methodological difficulties experienced at multiple DCAA field
offices and on multiple DCAA audits” that have “led to audit conclusions
that are unsupported by evidence.” (Source:
Interim Report, page 47.) DOD may or may not
choose to accept the Panel’s recommendation in this area, but it should
be given the opportunity to consider the recommendation and reach a decision without having the
decision forced on the Department by hurried rule-making.
Finally,
I understand that DCAA is currently reevaluating its approach to how it
conducts its audits and reports findings with respect to contractor
business systems. I applaud the agency’s efforts to address problems caused by its current “pass/fail” approach that has been publicly
criticized by many parties, including the CWC. Many planned contractor business system audits have
been deferred pending implementation of the new audit guidance. This
proposed rule, if implemented as written, would significantly affect
DCAA audit procedures, as many areas that are currently treated as
separate business systems would be aggregated into fewer systems. (E.g., the accounting system would include labor
accounting/timekeeping and indirect/other direct cost accounting, which
are currently audited as separate systems.) My point is that the DAR
Council should delay this rule until DCAA has new audit guidance in
place sufficient to conduct
audits under the new business system adequacy regime. Implementing the
new regime before DCAA is ready to conduct its audits will only
exacerbate the issues regarding audit quality and timeliness I have
previously noted.
To sum up, neither DCMA nor DCAA is currently
ready to implement this proposed rule, and implementing it now, while
the oversight agencies are under-resourced, lack the necessary direction, and are still addressing audit quality problems, risks chaos. The stakes are high—they
are the financial stability of the defense industrial base. Does the
DAR Council want to take the risks I’ve outlined above? Clearly the
better course is to delay implementation of the final rule, however
drafted, until there is some indication that the oversight agencies are
positioned to successfully implement it.
Thank you for
the opportunity to comment on the proposed rule. I sincerely hope that
the DAR Council and its support staff consider my comments and either
withdraw or significantly rewrite the proposed rule to address the
concerns I’ve raised. In any case, I hope implementation will be timed
so that the oversight agencies can effectively comply with the final
rule without penalizing defense contractors because they lack adequate resources or direction.
Sincerely,
Nicholas Sanders
Principal
Consultant
Apogee Consulting, Inc.
This e-mail address is being protected from spambots. You need JavaScript enabled to view it