We have posted enough articles on the recent “public discussions” regarding assertions of Department of Defense (DOD) oversight failures to fill a book.  (Actually not a bad idea, but we’ll table it for another time.)  This article will discuss reactions to the various reports and testimony, from Congress, public “watchdog” groups, and from other media outlets.  Before we get into the fun fireworks, let’s recap the recent action so far.

August 6, 2009 – GovExec.com writes about leaked internal DCAA memoranda discussing the findings of the upcoming GAO report regarding DCAA audit quality. The findings do not sound good. See the article on that story here.

August 12, 2009 – The Commission on Wartime Contracting in Iraq and Afghanistan (co-chaired by long-time DCAA executive Michael Thibault) hears testimony from (among others) DCAA Director April Stephenson, blaming "faulty accounting, cost-estimating, purchasing and other business systems" for "millions of dollars" of contractor overbillings to the DOD.  Rather than focusing on DCAA, the Commissioners accused DCMA of “caving to the contractors and not acting properly on the Defense Department’s behalf,” according to an article on FederalTimes.com.  See the article on that story here.

September 21, 2009 – The Commission on Wartime Contracting issues a Special Report (“Defense Agencies Must Improve Their Oversight of Contractor Business Systems to Reduce Waste, Fraud, and Abuse”) recapping the August testimony and managing to blame all parties—from DCAA to DCMA and the contractors—for “unreliable data” from contrators’ “weak control systems”.  According to the Commission, DCAA auditors “are recognized experts on accounting matters, internal controls, and business systems,” while DCMA contracting officers “are not typically trained in these complex audit and accounting procedures and sometimes make questionable decisions, seemingly ignoring DCAA recommendations.” The dysfunctional relationship between the two DOD agencies allegedly “creates an environment in which contractors can exploit the agencies’ mixed messages and game the system to their advantage.”  See the article on that story here.

September 22, 2009 – The GAO issues a report addressing the adequacy of contractors’ ethics and business conduct policies, and their related internal control systems.  While reporting that nearly 100 percent of contractors surveyed had adequate policies, GAO castigated both DCAA and DCMA for failing to verify that their contractors had implemented a compliant business ethics program. GAO also alludes to a bit of bureaucratic finger-pointing, with DCMA telling GAO auditors that DCAA should be responsible for assuring that contractors have compliant business ethics programs, not them. See the article on that story here.

September 22, 2009 – The DOD Inspector General’s (DOD IG) August 31, 2009 report is released to the public.  This report was a follow-up effort to the DCAA audit deficiencies identified by GAO in its July 2008 report, and designed to address allegations regarding employee intimidation by management and an abusive work environment.  In its report, the DOD IG confirmed many of GAO’s initial findings and asserted that impaired independence by a DCAA Regional Audit Manager (RAM) led to the U.S. Air Force paying up to $271 million in unallowable costs.  With respect to the DCAA work environment, the DOD IG reported scattered employee concerns that “may have contributed to deficient audit work,” but only 18 percent of those auditors interviewed “had a supervisor change or direct a change to audit results or opinions.” (We note that the survey question did not address whether or not the supervisor changes were appropriate.)  It’s our view that the DOD IG’s survey results do not support their conclusion in this area.  See the article on that story here.

September 23, 2009 – The GAO releases its expanded report on DCAA audit quality problems, in which it reports “widespread” audit quality problems based on its review of 69 audits performed by seven DCAA FAOs.  To be sure, the anecdotal evidence is damning.  But in our view, GAO was overreaching by basing its general indictments of the audit agency on such a small, admittedly “not statistical” sample.  More importantly, GAO examined audit reports only from offices that issued predominantly “clean” opinions of contractors’ internal control systems; there is every reason to believe that there was a many errors in reports adverse to contractors as there were in reports favorable to them.  The GAO also took a shot at the DOD IG, asserting that its conclusion from a peer review of DCAA audit quality—that DCAA had “adequate” quality controls—was controverted by the actual findings of the DOD IG’s review. See the article on that story here.

All of which leads us to the September 23, 2009 hearing by the Senate Committee on Homeland Security and Governmental Affairs.  Our article on the hearings is here.

So with the foregoing in mind, let’s take a look at the reactions to the story.

GovExec.com published a generally objective article by Robert Brodsky entitled “DCAA Called Out Again Over Mismanagement” which started with: “The Defense Contract Audit Agency needs a complete overhaul, including new leadership and more independence from the Pentagon ….”  See the article here. The article reported various reactions from the Senate Committee members, “ranged from disappointment to rage.”  The article reported the following:

From Committee Chair Lieberman: "Perhaps in an effort to do too much, they are doing everything badly.”  DCAA "still seems driven by a culture that emphasizes speed and production of audits over the quality of results.”

From Ranking Minority Member Collins:  The GAO's findings are "an epic failure by the agency and the department."

From Committee Member Coburn, who “got sick” reading the GAO report:  "I can't understand why the management of this agency hasn't been completely changed."

From Committee Member Claire McCaskill, who last year led the outrage over the initial GAO findings:  "In the world of auditing, what has been happen[ing] here is a capital crime. There can be no bigger indictment of an agency than this GAO report. … At this point, DCAA audits are a joke.  If someone is not fired over this, I don't think anyone should ever take this agency seriously again."

The Project on Government Oversight (POGO), a nonprofit organization that focuses on exposing government corruption, expressed its “concern” about DCAA’s “ability to effectively oversee DoD contracts.  We are particularly troubled by DCAA Director Stephenson's testimony that despite the concerns raised by last year's GAO report, DCAA still only has enough funding to perform 65 percent of the audits they are required to complete.  This raises questions as to whether the Comptroller's office is properly prioritizing resources and support for this agency.  This may be due in part to a conflict of mission between the Comptroller's office and DCAA.”

Daniel Shulman, writing in Mother Jones, bastion of “smart, fearless journalism,” didn’t let facts interfere with the story.  His story, based on the Commission on Wartime Contracting’s report just a day before the Senate hearings, confused DCMA CPSR auditors with DCAA contract auditors, and said:

This explains a lot: Little league teams have more players than the Defense Contract Management Agency (DCMA) has staffers overseeing how military contractors are spending the government's money. Contract transactions have spiked 328 percent since 2000, but there are presently a mere 14 contracting officials monitoring them. … Not only do Pentagon contractors lack adequate ‘internal controls’ to insure they are billing the government correctly, resulting in billions in costs that auditors can't verify, but the DCMA and DCAA ‘are not effectively working together to protect’ the government from getting bilked. Like feuding siblings, the agencies can't seem to agree on much and wind up sending ‘mixed signals’ to military contractors.

But perhaps the most telling response came (once again from Sen. McCaskill) who Tweeted the following:

Gonna be some tuf ?s for witnesses in a few at this hearng. Unbelievable problms at Def Contrctng Agncy. Top of my head is about to pop off.

Followed by:

Complete failure of Def Contrct Audt Agency to meet auditng standards,no one fired. Hard to believe. Was I too mad?

So where do we (the taxpayers) go from here?  Will we be reading again, next year, about the same issues at the same audit agency?  Or will there be a new audit agency, more “independent” from its DCMA customers … or perhaps led by somebody from “outside” the “insular” entity?  Based on conversations with several DOD contractors, the primary emotion is one of anxiety, as they wonder if the government is about to throw away the playbook that’s been developed over the past 45 years.  The bottom line is that all partiers, from DCAA to DCMA and from contractors to taxpayers, want the same thing.  They all want quality audits, based on facts and evidence, interpreted by the same standards applied to everybody. The difficulty lies in agreeing on how to get there.

Before getting into the September 23, 2009 hearing by the Senate Committee on Homeland Security and Governmental Affairs (which will be the subject of an upcoming article), we want to spend some time on the 148-page GAO audit report on which most of the testimony centered—GAO Audit Report GAO-09-468 (September 23, 2009) entitled “DCAA Audits: Widespread Problems with Audit Quality Require Significant Reform.” This was a follow-up report to last year’s now-infamous GAO report (GAO-08-857), and was designed to (1) conduct a “broad assessment of DCAA’s management environment and quality assurance structure,” (2) evaluate corrective actions taken in response to last year’s report (as well as internal reports by the Defense Business Board and other DOD stakeholders), and (3) identify potentials actions that might be taken by Congress (and others) that “could improve DCAA’s effectiveness and independence.”  As the title of the report indicates (and as was previously leaked), DCAA did not fare well in the GAO’s investigation.

The GAO looked at DCAA Contract Audit Manual (“CAM”) guidance and DCAA’s quality assurance program.  It examined internal quality assurance reviews. It examined the 2007 DOD Inspector General external quality “peer review” of DCAA audit quality (but did not review any DOD IG working papers). And it also reviewed 69 audit assignments from the period Government Fiscal Years (GFYs) 2004 through 2006, focusing on reports issued by “DCAA offices that reported predominantly adequate (‘clean’) opinions on contractor systems and related internal controls ….”  The 69 audit assignments that GAO reviewed were comprised of 37 audits of contractor internal controls and 32 “cost-related audits” issued from seven “geographically disperse DCAA field offices within the 5 DCAA regions.”  Notably, the GAO did not review assignments from DCAA’s Field Detachment (which audits classified contracts) nor did GAO review assignments from offices that issued reports with predominantly adverse contractor findings.  Consequently, GAO’s findings are admittedly “not statistical” in nature; the review covered less than 10 percent of the 76 offices in which contractor internal control-related audit reports were issued during the review period.

To summarize, the GAO examined a biased sample of reports from a small fraction of DCAA’s offices, issued in historical periods prior to the July 2008 GAO report (and thus prior to implementation of any DCAA corrective actions in response to that report).  Moreover, the management activities the GAO examined were issued prior to the issuance of Defense Business Board recommendations on changes to DCAA organizational strategy (and implementation of same).  Further (and more to the point with respect to certain Senators’ angry and pointed questions during the recent hearing), all of the audit reports and activities, and related findings, in the GAO report occurred prior to Ms. Stephenson assuming her current position as Director of DCAA.  These limitations didn’t stop GAO from generalizing from the findings, nor did they stop GAO from making sweeping generalizations and major policy recommendations for the Department of Defense and Congress. For example, the GAO report concluded “[we] found DCAA’s management environment and quality assurance structure were based on a production-oriented mission that put DCAA in the role of facilitating DOD contracting without also protecting the public interest.”

Notwithstanding the foregoing caveats, the GAO report was rife with damning anecdotes and findings. It is hard to dispute the overall conclusions of the report, which were summarized thusly:  “we found audit quality problems at DCAA offices nationwide, as demonstrated by serious quality problems in the 69 audits … we reviewed, DCAA’s ineffective audit quality assurance program, and DCAA’s rescission of 80 audit reports in response to our work.”

The GAO report stated that “we found audit quality problems … with all 37 audits of contractor internal controls and the 4 incurred cost and the 2 request for equitable adjustment audits we reviewed at 7 FAOs across the 5 DCAA regions ….”  Detailed findings included:

• In 2004, a Western Region FAO planned a billing system audit of a federally funded research and development center (FFRDC)—a “grantee” that receives $1.5 billion annually for its research services.  The planning “did not take into account the fact that grantees are funded through letters of credit and do not actually bill the government.”  Despite this “obvious mistake,” DCAA auditors “issued a report stating that the grantee had an ‘adequate billing system’.”  Another report issued by the same office on the same FFRDC addressed cash management practices under the Single Audit Act.  According to the GAO, “the auditors could have simply forwarded this report to the DOD contracting officer—a task that would take an hour at the most to complete.  Instead [they] charged over 530 staff hours to generate documentation to meet DCAA’s billing system audit requirements, even though there was no related ‘billing system’.”  The GAO noted “DCAA has not rescinded the audit report even though it expresses an opinion on a nonexistent system.”

• In 2006, DCAA conducted a billing system review on a contractor generated approximately $76 million in annual sales to the U.S. Government; its last billing system review had been performed in 2000.  In the intervening six years, “the contractor had experienced significant downsizing and restructuring.”  The DCAA audit strategy was based on providing the contractor’s Information Systems Manager with six year-old audit documentation from its files and requesting that the documentation be updated and edited where necessary. Based on the contractor’s edited billing system internal control documentation and a walk-through, the DCAA auditor concluded that she could limit testing because the system was “strong.”  The GAO, however, that “the billing system was a software package that downloads accounting system data to spreadsheets [and] manual calculations were then used to develop invoice amounts—a process that is prone to errors….”  The contractor’s billing system internal controls were determined to be “adequate” even though no testing was performed on those controls.  Based on the GAO’s findings, the report was subsequently rescinded.

• In 2004, a contractor objected to draft findings and recommendations in a DCAA review of its accounting system internal controls.  In response to the contractor’s objections, “the auditors revised and deleted some workpapers and created new workpapers. …  GAO also found evidence … that the final supervisor instructed the final lead auditor to insert the signature of a prior supervisor on an electronic workpaper after it had been revised, thereby making it apper that the prior supervisor had approved the workpaper revisions.”  In 2006, DCAA issued its report recommending that the accounting system be determined to be “adequate”—even though it had “’scrub[bed]’ the audit documentation … dropp[ed] five significant deficiencies and drowngrad[ed] three significant deficiencies to suggestions for improvement.”  The GAO reported that “the audit supervisor, who authorized the electronic recording of the prior supervisor’s name on the audit documentation and supervised the issuance of the audit report, was subsequently promoted to Western Region Quality Assurance Manager, where he went on to act as a quality control check over thousands of audits ….”

Findings such as those summarized above were used to support broad, generalized conclusions such as:

• DCAA’s mission statement and strategic plan do not focus on the public interest
• DCAA’s performance metrics were designed to measure output
• DCAA’s audit quality assurance program was ineffective
• DOD IG’s peer review opinion on DCAA’s audit quality control system is inconsistent with the underlying deficiencies reported
• DCAA lacks a risk-based audit planning approach
• DCAA lacks effective human capital management

As a result, the GAO recommended several actions that it asserted would “improve DCAA’s effectiveness and independence.”  Among these recommendations were the following:

• Legislation should grant to DCAA “protections and authorities” equivalent to an agency Inspector General, such as “public reporting of audit results [and] rights to take statements from contractor and other personnel ….”
• Legislators should consider “changes in organizational placement” of DCAA, either by elevating DCAA within DOD, or by moving the audit agency out of DOD altogether—creating an “independent, Governmentwide contract audit agency.”

In addition, the GAO made 15 “recommendations for executive action” to the Secretary of Defense designed to “improve the quality of the agency’s audits and strengthen auditor integrity, objectivity, and independence ….”  Notable among these was the recommendation to “ensure that auditors who make direct bill [authority] decisions are independent of DCAA employees who perform a DOD management function … thereby reducing situations where DCAA auditors are encouraged to reduce their office workload by approving contractors for the direct-bill program.”

In conclusion, the GAO report included sensational, headline-grabbing findings that seemed to support the assertion that DCAA audit reports were poorly planned, poorly supervised, and were the result of an assembly-line production environment where quantity was valued more highly than quality.  However, as we noted above, the GAO review sample was biased and of insufficient size to support an agency-wide indictment of management inadequacy.  As many contractors would willingly agree, DCAA has considerable room for improvement with respect to audit planning and quality, and is badly in need of a cultural transformation.  We’re not necessarily convinced that the audit quality problems are as terrible (or as endemic) as the GAO asserts.

Next up:  what the Senators heard and how they reacted to the GAO report findings.