You know that feeling when you have a first date with somebody you are really attracted to? You look forward to it. You think about what you will wear. You think about the best place to meet each other, one that is slightly romantic (but not too romantic—after all, it’s a first date). It can’t be too loud, because then you won’t be able to talk to each other and get to know each other, and explore that connection you feel. And then it’s time! You both get to this special place, wearing nice clothes. You sit down and look at each other ….

… and then you realize you have nothing in common. Nothing at all. All the conversational gambits fail. Questions get one-word answers. Or maybe he spends all the time looking at the game on the TV over the bar. Whatever. But after a few minutes you realize that attraction you felt has faded away and you start looking at your watch (or phone), counting the minutes until the date is over. Maybe you start texting your friend to call you with a made-up emergency, just to get out of there that much faster.

What you looked forward to has evaporated and it’s been replaced with nothing. There’s now a hole where the expectation of a potential great relationship used to be.

“Disappointment” is a word that might describe your feelings about the situation, but it’s hardly the right description. Sure, there’s disappointment. But there’s also anger as well. Anger that the opportunity was wasted. Anger that the money was wasted. Anger that the you were misled, that the attraction you felt was really a mirage.

Disappointment and anger and maybe a bit of a betrayal.

Those are our feelings about GAO’s report on Contractor Business Systems.

How did this fiasco get started?

Section 890 of the 2018 National Defense Authorization Act (NDAA), required the Comptroller General of the United States to “submit to the congressional defense committees a report evaluating the implementation and effectiveness of the program for the improvement of contractor business systems established pursuant to section 893 of the Ike Skelton National Defense Authorization Act for Fiscal Year 2011 (Public Law 111–383; 10 U.S.C. 2302 note).”

Note that key word: evaluate.

But more than that was required. Section 890 went on to say:

The report shall—

(1) describe how the requirements of such program were implemented, including the roles and responsibilities of relevant Defense Agencies and known costs to the Federal Government and covered contractors;

(2) analyze the extent to which implementation of such program has affected, if at all, covered contractor performance or the management and oversight of covered contracts of the Department of Defense;

(3) assess how the amendments to contractor business system requirements made by section 893 of the National Defense Authorization Act for Fiscal Year 2017 (Public Law 114–328; 130 Stat. 2324) were implemented, including—

(A) the effects of revising the definition of “covered contractor” in section 893(g)(2) of the Ike Skelton National Defense Authorization Act for Fiscal Year 2011 (Public Law 111–383; 10 U.S.C. 2302 note) and the feasibility and the potential effects of further increasing the percentage of the total gross revenue included in the definition; and

(B) the extent to which third-party independent auditors have conducted contractor business system assessments pursuant to section 893(c) of the Ike Skelton National Defense Authorization Act for Fiscal Year 2011 (Public Law 111–383; 10 U.S.C. 2302 note);

(4) identify any additional information or management practices that could enhance the process for assessing contractor business systems, particularly when covered contractors have multiple covered contracts with the Department of Defense; and

(5) include any other matters the Comptroller General determines to be relevant.

But more than that was required. The House language (quoted above) was modified in Committee and “the Senate recedes with an amendment that would expand the review to evaluate overall implementation and effectiveness of the contractor business system program…” (Emphasis added.)

Again, we note the key word: evaluate.

Evaluate the effectiveness.

Thus, the Comptroller General and GAO had a clear mandate and the topics to be covered were clearly stated. Too bad the Comptroller General and GAO ignored their mandate and ignored the topics to be covered, and issued a nothing burger of a report.

Let’s be clear that auditors from GAO made token efforts to try to hit the marks established by the NDAA. They met with individual contractors and they met with industry associations. Those people interviewed by GAO were led to believe that their inputs were valued, that they would be considered in the final report. Contractors gave their time and taxpayers paid for that time, just like taxpayers paid for GAO auditors to travel to those contractor sites to obtain the valuable insight from the contractors. And it was going to be used in the report and that report was going to pull the curtain away from the utter nonsense that is the Contractor Business System oversight regime.

Yeah, about that. Not so much.

Report findings:

• DOD does not have a mechanism to monitor and ensure that these reviews are being conducted in a timely manner.

• DCMA currently lacks a mechanism based on relevant and reliable information, such as the number of reviews that are outstanding and the resources available to conduct such reviews, to ensure reviews are being completed in a timely fashion.

And … that’s it.

Does that sound like GAO actually did what Congress demanded—via Public Law—that it do? No?

We didn’t think so either.

What about the table that showed actual versus planned DCAA Contractor Business System audits? You know, the one that showed less than 20 audits per year over the period GFY 2013 through GFY 2018, but then the number of planned audits suddenly increasing from low levels to more than 100 per year by GFY 2020?

(We mean, we’ve seen charts like that one before—mostly prepared by Marketing. They’re called “hockey stick” charts because they’re flat until they suddenly turn upwards at the very end of the year. That way, the Marketing folks get to keep their jobs longer, until it becomes painfully obvious they will not meet their plans.)

What did GAO say about that hockey stick DCAA audit chart? Well, on pages 22 and 23, GAO wrote about DCAA’s plans to radically amp-up its CBS audits. GAO wrote—

DCAA officials acknowledged they have not been able to conduct audits of contractor business systems within the timeframes outlined in DCMA instructions. … Recognizing that it cannot perform all of the required CBS audits in a timely fashion to meet current DCMA policy requirements, DCAA officials told us they focus their audits on business systems they identify as high-risk. … Our analysis indicates that successfully executing [DCAA’s] plan is dependent on several factors, including the ability to shift resources from conducting incurred cost audits to business systems audits, the use of public accounting firms to perform a portion of the incurred cost audits, and the ability of DCAA auditors to use new audit plans and complete the required audits in a timely manner. … DCAA plans to shift more than 378,000 hours from incurred cost audits to CBS audits between fiscal years 2018 and 2020. DCAA officials noted, however, that although they have made significant progress in addressing incurred cost audits, the fiscal year 2018 NDAA requires DCAA to have all incurred cost audits performed within 12 months. DCAA officials noted that this means it will have to continue to spend significant resources on incurred cost audits in fiscal year 2019 to meet this legislative requirement. … DCAA officials stated that these estimates include the resources that are expected to become available to perform CBS audits as DCAA starts using public accounting firms to perform incurred cost audits. …

In summary, Marketing has a plan to hit its sales goals but it’s dependent on things happening that almost certainly will not happen. Recognition of failure is thus delayed: the can is kicked into GFY 2020.

About those contractor interviews—

Our review of six selected contractors’ business system reviews illustrates the challenges in identifying and resolving deficiencies in a timely manner. Overall, our review of these six cases found that it took from 15 months to 5 years or more to resolve deficiencies initially identified by DCAA or DCMA. Factors contributing to the time it took to resolve these issues included contractors submitting inadequate corrective action plans, DCMA or DCAA identifying additional deficiencies in subsequent reviews or audits, and the use of different auditors to conduct the reviews. [But] DCMA and DCAA officials believe the cases we analyzed were not representative of the length of time needed to complete the CBS review process, but could not provide data to support their views because DCMA and DCAA do not track data on the length of time it takes to complete the entire CBS review process (i.e., from the start of an audit or review to the resolution of system deficiencies and final determination).

(Emphasis added.)

There you have it. In the time-honored tradition of government bureaucrats, contractor complaints and actual audit findings were arm-waved away as being “not representative” of the situation—even though they absolutely were representative of the situation. GAO accepted the bureaucratic rebuttal at face value, even though (as GAO noted) the bureaucrats “could not provide data to support their views.”

So much for contractor and industry association input.

Oh, there was something about the use of independent auditors and how DoD and DDP haven’t yet acted on the GFY 2017 NDAA Public Law requirements. Because there are “concerns.” Moreover—

… the Director of the Defense Acquisition Regulation Council—who is responsible for promulgating proposed and final rule changes to the DFARS— tasked her staff to draft a proposed rule by March 2017. This deadline was subsequently extended to January 23, 2019. In November 2018, Defense Pricing and Contracting (DPC) officials told us that they now expect to issue the proposed rule for public comment in the third or fourth quarter of fiscal year 2019. DPC officials attributed this delay, in part, to a recent executive order that calls for the reduction and control of regulatory costs, as well as the complexity of having public accounting firms perform CBS reviews.

Again, note that the statements were taken at face value. The nearly three-year delay in even issuing a proposed rule for public comment was explained as being President Trump’s fault. If only he hadn’t issued that pesky Executive Order, well then, of course the DAR Council would have fulfilled its role and complied with Public Law. To us, that smells very much like GAO auditors not acting with professional skepticism.

And that’s the report. All of it.

Our understanding is that a representative from GAO will be meeting with contractor industry associations to discuss the findings of this report, just as if it were an important report, with actionable findings. We hope those industry associations ask probing questions about what happened to the Congressional mandate GAO had to evaluate the effectiveness of the CBS oversight regime?

Where the heck was the evaluation of the effectiveness to be found in the report?

This report was supposed to be an important report. Just like that first date was supposed to be an important event. Things were supposed to happen, based on this report. Reforms were possible. Just like that first date was supposed to lead to a beautiful relationship.

Yet, at the end there was nothing.

Nothing of substance. Nothing of consequence.

And now we’re wondering when that “emergency” phone call is going to happen, because we want to get out of here.

As readers know, we don’t post many of the fraud stories that come our way, courtesy of the U.S. Department of Justice. The reason for that decision to elide them, as we’ve told you before, is that they are (for the most part) boring. Fraudster does a scheme. Fraudster gets caught. Fraudster pays. Company pays. Repeat ad infinitum.

But today we have a couple of more interesting ones. Let’s dive in, shall we?

The first story concerns a small business, E.M. Photonics (EMP). EMP and its CEO recently settled allegations that they violated the False Claims Act. The reported settlement amount was $2.75 million.

What’s the story? Well, “as alleged in the settlement agreement”—

EMP received SBIR and STTR funds from various agencies (including DARPA, military services, the DOE, and NASA) during the period January 2009 to April 2014. (Let’s say 5 years.) EMP and its CEO allegedly defrauded the SBIR/STTR programs via two schemes.

(1) EMP received duplicative funds; i.e., they submitted proposals (and received funding) from different agencies for doing essentially the same work. As part of their proposals, they certified that the work was non-duplicative; but it wasn’t.

(2) EMP and its CEO “directed EMP employees, or caused others to direct EMP employees, to falsely complete timesheets for direct labor that the employees did not perform.” Thus, the invoices that contained the false labor hours/dollars were considered to be false claims under the False Claims Act.

The two schemes make sense when you look at them together. The first scheme brought in duplicable contract and grant funding, but then EMP needed to create false labor costs to show that work was being performed. In the words of the DOJ announcement, “The government alleged that both of these schemes were designed to maximize charges to each contract or grant.”

Yeah, it looks that way.

The second story is about Microsoft. According to The Seattle Times (in a story written by Mike Carter), a “former” Microsoft Director agreed to a plea deal related to an alleged corporate fraud worth as much as $1 million. The story states that “Jeff Tran, 45, who served as director of Microsoft’s Sports Marketing and Alliances division,” allegedly did a number of naughty things, including—

• Stole 62 Super Bowl tickets intended for company employees and sold them online for $200,000.

• Stole “blocks of Super Bowl tickets and Super Bowl Party tickets belonging to Microsoft. … In one instance, he sold an unnamed Microsoft employee a pair of the free tickets for $12,400 and pocketed that money.”

• “Solicited a $775,000 payment from a vendor … The indictment alleged Tran funneled the payment to his own bank account, and then asked the vendor to help cover it up, threatening to remove the business from a preferred vendor list if it didn’t.”

• “Tried to solicit a second, $670,000 payment through a fraudulent invoice and was planning to ask for a third for $500,000 …” but was caught before he could consummate those schemes.

We might have been happier if Microsoft’s internal controls had detected the wrongdoing. Alas, it is not so. Instead, “Microsoft vendors became suspicious of Tran’s activity and reported the conduct to the company.” That was when Tran allegedly “destroyed electronic communications and told the vendors to lie to Microsoft about the $775,000 payment.” Unfortunately for Mr. Tran, his scheme was uncovered and he subsequently “paid $1,036,000 to Microsoft in restitution.” Yeah, we would have been “suspicious” as well, if somebody had tried to extort hundreds of thousands of dollars from us.

So the suspicious vendors told Microsoft, who then told the FBI. And that’s how Tran went down. Not a shining moment for Microsoft, who let a Director perpetrate (alleged) fraud schemes and didn’t detect any wrongdoing.

But Tran’s restitution to his (former) employer didn’t end his legal problems. According to Mike Carter’s story, “he pleaded guilty to a single count of wire fraud in a deal that will result in the dismissal of four other counts when he’s sentenced May 10 by U.S. District Judge Ricardo Martinez…. Wire fraud carries a possible prison term of up to 20 years. As part of the plea agreement, prosecutors will ask that Tran serve no more than three years in prison, according to a statement from the U.S. Attorney’s Office.”

When Tran is released from prison, we suspect he’s going to have a hard time finding gainful employment in the white-collar sector of private industry.