DCMA and DCAA Interaction, as Seen by the DoD Inspector General
We have called them “the Oversight Wars” and, although the war has largely died down since its most confrontational moments six or seven years ago, little hotspots still flare up every so often.
The Oversight Wars, for those who may have forgotten, were a series of hostile reports issued by GAO, DoD OIG, and the Commission on Wartime Contracting. Sometimes the finger of blame was pointed at DCMA; other times it was pointed at DCAA. Sometimes it was pointed at both. It was a form of internecine bureaucratic warfare, seemingly designed to degrade the perception of the defense acquisition environment in the eyes of both Congress and the public.
The latest little flareup appears to be ignited by the work of the DoD Office of Inspector General (OIG). Recently, the OIG issued a report critical of DCMA contracting officers. According to the OIG, DCMA contracting officers weren’t doing a good job of complying with CAS administration requirements. We didn’t think much of the report and we told our readers why we felt the way we did. In a nutshell, we found the OIG’s analysis superficial and its recommended corrective actions equally superficial. We noted that DCMA made it easy for the OIG to have findings because its Instructions established timeframes that were nearly impossible for COs to meet. Whatever.
Just another shot fired in The Oversight Wars.
More recently, the DoD OIG has issued another report critical of DCMA Contracting Officers. This time, the OIG found that the CO’s lack of compliance with “FAR, DoD Instruction 7640.02, or DCMA instructions” with respect to dispositioning DCAA questioned costs led to a situation where “contracting officers may have inappropriately reimbursed DoD contractors for millions of dollars in unallowable costs, the Government did not collect penalties when they should have been assessed, or reported incurred cost findings were not addressed in a timely manner.”
Editor’s note: One of those things is not like the others. Can you identify which it is?
Basically, the OIG auditors examined 22 DCAA audit reports issued between September 2013 and July 2015. During that period, DCAA issued 1,072 audit reports, but the OIG auditors selected only 22 of them to review. That’s a two percent sample, for anybody counting. Also, the OIG noted that it didn’t select those 22 audit reports randomly; instead, the auditors “judgmentally selected” their two percent sample. The OIG report did not mention the factors that contributed to the auditors’ judgment with respect to sample selection.
The point of the audit was not to evaluate the quality/accuracy of the DCAA audit findings; instead, the objective was to evaluate what DCMA did with the audit findings.
-
In 15 of the 22 reports, the DCMA COs did not enter accurate status in the Contract Audit Follow-up (CAFU) system.
-
In 5 instances, the COs did not meet the deadlines established by DoD Instruction 7640.2.
-
In 3 instances, the COs sustained DCAA audit findings (cumulatively worth $4.3 million) but those findings were not incorporated into the agreement on final billing rates, meaning that the negotiated final billing rates were higher than they should have been.
-
In 2 instances, the COs did not sustain DCAA audit findings, but failed to document the rationale for not doing so.
-
In 7 instances, penalties were recommended (cumulatively worth $1.4 million) on costs found to be expressly unallowable, but the COs did not take the recommended action, nor did they expressly waive the penalties (which they have discretion to do). Or to be more specific, in 5 instances the penalties were expressly waived but the OIG found the rationale for doing so to be lacking.
-
In 8 instances, DCAA questioned direct contract costs (cumulatively worth $305 million) but the COs did not take any action.
CDA Statute of Limitations
In at least one instance, the CO explained to the OIG auditors that action was not taken because the CDA Statute of Limitations had expired. The OIG position was, “who cares?” As the audit report stated—
… the contracting officer’s own legal counsel advised the contracting officer that the statute of limitations does not preclude the contracting officer from pursing the questioned direct costs. The legal counsel also advised that the statute may not have expired because the contractor had submitted revised incurred cost proposals to the Government.
We know now (or we think we know) that the CDA SoL starts running when the vouchers containing the direct costs are paid by the Government. Thus, the DCMA legal counsel’s advice was unsound. Further, the advice was seemingly based on the assumption that the contractor might not be aware of the expiration of the statute of limitations, and thus might pay some or all of the questioned costs despite the expiration. That position seems to us to be unworthy of a government agency.
Conclusion
Being a contracting officer is a tough job—made even tougher by bureaucratic rules and near-impossible deadlines. This DoD OIG report points out some areas in which performance can be improved, but it also misses some opportunities to recommend process improvements. For example, would the COs’ job be easier and quicker if the DCAA audit reports were of higher quality? We believe so. Yet the OIG simply did not opine on the overall quality of the DCAA audit reports it selected for review. What were the overall sustention rates? If that information was provided, we didn’t see it.
Another opportunity missed was to track the dates of the milestones in the process, to see whether it was the CO (or perhaps the CO’s management) that was delaying the disposition of the audit findings. Between the pre-negotiation memorandum and the post-negotiation memorandum, how many management review steps were there? Did they add value, or did they simply delay the process? Was there any management override of the CO’s judgment? We don’t know because the DoD OIG audit report didn’t say.
I Did it My Way
We were going to write a long, involved post about December’s KBR decision at the ASBCA, but their website is down indefinitely. So that plan didn’t happen. This is Plan B. Plan B is a discussion about small businesses, entrepreneurship, and contract compliance.
We do a lot of work with small businesses, those government contractors who start from nothing and build themselves up to a position where they can perform effectively on subcontracts, and perhaps start thinking about going after a prime contract of their own. We do not focus exclusively on small businesses, but the largest contractors already have their full-time compliance teams—so it tends to be the smaller contractors that seek consulting advice.
Each of these businesses starts with a single person, or perhaps a small team. They have a vision of what the market needs and the value they can add. They spend time developing infrastructure. They spend time recruiting. They spend time marketing. And eventually they win a couple of contracts—almost always firm, fixed-price contracts awarded under competitive conditions. (Which are some of the lowest-risk contracts from a compliance perspective.) With respect to service providers, they land T&M subcontracts with fixed hourly billing rates. Since they are small companies, risks associated with T&M contracts are fairly low as well.
The point is, they start small, with low-risk contracts, and that gives them a solid foundation for developing experience and past performance credentials. The experience and past performance credentials enable them to bid on larger, more lucrative, contracts.
But what works for low-risk contracts doesn’t always work for higher-risk contracts, such as the cost-type contracts that typically come with SBIR Phase II awards. For that matter, any prime contract awards that are not awarded on a competitive basis are probably going to be subject to cost analysis—which means submission of cost or pricing data (whether or not certified) in a prescribed format. Thus, as small contractors progress into more lucrative contracts—which have higher compliance risks both on the front end and the back end—they need to evolve their back office policies, procedures, and practices.
Many small business government contractors don’t evolve their infrastructure, their back offices, to keep pace with the compliance risks of their newer contract awards. They end up with a mismatch between the needs of their newer contract requirements and the capabilities of their administrative staff. That’s when consultants can add some value.
But the real issue is not the knowledge or expertise of the team; the real issue is that the actual practices may need to change to match the compliance requirements of the newer contracts. The company may need to make fundamental changes to the way in which it does business.
For example, many small businesses operate on a “cash basis” accounting. That is fine for low-risk contracts, but it really doesn’t work for cost-type contracts. Contractors anticipating going after cost-type contracts (either as a prime or as a subcontractor) need to move toward “accrual” accounting. That is a fundamental change with far-reaching ramifications to many aspects of the business.
For another example, many small businesses use Quickbooks. Many small businesses have a bookkeeper to enter transactions into Quickbooks and run reports. That’s fine for smaller, low-risk contracts but, at a certain point, companies need to move away from Quickbooks and find another piece of accounting software more suited to the compliance needs of the higher-risk contracts.1 Some companies will need to move on from their bookkeeper—who may have been in place for years and is now treated like a member of the family—because they need to tap into the expertise of a CPA with government contracting experience.
Sometimes the first inkling of an issue surfaces when DCAA comes in to perform a pre-award accounting system review. The company fails the pre-award review and misses out on an opportunity for which it had been preparing, perhaps for several years. Sometimes a company will pass the pre-award review, but then fail the post-award review, which leads to problems such as demands for repayment of allegedly overbilled costs. In extreme cases, claims of bad accounting or misbilling can lead to allegations of violations of the False Claims Act—which can (and have) killed otherwise successful entities.
Many small business move forward with their new business capture strategy, completely unaware that they also need a back office strategy to go with it.
One problem is that the business may have become accustomed to how it has operated over time. It may not understand the need for change—or it may not want to change. “If the wheel ain’t broke, why fix it?” may be the reply to the consultant who recommends changes to business practices in order to better assure compliance with new contract terms.
This is especially true with respect to labor accounting.
We have experience with one small business—a very successful small business—that has incentivized its staff by paying higher labor costs on direct-billed work than it does on IRAD or other indirect billed work. The owner very much believes in his “innovative” way of doing business. The owner has resisted all recommendations (made by multiple consultants) to change the company’s payroll and labor accounting practices to pay a single rate for all staff hours. When the company failed its DCAA pre-award accounting system survey, it came as a complete surprise. When the company lost out on a large prime contract award because of the failed accounting system survey, that came as a surprise as well. However, regardless of the facts, the small business refused to change and thus it is stuck receiving FFP task orders, mostly as a subcontractor.
And that’s not the only labor accounting issue we’ve had to address in the past few years.
The point of this article is that companies grow and the compliance requirements grow as well. Companies that want cost-type government contracts need to be prepared to account for costs, including labor costs, in a manner that supports billings and audits of billings. This may require change to long-standing (and long-cherished) practices that no longer work in the new risk environment. Companies that refuse to change risk adverse audit findings—or worse.
1Yes, Quickbooks can be made to work for higher-risk contract types as well. With enough work it can meet all contracting requirements. Yet in our experience too many contractors don’t know how—or simply cannot—make Quickbooks do what it needs to do. For that matter, we are not recommending any particular accounting software in this article.
|
Final Voucher Services
Another week gone by, and the ASBCA website is still down with Error 403 problems. Thus, we still cannot write about the KBR decision, nor can we write about the newer A-T Solutions decision. So instead we’ll discuss the latest MRD (audit guidance) from DCAA.
DCAA, as you already may know, publishes much fewer pieces of audit guidance than the agency used to publish. The number of MRDs published each year has fallen precipitously; much like the number of audit reports issued each year has fallen precipitously. Consequently, we are excited when we see a new MRD on the DCAA website, wondering what important new audit guidance it may contain.
So here we are at MRD 17-PIC-001, dated 1/18/2017. It discusses “final voucher services.” According to the MRD, the purpose of the audit guidance “is to emphasize the types of services audit teams may provide to the Cognizant Federal Agency Official (CFAO), generally the Administrative Contracting Officer (ACO), to assist in processing final vouchers for contract closeouts.”
What are final voucher services?
According to the MRD, final voucher services may include:
-
Providing the CFAO with specific requesting information, such as signed rate agreement letters for the fiscal years of the contract, prior years’ Cumulative Allowable Cost Worksheets (CACWSs), etc.
-
Non-audit services as requested, which are limited to compiling factual information and expressly exclude audit services.
-
Final voucher audit services, which are an attestation examination or agreed-upon procedure to address identified CFAO concerns about the contractor’s final voucher.
Readers may recall we’ve opined that the CACWS requirement of FAR 52.216-7 is an illustrative example of additional regulatory burden imposed on contractors. The CACWS is nothing more than an auditor working paper. The MRD guidance is quite clear that not only must a contractor prepare a CACWS (disguised as Schedule I of the DCAA ICE Model for proposals to establish final billing rates), but that a contractor has a duty to update the CACWS “within 60 days of rate settlement” as required by 52.216-7(d)(2)(v). (This would be a requirement of the 2011 version of the contract clause; the MRD is equally clear that contracts containing the earlier version of the clause are not subject to that requirement.)
Indeed that language does state: “The Contractor shall update the billings on all contracts to reflect the final settled rates and update the schedule of cumulative direct and indirect costs claimed and billed, as required in paragraph (d)(2)(iii)(I) of this section, within 60 days after settlement of final indirect cost rates.”
One of the many problems with that statement is that the clause also states (at (d)(5)) that: “Within 120 days (or longer period if approved in writing by the Contracting Officer) after settlement of the final annual indirect cost rates for all years of a physically complete contract, the Contractor shall submit a completion invoice or voucher to reflect the settled amounts and rates.”
So which is it? Does a contractor have 60 days to “update the billings on all contracts to reflect the final settled rates,” or does it have “120 days ... after settlement” to submit a completion voucher? Certainly the 60 day rule would apply to final rates negotiated during performance while the 120 day rule would apply to final rates of the final year of performance but, in the final year of performance, both the 60 day rule and the 120 day rule would apply. So which is it?
This is one of the problems here. The other problem is that the clause requires update of the CACWS after the final billing rates have been negotiated. If you take the position that the (d)(2)(v) clause language only applies to final rates negotiated during performance, whereas the (d)(5) language applies to the final year of contract performance, that clearly means that the CACWS does not have to be updated to reflect the final billing rates for the final year of contract performance.
Let’s do a hypothetical example.
Contractor A has one and only one cost-type contract containing the 2011 version of 52.216-7. The contract has a 4 year period of performance. In compliance with clause requirements, it updates its CACWS to reflect settlement of direct and indirect costs each year within 60 days of agreement. At the end of Year 4, it does not update its CACWS and submits a final voucher within 120 days of agreement. That would seem to us to be compliant with the exact requirements of the contract clause.
Let’s do another hypothetical example:
Contractor B has many cost-type contracts; some of them contain the pre-2011 version of the 52-216-7 clause while others contain the 2011 version of the clause. As its proposal to establish final billing rates is audited and negotiated and settled, it updates its CACWS—but only for the contracts that contain the 2011 language. For the rest, updating the CACWS is not a contractual requirement. We believe that is a compliant posture.
Let’s do another hypothetical example:
Contractor C has one cost-type contract (“Contract 1”) containing the pre-2011 version of the clause, and one cost-type contract (“Contract 2”) that contains the 2011 version of the clause. Both contracts are physically completed in the same year. The contractor’s Disclosure Statement states that close-out activities will be charged to the contract for which they benefit. DCAA and DCMA ignore Apogee Consulting, Inc.’s sage wisdom (about the conflict between the (d)(2)(v) and the (d)(5) clause language) and require the contractor to update its CACWS as a condition of final voucher payment. The contractor does so but only for Contract 2. The effort involved in updating the CACWS is considered to be a contract close-out activity, and so the labor efforts are charged to Contract 2 as direct costs. Now Contractor C has direct costs outside the contract’s period of performance, plus it has direct costs in a year not subject to the final rate agreement. Therefore, Contract 2 is not ready for a final voucher. First Contract 2 must be modified to extend the Period of Performance. If the costs involved in updating the CACWS are material in amount, the contractor may be due a price adjustment. Second, the final voucher must be withdrawn and must wait for another year to be audited, negotiated, and finalized. In that year the effort to update the CACWS will be repeated, creating the same problems as before. Is this really what the parties intended? Meanwhile, Contract 1 was done, the final voucher was submitted and paid, and the files can now be put away.
We have suggested that contractors not update the CACWS after billing rates are finalized. That suggestion flies in the face of the express requirements of FAR 52.216-7(d)(2)(v). We’ve (hopefully) explained why a literal reading of that clause language leads to several problems. Notwithstanding our position, we strongly suspect that DCAA and DCMA will refuse to pay a contractor’s final voucher until and unless that pesky CACWS is updated by the contractor.
So what’s the resolution?
Contractors need to ensure that final billing rates reflect a credit against provisional billing rates. Of course the same 52.216-7 clause requires that provisional billing rates be set as closely as possible to anticipated final billing rates, so as to avoid a “substantial” overpayment or underpayment. Substantial is one of those words, like “material” or “significant,” that creates a certain amount of subjectivity and/or ambiguity. Our best advice here is to set provisional billing rates so that there is a very slight (certainly not “significant”) overpayment situation. Thus, the contractor would owe the government a very small check at the time of final billing rate settlement. In this fashion, should the government refuse to process the contractor’s final voucher (which would reflect a very small credit due the government), the contractor can shrug and say “so what?”
Oh, and that MRD we started with? It’s just over 2 pages long. But it contains a 41 page-long PowerPoint attachment. In that attachment, DCAA makes it very clear that the updated CACWS is required even in the year of physical completion—ignoring the (d)(5) clause language.
Subcontractor Risk Management (Again)
We have always looked to Lockheed Martin for leading practices in subcontractor management. Unlike far too many other A&D contractors, LockMart has created a position of Subcontract Project Manager—acknowledging and reinforcing the position that subcontractor management is a critical aspect of program management.
We are not going to recap our many posted pleas to get your subcontract management act together. We are not going to repeat our assertion—posted here many times—that effective subcontractor management is the key to effective program management. Instead we are going to focus today on subcontractor risk management, which is a subset of overall program risk management.
The state of the art with respect to program risk management is unfortunately immature. Sure, almost every program has a “risk register” (which is almost always offset by an “opportunity register” as if risks and opportunities were mathematically required to equally balance each other). In some companies the risks are dollarized (probability of occurrence times estimated impact) and then used in Estimate-at-Completion (EAC) calculations. That’s all fine, but it’s not enough. Following are some observations with respect to the state of A&D industry risk management, based on the last time we took a deep dive into the subject. Granted, that was about five years ago, but we don’t believe things have changed dramatically since then.
-
Risk identification is lacking. At best, risk identification is based on similar risks and/or issues dealt with on prior programs of similar complexity. In most instances, risks are identified by PM or engineering staff. Almost nobody is creating cross-functional teams to focus exclusively on risk identification. Almost nobody is continually adding new risks to the risk register as the program matures. (This is in part because for every risk identified there is pressure to add another opportunity.)
-
Risk management assumes a static environment. In contrast, the risk environment is dynamic. Risk probabilities change over time, sometimes increasing and sometimes decreasing. Almost nobody is reviewing risk probabilities and seeking to identify critical inflection points. Almost nobody is actually “burning down” risk probabilities in a manner commensurate with implementation of risk mitigation plans.
-
Risk mitigation tends to be formalistic. In other words, the risk mitigation plans tend to be for show. Typically, risk mitigation plans aren’t implemented in response to new risks or changing risk probabilities; instead, they are designed and approved—and then never used. One way to assess the efficacy of a risk mitigation plan is to ask who has approval to implement it. If the answer is that an approved risk mitigation plan requires additional approvals in order to implement it, then you know it’s simply for show; it’s not really intended to mitigate a risk that’s evolving towards actualization.
In a true risk-based culture (which we have not yet observed in the A&D industry), risks are identified, assigned a probability and a consequence, and a risk mitigation plan consistent with the probability and consequence. The risk mitigation plan is executed immediately when the cost of risk mitigation is less than the dollarized risk (probability x consequence). Both risk and risk mitigation plans are constantly monitored by a cross-functional team (or IPT), and that team acts like an advisory committee with respect to the PM and the PM team.
So what happens when risk management fails in a major defense program? Here’s one very recent story.
The story from Bloomberg (link above) quoted MG Teague (USAF Chief of Space Programs) as saying of the latest program setback: “This was an avoidable situation and raised significant concerns with Lockheed Martin subcontractor management/oversight and Harris program management.”
What’s the problem?
According to the Bloomberg story—
Last year, the Air Force and contractors discovered that Harris hadn’t conducted tests on the components, including how long they would operate without failing, that should have been completed in 2010. Now, the Air Force says it found that Harris spent June to October of last year doing follow-up testing on the wrong parts instead of samples of the suspect capacitors installed on the first three satellites.
Let’s be clear here: building satellites to meet specialized technical requirements is about the toughest thing there is. A next generation military satellite program is about the toughest PM challenge one can imagine. So let’s not pile on Lockheed Martin and its GPS III satellite program; and let’s not pile on Harris Corp. Instead, let’s look at this situation from a subcontractor risk management perspective.
-
What were the risks involved in the Harris subcontract?
-
Was there a risk that Harris (or any subcontractor, really) would not perform required testing?
-
Was there a risk that Harris, once it learned of improper or non-performed tests, would make another testing mistake?
-
What was the probability of occurrence? (Certainly it was greater than zero.)
-
What was the consequence? (Putting entire multi-billion dollar program at risk.)
Based on the answers above, what were appropriate risk mitigation strategies that Lockheed Martin could have employed? (Hint: One potential strategy could involve deploying test oversight personnel at the Harris facility to ensure required testing was properly performed.)
Typically, risk mitigation is not implemented because of budget concerns. In this example, we would speculate that nobody budgeted the labor and expenses associated with deploying test oversight personnel at the subcontractor facility. It was judged to be too expensive. But that is a myopic view, isn’t it? Now the program has had yet another schedule slip and the customer is upset. Thus, a failure to implement effective risk mitigation strategies (perhaps stemming from budgetary concerns) has jeopardized the entire program. From the government customer’s viewpoint, it needs to implement its own risk mitigation strategy, which may involve asking other contractors to act as prime (instead of Lockheed Martin) on future GPS III satellite builds.
Perhaps those other contractors will employ a more effective subcontractor risk mitigation strategy.
|
As I may have mentioned before, I recently was granted the honor of adding “CCEP” after my name, to go with my “CGFM” designation. CCEP means “Certified Compliance and Ethics Professional.” (CGFM means Certified Government Financial Manager.) The CCEP designation was granted by the Board of the Society of Corporate Compliance and Ethics (SCCE).
