We recently spent a lot of words discussing how DCAA is now able to perform, once again, the full panoply of audit services for non-DoD agencies. This article is kind of a postscript to that one. In this shorter essay we want to explore whether the DoD Comptroller Certification to Congress was a bit too little, too late.

We’ve been tracking this for a while. We’ve reported that both NASA and the Department of Energy (DOE) have been concerned about the lack of DCAA audits – as well as the timeliness and quality of what audits have been performed by DCAA – for some time. We’ve been on this topic for some time. For years, as a matter of fact. Don’t believe us? You can search this site and see the articles. We’re not going to link to them here.

So while DCAA was busy not performing audits at non-DoD agencies, what were the auditors doing? First, they were lobbying Congress to get the statutory ban lifted. When that didn’t work, they focused on eliminating as many unaudited proposals as possible from the backlog. And while that was going on, they were working hard to persuade those non-DoD agencies to be patient and await GFY 2017, when DCAA would return to be their auditors once again.

But that approach didn’t really work either. As we have noted before, DOE OIG and NASA OIG already had concerns with DCAA’s audit support well before the GFY 2016 NDAA came into play. In February, 2015, the DOE OIG found that “DCAA has been unable to meet the non-M&O contract audit needs of the Department” and noted the DOE management had already taken action to address the audit support shortfall. The DOE OIG reported that DOE —

… has put a contract in place for audit services to ensure Contracting Officers have an alternative to DCAA to obtain quality audits; is coordinating closely with DCAA on its audits; and is following up with contracting activities to ensure they understand what is expected and have the appropriate support. Department management also noted that they believe it is important to recognize that whatever good intentions DCAA has, its track record makes it prudent to avoid assuming a marked change in DCAA's support.

A couple of months before that, in December, 2014, we reported that the NASA OIG said “NASA is at increased risk of paying unallowable, unreasonable, and unallocable incurred costs and of losing the opportunity to recoup improper costs because Agency contracting officers rely too heavily on DCAA’s incurred cost audit process.” The NASA OIG recommended that NASA “Revise the NASA FAR Supplement 1815.404-2(a)(1)(F)(1) to allow independent public accounting firms to provide supplemental audit coverage for NASA contracts where DCAA currently conducts any contract audit services but cannot be responsive to NASA’s need for an audit.”

So this is not a new thing and the NDAA prohibition on DCAA performing audits for non-DoD agencies really didn’t affect the management strategies for contract audit support at those non-DoD agencies. But it certainly did get the attention of DCAA’s management team, who have come to rely on funding from those non-DoD agencies to pay for their staff and to pay for an approach to audits that sacrifices audit quality and timeliness in favor of risk assessments and working paper documentation.

While DCAA was working hard to convince Congress it had the resources to provide audit support to non-DoD agencies (and that the audit agency was perfectly ready to pocket all that lovely audit reimbursement funding), both DOE and NASA were busy replacing DCAA with independent contractor auditors.

Earlier this year we reported that DOE was going to make its M&O contractors audit their subcontractors. And in August, 2016, we told readers that DOE had made it official: they had put procedures in place to permit DOE contracting officers to obtain audit support services from the private sector. The new DOE policy stated—

As an alternative to DCAA audit support, DOE/NNSA Contracting Officers may obtain audit services from a private sector provider of audit services. One available option is a Blanket Purchase Agreement (BPA) for audit services that is currently in place with CohnReznick, LLP. Orders for audit support can be placed by any DOE/NNSA Contracting Officer through individual awards issued against BPA DE-MA0011836. Each order placed against the BPA is awarded and administered by the field site Contracting Officer placing the order.

And now, October, 2016, the news media is reporting that NASA has awarded contracts to six independent audit firms, including: Castro & Company, Kearny and Company PC, CohnReznick LLP, KPMG LLP, Moss Adams LLP and Regis and Associates PC. The contracts are reported to be FFP, multiple-award ID/IQ, types, worth up to $100 million (combined). (Hat tip: Stephen Avery.)

So DCAA now has competition for audit support services provided to at least two non-DoD agencies. Those agencies will be able to compete required audit services between DCAA and outside auditors, perhaps evaluating price, quality, and timeliness – and making best value trade-offs. That’s new.

And if you are a DCAA auditor looking to leave government service and continue your profession elsewhere, you now know you have options … and where to submit your resume.

The big news right now is that DCAA has formally notified Congress, through the DoD Comptroller, that it has reduced its backlog of unaudited incurred cost submissions to a more acceptable 18 months' of inventory. Thus, DCAA may now resume providing full audit support for non-DOD agencies, such as NASA and the Department of Energy (DOE).

That’s good news for DCAA and its auditors.

As readers may well know, DCAA was prohibited by statute for performing audit services for non-DoD agencies until it certified it had reduced its embarrassing backlog to more acceptable levels. As we reported, at the end of GFY 2011 DCAA had a backlog of 24,000 unaudited contractor proposals to establish final billing rates. 15,000 of those 24,000 had been determined to be adequate and 9,000 had not.

Similarly, at that time (GYF 2011) DCAA was reporting almost unbelievable drops in auditor productivity. In that year DCAA issued 7,390 audit reports – in total. It became clear that the drop in auditor productivity was systemic, as we discussed in this article. We wrote at the time—

In GFY 2008, DCAA had 4,200 employees and roughly 8,064,000 work hours available (assuming that each auditor had 1,920 audit hours available per year (which may be overstating the situation, but not materially.) That year, DCAA issued 30,352 reports. So DCAA spent an average of 265.7 hours per report and issued about 7.23 reports per employee.

In GFY 2011, DCAA had 4,777 employees, and thus roughly 9,171,840 work hours available. That year, DCAA issued 7,390 reports. So DCAA spent an average of 1,241.1 hours per report and issued about 1.5 reports per employee. Comparing GFYs 2008 and 2011, DCAA had 577 more staff, but spent nearly 1,000 more hours on every completed audit report (975 more hours per report, to be exact). In GFY 2011, DCAA was only 21 percent as productive as it was in GFY 2008—meaning that the audit agency was 89 percent less efficient. [Note: Math error in original post. Should have been 79 percent not 89 percent.]

And subsequent articles confirmed that the drop in auditor productivity was not only systemic, but it seemed to be permanent as well. True, the stats varied a bit, but the trends and results were quite clear. For example, we wrote (in yet another article devoted to this topic) the following about DCAA’s published GFY 2014 statistics—

DCAA reported that it still takes the audit agency more than 1,000 days to perform an incurred cost assignment and to issue an audit report to a cognizant Federal agency official (CFAO) for negotiation with a contractor. That means it still takes DCAA nearly three full years to perform an audit on one year’s worth of contractor costs. … Despite those problematic numbers, DCAA reported that it had managed to ‘close’ 11,101 incurred cost assignments during the year, leading it to report that the agency had worked down its backlog of incurred cost audits to a year-end balance of 18,185 – for a reported reduction of 21 percent during GFY 2014.

Thus, our confusion. How could DCAA have reduced its backlog so dramatically without changing the underlying productivity metrics? If the agency is taking three years to audit one year, how could it ever have improved at all—let alone reached the point where it had less than two years’ worth of backlog?

Our readers already know the answer to that question. We all know how DCAA was able to have the Comptroller certify to Congress that the backlog was down to 18 months.

DCAA didn’t hire busloads of new auditors.

DCAA didn’t improve auditor productivity.

DCAA didn’t revise its approach to performing incurred cost audits.

Instead, DCAA simply redefined its backlog to exclude enough proposals so that the backlog could be reported to be at acceptable levels.

It was a bureaucratic trick. And we all saw it coming.

In May, 2012, DCAA split its “incurred cost” audit program into two: one for “major” contractors and one for “non-major” contractors. We posted comments from self-identified DCAA auditors that indicated this was the start of a larger strategy to focus on big-dollar audits and to “risk-away” or waive audits on small dollar contractor incurred cost proposals.

One commenter wrote—

Concerning the incurred cost workload, the plan for getting current is to sample the submissions that are less than $250M. Those that are less than $1M will likely never be audited because HQ views those audits as cost losers, which is no wonder given the amount of prepatory work (the risk assessment, increased transaction testing, and the greater number of reviews) now required. HQ is talking about more and more sampling (leaving more submissions completely unaudited), which will certainly incentivize some contractors to push the envelope when it comes to questioned costs. …

Another commenter wrote—

… DCAA wants to waive all possible incurred cost audits under $1 million too. And the metrics will show that we actually completed these audits. Waiving 1 low dollar incurred cost = completing 1 (only in DCAA does 0 = 1). Then there's our audit guidance - all of our audit guidance is being written for the largest contractors. Does our upper management get the risks at the nonmajors especially at a time when there is less spending and companies are going out of business or being bought out?

Indeed, those assertions proved to have merit. They were spot-on.

Just a few months later, we told readers that DCAA had developed a “risk-based” approach to determining which proposals to establish final billing rates it would choose to audit. Proposals determined to be “high risk” would be audited, while proposals determined to be “low risk” would be audited on a sample basis—and the sample would be based on the auditable dollar value of the submission. For example, only one out of 5 low risk submissions with an ADV of between $50 and $250 million would be audited by DCAA. The other 4 submissions would not be audited. Ever. Nor would they be counted in the backlog statistics reported to Congress.

For another example of how risk-based audits were to work only one percent of submissions with an ADV of $1 million or less will be selected for audit. Of all contractor submissions with an ADV of $1 million or less, only one out of a hundred would be audited. The other 99 would not be audited. Ever. Nor would they be counted in the backlog statistics reported to Congress.

Brilliant plan, no? Only it didn’t work.

In December, 2012, GAO Report No. 13-131 told DoD that DCAA’s cunning plan wasn’t working, because not enough contractors were being categorized as being “low risk.” GAO wrote “Of 13,522 risk assessments completed, DCAA determined that 7,815 proposals were high risk, or about two-and-a-half times more than it had initially anticipated.” (Emphasis added.) [Note: we predicted this would be the case.]

Only a few months into the plan, it was already clear that DCAA needed to change course. And so they did.

In October, 2013, MRD 13-PPD-021 directed auditors to put more contractors into the “low risk” category. It changed the definition of “low risk” to help auditors with the categorization but, more than that, the tone of the MRD made it very clear as to what the expectations were. For example, the MRD stated—

If the last incurred cost audit performed found no significant questioned costs, all proposals with less than $5 million in ADV should be considered low-risk unless significant relevant risk material to the incurred cost proposal exists, such as fraud referral (Form 2000), “unacceptable” opinion from a pre-award accounting review, no previous experience (e.g., voucher processing, forward pricing effort, pre-award accounting systems, etc.), or specific relevant risk with the contractor that has material impact to the incurred cost proposal (identified by the contracting officer or auditor).

And: “There will be no sampling for low-risk proposals with ADV <$1M.” (And no auditing, either. And no counting of such proposals in the backlog numbers reported to Congress.)

Basically, effective with GFY 2013, any contractor who submitted a proposal to establish final billing rates that had an auditable dollar value of less than $5 million could be confident that DCAA would never, ever, audit that proposal, except to check that the formatting of the proposal was “adequate.” If it looked good then it was good. And so the proposal would be passed and not counted in the backlog of unperformed audits.

But DCAA wasn’t yet done tinkering with its risk-based approach to waiving incurred cost audits. Earlier this year, we noted that DCAA’s MRD 16-PPD-06 (5/27/2016) had once again helped audits put more contractors into the “low risk” bucket. Proposals with less than $250 million in auditable dollar value would be risk-assessed using more relaxed standards (baked into the “Low-Risk Determination Tool” and proposals with less than $5 million would be determined to be “low risk.” Period. The MRD stated—

FAOs shall reassess all assignments that are classified as high risk with an adequate proposal with ADV less than $5 million where fieldwork has not been started using the revised policy and procedures and the Low Risk Determination for Contractor Years with Less Than $5M in ADV Tool. FAOs will need to obtain Regional Audit Manager (RAM) approval if performance of an audit is warranted based on significant relevant risk ….

If that HQ direction didn’t get the message to auditors that nobody wanted to spend time auditing incurred cost proposals valued at less than $5 million, nothing would.

And finally, we should note that DCAA also issued guidance that contractor proposals that were deemed “inadequate” would excluded from its backlog values, as well as proposals that were “delinquent.” In both cases, DCAA would close its audits assignments as being completed and turn the matter over to DCMA for further action.

And so, here we are at the end of GFY 2016 and the beginning of GFY 2017. DCAA has told the DoD Comptroller that he can certify to Congress that the backlog of unaudited contractor incurred cost proposals is now at acceptable levels. How did it get there without hiring more auditors, increasing auditor productivity, or radically changing its approach to incurred cost audits?

This article tells the story of how DCAA accomplished its feat.