Internal Controls, How Do They Work?
Perhaps one impediment to establishing robust internal controls designed to detect and deter corrupt actions by employees is that management does simply not know where to start. After all, it’s not like corporate governance is a core curriculum concept of most MBA programs. And to the extent internal controls are covered in those programs, the primary focus is generally on SOX 404 controls over financial reporting, as opposed to more “operational controls,” that would address potential corruption in other areas of the corporation’s day-to-day activities. So perhaps we should cut management some slack and stop having such high expectations for their performance in this area.
On the other hand, it ain’t rocket science either. Accounting and other professional service firms routinely deploy recent college graduates to evaluate internal controls. Apparently those recent graduates can be taught what to look for, and can be sensitized to the point that, should they trip over an internal control problem, they can tell somebody about it. It seems rather obvious that it doesn’t take an MBA from a fancy Ivy League college to effectively address corporate governance and implement an appropriate system of internal controls.
In fact, perhaps the ability to address corporate governance ought to be a prerequisite for more MBAs than is currently the case. It would seem to be a rather pressing issue. (It’s not like there is a scarcity of stories about absent (or failed) internal controls on this blog.)
A key step in developing a robust set of internal controls is to evaluate their current state. The evaluation establishes the baseline that will be compared against the “future state” of the internal control environment. That comparison will lead to identification of “gaps” that need to be remediated through enhanced processes, enhanced documentation, enhanced training … or perhaps a combination of all three.
We have developed a test for readers who want to check their abilities in this area. It is based on a real life example, ripped from today’s headlines. All factual statements are based on reported allegations and not on any proven charges. Persons (including corporations) are innocent until proven guilty in a court of law.
When you read the following story, how would you evaluate the internal controls at this entity?
Between August 2002 and October 2012, Employee D was employed as the Director of the Environmental Health and Safety Department at Entity K, where he had the authority to pay vendors without a bidding process, and without any additional approvals, for amounts less than $5,000.
Through his position at Entity K, Employee D funneled money to himself and others by directing Entity K to pay vendors at an extreme mark-up, or for work that was never done. Supplier S was the main vendor who worked with Employee D to implement the scheme. Suppler S would receive payments from Entity K and would then make payments to Employee D. Entity K paid Supplier S more than $354,000 for work purportedly done during the 10-year period.
Supplier T was a legitimate business and vendor to Entity K. Even though Supplier T was a legitimate vendor, it billed Entity K unreasonable fees for work it performed. More than $61,000 of the money Entity K paid to Supplier T was later transmitted back to Supplier S. Supplier S then made payments to Employee D. Supplier T and Employee D also facilitated the scheme by forging four re-inspection forms by listing the name and accreditation number for an accredited inspector who had not actually done the inspections in question.
Supplier J was owned by a childhood friend of Employee D. Supplier J was based out of state and had never done any work for Entity K. Employee D directed Entity K to pay Supplier J more than $221,000 for purported contract work, and more than $198,000 of that money was funneled back to Supplier S. Supplier S then made payments to Employee D.
Employee D also hired his neighbor to do odd jobs at Entity K in exchange for the neighbor creating fictitious businesses, called Supplier O and Suppler H. Employee D then allegedly created phony invoices with inflated amounts due to the neighbor and to Supplier H. Employee D directed Entity K to pay these companies $56,709, of which $49,546.50 was paid back to Supplier S. Supplier S then made payments to Employee D.
This is not a hypothetical example. This alleged scheme was active for ten years. A Grand Jury charged Employee D and his associates with racketeering for allegedly obtaining more than $686,000 through fraudulent billings to Entity K. If the suspects are convicted, racketeering carries a penalty of five to 20 years in prison, a fine or both.
So how do you assess the current state of Entity K’s internal controls? How many internal control “gaps” did you identify?
The problem describes a complex scheme. But could it have been detected with appropriate internal controls? Could it have been detected before 10 years of allegedly corrupt activities took place? Discuss.
Did you note that a single individual had the authority to both select suppliers and to authorize payments to them? Do you think that $5,000 is a reasonable authorization limit for miscellaneous services? Do you think somebody should have reviewed those under-$5,000 payments to verify that services were performed? (At least once every decade or so.) Do you think names of entities that received payments (of whatever size) could have been matched against a vendor master file in order to verify that they were legitimate companies? Do you think inspection forms could have been randomly selected for outside review? Do you think supplier addresses could have been matched against employee home addresses to see if there were any anomalous correlations?
What else did you notice? What other inexpensive, relatively effective, internal controls might have been deployed?
Are you smarter about internal controls than the management team that ran Entity K?
It ain’t rocket science.
But based on the reported allegations, it is apparently too hard for the administration team at least one accredited institution of higher education.
Why You Subcontractors Should NOT Let Your ACO Set Billing Rates for Invoices to Your Prime Contractors
This is going to be an important article. Which means, of course, that few will read it and even fewer will heed it. So be it.
This is going to be a controversial article. Which means, of course, that most will disagree with it and even more will simply ignore it. So be it.
Newsflash: If you are a subcontractor, if you are supporting a prime contract and submitting vouchers/invoices to the prime contractor instead of directly to the U.S. Government, then you should not—indeed, you must not—let your cognizant ACO establish the billing rates you use to prepare those invoices.
The cognizant ACO has authority to establish provisional billing rates and final billing rates only for your prime contract billings, the invoices submitted directly to your US Government customers. Your cognizant ACO lacks authority to establish provisional billing rates and final billing rates for your subcontract invoices to your prime contractors.
To be clear, you can agree to give the ACO that authority. You can execute a subcontract with a prime contractor that links your provisional and final billing rates to what the ACO does for the contractors over which s/he does have authority. You can do that, and many upon many subcontractors do so automatically, as a matter of routine. It’s the common wisdom, the way things are normally done. So of course you can choose to do that.
But you’ll be making a big mistake if you do so.
By way of background, try this article. In it we wrote:
… whenever the contractor knows that its provisional billing rates are varying, to a significant degree, from its currently anticipated final indirect rates for the year, it should request an appropriate adjustment. If the contracting officer declines to adjust the billing rates, then s/he needs to be able to justify why not—since the clause mandates that the provisional billing rates “shall be” the anticipated final rates. Bottom-line: while there may be some discretion with respect to notification, there is no discretion once notification has been made—the billing rates must be adjusted.
[Emphasis in original.]
For a little more nuance, consider reviewing this other article, in which we wrote—
So if the parties are complying with the requirements of the Allowable Cost and Payment Clause, then the difference between provisional and final billing rates should be de minimis.
That’s the theory, anyway. We’re quite certain that practice does not match theory in this area. The primary reason for the deviation between theory and practice is that many Contracting Officers apply decrement factors to contractor’s proposed provisional billing rates in order to ‘protect the Government’s interests.’ As a result of the desire to protect the Government’s interests, contractors are only approved to bill at provisional rates that are lower than the estimated final billing rates. The size of the decrements seems to depend on the individual Contracting Officer; some contractors have rather small decrements and others have rather larger decrements. The immediate impact is to reduce contractors’ cash flows, which is annoying, no doubt. But since the provisional billing rates should be synced up to final billing rates over time, the cash flow impact primarily manifests during the current performance year and, accordingly, is perceived as a temporary phenomenon and not something to get overly worked-up about. …
The fact of the matter is that provisional billing rates should closely approximate final billing rates. Imposition of a large decrement factor on a contractor risks the government being unaware of a contract’s true costs, and receiving a large ‘surprise’ when the final billing rates are negotiated. (We note for the record that too-low provisional billing rates do not relieve a contractor from having to comply with the Limitation of Cost/Limitation of Funds clause requirements.) Moreover, from the contractor’s perspective, having provisional billing rates closely approximate final billing rates means that the settlement of final rates will not have a significant impact on cash flow.
Okay. You should be up to speed now. Provisional billing rates should always closely approximate expected final billing rates, and contractors should request adjustments to provisional billing rates when those rates start to differ significantly from estimated final billing rates. The parties have six years to negotiate final billing rates, and if the parties did the right thing during contract performance (as defined by complying with the requirements of the 52.216-7 Allowable Cost and Payment Clause) then the final invoices, calculated at the negotiated final billing rates, should be relatively small.
Note that all of our previous writings on the topic elided any discussion of what happens to subcontractors that want to adjust their provisional billing rates. The closest we’ve ever come to that discussion point can be found over here, where we wrote about a subcontractor to L-3 Communications that had submitted rate adjustment vouchers, that L-3 refused to pay until DCAA had conducted an audit and had determined the subcontractor’s final billing rates. The subcontractor sued L-3 for a failure to pay its invoices (among other allegations) and won. We reported that suit and its outcome but we failed to draw any conclusions from it.
What we should have said was, based on that case, subcontractors don’t have to wait for a DCAA audit and formal rate negotiation in order to submit adjustment vouchers to their prime contract customers. Granted, that was only one case, and it was at the State level, thus its precedent-setting ability was somewhat in doubt to this non-attorney. But still, we missed that implication.
We rectify that omission today, citing to a recent U.S. Court of Federal Claims case to support our position. We refer to U.S. Enrichment Corporation v U.S.A. Now, before we get into our analysis of the decision, please remember that we are not attorneys and you should not rely on our legal analyses. If you want a legal analysis upon which you can rely, go hire yourself a good government contracts attorney.
All that being said, we look at the July 28, 2014 decision, in which Judge Firestone granted the Government’s Partial Summary Motion to Dismiss, finding that the court lacked jurisdiction to hear the part of the case that involved USEC’s subcontract costs. Judge Firestone's reasoning in granting the Government’s Motion supports our position.
USEC filed a suit at the COFC, alleging that the Department of Energy (DOE) breached its contracts with USEC “when the government failed to reimburse certain indirect costs that USEC incurred as both a prime contractor and subcontractor while performing work at the United States Department of Energy’s … gaseous-diffusion plants (‘GDPs’) in Portsmouth, Ohio and Paducah, Kentucky.” USEC’s suit was based on “DOE’s purported failure to establish provisional and/or final indirect cost rates in a timely manner in connection with those prime and subcontracts, which allegedly resulted in USEC being under-compensated throughout performance.” Roughly 10 percent of USEC’s claimed $38 million in damages were related to its cost-reimbursement subcontracts with other prime contractors performing their own DOE contracts (also called “Captive work”). The Government argued that “the court lacks jurisdiction to entertain a suit brought directly by USEC in its capacity as a subcontractor.”
Those subcontracts, as well as USEC’s prime contracts with DOE, contained the Allowable Cost and Payment Clause (52.216-7). We have extensively discussed the requirements associated with that clause on this site. Indeed, the articles from which we quoted above go into some detail. Judge Firestone summarized many of those requirements in her decision.
With those requirements as context, Judge Firestone found that the dispute started with respect to USEC’s FY 2003 indirect cost rates. The DOE granted one rate adjustment (in May 2004) but refused to grant another, despite USEC’s June, 2004, request that it do so. And there the matter languished, for literally seven years, until 2011, when USEC finally submitted rate adjustment invoices for FY 2003 and DOE rejected them (we assume because they contained unapproved billing rates). DOE refused to let USEC adjust its FY 2004 billing rates. Eventually USEC took the DOE to court.
As noted, Judge Firestone granted the Government’s Motion. She found that—
… USEC entered into separate agreements with prime contractors to provide Captive work, those agreements are controlling. To recover additional indirect costs, USEC must comply with the mechanisms set forth in those agreements and applicable regulations. See 48 C.F.R. § 52.216–7(d)(5) (‘The completion invoice or voucher shall include settled subcontract amounts and rates. The prime contractor is responsible for settling subcontractor amounts and rates included in the completion invoice or voucher and providing status of subcontractor audits to the [C]ontracting [O]fficer upon request.’)
Judge Firestone found that the DOE lacked privity with USEC in its capacity as a subcontractor. Accordingly, she could not hear that part of USEC’s case. If USEC wanted to adjust its indirect cost rates so as to bill more (and collect more), then that matter was between it and its prime contractors. The DOE Contracting Officer was not a party to the matter, nor did s/he have authority to override the billing mechanisms found in USEC’s subcontracts. If there was a dispute, then the two contracting parties would need to work it out. Importantly, Judge Firestone cited to the 52.216-7 language that expressly provided that the prime contractor, and not the U.S. Government, was “responsible for settling subcontractor amounts and rates.” There was a regulatory basis for her position.
Therefore, it seems very clear to us that your billings to your prime contractors are a matter between you and them. The Government is not a party to your disputes nor does it have authority to set either the provisional billing rates or the final billing rates. Subcontractors need to push your prime contractors to the negotiating table and settle your final billing rates (with respect only to the individual subcontract under discussion), and you absolutely do not need to wait for DCAA or for your ACO.
Prime contractors, then can be good news for you. All those old prime contracts you can’t close because you have subcontractors whose rates have not yet been finalized? Go ahead and negotiate your final billing rates and close ‘em out.
Best get to it now.
|
L-3 Fires Four in Reported Revenue Recognition Violation
From a recent Reuters article:
An employee complaint exposed accounting misconduct at [L-3 Communications], according to people familiar with the matter, prompting the aerospace and defense supplier to fire four people, revise two years of earnings statements and cut its earnings forecast.
L-3's shares plunged as much as 17 percent - their biggest intraday percentage drop ever - after the company said on Thursday it would take a pretax charge of $84 million for misconduct and accounting errors, including cost overruns and overstated sales figures from 2013 and 2014. The surprise announcement prompted some analysts to cut ratings on the company, and raised concern about a broader problem at L-3, which also suffered an ethics scandal in 2010.
According to the article, a single fixed-price maintenance and logistics support contract in the L-3 aerospace segment was responsible for the accounting irregularity. The resulting charge and accounting adjustments were not considered to be material in amount and did not trigger restatements of the corporation’s financial statements. However, the article cited an analyst’s comment that “accounting irregularities tend to unnerve investors and bring further scrutiny of company's operations.”
But that’s not all that happens. In addition, attorneys start talking about lawsuits on behalf of investors who were allegedly harmed by management’s alleged negligence and the resulting drop in the price of the company’s stock. See, for example, this notice.
That notice stated—
According to the Company, the adjustments primarily relate to ‘contract cost overruns that were inappropriately deferred and overstatements of net sales, in each case with respect to a fixed-price maintenance and logistics support contract,’ and are the result of ‘misconduct and accounting errors’ at the Aerospace Systems segment, which ‘included concealment from L-3's Corporate staff and external auditors.’
Obviously we have none of the details unearthed by the company’s internal investigators, or by the external law firm it hired, or by the external forensic accounting firm it hired. But based on the foregoing, we can surmise that the issue stemmed from a botched Estimate-at-Completion (EAC) on that contract. And by “botched” we mean that we tend to believe that a rigorous EAC would have disclosed an overrun at completion. Under applicable GAAP requirements, any such overrun should have been recognized on the financial statements immediately upon recognition, which would have affected the revenue (sales) being recognized for the current period.
Remember when we wrote about the difficulties in accurate revenue recognition? We said—
For example, if you have a firm, fixed-price contract to deliver 20 widgets over a 36-month period of performance, do you recognize revenue as each widget is delivered (say, at 1/20th of the contract price for each delivery) or do you recognize revenue based on the percentage of completion of the entire contract? What about if you believe you planned profit won't materialize because of unplanned cost growth? How does that knowledge factor in to the picture?
Hey, pretty good example, huh?
We have also repeatedly ranted about the importance of internal controls. We have asserted that good internal controls are not expenses; instead, they should be viewed as investments with an ROI that can be calculated based on prevention of just the type of problem that L-3 Communications recently ran into.
L-3 Communications has already recorded a charge of $84 million associated with the RevRec violation. Undoubtedly there will be more charges to follow, if only to record the costs of defending against shareholder suits.
Hmm. We wonder how much L-3 Communications might be willing to invest in its internal controls today. What does $84 million buy you in terms of salary and travel expense? We think you can buy quite a nice set of rigorous internal controls for that kind of money.
Proposed Revisions to DFARS Business System Oversight Regime
Governor Robert Ritchie, R-FL : Now, he's going to throw a big word at you – ‘unfunded mandate.’ He's going to say if Washington lets the states do it, it's an unfunded mandate. But what he doesn't like is the federal government losing power. But I call it the ingenuity of the American people.
Moderator : President Bartlet, you have 60 seconds for a question and an answer.
President Josiah ‘Jed’ Bartlet: Well, first of all, let's clear up a couple of things. ‘Unfunded mandate’ is two words, not one big word.
If there is one particular topic we have covered thoroughly on this site, it would have to be the DFARS Business System Administration rules. We railed against it when it was first promulgated as a proposed rule; we railed against it when it became a final DFARS rule. We reported on DCAA and DCMA implementation and interpretation, and we reported on DOD Inspector General criticism of DCAA’s inability to fulfill its oversight responsibilities. You want to see those articles, just type “business system” into the keyword search feature on the front page.
More recently, we warned readers of a rumored sea change in the DCAA Business System oversight role, wherein DCAA would stop auditing contractors’ business systems altogether. We thought that would be a brilliant idea, writing “Consequently, it's likely that contractors are going to be required to spend more of their limited indirect funds to pay for external CPAs to review their business systems, a review that will be mandated by DOD and paid for through increased prices for goods and services.”
Indeed, that is what the proposed DFARS rule revisions would entail.
Published July 15, 2014, the proposed DFARS rule revisions would purport to “ensure appropriate contractor accountability for adequate contractor business systems.” It would accomplish that objective by—
… proposing to amend the DFARS to entrust contractors with the capability to demonstrate compliance with DFARS system criteria for contractors' accounting systems, estimating systems, and material management and accounting systems, based on contractors' self-evaluations and audits by independent Certified Public Accountants (CPAs) of their choosing. Government auditors will perform overviews of the results of contractor self-evaluations and CPA audits.
Let’s be clear. DCAA would no longer audit three of the six DFARS business systems. Those three systems are Estimating, Accounting, and Maternal Management and Accounting (MMAS). Instead, contractor’s would be “entrusted” with their own evaluations, augmented by periodic reviews by independent CPA firms.
Let’s be even clearer:
-
For the three systems noted above, contractors must conduct annual self-assessments and report the results of those self-assessments to the cognizant ACO and to DCAA. The annual self-assessments must be completed within six months of the end of the contractor’s fiscal year and must be signed-off by a contractor executive.
-
In year one, and once every three years thereafter (unless the cognizant ACO directs a more frequent assessment) the contractor will engage an independent CPA firm to perform an external assessment of the three systems in accordance with GAGAS. As part of the external report, the contractor must provide the cognizant ACO and DCAA with the CPA's audit strategy, risk assessment, and audit plan (program), upon completion. The CPA firm must provide its working papers for government inspection.
-
DCAA may review the annual self-certifications or the triennial independent CPA reports, and may provide its findings to the cognizant ACO.
-
The contractor’s failure to submit either the annual self-certification or the triennial independent CPA report will constitute a “significant” deficiency and will lead to payment withholds.
-
The new rule does not apply to small businesses.
The proposed rule has drawn intense scrutiny from many sources. The attorneys at Wiley Rein opined—
For contractors, the ability to potentially accelerate approval of their business systems may be attractive. Nonetheless, the proposed rule imposes significant new mandatory requirements on covered contractors to report their annual business system assessments, engage independent CPAs to provide audit plans and perform audits, and produce documentation regarding audits and assessments. Since these contractor and CPA reports are subject to DCAA review, it remains to be seen how long DCAA takes to review the reports and whether DCAA will accept CPA audits or review them so critically that the anticipated efficiencies are lost.
Attorneys at McKenna Long & Aldridge wrote—
The purposes of the proposed rule appear to be to relieve DCAA of business system audit responsibilities it has been unable to meet, and to require that contractors disclose to the government internal documentation supporting contractor’s business systems that the government is often unable to obtain in connection with system reviews. It remains to be seen whether DOD will seek to impose the same or similar reporting requirements in connection with the purchasing, earned value management, and property management systems that DCMA currently reviews.
What do we think?
Well, we think that if contractors’ business systems truly are the “first line of defense against fraud, waste, and abuse,” as every civil servant seems to think and has so testified, then it is a damning indictment that DCAA lacks sufficient resources to perform timely audits on those business systems. The phrase “inherently governmental function” springs to mind. And now that government oversight, for which the taxpayers have paid and paid and paid, is going to be outsourced. Will DCAA downsize as a result of its suddenly reduced workload? Doubtful. So there will be no reduction in government oversight costs, while the contractors will be required to pay for the oversight that was previously performed by DCAA.
Tell us that won’t raise contractors’ costs and prices. Tell us the taxpayers won’t pay more. Go on. We’re waiting.
But more fundamentally, we believe this rule is anti-small business. We believe this rule will harm small businesses. “How is that,” you may say, since the proposed rule clearly exempts small businesses. Well, here’s how: If DCAA is not going to perform business system reviews and large businesses will perform their own reviews, then what are small businesses going to do? That’s right: nothing. So they will not have approved business systems and will be at a competitive disadvantage. They won’t be able to win that big contract that moves them from small to large business.
At a time when more and more RFPs required approved business systems, small businesses won’t have them. FAR 16.603 requires that a contractor must have an adequate accounting system in order to be awarded a cost-type contract. How are small businesses going to obtain a determination that their system is adequate when DCAA won’t be performing audits anymore? Are small businesses supposed to have the same financial resources as large businesses? We don’t think so. As a result, we very much suspect small businesses will be unable to win awards of cost-type contracts—including SBIR Phase 2 contracts.
Where are the independent CPA firms going to come from? You know, the ones with GAGAS compliance training and government contract expertise. Sure, they exist. But contractors will not be able to use their external auditor for such work and the other firms will be vying for the remediation work (where the money is), so who will be left to perform the assessment work?
Which firm will agree to the potential liability associated with a system approval that the DCAA subsequently finds to be deficient? Which firm will agree to turn over its working papers for DCAA review? Again, they exist. But there will not be very many of them and they will charge contractors dearly for the work. And the contractors will pass those charges back to DOD via indirect rate increases.
Clearly, something needs to be done. But this proposal either goes too far or doesn’t go far enough. DOD needs to remove DCAA completely from the picture and simply rely on the work of the independent CPAs. Failing that, DOD needs to completely revamp DCAA so the audit agency can actually perform quality audits that are useful to COs, and issue them timely.
Or perhaps it’s time to rethink this unworkable and quite frankly punitive business systems oversight regime. You know, go back to the drawing board and start fresh. We would advocate that approach.
If you feel the same way we do about this proposed rule, you may wish to submit written comments to the DAR Council for consideration. Not that we expect the DAR Council to actually listen to the public input (they didn’t listen the last time, when many (including Apogee Consulting, Inc.) told them their original plan was not going to work, because DCAA lacked sufficient resources to execute its role. But still. We have to keep trying to help the bureaucrats even if our efforts will prove futile.
You can submit comments on DFARS Case 2012-D042 before September 15, 2014 as follows:
Regulations.gov: http://www.regulations.gov. Submit comments via the Federal eRulemaking portal by inserting “DFARS Case 2012-D042” under the heading “Enter keyword or ID” and selecting “Search.” Select the link “Submit a Comment” that corresponds with “DFARS Case 2012-D042.” Follow the instructions provided at the “Submit a Comment” screen. Please include your name, company name (if any), and “DFARS Case 2012-D042” on your attached document. Follow the instructions for submitting comments.Show citation box
Email:
This e-mail address is being protected from spambots. You need JavaScript enabled to view it
. Include DFARS Case 2012-D042 in the subject line of the message.
Fax: 571-372-6094.
Mail: Defense Acquisition Regulations System, Attn: Mr. Mark Gomersall, OUSD(AT&L)DPAP(DARS), Room 3B941, 3060 Defense Pentagon, Washington, DC 20301-3060.
|
