In the previous article we mused on the panoply of issues confronting the Defense Contract Audit Agency (DCAA), which range from an agency-wide lack of productivity to a pervasive lack of audit quality in the few reports that do manage to slip past multiple levels of review. We discussed how DCAA's systemic GAGAS compliance failures, originally alleged in 2008, 2009, and 2010, continue to haunt the audit agency today. We discussed how DOD has permitted (or perhaps directed?) DCAA to shift the audit workload onto the backs of others, most notably DCMA Contracting Officers and their staffs. The first example of this trend was the decision to have DCAA stop performing "field pricing assistance" on certain contractor proposals, so that the audit agency could focus on more important audits. The Department of Defense Inspector General (DOD IG) questioned that decision and reported it had not led to the performance improvements originally contemplated by the decision-makers.

That decision, which was an intentional effort to reduce DCAA auditor workload by increasing DCMA Contracting Officer workload, was the first step down the road, but it was by no means the last. Other management decisions have continued that trend.

One of those other decisions was the 2010 "contractor recovery initiative" in which DCAA and DCMA teamed-up to disposition some 400 "reportable audits" and roughly 300 DCAA Form 1's that had been awaiting Contracting Officer disposition. We didn't think too much of that initiative at the time and opined as follows:

If you look closely at the resolution process, and the roles and responsibilities, you'll see that DCMA has all the actions. Moreover, you'll see that DCMA has to make its dispositions 'in consideration of the DCAA audit report'-which seems very much like direction to the ACOs to 'accept the DCAA audit report as if it had merit'. Well, after nearly three years of GAO and DOD IG criticism of the quality of DCAA audit reports, we don't expect that guidance to result in many fair, reasonable and/or correct ACO decisions.

We didn't remark much on it at the time, but in retrospect CRI was blazing a trail for future DCMA/DCAA/contractor interaction in aspects beyond merely shifting workload to DCMA. Not only did it mark the diminution of "independent business judgment" of the warranted Contracting Officer in the face of a DCAA audit finding, but it also marked the first real use by DCAA of non-GAGAS memoranda and ROMs to quantify the auditors' so-called findings. The reverberations of that particular sea change still echo today.

We were not the only ones to note the sea change. In another article we quoted respected attorney John Pachter (of the firm Smith, Pachter, McWhorter), who opined (in an article published by the ABA's Public Contract Law Journal)-

Contracting Officers must confront the notion, expressed in various ways, that auditors' advice is presumptively correct. Rather than being allowed to rely on the advice of auditors and then make a considered decision as the FAR contemplates, Contracting Officers now have the burden of justifying their decisions when they differ from those of auditors.

[Emphasis added.]

The trend continued with the publication in late May 2011 of the FAR revisions ostensibly designed to improve the contract close-out process. Instead, DCAA drove significant changes to the Allowable Cost and Payment contract clause (52.216-7) that required contractors to use the 15 "Incurred Cost Electronically" Schedules developed by DCAA, regardless of whether or not those Schedules actually had anything to do with calculating final billing rates or claiming allowable incurred costs.

This was perhaps the biggest workload shift ever seen to date, and it shifted the workload from those doing the auditing to the contractors being audited.

Readers, some of those now-mandatory Schedules were previously DCAA audit working papers. Some of the Schedules now prepared by contractors where internal DCAA schedules that used to be prepared by auditors.

For example, Schedule I ("Schedule of cumulative direct and indirect costs claimed and billed by contract and subcontract") is used by DCAA in the preparation of the Cumulative Allowable Cost Worksheet (CACWS). It creation of Schedule I has nothing to do with claimed costs nor does it have anything to do with calculating indirect cost rates. If it weren't for the necessity of preparing a CACWS, it would not need to be done. Historically it was an internal DCAA working paper that was a data source of the CACWS. After the 2001 FAR changes it became a mandatory Schedule that contractors needed to prepare and submit in the exact required format mandated by DCAA, a format that was designed to provide data into the CACWS. Similarly, Schedule J is simply a listing of awarded subcontracts so that DCAA can request assist audits. Schedule O simply identifies contracts that might be closed-out, if DCAA could ever get around to finishing the 10100 audit. Those three Schedules add zero value to the contractor but DCAA demands the contractor prepare them.

If the contractor declines to take on the auditors' workload, then its proposal to establish final billing rates is determined to be inadequate for audit by DCAA (even though the FAR expressly reserves the right to determine adequacy to the DCMA Administrative Contracting Officer) and the contractor has no right of appeal. Actually, the consequences for a refusal to do the auditors' work are worse than a simple finding of "inadequate for audit."

If DCAA judges that the contractor cannot remedy the alleged deficiencies in its final billing rate proposal within 30 days then it will send the DCMA Administrative Contracting Officer a memo recommending decrements to the proposed direct and indirect costs. What happens after that is solely the responsibility of the ACO, since (as we told readers) DCAA will close out its audit assignment and drop the proposal from its backlog. In other words, DCAA will wash its hands of the matter and negotiating final billing rates will then become DCMA's problem.

Moreover, if DCAA judges that a contractor cannot (or is unwilling to) submit an "adequate" final billing rate proposal (as defined by DCAA), then the auditors have the option of issuing a deficiency report and recommending that the contractor's accounting system be determined to be inadequate for cost-reimbursement contracting. Not only would that determination lead to a massive erosion of competitive position, but it might well lead to an imposition of payment withholds under the DFARS Business System administration regime. The person who makes the final call and prepares the Board of Review package is the ACO and (once again) not the DCAA auditor making the finding. (Naturally, if the finding is not sustained by the Contracting Officer or the Board of Review, then there are no consequences for the DCAA auditor or his/her supervisory auditor or his/her Branch Manager. Nobody ever puts a letter of reprimand in their personnel files for issuing bogus findings that waste the time of the DCMA Contracting Officers and/or the DCMA Review Boards. That's a feedback loop that does not seem to exist. So much for accountability; but perhaps we digress.)

There's more to discuss.

There are some tasks that DCMA has taken from DCAA for itself, apparently because DCAA cannot or will not issue a timely audit report that would actually be of value to a Contracting Officer. The most apparent of these is the review of a contractor's CASB Disclosure Statement for adequacy. This review used to be DCAA's bread and butter; now, it's a review performed by the DCMA Contracting Officer and staff. Similarly, DCMA now issues Forward Pricing Rate Recommendations (FPRRs) without waiting 90 or 120 or 180 days for an official DCAA audit report that will express an opinion on the mathematical accuracy of the contractor's estimate of direct and indirect costs it will record over the next year or two or five. (Let's be clear. DCAA has little if any ability to actually express a supported conclusion on the contractor's forecast of sales and cost of sales and SG&A costs, which is fundamentally a crystal ball-based educated guess as to what the future holds. Guess what? DCAA's guess about the contractor's future is going to be significantly less educated than the contractor's guess. But that disparity doesn't keep DCAA from "questioning" forecasted costs and then reporting those questioned costs as some kind of taxpayer savings that justifies next year's operating budget. Oops! Perhaps we digressed once again. Let's wrap this up, shall we?)

At this point we've discussed how DCAA has shifted its former workload over to DCMA, and how DCAA has shifted its former workload onto the contractors. (Did we mention how much pressure is on contractors these days to lower their indirect expenses? It's tough to do that when you're taking on additional workload.) And we've discussed how DCMA has voluntarily taken on some of the former DCAA workload, in what seems to be an effort to move the ball forward despite DCAA's inability to play in the game.

The last item we will discuss is going to be how the Department of Defense is preparing to shift a huge piece of DCAA's workload over to the contractors. It's called DFARS Case 2012-D042. Now we confess we haven't seen the proposed DFARS revision. According to the open DFARS Open Cases Report (dated 4/26/2014) the rule is at OIRA for review. (OIRA = Office of Information and Regulatory Affairs, for those who don't follow Federal rulemaking.) The Open Cases Report simply says of the proposed DFARS revision: "Revises business systems clauses to include contractor reporting and documentation requirements regarding contractor compliance with DFARS business systems criteria." Now, that sounds rather benign (unless you know the propensity for the rulemakers to hide their true intentions behind benign-sounding phrases). But according to Adam Eastridge, writing in the March 2014 edition of West's Government Contract Costs, Pricing & Accounting Report, hidden within that proposed rule will be a key policy shift that increases contractor workload. Mr. Eastridge wrote-

The proposed DFARS rule … clearly has the potential to create additional inefficiencies in both the Government and the contracting industry. The proposed rule would require contractors to pay CPA firms to audit and opine on their business systems. … [Under the proposed rule] DCAA will no longer be responsible for auditing business systems … DCMA may view the proposed rule as beneficial because it transfers the responsibility for business system audits away from DCAA. Excluding DCAA from the process to allow quicker and timely decisions is clearly DCMA's preference, as illustrated in the recent DCMA FPRP guidance.

[Emphasis in original.]

Again, we have not seen the DFARS revisions (because they haven't been published yet), but Mr. Eastridge clearly has seen a draft. If his summary of the proposed change is accurate, then DOD will once again be shifting the workload from its own staff to the staffs of its contractors. But of course the contractors will not have to hire any new personnel; they will simply hire outside CPA firms to do the work. Sure it will cost money, but it's free money because it's not coming out of DOD's budget. Where is that money coming from? Contractors' prices, is where.

Consequently, it's likely that contractors are going to be required to spend more of their limited indirect funds to pay for external CPAs to review their business systems, a review that will be mandated by DOD and paid for through increased prices for goods and services.

This is but the latest example of how DCAA has reduced its workload. But remember, readers, this workload shift has been happening at the same time as DCAA has been adding additional staff. DCAA has been reducing the workload of its auditors and asking them to do less, while at the same time hiring more staff.

Yes, you read that correctly. DCAA is working hard to do less with more, with the official blessing of Pentagon leadership.

Given the foregoing, we have to ask whether DOD and the taxpayers need DCAA anymore. What is the purpose of an ever-growing audit agency that no longer performs a significant piece of the workload for which it was responsible only a few short years ago? What is the purpose of an audit agency when its own customers prefer to do the work themselves or to push it to others? What is the purpose of an audit agency when its reports lack meaningful value in the eye of its customers?

If DCAA were a commercial audit firm-the kind of audit firm that DOD wants to now audit contractor business systems-then it would be going out of business. Instead, DCAA keeps on hiring. For what purpose? We don't know.

We are reminded of Norm Augustine's musing on the ever-expending role of the auditor. He wrote:

Auditors, reviewers, inspectors, and other forms of overseers perform a truly important role, but that role can be beneficial only when applied constructively and with considerable moderation. The prevailing trend would suggest the existence of an explosion in the overseer business, with an ominous threat approaching that there will soon be no one left for the auditors to audit. When this day of an infinite watcher-to-worker ratio arrives, it will presumably be necessary to focus audits on the mistakes which would have been made had in fact there been anyone doing anything.

[Emphasis in original.]

This blog has existed for more than five years now. In that time we've discussed many different topics. But no topic has been more prevalent, or more popular, than the discussions about DCAA and its evolving role in the defense acquisition process. This website has documented the fall of DCAA and we think that fall will continue. We don't know what DCAA is going to do with its ever-growing audit staff but, obviously, it will not be performing many audits or Disclosure Statement reviews or contractor business system reviews in the future.

We don't relish the following statement, because we personally know many DCAA auditors and (for the most part) we like and respect those we work with. But the truth is that the DOD audit agency is working hard to put itself out of business and we think it's time to let that happen.

It's time to put DCAA out of business completely.

One of the recurring themes here is that paying attention to internal controls is good business. Yes, we know that selling work is also good business. We know that billing and collecting cash is also good business. In addition, we understand that doing good work and helping clients is also good business. We get all that and most business people do as well. But not all business people understand that designing good controls and hiring the right people to assess them is also good business. Most business people-especially those in C-Suite positions of medium-sized and larger companies-really don't seem get it.

Assume there is only limited budget to run the business. Assume there is only a limited pot of money available to devote to business development/proposals, finance/accounting, legal, training, and similar expenses of an indirect nature (i.e., expenses that do not directly support revenue-generating work). Such below-the-line expenses are always under scrutiny, because the more you can cut there, the more one's revenue can turn into profit. So let's take as a given that there is a limited amount of money for such expenses, and therefore one of the key responsibilities of the management team is to prioritize the tasks associated with running the business and to ensure that only the necessary tasks are performed, so as to minimize associated expenses. That makes good sense, right?

The general approach to such prioritization is to identify the needs of the business and rank them. There are necessary tasks that must be performed, such as accounting/bookkeeping, billings, and collections. Employees must be recruited, hired, trained and retained. Those tasks and others like them are considered to be mandatory and typically receive budgets accordingly. Fringe benefits such as medical insurance and a retirement plan generally fall into the top tier of "discretionary but important" budget items. And in order to generate new business, budget must be made available for travel, client meetings, and to fund generation of proposals. Finally, there are a host of lesser "nice-to-have" expenses such as dues/subscriptions, attendance at training and technical conferences, and employee morale events. The limited bucket of management funds has to be allotted judiciously, given due consideration and weight to benefit received by the company.

Moreover, there are other indirect tasks that may have no concrete benefit, but which are funded (and staffed) anyway-because the risks associated with not performing them need to be mitigated. Some risks have a low probability of occurrence, but their consequences are catastrophic, so smart business owners fund them. A great example is insurance. Smart business owners identify business risks (such as liability to employees or to third parties, or the risk of property loss, or the risk of business interruption from natural or manmade disasters) and they buy insurance policies and pay premiums so that if those risks ever do occur the company is protected.

Establishing internal controls falls into this "risk-mitigation" category of management funding. Much like an insurance policy, effective internal controls act to militate against certain risks. While insurance may address external risks, internal controls address internal risks: risks associated with employees and potential wrongdoing.

But the key notion here is that the insurance coverage (and associated premiums) is funded only to the extent deemed necessary to protect the business. The probability of occurrence and consequences are weighed in determining how much to pay for the coverage. Smart business owners generally employ a similar approach to determining how much budget to devote to internal controls, and the people who will implement them. Like insurance, internal control efforts are funded only to the minimum amount judged necessary to protect the business, given the identified risks and consequences associated therewith.

The problem with taking that approach to funding internal controls is that it is based on management's assessment of risks and consequences. In order to properly evaluate risk/consequence so as to determine the appropriate amount of limited funds to apportion to that effort, management has to have a good understanding of those risks and consequences, or be guided by somebody who does. With respect to government contracting statutes, regulations and rules, management rarely has a deep understanding of those risks and consequences. Consequently, management may under-fund the company's internal control efforts, to the long-term detriment of all stakeholders.

We've written about this situation before. We wrote-

The other problem is that contractors too frequently screw up the risk analysis. This is especially true when commercial companies dabble in government contracting. When the government contract revenue is a small percentage of total corporate sales, then management has a tendency to treat its Federal customers just like any other sales channel. Sure, they know (vaguely) that there are some special regulations involved in that government contracting stuff, and maybe they've hired a couple of people to 'scrub the books' to make sure that those arcane regulations are complied with. But there is a definite tendency-especially at the most successful commercial companies-to think that those additional hires plus some good ol' common sense will be sufficient to militate against the risk of noncompliance.

They screw up the risk analysis because they do not understand the risks.

They screw up the risk analysis because they do not understand the true cost of merely being accused of submitting a false claim to the Federal government. The cost of hiring attorneys and other outside experts. The cost of diverting personnel to litigation support instead of what they were hired to do. The cost of litigation-related reserves. The cost of filing SEC disclosures and of preparing special litigation notes to the financial statements. The cost of answering probing questions-not just by the Assistant U.S. District Attorney, but also by investment analysts during investor conference calls. The cost of seeing the stock price fall because of DOJ press releases. The reputational 'brand' impact in the marketplace.

This website blog is rife with articles about blown risk analyses and inadequately implemented internal controls. There are any number of articles that discuss how even the biggest defense contractors have paid huge dollars because they were accused of wrongdoing. How much more catastrophic, then, are the impacts of similar accusations on smaller contractors, the mid-tier companies that are (generally) subject to the exact same risks as the Top 5 aerospace/defense contractors? The big dogs have the deep pockets, the available cash and/or lines of credit. What about the smaller dogs? How deep are their pockets? Not as deep, is our assertion.

Thus, while the risks may be similar across the spectrum of government contractors, the consequences associated with those risks may well vary by individual company circumstances. And while the smaller dogs may not have as much management budget to allot to their internal controls, we believe it is absolutely critical that they do so, given their relative vulnerability.

It is critical for the mid-tier and smaller companies to focus on this area, even though the task is harder for them. Because if the big dogs, such as UTC and CH2M Hill, misevaluate the risks and consequences within the complex world of government contracting, how much more likely will it be for the smaller dogs to blow it? We fervently believe that all companies-but especially the mid-tiers-need to work harder on this evaluation.

(Now of course we could discuss internal controls within the Federal government. And we have done so, many times, on this site. But that's not the focus of today's article.)

We would like to offer evidence in support of our fundamental assertion that too many companies fail to appreciate the risks and consequences associated with regulatory noncompliance within the government contracting marketplace.

• An IT manager at two (2!) government contractors funneled some $700,000 to his own shell company. "Over the course of the scheme, Spangler created fraudulent documentation for 19 purported purchases of IT supplies from the shell company that he owned. In reality, however, Spangler did not provide the supplies at the agreed-upon prices and instead used the funds for personal expenses."

• Employee timecard fraud led to allegations of submission of False Claims for one former NGA contractor employee. More importantly, his falsification of intelligence reports put U.S. military personnel at risk.

• The Glenn Defense Marine Asia scandal claimed another victim, as a "general manager of government contracts" pleaded guilty to one count of conspiracy to defraud the United States. "… Wisidagama and other GDMA employees generated bills charging the U.S. Navy for port tariffs that were far greater than the tariffs that GDMA actually paid … created fictitious port authorities for ports visited by U.S. Navy ships … created fake invoices from legitimate port authorities purporting to bill the U.S. Navy at inflated tariff rates. Wisidagama and GDMA also overbilled the U.S. Navy for fuel by creating fraudulent invoices which represented that GDMA acquired fuel at the same cost that it charged the U.S. Navy when in fact GDMA sold the fuel to the U.S. Navy for far more than it actually paid … also defrauded the U.S. Navy on the provision of incidental items by creating fake price quotes purportedly from other vendors to make it appear that the other vendors' offering prices were greater than GDMA's prices."

• A Utah construction company agreed to pay $928,000 to settle allegations that it "made false statements and submitted false claims" in connection with its Mentor-Protégé Agreement with a qualified 8(a) business. Among other allegations, "The government also alleged that Okland Construction's relationship with Saiz Construction violated the terms of an SBA set-aside contract awarded to Saiz Construction that required Saiz Construction to perform at least 15 percent of the labor on the contract minus the cost of materials."

• An owner of a Maryland contractor pleaded guilty to defrauding both the Small Business Administration and the Internal Revenue Service.

• A medical-device maker in Orange County, CA, paid $500,000 to resolve allegations that it violated the Buy America Act by selling foreign-made devices to the U.S. Army. To its credit, the company discovered the violations on its own and voluntarily disclosed them. "In conjunction with Ossur's voluntary disclosure, the company instituted a series of compliance measures, including distribution of instruction sheets to sales representatives and training for management officials, to ensure future compliance with the Buy American Act."

• A university professor was convicted of "wire fraud, mail fraud, falsification of records, and theft of government property in connection with a scheme to fraudulently obtain research grants from the National Science Foundation (NSF) and kickbacks from students' stipends." The fraud was uncovered during a routine audit by the NSF Office of Inspector General.

• A co-owner of a New Jersey industrial supply company pleaded guilty to one count of "making a materially false and fictitious statement to the U.S. Environmental Protection Agency (EPA) at a debarment proceeding." Yes, the individual fibbed at his own debarment hearing. How did the individual find himself in a debarment proceeding? "Previously, Boski and his company … had pleaded guilty … to participating in a kickback and fraud conspiracy … from approximately December 2000 to approximately September 2004. As outlined in the 2009 plea agreement, Boski provided $55,000 in kickbacks to two employees of the prime contractor responsible for awarding contracts at the two Superfund sites in exchange for the award of sub-contracts to NIS. These kickbacks included luxury vacations and payments to shell companies held by the two employees."

• A former vice president of a government contracting company pleaded guilty to "conspiracy to pay bribes to public officials in exchange for favorable treatment in connection with U.S. government contract work."

• A construction company agreed to "pay $2.4 million and implement internal reforms subject to independent monitoring to resolve a multi-agency joint criminal and civil investigation into alleged fraud committed by the company in connection with a public works project that commenced in 2007."

• Five California-based masonry contractors and two individuals agreed to pay nearly $1.9 million "to resolve allegations that they violated the False Claims Act by misrepresenting their disadvantaged small business status in connection with military construction contracts." According to the announcement, "The government alleged that the defendant masonry subcontractors and their principals misrepresented to the prime contractors that they were small businesses, and that these misrepresentations caused the prime contractors to falsely certify that they had complied with the small business provisions of the contracts in claiming payment."

Readers, every single one of the foregoing press releases was published within a single 30-day period. Every single one. And we didn't even report them all!

When evaluating risks and consequences, please feel free to refer to this article.

Now in fairness, the instances of wrongdoing listed above might not have been prevented, even through the best internal controls regime. The fact of the matter is that fraud committed by a company CEO or President, or other officer, is almost impossible to prevent. Which is why outside auditors so often focus on "tone at the top" as an element of assessing fraud risk.

Regardless, we maintain that the probability of wrongdoing taking place is higher than almost all management thinks it is, and we maintain that the consequences of that wrongdoing (even if detected and voluntarily disclosed) is much worse than management thinks it is. Thus we believe management is (generally) failing to invest sufficient amounts of its limited indirect funds to implement effective internal controls.

Investing in internal controls is good business. Investing in good controls and good compliance people may seem like a lower-priority than some other management tasks, but we believe it's an investment that will have a good return, in terms of employee or vendor wrongdoing detected or (better yet) deterred.