We interrupt our series of articles on the structuring of indirect cost allocations to let our readers know that the DOD Inspector General has just issued its latest assessment of DCAA audit quality.

The reported results were consistent with historical findings reported by both the DOD IG and the Government Accountability Office (GAO).

In other words, they weren’t very pretty, folks.

The DOD IG used to be the “peer reviewer” that audited the quality of DCAA’s audits, so as to comply with the requirements of GAGAS (Generally Accepted Government Auditing Standards). According to the IG, GAGAS requires that “organizations performing audits or attestation engagements in compliance with GAGAS [must] have an external peer review at least once every 3 years. Based on the criteria, DCAA should have obtained a peer review on its work performed in [Government] FY 2009.” But DCAA didn’t do so. In fact, the last peer review opinion (covering audits performed in FY 2006) was withdrawn in August, 2009, because of the IG’s “significant findings … coupled with the results of the July 2009 Government Accountability Office (GAO) draft report, ‘DCAA Audits: Widespread Problems with Audit Quality Require Significant Reform’ (GAO-09-468).”

Many observers, including those here at Apogee Consulting, Inc., identify the withdrawal of the external quality opinion in August 2009 as the point in time where the organization that is DCAA went insane. In its subsequent attempts to comply with GAGAS and avoid criticism on the quality of its audit reports, the DCAA audit approach underwent a Kafkaesque metamorphosis into a bizarre and largely incomprehensible monstrosity, from which it has yet to recover.

The DOD IG explained DCAA’s reaction this way—

Prior GAO and DOD Inspector General (IG) reviews of DCAA reports identified significant deficiencies in audit work, including poor supervision, inadequate documentation, inappropriate changes to report opinions, and lack of sufficient testing to support report opinions. To address audit quality issues, DCAA implemented various corrective actions such as revised supervisory training; a required computer - based training course on working paper documentation; required training on GAGAS; revamped audit programs; and issuance of revised guidance on variable and attribute sampling with relevant training modules.

What the DOD IG did not state was that DCAA’s “corrective actions” included issuance of (let us say) questionable audit guidance and creation of multiple management review layers. (For an example of our thoughts on the new layers of audit review, see our article here.) The end result of DCAA’s corrective actions was an environment that, by any measure, was dramatically less productive. Audits took significantly more hours to conduct and took significantly longer to issue. That’s not an opinion: that’s an objective assessment based on DCAA’s own reported statistics.

Another one of the changes DCAA undertook was to exclude the DOD Inspector General from further peer reviews. In fact (as the DOD IG reported)—

In FY 2012, with the assistance of the Council of Inspectors General on Integrity and Efficiency (CIGIE) Audit Committee, DCAA started the process of obtaining an outside firm to perform its next peer review. DCAA stated that the peer review is to be performed in FY 2013 and cover [audit] reports issued in FY 2012.

DCAA’s attempt to find a more sympathetic external quality control auditor didn’t stop the DOD IG from performing further reviews on DCAA audit quality; it simply stopped those reviews from having any effect on the officially “expired” peer review assessment. In other words, the IG has declared that it cannot be shut out and that this latest report will not be its last on the topic of DCAA audit quality.

Before we get into the meat of the report, let’s note for the record (as the IG did) that though it reviewed audit reports issued in GFY 2010, most of the field work had been performed in GFY 2009—i.e., before DCAA had implemented many of its “corrective actions” that were ostensibly intended to address the audit quality issues identified by the DOD IG and GAO. Accordingly, the DOD IG report gives DCAA an out. The audit agency can (and did) claim that when the outside firm performs the external peer review in GFY 2013 (covering audit reports issued in GFY 2012), those corrective actions will have been digested and all will be well, quality-wise.

(Pause for skeptical throat-clearing.)

So here’s what the DOD IG auditors found, with respect to the 50 GFY 2010 DCAA audit reports they reviewed:

In 37 of the 50 assignments (74 percent) reviewed, the audit staff did not exercise professional judgment as evidenced by deficiencies identified in multiple standards areas. The 37 assignments had a high number of deficiencies, ranging from 6 to 9 deficiencies out of 9 standards areas excluding professional judgment. … The abundance of noncompliances with standards identified in the 37 assignments evidences the need for improvements in the area of competence at DCAA.

[Emphasis added.]

Some of the GAGAS noncompliances were tied to the use of inexperienced auditors coupled with inadequate supervision. The DOD IG wrote—

In 3 of the 50 assignments reviewed, auditors with limited experience or training were assigned to complex engagements. In two assignments, the auditors either did not possess the knowledge and skills required or did not receive appropriate supervision reflective of their limited experience to adequately perform the assignment. In the other assignment increased supervisor and audit manager involvement made up for the lack of experience and training of the audit staff. GAGAS 3.33 discusses the interrelationship between professional judgment and competence because auditors’ judgments are dependent upon the auditors’ competence. GAGAS 3.36 further links the determination of whether professional judgment was demonstrated in an engagement to the appropriateness of the consideration of the collective experience, training, knowledge, skills, abilities, and overall understanding required by the audit team and its members to properly perform the engagement. Without the appropriate mix, the audit team will not be able to properly assess the risks that the subject matter under audit may contain a significant inaccuracy or could be misinterpreted. Therefore, DCAA used inexperienced auditors under limited supervision, which contributed directly to the audit teams not demonstrating professional judgment. DCAA[‘s] use of inexperienced auditors and the associated lack of professional judgment also led to the noncompliances identified in the assignment with key standards such as planning, evidence, documentation, and reporting.

[Emphasis added.]

And despite the efforts of DCAA to keep the DOD IG from commenting on its audit quality control system (as described above), the DOD IG commented on the DCAA audit quality control system. It wrote—

In 46 of the 50 assignments reviewed, the DCAA quality control system was ineffective in ensuring that its attestation engagement and performance audit assignments complied with applicable professional standards. … The need for improvement in the DCAA quality control system was evidenced by the deficiencies identified in multiple standards areas; in engagements performed in all regions and Field Detachment; and in all engagement types reviewed.

DOD IG also reported that DCAA’s implementation of multiple quality reviews prior to issuance of reports did not significantly improve the quality of those audit reports. The DOD IG wrote—

The DCAA regional and Field Detachment quality control procedures were generally ineffective in ensuring that attestation engagements and performance audits complied with GAGAS and DCAA policies and procedures. The quality control procedures including regional and Field Detachment management pre-issuance reviews varied among regions and Field Detachment. The regional and Field Detachment pre-issuance reviews did not identify significant noncompliances with GAGAS and resulted in the regional or Field Detachment audit managers approving reports that should not have been issued. In addition, the regions and Field Detachment management did not have adequate procedures in place to ensure that audit offices complied with regional and Field Detachment quality control procedures for which the audit offices were assigned responsibility.

[Emphasis added.]

We could go on and on, just like the DOD IG audit report did, listing example after example of poor audit planning, poor communication, poor documentation, lack of professional competence, lack of adequate supervision, insufficient evidence, delayed reports, and other GAGAS violations. But why bother? The report is, unfortunately for DCAA, damning.

Just as the prior DOD IG and GAO reports on DCAA audit quality have been damning.

We’re not particularly surprised by the findings in the DOD IG report; nor do we suspect our readership is particularly surprised by them. We’ve asserted for some time that the DCAA initiatives intended to increase audit quality have not worked out as planned. As this report demonstrates, DCAA audit quality is still lacking.

In other words, DCAA has implemented its revised procedures and multiple reviews and, as a result, has dramatically delayed its audit report production for no good reason. They still suck.

So we think DCAA may as well just throw the audit reports over the transom to the customer just as quickly as it can. The quality will still be as poor; but at least the reports will be more timely.

But we can hear the chorus of cries from Fort Belvoir from here—“just wait until the next review!” Yes, things will be so much better then. Higher quality audit reports issued faster.

Sure.

We’ll be very happy to report on the assessed quality of DCAA audit reports when that next external peer review report is issued. If things have improved significantly, we’ll be first in line to say so.

In the meantime, we’re not so happy to be reporting on this assessment. Nor, do we think, should current and former DCAA auditors be happy to read about the quality of their agency’s audit reports, as assessed and documented by the DOD Inspector General.

We have friends who work at CH2M Hill; truly, we do. And we sincerely have tremendous respect for the company, which has grown itself into a juggernaut of an entity providing top-notch environmental services, design and design/build services, and architect/engineering services since its founding some 65 years ago. And we were pleased to see that it was recently named as “one of the world’s most ethical companies” by Ethisphere, and that it was also recently named as “one of the world’s most admired companies” by Fortune magazine. We’re not surprised. The company is that good.

And yet …

And yet we told you about the company’s timekeeping problems back in October, when we discussed its long-running allegations of timekeeping fraud (and resulting false claims) at its Hanford DOE project site, and wrote—

Certainly, CH2M Hill must have learned by now that its operations, which generally take place in remote locations far from its Corporate Headquarters in Denver, Colorado, are subject to risks that a reasonable person might think would be worth some largish internal control and awareness training investments, in order to mitigate.

We wonder how company leadership feels about investing in internal controls and employee training now, after they just settled with the DOJ for $18.5 million.

As the story at The Tri-City Herald (link above) reports—

CH2M Hill has agreed to pay $18.5 million to settle civil and criminal allegations of defrauding taxpayers through widespread timecard fraud at the Hanford nuclear reservation. It's the largest-ever penalty for a Hanford contractor and possibly the largest settlement ever negotiated by the U.S. Attorney's Office for the Eastern District of Washington, said U.S. Attorney Michael Ormsby on Wednesday.

[Emphasis added.}

In addition to the $18.5 million payment, the story reported that—

CH2M Hill also will pay $500,000 toward a timekeeping system to better monitor timecards for workers on its current Hanford contract. … It will hire a corporate monitor at a cost of up to $80,000 to develop policies, procedures and employee training, the settlement agreement said. In addition, CH2M Hill will continue to cooperate in the Department of Justice's ongoing fraud investigation.

So really, it was a $19 million settlement, right?

And as part of the settlement, CH2M Hill agreed to do what it should have done years ago, when it took over site management—i.e., to implement an effective timekeeping system and to develop policies, procedures, and employee awareness training, in order to reduce the risk associated with the systemic timekeeping fraud that was alleged to have occurred.

Let’s be clear on the math here. For a roughly $600,000 investment, CH2M Hill could have avoided a $18.5 million settlement and God-only-knows-how-much in unallowable legal expenses. By our calculations (excluding the legal fees) that’s a Return on Investment of nearly 3,000 percent. When we put it that way, you’ve got to wonder ….

Over at LinkedIn, we got involved in a discussion about how much a company should expect to spend on its compliance program as a percentage of sales. We resisted using percentage of sales as the metric, because we thought that the risks of noncompliance were not wholly sales driven. (I.e., we didn’t think that risks scaled with revenue growth). But the example of CH2M Hill’s recent settlement shows how a penny-pinching approach to compliance programs, focusing solely on the costs involved in detecting/preventing noncompliance without also considering the risks and the costs associated with the noncompliance (should it occur) is also the wrong approach.

Remember, establishing strong internal controls and strong policies/procedures and strong employee training programs and strong compliance programs to detect/prevent wrongdoing are investments.

They are investments in litigation avoidance.

That’s the proper way to look at these things, in our (perhaps biased) view.

As CH2M Hill learned too late.

CH2M Hill is a good company—some would even assert it’s a great company. We’re sure they’ll figure this one out. After all, they have 19 million reasons to have learned their lesson.