Ending 2012 with a Fraud Settlement that Illustrates an Important Point
In April 2011 we posted an article about Verizon’s $93.5 million settlement with the Department of Justice that resolved False Claims allegations for invoices submitted by an entity it had acquired in 2006. Allegedly, those invoices contained taxes and surcharges prohibited by its contracts with the General Services Administration (GSA). That situation led us to write something that we’ve repeated many times on this site, namely: “government contractor compliance failures tend to be on the very expensive side, such that investments in compliance mechanisms and internal controls tend to pay for themselves.”
The cost/benefit analysis seems frighteningly clear to those who work in this industry. It’s essentially a no-brainer. The probability of being accused of submitting false claims (or making false statements) to the Federal government may be low, but the consequences tend to be huge. The risk analysis always shows that it’s cheaper to invest in an effective compliance program than it is to defend against allegations of wrongdoing.
The problem is that contractors too infrequently perform such a risk analysis. So in times of budgetary pressure—such as that in which we are currently working—it seems like picking low-hanging fruit to cut back on internal controls and compliance programs. Such a decision ameliorates today’s budget problems at the expense of creating potential problems for tomorrow’s leadership—as in when Verizon paid nearly $100 million for the decisions made by MCI/WorldCom nearly five years earlier.
The other problem is that contractors too frequently screw up the risk analysis. This is especially true when commercial companies dabble in government contracting. When the government contract revenue is a small percentage of total corporate sales, then management has a tendency to treat its Federal customers just like any other sales channel. Sure, they know (vaguely) that there are some special regulations involved in that government contracting stuff, and maybe they’ve hired a couple of people to “scrub the books” to make sure that those arcane regulations are complied with. But there is a definite tendency—especially at the most successful commercial companies—to think that those additional hires plus some good ol’ common sense will be sufficient to militate against the risk of noncompliance.
They screw up the risk analysis because they do not understand the risks.
They screw up the risk analysis because they do not understand the true cost of merely being accused of submitting a false claim to the Federal government. The cost of hiring attorneys and other outside experts. The cost of diverting personnel to litigation support instead of what they were hired to do. The cost of litigation-related reserves. The cost of filing SEC disclosures and of preparing special litigation notes to the financial statements. The cost of answering probing questions—not just by the Assistant U.S. District Attorney, but also by investment analysts during investor conference calls. The cost of seeing the stock price fall because of DOJ press releases. The reputational “brand” impact in the marketplace.
The leadership at defense contractors largely (but not universally) understands the cost/benefit analysis. They’ve been in the cross-hairs since the seventies, and they’ve largely adapted to the environment in which they work. But commercial companies who are new to government contracting, and whose government sales are a very low percentage of total sales, don’t get it. They haven’t been burned yet, so they don’t understand the risks of playing with matches. And so they skimp on internal controls and multiple reviews, and on the hiring of subject matter experts in areas such as contract administration, cost accounting, pricing, and billing.
The W.W. Grainger Corporation of Lake Forest, Illinois, presents us with a sterling example of the blown risk analysis.
Now, before we dig into this illustrative example of a commercial company who dabbled in government contracting, to the eventual chagrin of its leadership and shareholders, we have to let you know that we don’t have any inside information about the situation. All we have is what the Internet provides. Accordingly, we may be getting some of the details wrong. But we don’t think so. We think we understand W.W. Grainger, Inc. all too well.
W.W. Grainger, Inc. is a distributor of maintenance, repair, and operating (MRO) supplies, as well as other related products and services used by businesses. Although the majority of its sales take place in North America, it also has a global presence. The company serves about two million customers through its network of branches, distribution centers, websites, and export services. Grainger has centralized business support functions that provide coordination and guidance in the areas of accounting and finance, business development, communications and investor relations, compensation and benefits, information systems, health and safety, global supply chain functions, human resources, risk management, internal audit, legal, real estate, security, tax and treasury. These services are provided in varying degrees to all business units.
(We hope Grainger invested in providing some extra “centralized business support functions” to its business units selling goods and services to the Federal government. But our experience with such centralized service functions leads us to suspect that they skimped in that area. See our comments above about perceptions of low-hanging fruit ripe for cutting in times of budgetary pressure.)
W.W. Grainger had $8 billion in sales in its FY 2011. (FY 2012 numbers have not yet been released.) During its FY 2011, the company made about 105,000 individual transactions each day, selling to “small and medium-sized businesses to large corporations, government entities and other institutions.” No customer—not even the mega-buyer that is the United States Federal government—accounted for more than two percent of corporate sales. Grainger reported two segments, but those segments were differentiated by geography and not by customer. Tellingly, Grainger did not report a separate segment for its Federal sales.
In other words, W.W. Grainger dabbled in government contracting.
Item 1A of its FY 2011 10-K (Annual Report) filing with the Securities and Exchange Commission lists “significant risk factors relevant to Grainger’s business that could adversely affect its financial position or results of operations.” There are thirteen (13) significant risk factors listed. The thirteenth is an admission that the company “is subject to various government regulations.” The paragraph following that statement contains additional details, including:
As a government contractor selling to federal, state and local government entities, Grainger is subject to a variety of laws and regulations, including without limitation import and export requirements, the Foreign Corrupt Practices Act, tax laws (including U.S. taxes on foreign subsidiaries), foreign exchange controls and cash repatriation restrictions, data privacy requirements, labor laws and anti-competition regulations, and is also subject to audits and inquiries in the ordinary course of business. … Grainger has implemented policies and procedures designed to facilitate compliance with these laws and regulations, but there can be no assurance that employees, contractors or agents will not violate such laws and regulations or Grainger's policies. Any such violations could individually or in the aggregate materially adversely affect Grainger's financial condition or operating results.
Note 19 to the company’s 2011 financial statements contained the following statements—
Grainger is a party to a contract with the United States General Services Administration (the GSA) first entered into in 1999 and subsequently extended in 2004. The GSA contract had been the subject of an audit performed by the GSA's Office of the Inspector General. In December 2007, the Company received a letter from the Commercial Litigation Branch of the Civil Division of the Department of Justice (the DOJ) regarding the GSA contract. The letter suggested that the Company had not complied with its disclosure obligations and the contract's pricing provisions, and had potentially overcharged government customers under the contract.
Discussions relating to the Company's compliance with its disclosure obligations and the contract's pricing provisions are ongoing. The timing and outcome of these discussions are uncertain and could include settlement or civil litigation by the DOJ to recover, among other amounts, treble damages and penalties under the False Claims Act. Due to the uncertainties surrounding this matter, an estimate of possible loss cannot be determined. While this matter is not expected to have a material adverse effect on the Company's financial position, an unfavorable resolution could result in significant payments by the Company. The Company continues to believe that it has complied with the GSA contract in all material respects.
Grainger is a party to a contract with the United States Postal Service (the USPS) entered into in 2003 covering the sale of certain Maintenance Repair and Operating Supplies (the MRO Contract). The Company received a subpoena dated August 29, 2008, from the USPS Office of Inspector General seeking information about the Company's pricing compliance under the MRO Contract. The Company has provided responsive information to the USPS and to the DOJ.
Grainger is also a party to a contract with the USPS entered into in 2001 covering the sale of certain janitorial and custodial items (the Custodial Contract). The Company received a subpoena dated June 30, 2009, from the USPS Office of Inspector General seeking information about the Company's pricing practices and compliance under the Custodial Contract. The Company has provided responsive information to the USPS and to the DOJ.
Discussions with the USPS and DOJ relating to the Company's pricing practices and compliance with the pricing provisions of the MRO Contract and the Custodial Contract are ongoing. The timing and outcome of the USPS and DOJ investigations of the MRO Contract and the Custodial Contract are uncertain and could include settlement or civil litigation by the USPS and DOJ to recover, among other amounts, treble damages and penalties under the False Claims Act. Due to the uncertainties surrounding these matters, an estimate of possible loss cannot be determined. While these matters are not expected to have a material adverse effect on the Company's financial position, an unfavorable resolution could result in significant payments by the Company. The Company continues to believe that it has complied with each of the MRO Contract and the Custodial Contract in all material respects.
Similar statements were provided in Grainger’s Q1 and Q2 10-Q reports to the SEC. The Q3 10-Q report added the following details—
Following this mediation with representatives of the DOJ, the Company reached a settlement in principle with the DOJ relating to the Company's disclosure obligations and pricing provisions of the GSA and USPS contracts. Under the terms of the proposed settlement, the Company agreed to pay $70.0 million to resolve the parties' dispute (other than with respect to certain alleged claims regarding tax, freight and billing errors that the Company does not believe will require it to make any material additional payments and for which the Company estimates its liability to be approximately $6.0 million). Accordingly, the Company recorded a $76.0 million liability which is included in Accrued expenses at September 30, 2012. The proposed settlement, which does not contain any admission of wrongdoing by the Company, remains subject to approval by authorized officials of the DOJ and the negotiation of a definitive settlement agreement.
We were struck by the statements in the 2011 annual report and the 2012 Q1 and Q2 quarterly reports that the possible litigation liability could not be estimated and thus no provision had been recorded. Despite the fact that the liability could not be estimated, the company told investors that it did not expect the resolution to have a “material adverse effect on the Company’s financial position.”
Yeah, right. The liability could not be estimated, because the company’s executive management team didn’t want to estimate it. They didn’t want to estimate it, because the potential liability was so freaking large. That farce continued for nine months, until the company finally got around to recording the liability in its Q3 (unaudited) financial statements. And the company auditors, Ernst & Young, LLC, accepted that delay, thus leading to earnings that were significantly overstated for a period of nine months—since the $76 million accrual represented roughly ten percent of annual earnings.
One wonders whether the auditors of Ernst & Young, LLC, had the experience and knowledge of Federal contracting matters to properly evaluate whether Grainger should have recorded its litigation liability in 2011, rather than waiting for nine months to do so. Since the Apogee Consulting, Inc. Principal Consultant used to work for EY, we think we know the answer. The answer is that EY very likely treated Grainger like a commercial business instead of as a Government contractor, and they very likely assigned an audit team to Grainger who had little (if any) expertise in Government contracting matters. Thus, we strongly suspect the auditors had no ability to evaluate the potential liability that Grainger was facing.
Like Grainger’s executive management team, the company’s auditors very likely had no clue about the special risks associated with selling to the Federal government. And no clue about whether or not the company was deploying sufficient internal controls and compliance procedures to mitigate those risks.
In fairness, there is nothing that absolutely requires the auditors to be able to assess government contracting risks. Their Sarbanes-Oxley (SOX) work focuses on financial reporting and disclosure risks, and not on the more esoteric risks associated with regulatory compliance. On the other hand, the big audit firms have experts to evaluate income tax provisions; one wonders why they don’t have similar experts to evaluate legal and litigation provisions. One wonders why they don’t use their government contract cost accounting experts to assist their audit clients in performing robust risk analyses.
Had Grainger and/or its auditors performed a robust risk analysis, we think it would have been readily apparent that the company’s contracts with the GSA and USPS were extremely risky.
What do we mean? Let’s look at this statement from Grainger’s FY 2011 10-K filing:
The business has a sales force of almost 2,700 professionals who help businesses and institutions select the right products to find immediate solutions to maintenance problems and to reduce operating expenses and improve cash flows. The sales force increased over the prior year with the majority of the new sales representatives focused on acquiring additional business from existing medium-sized customers as well as acquiring new business across the United States.
We already told you that Grainger processed roughly 105,000 transactions each day for nearly 2 million customers each year. It had a sales force of 2,700 individuals, processing transactions through multiple channels. How in the world was it going to ever accurately disclose its commercial pricing practices, as required by its Federal contracts? How in the world was Grainger ever going to provide assurance that it was complying with the contracts’ price reductions clauses?
The fact of the matter is that Grainger should never, ever, have entered into those contracts. It was virtually impossible for it to comply with contractual requirements. We don’t have to know much about the company—and its centralized business support functions—to reach that conclusion.
And nobody had to be a subject matter expert to predict that the combination of commercial mind-set with the multiple sales channels and gigantic sales workforce was going to lead to a problem in contract compliance. Thus: the inevitable DOJ press release. It said (in part)—
Today’s settlement resolves issues discovered during a GSA post-award audit of Grainger’s MAS contract. The GSA Office of Inspector General learned that Grainger failed to meet its contractual obligations to provide the GSA with current, accurate and complete information about its commercial sales practices, including discounts afforded to other customers. As a result, government customers purchasing items under the Grainger MAS contract paid higher prices than they should have.
In addition, today’s settlement resolves allegations that Grainger failed to meet its contractual obligations to provide “most-favored customer” pricing under two USPS contracts for sanitation and maintenance supplies. The USPS contracts required Grainger to treat USPS as Grainger’s ‘most-favored customer’ by ensuring that USPS received the best overall discount that Grainger offered to any of its commercial customers. Agents and auditors from the USPS Office of Inspector General (OIG) investigated Grainger’s pricing practices and discovered that Grainger did not consistently adhere to this requirement, causing USPS to pay more than it should have for purchases made under the two contracts.
Yeah, big surprise, that.
Where was the corporate risk analysis? Where were the mitigation controls and procedures? And where were the auditors? Indeed, this is a great example of a blown risk analysis by a commercial dabbler in government contracting.
A Failure to Implement the Corrective Action Plan
In the still relatively new compliance environment established by the DFARS Business Systems Administration clause, it has become clear that the Corrective Action Plan (CAP) is the key to minimizing—or avoiding—payment withholds. According to what was stated at a joint DCAA/DCMA industry briefing, if the contractor submits an adequate CAP at the time of the Contracting Officer Initial Determination of an inadequate business system, then it can immediately reduce the prospective payment withhold from five to two percent—mitigating what would otherwise be a significant cash flow impact! Moreover, even if the CAP is submitted after payment withholds have already been implemented, then the contracting officer “will—not may” immediately reduce the withhold percentage.
So the question naturally arises, what does an “adequate” CAP look like?
Well, according to that same industry briefing—
An adequate CAP must include discrete and measurable actions with realistic due dates and an explanation of how the corrective action plan will be monitored. The Contractor should notify CO [Contracting Officer] when the entity believes that the identified deficiencies have been corrected. The CO, with input from auditor/functional specialist, will determine whether all corrective actions have been completed, or whether there is a reasonable expectation (based on the evidence presented) to believe that the deficiencies have been corrected. If so, then the CO will approve the system and release the payment withholds
But woe to the contractor that submits a “smoke and mirrors” CAP, and then fails to achieve its planned milestones on time. That same briefing stated—
The DCMA CO, in consultation with auditor or functional specialist, will monitor the contractor’s progress on the CAP. If the CO determines that the contractor is not making adequate progress, then the payment withhold will be increased.
It’s not good news when a Contracting Officer tells you that you have an inadequate business system and your cash flow is going to be reduced until you show that you’ve corrected your “significant deficiencies”. But it’s even worse news when you’ve convinced the Contracting Officer that you’ve got a decent CAP, and there’s light at the end of the tunnel—only to then blow it by failing to make progress in achieving the promised milestones. Your cash flow will take another hit. And your credibility (and, we imagine, any sympathy) has just gone right out the window. Good luck convincing the CO that you’ve completed your corrective actions.
So we wonder what the penalty might be for a Government agency that identifies corrective actions in response to an agency Inspector General report … and then fails to execute those corrective actions within the promised schedule. There’s no cash flow to reduce. There’s no way to hold the leaders responsible for their lack of action. It seems as if everybody agrees to forget about the agreed-upon actions and just continue with “business as usual.” The auditors pretend they never issued their report with its findings, and the Government agency pretends it never agreed to implement corrective actions to address those findings. And nobody seems to care a whit.
But what if the Government agency in question is the Defense Contract Audit Agency?
What if the DOD Inspector General conducted an audit, had some findings, and submitted some recommended corrective actions? What if DCAA agreed with those findings and those recommended corrective actions? What if DCAA established due dates for implementing those corrective actions, and then missed them … by more than a year? What then?
Well, then nothing. Apparently, there are no repercussions whatsoever when DCAA misses its agreed-upon corrective action milestones to address DOD IG findings. The DOD Inspector General says nothing. The DCAA Director says nothing. And nobody seems to care a whit.
Oh, wait. We know somebody who cares: the auditors who are awaiting the agreed-upon policy changes care. They care because they are trying to comply with Generally Accepted Government Auditing Standards (GAGAS), and they’re worried that the lack of policy guidance out of Fort Belvoir is going to take them into a GAGAS noncompliance.
We know this is true, because at least one self-identified DCAA auditor brought the matter to our attention. (Note: we have no means to verify that people who send us emails are who they claim to be.) In truth, this issue had been in the back of our mind for a while. It’s not like we weren’t aware of the agreed-upon corrective actions … but we had forgotten how much time had passed without the agreed-upon policy changes.
So now we get to write about it.
You remember the issue right? We discussed it right here.
In that article (link above) we discussed the DOD IG findings contained in audit report D-2011-6-011. The audit report identified inconsistencies in DCAA’s policy regarding “currency” of audit testing. In fact, the audit report identified that DCAA had no such policy—which is why the Inspector General concluded that DCAA’s auditors were “uncertain” when evidentiary data supporting audits of contractor business systems was too old to rely upon. Consequently, DCAA audit reports regarding the adequacy of contractor business systems could "be delayed because of retesting.”
The DOD IG wrote “GAGAS 6.04b requires the auditor to obtain sufficient and appropriate evidence to provide a reasonable basis for the conclusion that is expressed in the report. The evidence provided in the report is more helpful if it is current.” Accordingly, the audit report recommended that DCAA implement policy guidance to ensure DCAA auditors were compliant with GAGAS.
The DOD IG wrote—
We recommend that DCAA Headquarters develop written agency-wide policy and guidance on the need to test current data to support opinions on the contractor’s internal controls and business systems. The policy and guidance should include criteria when the auditor should expand testing and perform additional work.
DCAA concurred with the findings and the recommended corrective action. In fact, it was Director Patrick Fitzgerald who concurred, on behalf of his agency.
The DOD IG audit report stated—
By November 2011, DCAA will issue guidance, which will include the requirement for auditors to (i) perform sufficient testing of data that is relevant to the audit objectives, including the period or point in time covered by the report, (ii) perform testing of data generated by the system throughout the period under audit, and (iii) issue timely audit reports. For audits of contractor business systems, DCAA will perform compliance attestation engagements and report on the contractor’s compliance during a period of time or as of a point in time, consistent with the applicable attestation reporting standards (AT 601.55b) in AICPA’s Statements on Standards for Attestation Engagements. Circumstances where auditors would need to expand testing to obtain sufficient evidence for the conclusions expressed in the report should be limited since the transactions being evaluated in the audit will coincide with the defined period covered by the audit. DCAA agrees with the guidance in GAGAS A8.02g, that the evidence provided in the report is more helpful if it is current and, therefore, timely issuance of the report is an important reporting goal for auditors.
Note that the corrective action was due to have been completed by not later than November, 2011. That was more than one year ago as this article is being written. And so far DCAA has not generated the agreed-upon policy guidance to its auditors.
Why is DCAA blowing its CAP? Well, one self-identified DCAA auditor had this to say about the situation—
One reason and I think it is the [paramount] reason for no MRD is the number of DCAA audit assignments that would either have to be cancelled or have to be reworked. In my office there are over 40 assignments that are from the 2008-2010 time frame that are open and no one has worked on [them] for years. So most of them would have to be cancelled as their relevance has now dissipated. So [multiply] our 40 by another 100 DCAA [FAOs] and you would see [four] thousand audits [that] would need to be cancelled and a couple million taxpayer dollars down the drain.
So there you go. How many audit assignments would get cancelled if DCAA HQ issued the agreed-upon audit guidance? How many audit assignments would be delayed past the applicable statute of limitations? How many audit findings and how many questioned dollars would be thrown out of court when the auditor testified that his or her testing failed to comply with GAGAS, as interpreted by DCAA?
So perhaps that’s why DCAA has chosen to forget about its Corrective Action Plan. And there have been no repercussions. The DOD Inspector General has said nothing. The Director of DCAA has said nothing. And nobody seems to care a whit.
But the auditors remember. And they care.
|
Starting 2013 with a Look at 2012
For the first couple of years this site was active, we always started off the New Year with an open letter to the Director of the Defense Contract Audit Agency (DCAA). But that was just a stunt; we never actually believed that the Director would have either the time or inclination to read our letter. And even if he did (by some miracle) read our letter, it never seemed to make any difference. So we discontinued that practice.
Even so, we still like to start off a New Year with something special. It’s a hopeful time and we like to offer some hopeful thoughts to those fellow government contracting enthusiasts who read this blog. This year, we wanted to start off by looking back at the past twelve months’ worth of events, to see if they might foretell something about the next twelve months to come.
The first thing that stands out about 2012 is that many people woke up to the fact that DCAA had mismanaged itself into a corner. In responding to 2008 and 2009 Government Accountability Office (GAO) findings that too many of its audits were of poor quality, and to the “expiration” of its externally reviewed quality control system, the audit agency seemed to go out of its way to create a culture that emphasized work paper documentation at the expense of actually issuing audit reports. Auditors spent so much time performing risk assessments and documenting the files in preparation for one internal review after another—and then re-performing work and preparing additional file documentation in response to review “notes”—that the productivity of the entire agency fell like a boulder falling off a cliff.
Audit quality actually may have improved. We don’t think so but, then again, we don’t see every audit report. However, even if audit quality did improve, timeliness crashed and burned. The backlog of audits has grown over the past four years, and is now at the point that it’s nearly unimaginably large. And that fact got noticed in 2012.
The Defense Department—led primarily by the Honorable Shay Assad—took action to try to help DCAA with its audit backlog problem. The assistance did not come in the form of helping the audit agency reform its management approach or in the form of helping the auditors figure out how to audit faster while maintaining audit quality. Instead, the assistance came in the form of shifting the workload away from DCAA and permitting DCAA to waive certain audits that it normally would have had to perform.
We didn’t think very highly of that bureaucratic maneuver. And we were not alone in that regard.
DOD’s internal Procedures, Guidance, and Instructions (PGI) document was revised to reduce DCAA’s involvement in audits of contractor proposals submitted in hopes of receiving new contract awards. As the DOD Inspector General noted, this change had the effect of shifting the proposal analysis workload from DCAA to the Defense Contract Management Agency (DCMA)—who by all accounts was ill-prepared to accept it (having had its own mismanagement crisis that led to the “loss of critical skill sets” in relevant areas). Moreover, as the DOD IG reported, DCAA’s own back-tracking on the officially approved PGI revisions led to a situation where significantly less audit hours were saved than had been initially estimated.
In addition, DCAA implemented a new “risk-based” approach to the audits of contractor annual proposals to establish final billing rates (inaccurately called by DCAA “incurred cost proposals”). This new approach stratified the contractor proposals by auditable dollar value (ADV). Lower ADV proposals were subjected to a “risk assessment,” and those proposals found to be “low risk” would have a significantly reduced chance of being audited … ever.
We’ll repeat that: If a contractor’s proposal was both low ADV and low risk, it might not ever be audited by DCAA, and then it would be up to DCMA to negotiate final billing rates without the benefit of an audit report.
This was a huge sea change in DCAA’s audit approach. Formerly, the contractor “final incurred cost proposal” was the primary means by which DCAA audited a contractor’s indirect costs for allowability, allocability, and reasonableness. (Which is redundant, because in order for a cost to be allowable it must also be allocable and reasonable … but we digress.) Even today, the multiple “mandatory annual audit requirements” that DCAA imposes on itself are tied to performance of the “10100” audit of a contractor’s proposal to establish final billing rates. So DCAA’s decision to not perform a certain (unknown) percentage of its audit backlog in this area is a game-changing management decision. It’s so significant that everybody—including GAO—is awaiting the results.
So the big news of 2012 was that DCAA had a ginormous audit backlog, and was going to reduce that backlog by choosing not to perform certain audits that it had formerly considered to be mission essential. It also created “virtual incurred cost audit teams” and shifted workloads internally, between Field Audit Offices (FAOs), so that it could focus on whittling down the huge backlog that still remained even after its policy changes.
Will the 2012 policy changes affect 2013? We’re not confident that they will. We believe that DCAA’s problems are too intractable and that they will continue to persist. Let us offer some observations in support of that belief:
We noticed that the most recent DOD Inspector General Semi-Annual Report to Congress told lawmakers that DCAA had issued a paltry 22 post-award “defective pricing” audits in the past six months. Twenty-two. Across the entire audit agency. And we noticed that the implementation of the still new DFARS “business system definition and administration” oversight regime has been limited to only the very largest defense contractors at this point. And we haven’t seen very many CAS compliance audits for a while. And DCAA still has to review Disclosure Statements for adequacy sooner or later. And those timekeeping “floorcheck” audits aren’t going to perform themselves.
Just to mention a couple of audit areas that DCAA still considers to be mission essential (as of this date).
Accordingly, we think the backlog of unperformed audits is still there, waiting like the elephant in the room, as soon as Congress picks itself up from the bottom of the fiscal cliff it’s just about to run over as we write this. And if Sequestration has the cataclysmic effect predicted by many doomsayers, then DCAA is going to have a backlog of Termination Settlement Proposal audits to add to its already fantastically large pile of unperformed audits.
Sooner or later, somebody on The Mall is going to notice what’s happening—and perhaps more importantly what’s not happening—at DCAA. And then, we predict, the grilling that Mr. Fitzgerald will receive is going to make the grilling that Ms. Stephenson got before Senator McCaskill look tame in comparison.
Many critics like to point out problems without offering solutions. That ain’t us. We used to write an open letter to the DCAA Director each year, offering what we thought were practical, constructive, solutions. In addition, we frequently offer suggestions for improvement of Defense oversight on this site. So far, nobody in Fort Belvoir or in the Pentagon seems to be listening.
Which is fine.
We are perhaps a lone voice in the wilderness. Or perhaps we’re that little boy in the crowd, shouting that the Emperor has no clothes. In either case, we say what we mean, and we mean what we say. The truth is out there, whether or not those in power wish to hear it.
For our readership, we intend to continue telling the truth throughout 2013. To our readers, we wish you a Happy New Year.
Questioning Questioned Costs
As we’ve reported before, the number one metric by which DCAA measures its effectiveness as an audit agency is the amount of “questioned costs” that its audits generate. To be clear, DCAA does not often disallow costs on its own. Instead, it “questions” costs in an audit report that’s addressed to a customer (typically a DCMA contracting officer), and then it’s up to that customer to officially disposition the audit findings—including disallowing questioned costs when warranted. The ratio of contracting officer-disallowed costs to DCAA’s questioned costs is called the “sustention rate”. The higher the sustention rate, the more it can be said that the customer agreed with the audit findings.
Many observers disagree with DCAA’s management approach. They believe that it is not only the gross amount of questioned costs that should be measured, but that the sustention rate needs to be measured as well. For example, when DCAA told the DOD Inspector General that it “non-concurred” with IG findings that DCAA was leaving a quarter-billion dollars in questioned audit dollars on the table each year, it revealed that the sustention rate for those “forward pricing audits” was 41.8 percent. In other words, “in negotiations contracting officers are sustaining just over $4 for every $10 in DCAA questioned costs.”
Some people think that’s a pretty pathetic result—especially in the current contracting environment, where any DCMA contracting officer who disagrees with DCAA audit findings is likely to find him or herself before a Review Board, who will adjudicate the disagreement after reviewing a lengthy written package. Some people think that, in this environment, a sustention rate of 41.8 percent (i.e., where the customer disagrees with audit findings nearly 60 percent of the time) indicates some serious audit quality issues. Those audit quality issues are, of course, in addition to the well documented audit timeliness issues with which DCAA currently struggles.
Some might also assert that a sustention rate of just over 40 percent indicates that DCAA is padding its audit findings, and that the audit agency is questioning costs simply for the sake of questioning costs— knowing that the costs it questions will never be sustained. And it need not even be that intentional. If the auditors in the field thought that they were being measured solely on the basis of the amount of costs they questioned, then it would simply be human nature to want to question more costs, or to push the envelope regarding which costs should be questioned. We all want our bosses’ approval, and what better way to get it than to excel at the most important agency metric?
Yes, we understand that GAGAS—Generally Accepted Government Auditing Standards—should operate to ensure that audits are conducted with impartiality, independence, and objectivity. But you know what? Auditors are people too. People with all the human foibles endemic to any bureaucracy. You tell them that generating questioned costs is the most important thing in the world, and you are very likely to get questioned costs—lots and lots of them.
If you are a contractor, you should be concerned that DCAA’s recent penchant for generating lots and lots of questioned costs is going to put you in a tough position. You either agree with DCAA’s audit findings (thus eroding your profits), or you try to convince your cognizant federal agency official that DCAA is wrong. And if you can’t convince your CFAO to override DCAA, then you’ve got to pay up or litigate.
We thought we would look at some of the costs that DCAA is questioning these days, courtesy of the recently issued DOD Inspector General’s Semi-Annual Report to Congress, covering the six month period ending September 30, 2012. Appendix G of the Semi-Annual Report lists “Contract Audits with Significant Findings”. Here are some selected “significant findings” generated by DCAA from that Appendix G list.
-
Audit Report 02211-2006S10100001 was an audit of a corporate incurred cost proposal (i.e., a proposal to establish final billing rates) for the contractor’s FY 2006. (Note that the audit report was issued just a hair under the Contract Disputes Act’s six-year statute of limitations, in April, 2012.) DCAA questioned $33.3 million, including $24.8 million of “medical expenses due to ineligible dependents.” Our opinion on that particular issue is well documented on this blog.
-
Audit Report 02161-2011G10110001 was an audit of travel costs billed to a single Army contract. DCAA questioned $21.7 million—100% of all billed contract travel costs—because “the contractor did not obtain advance written approval for the travel as required by contract terms.” And yet—the customer apparently approved the invoices containing the travel costs; and (apparently) the customer received benefit from the contractor’s travel. (Can anybody say quantum meruit?)
-
Audit Report 02701-2006A10100003 was an audit of a contractor’s incurred cost proposal for the contractor’s FY 2006. (Again, note the timing; in this case, the audit report was issued July 31, 2012.) DCAA questioned $76.6 million, including $60.1 million of “direct material for which the contractor did not provide documentation of government inspection and acceptance and/or documentation demonstrating the material costs were based on competitive awards.” While we are of course unaware of the specific details of this contractor’s situation, we find it odd that government inspection and acceptance would be required for contractor-acquired material. Can’t contractors have their own receiving inspection and acceptance? Even so, one would think that the customer inspection and acceptance of the end product would have sufficed. And as for the notion that material costs must be based on competition in order to be allowable … we are concerned that DCAA’s position could have survived a supervisory review.
-
Audit Report 04911-2010J10100001 was an audit of a NASA contractor’s “final allocated direct cost report.” DCAA questioned $78.6 million, including $30.5 million in “questioned subcontract costs due to inadequate price competition, failure to evaluate cost overruns, and rework costs that should have been absorbed by the subcontractor.” In addition, DCAA questioned $20 million of health and dental insurance costs “because the contractor lacks adequate documentation and internal controls to verify eligibility.” Again with the ineligible dependents issue; notice how the lack of internal controls led to questioned costs. That’s a new twist, as far as we can tell.
-
Audit Report 04911-2006B10100001 was an audit of a contractor’s FY 2006 incurred cost proposal (issued September 19, 2012) in which DCAA questioned $58.2 million in claimed costs. Among the questioned costs were $21.6 million of “unauditable subcontract costs because the subcontractors are no longer in business and/or the records are unavailable.” Well. We think that if DCAA is going to delay performing its audits, it is hardly the contractor’s fault if the subcontractor went out of business in the meantime. (Can anybody say “laches”?) Further, DCAA questioned $2.9 million of “medical insurance costs due to lack of supporting documentation for the eligibility of claimed dependents.” Notice how DCAA has cleverly reversed the burden of proof there? Normally, in order to assert that a cost is unallowable, the government bears the burden of proof; in this case, DCAA has asserted that the contractor has the burden to prove that a cost is allowable. Wrong!
-
Audit Report 06271-2002A10100103 was an audit of a contractor’s FY 2002 incurred cost proposal—issued more than ten years after the contractor submitted its proposal. DCAA questioned $4.9 million in claimed subcontractor costs “which were not adequately supported with documentation to verify that services had been received.” Yes. What do you think the odds are that receiving documentation would be maintained for 10 years—more than double the time required by FAR 4.7? Is it reasonable for anybody to think that such minutiae could survive for a decade? We assert that it is not. Apparently, DCAA disagrees and thinks that 10 years is just the right amount of time to retain documents, despite what the FAR requires.
To be fair, we cherry-picked the audit findings reported above. There were a number of other findings that might well be legitimate, and which will likely save the taxpayers considerable sums of money. But the thing is—DCAA is obviously cherry-picking its findings, so we think turnabout is fair play here.
So if you agree with us that most, if not all, of the findings we reported above reek of auditors desperate to generate questioned costs at any price, then perhaps you’ll be better prepared the next time DCAA comes calling.
One final item, which we report with some trepidation. We have received a report that DCAA HQ is inflating the questioned costs reported by its auditors. It’s (allegedly) not enough that the auditors are reaching and pushing the envelope in order to generate loads of questioned costs; apparently HQ is piling additional costs on top of the auditors’ findings. HQ is (allegedly) doing this by counting as questioned costs items that the contractor has voluntarily withdrawn prior to the audit. Our sources say, “DCAA’s OWD group massages all the numbers at HQ … if only you could get them to show the public how much of our CQ is not found by DCAA [because] they are voluntary deletions [by the contractor].” In other words, the more the contractor complies with the FAR allowability requirements, the more questioned costs that DCAA reports as audit-generated taxpayer savings.
Now let’s just say this allegation is, as of this writing, unconfirmed by official sources. But if true, it would add a new level to our little discussion of DCAA’s number one management metric, would it not? One might perhaps believe that new heights in Kafkaesque management had been reached.
|
In typical melodramatic fashion we recently posted—
