DCAA Addresses Audit Timeliness
We recently posted an article largely critical of the Defense Contract Audit Agency.
Yeah. Big surprise.
We know. We get it. The bigger surprise would be if we wrote an article defending DCAA, telling readers that the audit agency was going good work. Well, all we can say is that we would write that article if DCAA merited praise.
You might be wondering whether we’ve ever posted an article about DCAA that wasn’t totally critical. Yes, we have. (Well, it wasn’t totally critical, from a certain relative point of view.) In that less-than-totally-critical article, we wrote—“But despite what you may hear about DCAA, at least we don’t have IG—or mainstream media—reports braying about defense auditors accepting gifts and going hunting with the defense contractors that they audit. So they’ve got that going for them….”
See, that was kind of not totally critical. So we are not entirely one-sided in our articles.
But yes, we mostly post articles that are critical of DCAA. Why? Because that’s the kind of article that the agency’s current guidance and audit output merits. Until we see both qualitative and quantitative improvement, we’ll continue to post articles that point out the agency’s many opportunities to make that improvement.
In our recent, critical, article, we posited that perhaps somebody (or bodies) was hearing the complaints—not only the ones posted here, but those posted elsewhere. Or perhaps it was the consistent tone of criticism heard in Congressional testimony. Or maybe it was the many industry surveys that reported the downward trends in the defense acquisition environment. We’ve told you about all of them.
The source doesn’t matter. What matters is that we think the message may be getting through.
The main piece of evidence we point to as support for our assertion is found in Section 805 of the FY2012 National Defense Authorization Act (NDAA). Section 805 of the NDAA requires the Director of DCAA to issue a new type of report to Congress, an annual report that will be in addition to the audit statistics reported by the DOD Inspector General in its Semi-Annual Report to Congress. The new DCAA annual report to Congress will include statistical tables depicting the following information—
-
The total number of audit reports completed and pending
-
The priority given to each type of audit
-
The length of time taken for each type of audit
-
The total dollar value of questioned costs (including a separate category for the dollar value of unsupported costs)
-
An assessment of the number and types of audits pending for a period longer than allowed pursuant to guidance of the Defense Contract Audit Agency
That kind of information could be very useful for those assessing DCAA’s management direction.
Perhaps in preparation for the upcoming statistical reporting, DCAA recently issued new audit guidance (MRD 12-PPS—005(R), dated February 24, 2012) that establishes metrics for issuing timely audits of “forward pricing assignments” (i.e., audits of contractor cost proposals). The MRD can be found on the DCAA website under “Open Audit Guidance.” The MRD states—
Effective immediately, we are revising our practices to require an agreed-to due date be established … for all forward pricing assignments …. We also are implementing a new performance measure to assess our progress in meeting agreed-to dates that audit teams establish. … This performance measure will help DCAA to continually improve our services and processes.
Readers may recall that one of the main criticisms of DCAA during the 2008/2009 “Oversight Wars” was that it was managing by metrics, and more concerned with producing reports than with their intrinsic quality. So why is DCAA moving back to a metric focused on timeliness? (Aside from the Congressional reporting requirement, that is.)
According to the MRD—
Our forward pricing audits play a critical role in the procurement process and failing to provide, as promised, could compromise the negotiation schedule or result in our valuable audit effort not being used to assist in the negotiation of a fair and reasonable price.
Well, yes. There is a reason that DOD has created a Director of Pricing position, and there is a reason that DCMA is creating lots of new databases of contractor price and indirect rate information. There is a reason that the DAR Council is trying to implement a Contractor Proposal Adequacy Checklist. There is a reason that Contracting Officer after Contracting Officer is bypassing DCAA “field pricing assistance” and choosing to negotiate prices without the “benefit” of a DCAA audit report.
The reason is that DCAA has chosen a path that leads to audit reports of dubious quality being issued far too late to benefit government negotiators.
The new timeliness tracking processes will affect more than audits of contractor cost proposals. According to the MRD, they will also affect audits of contractor Forward Pricing Rate Proposals and DCAA input into Cost Realism reviews. So in the spirit of “what gets measured gets improved,” we look forward to future improvement in those DCAA audit assignments.
But lest readers think this MRD marks the turning of a corner for DCAA, we need to share one cautionary note. At the end of the MRD we spotted the following verbiage—
Once DMIS contains sufficient data, the Agency will measure the percentage of time the Agency met our original agreed-to due date. DCAA will analyze the data to determine why dates are being met – that is, identifying best practices like milestone plans – or, identifying why dates are not being met – such as delays in obtaining contractor information. This will allow management the visibility needed to identify concerns and address the underlying issues to implement process improvements.
See that phrase we helpfully highlighted in italics for you? The part about delays in audit completion being caused by contractors not being responsive? Yeah, that. We’ve heard that before.
While we are certain that not all contractors are prepared for a rigorous GAGAS-compliant DCAA audit, and while we are sure that not all contractors are able to turn-around DCAA Requests for Information as quickly as everybody would like—we are similarly certain that the inability of DCAA to complete its audits in what any reasonable observer would consider to be a reasonable time is caused by its own approach to audits. From risk assessments that take months to year-long management reviews, and from an incorrect interpretation of GAGAS requirements to Internal Reference Reviews and an inappropriate focus on working paper documentation instead of the quality of auditor judgment, DCAA has chosen a path that has led it to this destination.
DCAA has made its choices and it needs to accept the consequences of those choices. The time for blaming contractors for the failings of the audit agency is long in the past.
As we said, we look forward to seeing real improvement in both audit quality and audit timeliness. When we see that improvement, we’ll tell you about it. We’ll write an article praising DCAA.
Until then, we’ll keep calling ‘em as we see ‘em.
Setbacks for Federal Law Enforcement
It would be easy to tuck into a large piece of Schadenfreude pie and bask in the misfortune of the Department of Justice. Depending on your point of view, two recent cases have highlighted either (a) problems with the underlying statutes that DOJ and the courts are trying to enforce, or (b) problems with DOJ’s overreaching and ill-advised attempts to catch wrong-doers and bring them to justice. One case addressed penalties under the False Claims Act (FCA) and the other concerned the Foreign Corrupt Practices Act (FCPA).
Both statutes have been discussed on this blog before. This article provided an overview of the FCPA, and this other article discussed how Congress was “adding teeth” to the statute. Further, we typed “False Claims” into the site search engine and 48 articles were listed involving some aspect of the FCA. Most of the articles have concerned settlements, fines, and other penalties associated with FCA violations, but not all—in one article, we reported that the U.S. Court of Appeals (D.C. Circuit) vacated and remanded a D.C. District Court judgment against SAIC, after finding the Government’s theories of corporate “collective knowledge” to be unpersuasive, and rejecting several of the government’s aggressive theories of damage quantification. The point is, if you have read this blog before, you should have a good layperson’s understanding of both statutes and how the government attempts to enforce them.
So you should have a good appreciation for the two cases we want to discuss today. In the first case, Bloomberg Businessweek reported that the DOJ moved to dismiss its indictments against 22 individuals accused of violating the FCPA, after failing to convict ten of them. The case was reportedly the largest prosecutions of individuals accused of FCPA violations as well as the first time the government used a sting operation “involving undercover techniques” to catch alleged FCPA violators.
According to the Bloomberg article—
‘I for one hope that this very long and very expensive ordeal will be a true learning experience for the department and the FBI as they regroup to investigate and prosecute FCPA cases against individuals’ U.S. District Judge Richard Leon said while granting the government’s request. He had earlier told prosecutors of his concerns about their ‘aggressive conspiracy theory’ of the case, he said.
The Bloomberg article also reported that—
The dismissal adds to courtroom setbacks for the government in FCPA cases. Last month, a federal judge in Texas acquitted a former manager at a Texas unit of Zurich-based ABB Ltd. who was accused of bribing Mexican officials. A related case was dismissed last year by a judge who said the jury verdict convicting two men at an electricity tower company of bribing Mexican officials was tainted by prosecutor misconduct in ‘a sloppy, incomplete and notably over-zealous investigation.’
According to the Bloomberg article—
The case stemmed from a three-year investigation involving an informant who had pleaded guilty in an earlier bribery case. Investigators recorded telephone calls and videotaped meetings with Federal Bureau of Investigation agents posing as representatives of Gabon, sub-Saharan Africa’s fifth-biggest oil producer.
The government said the defendants agreed to pay a $3 million commission for the business, half of which they were told would be paid to the country’s defense minister. …
The government’s case was put together through Richard Bistrong, a former executive from Armor Holdings Inc. He pleaded guilty in 2010 to bribing officials of the United Nations and the Netherlands to obtain contracts for body armor and pepper spray, according to court papers. He has yet to be sentenced.
Bistrong identified possible targets for the government, according to court papers. Working with the FBI, he recorded telephone and in-person meetings with the defendants. He also introduced them to Pascal Latour, an FBI agent posing as a representative for Gabon’s defense minister.
Bistrong, in testimony given during the second trial, admitted to having a cocaine addiction and to filing false tax returns and other crimes. Defense lawyers said the lead FBI agent shared cigars, gifts and meals with Bistrong, compromising the government’s investigation. The relationship was documented in text messages and e-mails shown to the jury.
In the second case, FCA penalties were found by a District Court Federal Judge to violate the U.S. Constitution’s prohibition on excessive penalties. Here’s an article that summarizes the case and the ruling. As the article reported—
[The defendant] submitted 9,136 invoices for payment under the fraudulently received contract, according to the court opinion. Pursuant to the False Claims Act’s penalty provision, the whistleblowers sought $5,500 to $11,000 in penalties for each of the invoices.
So the defendant was looking at paying somewhere in the neighborhood of $50 million to $100 million on conviction. The article noted—
[The Judge] compared the extent of the harm caused by [the defendant’s] conduct to the fine requested, finding that the economic harm felt by the government because of the price fixing was uncertain, and possibly insignificant. [The Judge] took care to base his decision on the fact that the government would not necessarily have received a better price for services but for [the defendant’s] price fixing conduct.
The same decision was discussed in more detail by the attorneys at Wiley Rein. They wrote—
… the Eastern District of Virginia denied any civil penalties under the False Claims Act (FCA), holding that even the minimum mandatory civil penalty was unconstitutionally excessive, in violation of the Eighth Amendment. … a jury found the defendants liable under the FCA for conspiring to fix prices of subcontracts and then falsely certifying that the pricing in their bids had been independently calculated. … the parties stipulated that the defendants filed 9,136 invoices under the contract at issue; thus, there were 9,136 potential false "claims." In theory, the FCA would require civil penalties amounting to between $50,248,000 and $100,496,000 for 9,136 false claims.
In the face of such a large penalty, Judge Anthony Trenga, who wrote the opinion, awarded no civil penalties because even the minimum penalty of $50 million would be unconstitutionally excessive. The court found no evidence that the defendants' actions caused the government any economic harm. Nothing supported the relator's contention that the government paid more for services or received deficient services because of the subcontract pricing conspiracy. In fact, the government had extended the contract twice. Additionally, the court found the defendants received only a limited benefit from their misconduct. The defendants only realized a $150,000 profit on $3.3 million worth of services. Among other key findings, the court determined that there was nothing in the language of the FCA suggesting an intent to impose a $50 million penalty in these circumstances. Thus, the court ruled that imposition of the minimum required fine under the FCA would result in disproportionally excessive fine in violation of the Eighth Amendment.
The Wiley Rein attorneys concluded—
Coming from a court in which government contract issues are frequently litigated, this decision may limit the government's ability to recover penalties that are disproportional to the harm caused by the defendants. For government contractors facing FCA allegations, especially in situations where the government received the full value of the contract, this decision could be quite important.
Compliance professionals often lose sleep worrying about compliance with FCA and FCPA. Although these two cases can be seen as victories for the defendants and losses for the prosecutors, we would not advise reducing risk assessments associated with these two statutes. As with all Federal prosecutions, the cost of winning is excessive, whether measured in terms of distractions to the executive team, in diversion of internal resources, or in payments to very expensive external attorneys.
Sure, these were two victories—but we think you’ll agree that they were pyrrhic victories.
|
The Defense Department and its Industrial Base: A Marriage of Convenience Headed for a Bitter Divorce?
From time to time we like to look at the partnership between the Pentagon and the defense industrial base that supports America’s national security policies. One doesn’t need to be a marriage counselor to recognize the recent signs of strain in that relationship. We’ve reported many times on pressures facing the two parties, be they political, budgetary, or operational. And it’s not like we only take one side: in fact, there’s plenty of blame to be spread around. Just like a marriage.
Let’s start with some neutral facts.
1. In this very recent article by the Washington Post, readers learned that “the number of new suppliers to the U.S. government fell 14 percent last year even as the Obama administration sought to increase competition in contracting.” This was noted as a bad thing, since reduced competition might lead to the DOD paying higher prices. What factors contributed to the decline? Two factors that were mentioned were (a) budgetary pressures, and (b) burdensome Federal rules and regulations. The Post reported—
Working with the government presents challenges for small businesses not accustomed to the process, said Jake Ross, a retired Navy captain and partner at Maritime Security Strategies in Tampa, Fla. His company, a service-disabled veteran-owned firm, last year won its first federal contract, a $29 million deal to build a patrol boat for the Navy.
‘I kick myself every day,’ Ross said in an interview. ‘You think you’ve crossed one challenge and, by golly, you’ve got a new one the next day. The rules and regulations for government contractors do create significant barriers.’
2. The GAO issued a report evaluating DOD’s use of competition for acquiring services. In that report, GAO found that the most common rationale for lack of competition was “only one responsible source”—meaning that no other contractor was qualified to provide the services being sought. GAO reported—
… program officials can influence competition by expressing vendor preferences, planning acquisitions poorly, or specifying overly restrictive requirements. Unanticipated events such as bid protests or unforeseen requirements with time frames that preclude competition can also impact competition.
3. Recently, industry associations met with the Director, Defense Procurement and Acquisition Policy (DPAP) and his staff for a regularly scheduled “cross-talk”. Notes from one participant at that meeting reported—
[DPAP] was asked about the relationship between the industry and the Department. The … agenda noted that the relationship undergone broad fluctuations in the past few years – Mr. Kendall’s remark that DoD is not in a partnership with industry that [was] endorsed and supported by Messers Assad and Ginman at the 2011 Defense Procurement Conference is considered to be illustrative of what appeared to be a distancing of the two institutions. [DPAP] chose to view the question as a criticism of the quantity and quality of communication between industry and government. While [DPAP] acknowledged that industry and DoD share many of the same goals, [DPAP] said that he views an arm’s length relationship when negotiating contracts to be a necessity. …
The final question from industry to DPAP sought to get [DPAP’s] views on the big picture tradeoffs between individual regulations (business systems, changes to Part 15 that require negotiations for single bid procurements, etc.). The question referred to an increased emphasis on competition and only alluded to the increased emphasis on low price. When that clarification was made [DPAP] made a defense of the need for reliable business systems, and more insight into proposed prices. He was asked if attention was paid to the aggregate time and effort to respond to ever increasing requests for more perfect information. He responded by defending the merits of the individual policies.
Those are the facts, and just the facts. Based on those facts, how would you assess the relationship between the Defense Department and its industrial base?
We think it’s a shame that the Pentagon has, in the past decade or so, moved away from its self-acknowledged “partnership” with its contractors. In that same time, we have seen more and more that the DOD is reliant on its contractors—and not just the designers and producers of major weapon systems, either. From support to contingency operations to environmental clean-up, and from acquisition support services to creators of the highest-tech satellite sensors, it is contractors who get the job done—and not the so-called “leaders” of the Department of Defense. As the Pentagon has come to rely more and more on its contractors, we have seen a seeming backlash brewing—resentment perhaps based on the awareness that nothing can get done without the contractors.
And thus it is the contractors’ job to take the brunt of criticism pointed at the DOD. When the Commission on Wartime Contracting criticized DOD’s (mis)management of contractors, it was naturally the contractors themselves who had to defend their actions. When GAO (and DOD IG) criticized DCAA’s lack of audit quality, the audit agency pointed at the contractors and their “lack of responsiveness” as the primary reason for audit problems. And when former Secretary of Defense Gates called for a leaning-out of a bloated Pentagon bureaucracy, it didn’t take long for those same bureaucrats to evolve that direction into a “better buying power initiative” designed to lower the prices it paid to its contractors.
Since the end of World War II, America has struggled to accept the role of its military. In the past 60 years, we have seen returning service men and women given parades, and spit upon in hatred. During that same time, we have seen the Pentagon struggle to define its relationship with its contractors. Sometimes the relationship is defined as a “partnership” and other times, such as today, it is defined in more “arm’s-length” terms.
If the DOD and its industrial base were in a marriage, we think it would be fair to say that we are long past the honeymoon phase. We think the current relationship might be fairly characterized as a “separation.”
The funny thing is, as DOD shops around for a new partner with whom to commit, calling it a renewed emphasis on competition, it is seemingly learning that it has built up quite a bit of baggage over the past decade or so—baggage, in the form of onerous rules and regulations, that make it hard to attract a new mate.
Maybe the Pentagon’s current relationship is not as bad as it thinks? Maybe DOD needs to recommit to its existing contractor/partners?
If only there was a therapist with the power to get the parties together in one room, for some heart-to-heart sharing….
UPDATE: SAIC CityTime FUBAR Results in $500 Million Settlement
We have not heretofore commented on the loss of the control codes for the International Space Station (ISS). You may already know that somebody stole an unencrypted NASA laptop and thus gained possession of the “algorithms” used to control the ISS. It occurred to more than one person that such an incident would be a great start to an action movie, perhaps starring Tom Cruise, George Clooney, or Matt Damon—but unfortunately it was all too real. Proving once again that life is stranger than Hollywood can dream up, NASA had to accept that some person or persons unknown was in possession of the codes used to control the ISS.
That particular incident is only one of the 48 NASA laptops or mobile devices stolen from the Space Agency between 2009 and 2011, according to Congressional testimony by the NASA Inspector General. According to the NASA IG, data lost in these thefts included “export-controlled, Personally Identifiable Information, and third-party intellectual property.” Yet despite the ongoing risk posed by data loss, to date only one percent of NASA laptops and other mobile devices have been encrypted.
In this PCWorld article, the author explored some of the implications from unencrypted devices. He wrote—
Lost laptops and lost mobile phones have long topped the list as the biggest nightmare for security chiefs and PR teams (see this Laptop Losers Hall of Shame for some older cringe-worthy stories). Why does encryption continue to pose such a big business challenge?
NASA offers a good example. It doesn’t have an agency-wide data encryption system or solution. Individuals can encrypt a laptop at the file, folder, or drive level, but that could leave too much room for error or leave too much up to user discretion. A centralized, managed encryption solution for your whole fleet of mobile devices is a better idea, but obviously may involve more costly enterprise resources. Implementing such a system across a chain of command, with lots of people and systems involved, no doubt requires a lot of planning and commitment.
Considering that the average value of an individual lost laptop has been computed as more than $49,000, however, making sure each laptop is encrypted before it leaves the room with sensitive data on it is probably well worth the investment.
Readers of this blog already know about our position on this particular issue, thanks to Science Applications International Corporation (SAIC) and a stolen unencrypted laptop full of the personal information of 4.9 million TRICARE participants. Yes, you read that correctly: SAIC lost the personal information of 4.9 million TRICARE beneficiaries. As we reported—
So, let’s see now. We were at about $36 million or so. Plus $4.9 billion in potential legal damages. Plus $147 million in credit monitoring services. Hey SAIC, might want to rein in those rogue employees of yours. You know, the ones who can’t be bothered to encrypt their laptop hard drives?
That wasn’t our only article about SAIC. We also told you about the company’s problems with New York City. As we reported, SAIC faced troubling allegations regarding its “City Time” project, including receipt of kick-backs from a subcontractor and timekeeping irregularities by SAIC’s project manager. Between the City Time and the TRICARE legal hassles, we figured that SAIC had a full plate of problems with which to deal.
Well, SAIC is back in the news, and we have some updates on those two stories to share with our readers.
On March 14, 2012, Bloomberg Businessweek reported that SAIC “agreed to pay $500.4 million under a deferred prosecution agreement to resolve claims that it conspired to defraud” New York City with respect to the City Time project. The article stated—
SAIC admitted it failed to investigate claims that a manager of the CityTime payroll project directed staffing tasks to a single subcontractor, Technodyne LLC, in exchange for kickbacks, according to documents unsealed today by federal prosecutors. The McLean, Virginia-based company also failed to notify the city of the claims …
The city was billed about $690 million for SAIC to create a now-operational Web-based, time-keeping payroll management system … Payments to Technodyne ballooned to $325 million from $17 million, even as the contract was amended to transfer cost overruns to the city, according to a statement of responsibility submitted by SAIC.
Bloomberg also reported that—
SAIC agreed to the filing of one count of conspiracy to commit wire fraud and agreed to disgorge proceeds of the offense, including $370.4 million in restitution to the city and a $130 million penalty, according to a Justice Department letter describing the settlement. An independent monitor will be appointed to ensure compliance with the accord and with procurement policies.
If SAIC pays the money and cooperates with federal investigators, the U.S. will seek to have the charges dropped after three years, according to the agreement.
‘Those responsible for directly managing the project failed to enforce the company’s procurement policies in ways that allowed the irregular Technodyne relationship to continue,’ according to the company’s statement of responsibility. …
The project manager, Gerard Denault, was arrested in May and charged with fraud and conspiracy. His case is pending. … Prosecutors have charged 11 defendants plus Technodyne. One died, two pleaded guilty, and eight cases are pending ….
The bottom-line, as reported by Bloomberg is that “the $500 million [settlement] represents the ‘largest by dollar amount arising out of any state or government contract fraud in history’….”
Oh, but that’s not all. Remember SAIC’s stolen TRICARE laptop? Well, according to this Nextgov story, some of the TRICARE beneficiaries have “discovered bogus charges on their credit card statements and unauthorized bank transactions.” The Nextgov article provided details, gleaned from one of the pending suits against SAIC, regarding the problems experienced by several people. The article reported—
The amended complaint said TRICARE beneficiaries had to take extensive steps to protect their financial information.
The plaintiffs ‘had to cancel credit cards and close bank accounts; open new credit cards and bank accounts; stop direct deposits to those compromised accounts and re-enroll in direct deposits for new accounts; stop recurring electronic payments from compromised accounts and re-enroll in electronic payments through new accounts; and otherwise spend time and money in mitigation responding to notifications following the wrongful disclosure that certain financial accounts have been compromised,’ the complaint said.
Dr. Deborah Peel, founder of the Patient Privacy Rights Advocacy Group in Austin, Texas, said unwanted marketing, credit card cancellation, and identity theft are typical and expected when sensitive, richly detailed personal health data is breached. It could take years to discover the repercussions of stolen medical information, she said.
Interestingly, the story also noted that the amended complaint alleged that the theft of the TRICARE data may not have been a random act. Nextgov reported—
The new complaint alleges that the theft was targeted. The SAIC employee's car, a 2003 Honda Civic, was parked in a garage that housed many luxury cars, ‘yet the thief or thieves, who went to great effort to avoid security, did not break into any of the luxury cars in the garage, targeting instead the relatively inexpensive car containing the confidential data.’
The complaint added, ‘The thief or thieves stealthily broke into the employee's Honda Civic and took the unencrypted backup tapes and records, thereby gaining information worth billions of dollars. The nature of this theft supports the logical inference that the thief or thieves were specifically targeting the confidential information contained on the backup tapes and records.’
The Nextgov story also noted that SAIC is currently facing eight separate lawsuits related to the data loss.
How much more can we add to the facts of the two stories? We here at Apogee Consulting, Inc. frequently urge our readers to invest in their internal controls, calling it cheap when compared to the full cost of non-compliance. How much clearer can the math be? In SAIC’s case, one single state/local project led to a $500 million settlement, and one single failure to secure client data has led to eight separate lawsuits and a potential legal liability of more than $5 billion. How much more can one corporation, no matter how large, afford? At what point does the Board of Directors—or the shareholders—start to lose confidence in the executive leadership team?
Remember, SAIC only recently became a publicly traded company. From its founding in 1969 through 2005, it was an employee-owned company. By its own description—
… SAIC had become a company of entrepreneurs. ‘Not just one or two at the top,’ says [Founder Bob] Beyster. ‘A company in which those who are motivated and capable can organize, manage, and assume the risk of different aspects of the company. In return they received not only salary, but ownership of the company.’
The thing is, the SAIC of today isn’t the SAIC of 1969 or even 1999. It’s a publicly traded company with responsibilities to its shareholders. We wonder if perhaps it’s time, or even past time, for the company to consider changing its entrepreneurial culture and move toward a more centralized command-and-control structure—one that might act to mitigate some of the corporate risks that do not seem to be fully managed by its employees.
|
