Brace Yourself: GAO Slams DCAA for a Second Straight Year
As a result of last year's Government Accountability Office ("GAO") report (GAO-08-993T) detailing significant problems in Defense Contract Audit Agency (DCAA) audit quality at three locations in California, Congress asked GAO to (1) conduct a broad assessment of DCAA's management environment and audit quality assurance structure throughout all regions; (2) evaluate DCAA's corrective actions; (3) identify potential actions, including legislation, to improve DCAA's effectiveness and independence. As previewed in our August 10, 2009 Client Alert, GAO's review and conclusions are not pretty. GAO sharply criticizes virtually all aspects of DCAA's performance and recommends a complete policy and organizational overhaul.
In the short term, contractors should brace themselves for even greater issues in dealing with DCAA, less cooperation, and the further erosion of contracting officer authority. In the longer term, contractors should anticipate policy changes and legislation intended to overhaul DCAA and provide auditors with more authority and independence not only from contractors but also from all government personnel with a contract administration function, including the contracting officer. Contractors should begin to develop a strategy and plans to positively affect the major changes that will be coming to DCAA's organization and function.
On September 23, 2009, GAO issued a report entitled DCAA Audits, Widespread Problems with Audit Quality Require Significant Reform (GAO-09-468). GAO reviewed 69 individual audits, including 37 internal control audits and 32 "cost-related" (incurred cost, requests for equitable adjustment, overpayment, and paid voucher) audits. GAO found significant deficiencies in 65 of the audits and less serious failures to comply with generally accepted government auditing standards (GAGAS) in the remaining four. GAO concluded that there are "audit quality problems at DCAA offices nationwide, including compromise of auditor independence, insufficient audit testing, and inadequate planning and supervision." See Highlights of GAO-09-468. GAO also criticized DCAA�s management environment and quality assurance structure, which it found "were based on a production-oriented mission that put DCAA in the role of facilitating DOD contracting without also protecting the public interest." Id.
Among the specific findings most embarrassing to DCAA are the following:
- DCAA auditors spent 530 hours auditing a nonexistent billing system and reported adequate system controls.
- Supervisors directed audit staff to delete some audit documents, generate others, and in one case, copy the signature of a prior supervisor onto new documents making it appear that the prior supervisor had approved a revised risk assessment.
- DCAA promoted supervisors who were responsible for deficient audits identified in GAO’s 2008 review.
Equally embarrassing, in response to GAO’s review, DCAA rescinded 80 audit reports because “the audit evidence was outdated, insufficient, or inconsistent with reported conclusions and opinions and reliance on the reports for contracting decisions could pose a problem.”
GAO’s recommendations to DCAA will result in comprehensive changes to:
- Develop a risk-based contract audit approach that identifies resource requirements and focuses on performing quality audits that meet GAGAS.
- Establish a senior level position directly responsible for audit quality assurance.
- Establish a separate internal review organization to conduct critical internal inspector general functions, including performing periodic internal reviews and addressing DCAA hotline complaints.
- Review its current portfolio of audit and nonaudit services to determine if any should be transferred or reassigned to another DOD agency or terminated in order for DCAA to comply with GAGAS integrity, objectivity, and independence requirements.
- Consult with an expert on auditing standards and revise its audit policy to provide appropriate guidance on what constitutes sufficient testing to comply with GAGAS, and training on professional auditing standards. Update its Contract Audit Manual, as appropriate.
- Develop agency-wide training and detailed guidance on auditor independence, fraud risk, testing, supervision, judgment, documentation and reporting.
- Review and correct problems in quality assurance, serious audit deficiencies, and GAGAS noncompliance immediately through an independent review and annually thereafter.
- Establish policies and procedures to ensure that auditors are independent of DCAA employees who perform a DOD management function to eliminate internal conflicts of interest.
Even the DOD IG did not escape criticism. In a May 2007 report on DCAA’s quality control system, the DOD IG concluded that DCAA’s system of quality control was adequate. GAO disagrees, and recommends that the IG reconsider that opinion, and determine whether its report should be rescinded or modified. In short, GAO felt that the IG was improperly lenient in its review of DCAA’s quality control. DOD, the DOD IG, and DCAA generally agreed with GAO’s recommendations, concurring with all but two.
GAO also provides recommendations to Congress, which if accepted, would result in significantly greater power to DOD auditors:
- In the short term, as DCAA makes progress in correcting fundamental weaknesses that have impacted audit quality, Congress could consider enhancing DCAA reform efforts by enacting legislation to grant it protections and authorities similar to those embodied in the Inspector General Act.
- In the longer term, depending on the outcome of acquisition management reform initiatives under way and the success of DCAA management reforms, Congress could consider creating an independent, government-wide contract audit agency. Legislation to move DCAA should incorporate the protections and authorities similar to those embodied in the Inspector General Act, if these have not already been granted to DCAA.
Following the 2008 GAO report, DCAA issued new audit guidance that increased the number of findings of inadequate internal control systems and directed DCAA auditors to aggressively seek to compel production by contractors of information that the auditor deems relevant. In the guise of promoting “effectiveness” and “independence,” DCAA succeeded in creating needless disputes with contractors.
Upon review of DCAA’s corrective action after the 2008 Report, GAO concluded that “much more needs to be done.” Congressional reaction was much less restrained. After hearing GAO’s testimony on its findings, Homeland Security and Governmental Affairs Committee Chairman Joseph Lieberman was clearly frustrated with DOD and DCAA:
The Committee has run out of patience. Too much is on the line and the time for incremental changes is over. Each and every audit that GAO reviewed failed to meet auditing standards. That is not an aberration or a case of a few employees not knowing what to do. That indicates systemic issues within the agency. I expect strong leadership from the DOD so that our Committee will not be sitting here a year from now discussing the same old problems. We need to identify the root causes and get on to the solutions that the taxpayers demand and certainly deserve.
In light of this most recent report, contractors can expect action (and perhaps overreaction) not only from DCAA but also DOD and Congress. Most likely, DCAA’s audit guidance in response to last year’s report will appear tame compared to the changes that will result from this report.
A significant potential outcome is DCAA using Congressional interest to ask for the authority to interview contractor employees and expanded access to documents and data, including internal audit report and Sarbanes-Oxley information. DCAA has long sought these powers. Contractors (and contractor associations), therefore, should begin to develop a strategy on how to positively affect the inevitable and comprehensive policy and legislative changes. For example, contractors consider action and advocacy that limits DCAA’s audit function in the future to cost-related audits and transfers authority for review of internal controls to experts in other entities within DOD or outside the government. With a complete overhaul of DCAA on the horizon, contractors should position themselves to have a say in the form of DCAA that emerges.
DCAA’s focus on independence (which GAO believes includes independence not only from contractors but also government personnel performing contract administration functions) is likely to result in additional disputes and claims arising out of DCAA audits and an even more adversarial relationship between DCAA and contracting officers. Essentially, contractors should brace themselves for a wholesale assault on whatever cooperative relationship still exists with DCAA.Print PDF