DCAA Issues Guidance for Accounting System Audits Under Business Systems Rule
Recently issued Defense Contract Audit Agency guidance regarding contractor accounting system audits under the business systems rule represents the most detailed statement to date regarding how DCAA plans to incorporate the business systems rule into its audit program. The guidance, therefore, is highly relevant to government contractors that receive audit results under the business system rule and should be carefully considered if/when a contractor seeks to challenge DCAA findings of significant deficiencies.
One particularly noteworthy aspect of the DCAA guidance is its discussion relating to determining what constitutes a significant deficiency under the business system rule. Specifically, the guidance addresses how an auditor should assess whether a shortcoming in a contractor’s accounting system “materially affects” the ability of the government to rely upon information produced by that system, the core test for what constitutes a “significant deficiency.”
Under the business systems rule, contracting officers must institute withholdings against a contractor if the contracting officer determines a significant deficiency exists. To date, little formal guidance has been provided regarding how contracting officers should determine whether a shortcoming constitutes a significant deficiency. DCAA’s perspective and approach on resolving this question is made all the more important because, as many contractors can attest, contracting officers are often loath to disagree with DCAA.
The DCAA guidance notes, “[a] material noncompliance with any one of the 18 criteria [set forth in DFARS 252.242-7006] indicates a significant deficiency/material weakness exists and that the contractor has not complied in all material respects with the DFARS criteria.” (Emphasis original). The guidance goes on to note that auditors should consider “the likelihood that the identified noncompliance . . . will result in noncompliance with other applicable government contract laws and regulations (e.g., with FAR Subpart 31.2, CAS, or applicable requirements in FAR Part 15) and the magnitude of those potential other noncompliances” when determining whether a noncompliance is material. “If there is a reasonable possibility that the identified noncompliance with the DFARS criteria will result in a material noncompliance with other applicable government contract laws and regulations, either individually or in combination, it is a significant deficiency/material weakness.” (Emphasis original).
The DCAA guidance also highlights the following factors for auditors to consider when assessing the materiality of a noncompliance:
- The nature and frequency of the noncompliance with the DFARS criteria identified with appropriate consideration of sampling risk (i.e., the risk that the conclusion based on the sample is different than it would be had the entire population been tested).
- Whether the noncompliance with the DFARS criteria is material considering the nature of the compliance requirements.
- The root cause of the noncompliance. (Understanding why the noncompliance occurred will help to determine if it is systemic and significant.)
- The effect of compensating controls.
- The possible future consequences of the noncompliance with the DFARS criteria.
- Qualitative considerations, including the needs and expectations of the report’s users, contractor histories of noncompliance, and identifies of noncompliances with related laws and regulations.
The above factors, while not providing the level of detail necessary to ensure consistent and objective DCAA audits, will be helpful for contractors responding to DCAA determinations that a noncompliance is material. Specifically, these factors provide contractors with a roadmap of considerations to focus on when challenging a DCAA determination, which, to date, has been unavailable.
Other noteworthy aspects of the DCAA guidance include clarification that an actual monetary impact on the government is not necessary to demonstrate materiality of a weakness, description of the process through which DCAA will highlight business systems issues identified in non-business systems audits, and a brief discussion on business systems follow-up audits. The DCAA guidance is available at http://www.dcaa.mil/mmr/12-PAS-012.pdf.