DoD Proposed Rule for Business Systems
Impact on Interaction between DCMA, DCAA, and the Government Contracting Community
Norman McCord, CPA, MSA
Senior Manager, Capital Edge Consulting
Background and Status
During 2009, the Commission on Wartime Contracting (CWC) held hearings because it was concerned that perennially inadequate contractor business systems could result in significant fraud, waste and abuse in Government contracting. The CWC concluded that significant contributing factors included DCMA’s history of frequently ignoring DCAA reports which found contractor business systems to be unacceptable; and significant instances where DCAA’s audit effort and reported results of audit were not adequate to fully understand the underlying reasons for the inadequacies. The result was the decision by the DoD to revamp the regulations addressing the definition and administration of contractor business systems.
The DoD first published a proposed Business Systems rule change to the Defense Acquisition Regulations Supplement in January of 2010 (DFARS Case 2009-D038), with public comments due by March 10, 2010. A second proposed rule for the case was published in December 2010 responded to the comments, and in some cases modified the proposed rule as a result of the comments the DoD received. The intent of the proposed rule is to improve the Government’s oversight of contractor business systems by clarifying the definition and administration of those business systems. The jury is still out on whether DoD clarification of the administration of contractor business systems will be a success. The comments DoD received and addressed in the second proposed rule, and some scathing articles published by affected industry professionals, suggests some significant administrative and audit provisions remain problematic. Our comments in this article focus on two of the critical parts of the rule that we do not believe have been adequately addressed; and which present challenges for contractors anticipating audits of their business systems. We will also offer our outlook on what to expect from a DCAA business systems audit, and some comments on how to prepare for the experience.
Assigning Responsibility for Determining Acceptability
The CWC concluded that DCMA frequently ignored DCAA reports indicating contractor business systems were unacceptable. However, it reconfirmed that, 1) DCAA’s role is advisory to the contracting officer, and that 2) DCMA has the sole authority to determine whether a business system is acceptable. The current proposed rule states in several passages that, “The cognizant contracting officer, in consultation with the auditor, shall…determine the acceptability…” So, what has changed? On the one hand, nothing has changed with regard to the roles of the contracting officer and the auditor; they are just more clearly stated. However, we have observed recently that a lot has apparently changed in the dynamics of the relationship between the contracting officer and the auditor, even though the rule changes are not final. The CWC criticism of DCMA for ignoring DCAA’s reports on contractor business system adequacy, relied in part on testimony during its own hearings, and no doubt, the separate DoDIG report issued in early 2009 that severely criticized DCMA for failing to “document sufficient rationale…” for ignoring DCAA recommendations. Our assessment is that many DCMA contracting officers have become “shell-shocked” over the severe criticism of their decision making. In several recent instances we have observed the contracting officer “rubber stamp” DCAA advice and recommendations, regardless of apparent inadequate DCAA audit procedures and reporting. In one instance very recently, the contracting officer reversed a negotiated agreement reached with a contractor nearly three years prior, regarding an issue reported by DCAA; and has adopted the original DCAA audit position without additional comment, modification, or discussion with the contractor. We believe we are entering a cycle in the DCMA/DCAA relationship where, whatever the auditor reports, the contracting officer will find that the DCAA position is “reality,” without initially allowing the contractor adequate opportunity to counter DCAA’s position.
Acceptable Business System Criteria
Although the proposed rule adds specificity to the criteria for acceptable business systems, we believe there is still significant potential for variance in interpretation regarding whether a contractor’s policies and practices meet the expectations of the criteria. For example, the existing rule regarding accounting systems states that the system should “provide reasonable assurance that:”
(a) Applicable laws and regulations are complied with;
(b) The accounting system and cost data are reliable;
(c) Risk of misallocations and mischarges are minimized; and
(d) Contract allocations and charges are consistent with invoice procedures.
The proposed new rule continues to include the above vague requirements for an acceptable business system; and it adds 18 specific criteria that a contractor’s accounting system must meet in order to provide the above assurance. Although at first read the 18 criteria seem very specific, we found included in the text some potentially indistinct and problematic requirements such as:
• “A sound Internal Control environment…”
• “…organizational structure that is adequate for producing accounting data…”
• “A logical and consistent method for the accumulation and allocation of indirect costs…”
And many more…
Inconsistent and “personality driven” interpretations of any “requirement” will never go away. The proposed rule makes some improvement in identifying the criteria for business system acceptability. However, inconsistent application of the criteria will certainly continue, and we believe contractors will continue to experience inconsistent and in some instances inexplicable and extreme, interpretations of rule criteria.
Anticipating and Preparing for the Business System Audits
In the introductory paragraph, Background and Status, we mentioned that DCAA was also criticized by the CWC for inadequate audit effort and inadequate reporting. In addition, like DCMA, DCAA has also been severely admonished over the last couple of years in GAO reports which found significant deficiencies related to audit quality and independence. Curiously the GAO reports suggested the DCAA reported favorably on contractor business systems in instances where they were actually significantly flawed; whereas the CWC found that DCAA’s reports on inadequate business systems were ignored. The audits the GAO reviewed were audits of stateside contractors; and the CWC naturally focused on contractors doing business in Iraq and Afghanistan. There were different causal factors in play, but DCAA audit quality was questioned in both instances. DCAA’s reaction to the critical assaults on its audit quality, especially with regard to audits of internal controls and business systems (currently defined as Internal Control Audit Planning Summary – ICAPS), was to largely withdraw from commencing new audits of business systems until it could revamp its approach to these systems reviews, and improve related audit quality. To date, we have only seen DCAA re-enter this audit area with training delivered to some of its audit staff; and “pilot” reviews of billing systems. We anticipate that when they enter their full-scale effort to catch-up on audits of business systems, contractors will experience a DCAA with a strong desire to make a point; and initial audit efforts replete with missteps and inconsistent interpretation of the requirements of the proposed “new rule.”
We believe the most effective defense against potentially detrimental business system audit outcomes (especially during the initial roll-out of the new systems audits) is to prepare for the audit. This objective is admittedly more simply stated than accomplished; however, it is within reach and adequate preparation can have very positive outcomes. Preparation includes at least the following:
Understand the criteria the auditor will apply. This step can be commenced even before the proposed new rule is adopted. In most instances the criteria that have to be met to proclaim a business system as adequate will not materially change. The criteria the auditors will apply exist now for public review on DCAA’s web site (www.dcaa.mil). Reviewing and understanding the criteria are a critical place to begin.
Understand the auditor’s approach, and their view of the minimum activity required to comply with business system criteria. This statement really translates to “dialog.” We recommend contractors engage their cognizant auditors and DCAA managers in discussions ahead of the coming business systems reviews to understand how DCAA may view the requirements of any new rule when it is finally published. DCAA will of course not provide preliminary assurance during these discussions that any specific system is acceptable, buy may respond to relevant examples, and therefore reveal any biases toward what it believes is relevant or acceptable for satisfying business system criteria. The contracting officer should always be a part of the dialog.
Dialog with the auditor before, during, and after the audit. Current DCAA guidance to its auditors (“The Rules of Engagement,” September 9, 2010) emphasizes communicating with the contractor “to gain a full understanding of the contractor’s submission, or other areas subject to audit.” Prior to the start of the audit, contractors should provide a thorough “walk-thru” of their business system to ensure the auditor fully understands how the system satisfies the business system criteria. We recommend the walk-thru be structured to address each of the control objectives and control activities on which the auditor will focus during the audit. During the audit, we recommend each question presented by the auditor be addressed thoroughly, and the response documented. In the unfortunate circumstance where the auditor discloses at the exit conference that the audit report will include negative conclusions about a business system’s acceptability, we recommend the contractor’s response (which will be published with the audit report) be well researched and articulated. The response should be formal and should address each condition reported by the auditor in detail, and with supporting examples, regulatory citations, and references to DCAA’s own internal guidance, and GAGAS as appropriate. The contractor’s position should be reviewed by the contracting officer; and in the current political environment, the contracting officer may give the contractor’s rebuttal very little consideration, if any, without substantial ammunition.
In conclusion, we recommend to our clients to be “proactive” rather than “reactive” for all anticipated audits. With regard to the coming business systems audits, this is especially important. Once DCAA publishes a negative report, the consequences for a government contractor can be devastating and prolonged. Elsewhere on this web site, we have outlined our comprehensive approach to business system risk assessment and corrective action planning and implementation; services we have successfully provided to our clients, and which we are well prepared to provide to your company.