Focus. FEATURE COMMENT: Legal, Accounting And Practical Considerations In Responding To DCAA Audits Of Contractor Internal Controls Systems

Transcription

1 Reprinted from The Government Contractor, with permission of Thomson Reuters. Copyright Further use without the permission of West is prohibited. For further information about this publication, please visit or call The Government Contractor Information and Analysis on Legal Aspects of Procurement Vol. 52, No. 33 September 1, 2010 Focus FEATURE COMMENT: Legal, Accounting And Practical Considerations In Responding To DCAA Audits Of Contractor Internal Controls Systems Current Defense Contract Audit Agency guidance regarding audits of contractor internal control systems takes the position that a contractor s failure to accomplish any applicable control objective should be reported as a significant deficiency/material weakness, and that any significant deficiencies/material weaknesses will result in an [audit] opinion that the system is inadequate. DCAA, Memorandum for Regional Directors: Audit Guidance on Significant Deficiencies/Material Weaknesses and Audit Opinions on Internal Controls, 08-PAS-043(R) at 2 (Dec. 19, 2008), available at PAS-043.pdf (December 2008 audit guidance). Such an opinion can create a risk of suspension of progress payments or disallowance of costs, and also can put awards of contracts or task orders at risk. An important issue for contracting officers and contractors is whether a DCAA audit opinion based on the recent audit guidance provides a reasonable basis for taking actions such as suspending payments or disallowing costs. Contractors should anticipate this issue in responding to DCAA audits of internal controls. As discussed below, relevant considerations can include whether a DCAA audit finding (or proposed finding) regarding the contractor s internal control system is consistent with generally accepted Government auditing standards (GAGAS), and the likelihood that an alleged significant deficiency or material weakness will result in unallowable costs being charged to Government contracts and, if so, the materiality of those costs. Contractors should also consider taking corrective action in response to an audit if appropriate. A contractor s response to the audit process can be important in determining how a CO or higher-level agency management responds to a DCAA audit opinion finding that the contractor s internal control system is inadequate, and the record created in the audit process can be important in contract disputes or bid protests challenging Government actions based on such an audit. DCAA s December 2008 Audit Guidance on Contractor Internal Controls DCAA s December 2008 audit guidance states that it clarifies what constitutes a significant deficiency/material weakness and establishes new guidance on reporting audit opinions on contractors internal control systems. December 2008 audit guidance at 1. As the December 2008 guidance notes, prior DCAA audit guidance had stated, [A] significant deficiency/material weakness is an internal control deficiency that; (1) adversely affects the contractor s ability to initiate, authorize, record, process or report Government contract costs in accordance with applicable Government contract laws and regulations, (2) results in a reasonable possibility that unallowable costs will be charged to the Government, and (3) the potential unallowable cost is not clearly immaterial. Id. (citing DCAA, Memorandum for Regional Directors: Audit Guidance on Reporting Internal Control Deficiencies, 08-PAS-011(R) (March 3, 2008), available at (March 2008 guidance)); see 50 GC 100. However, the December 2008 audit guidance provides a further clarification of that earlier guidance and states that a contractor s failure to accomplish any control objective tested for in DCAA s internal control audits will or could ultimately result in unallowable costs charged to Government contracts, even when the control objective does not have a direct re Thomson Reuters

2 The Government Contractor lationship to charging costs to Government contracts (emphasis added). It cites control objectives relating to contractor ethics and integrity as an example. December 2008 audit guidance at 1. See also DCAA, Memorandum for Regional Directors: Audit Guidance on Federal Acquisition Regulation (FAR) Revisions Related to Contractor Code of Business Ethics and Conduct, 09-PAS-014(R) (July 23, 2009), available at also discussed at DCAA Audit Guidance on FAR Provisions Regarding Contractor Code of Business Ethics and Conduct (2009), available at Likewise, the December 2008 audit guidance states that [i]t is not necessary to demonstrate actual questioned cost to report a significant deficiency/material weakness. December 2008 audit guidance at 1. Thus, DCAA s position appears to be that any failure to accomplish an internal control objective will be presumed to have a material impact on costs charged to the Government and therefore will be reported as a significant deficiency/material weakness, without regard to the actual or potential materiality of any cost impact. DCAA s December 2008 audit guidance explains this position as follows: By limiting internal control audits to major contractors, DCAA only performs audits of contractor systems that are material to Government contract costs. As a result, internal control deficiencies identified in DCAA audits will generally have an impact or potential impact to Government contract costs that is material. Therefore, a contractor s failure to accomplish any applicable control objective should be reported as a significant deficiency/material weakness. December 2008 audit guidance at 1 2. Finally, the December 2008 audit guidance addresses future DCAA audit opinions. It states that any significant deficiencies/material weaknesses will result in an [audit] opinion that the system is inadequate, and that DCAA will no longer issue inadequate in part opinions. Id. at 2. It also indicates that DCAA audit reports will no longer include suggestions to improve contractor systems because, according to DCAA, such suggestions caused confusion in the past. Id. DPAP Policy for Resolving Audit Disagreements In response to the December 2008 audit guidance, the director of defense procurement and acquisition policy issued a memo on Dec. 4, 2009, which set out Department of Defense policy for addressing and resolving disagreements with DCAA audit recommendations. Office of the Under Secretary of Defense, Memorandum: Resolving Contract Audit Recommendations (Dec. 4, 2009), available at dpap/policy/policyvault/usa dpap.pdf (DPAP memo); see 51 GC 429(b). The DPAP memo recognizes that agreement between a CO and DCAA was neither expected nor necessary... on every issue, and concludes that the CO has ultimate responsibility to determine fair and reasonable contract values. Id. at 2. The DPAP memo focuses on significant disagreements situations in which the CO, in establishing a prenegotiation objective, plans to sustain less than 75% of the total costs questioned in a DCAA audit report on proposals valued at $10 million or more. Id. at 1. (Other disagreements are not specifically addressed.) It requires COs to discuss significant disagreements with DCAA and to document the discussion and basis for disagreement in the CO s prenegotiation objective. The CO is also required to advise DCAA in writing of his or her position following the discussion or prior to starting negotiations. After this process is completed and the negotiation objective is approved, the CO may proceed with negotiations. Id. The DPAP memo gives DCAA the opportunity to request higher-level review in the relevant DOD component if it disagrees with the CO s position. (Such requests must be made within three business days after receipt of the communication from the CO regarding the disagreement.) Id. at 2. The DCAA director may also raise a disagreement with DPAP if the component-level review does not resolve the matter and, if necessary, subsequently elevate the matter to the undersecretaries for defense, acquisition and logistics, and the DOD comptroller. Finally, the DPAP memo directs DOD components to develop procedures to implement the policy, which the Defense Contract Management Agency, Army, Defense Logistics Agency, Air Force and Navy have now done. For example, DCMA has provided for a process that includes elevation of disagreements on contractor internal control systems issues to operations and headquarters contract management boards of review. DCMA, Contract Mgmt. Boards of Review (June 2010), available at guidebook.dcma.mil/282/index.cfm. DCMA requires an administrative CO to obtain board approval before negotiating or taking any action to settle an issue. The guidance describes the 2 The Government Contractor 2010 Thomson Reuters

3 Vol. 52, No. 33 /September 1, 2010 documentation the ACO is required to provide to the board, and states that the board will review a matter and provide its written approval or recommendations within 15 working days after its receipt of the required documentation, or any supplemental documentation it requests. Finally, the procedure also permits DCAA to escalate the matter to the DCMA director if it does not agree with a headquarters board s decision. (The DCMA procedure also provides for boarding of other issues, such as Cost Accounting Standards noncompliances, changes to accounting practices, questioned costs in forward pricing rate agreements, notices of intent to disallow costs and final overhead rate determinations, with the availability and level of review subject to various dollar thresholds.) DLA and the uniformed services have also promulgated procedures pursuant to the DPAP memo. Those procedures generally track the DPAP memo and identify individuals in their respective management chains who will be involved in higher-level reviews if requested by DCAA. See, e.g., Dep t of the Navy, Memorandum: Resolving Contract Audit Recommendations (April 7, 2010), available at acquisition.navy.mil/rda/content/download/6669/30777/version/1/file/rsolving+cont RACT+AUDIT+MEMO+of+7+APR+2010.pdf. DCAA s May 27, 2010 Memo In response to the DPAP memo, DCAA issued further guidance on resolving disagreements on audit recommendations in May See DCAA, Memorandum for Regional Directors: Guidance on Resolving Contract Audit Recommendations, 10-PAS-015(R) (May 27, 2010), available at www. dcaa.mil/mmr/10-pas-015.pdf. It recapitulates the policy in the DPAP memo and specifically notes that requests for higher-level component management review must be made within three days after DCAA s receipt of notice from the CO. It also notes that the DPAP memo permits the DCAA director to elevate any disagreement he believes requires the DPAP Director s attention (e.g., precedent setting or of high interest to the Department). Id. at 1. Finally, the May 27 memo indicates that disagreements should be resolved at the lowest level possible, but also notes that [c]onsistent with DCAA s current practices, DCAA should continue to elevate disagreements or significant issues up through the DOD Component s chain of command. Id. Potential Implications of a DCAA Audit Opinion Finding Inadequate Internal Controls An audit opinion finding that a contractor s internal control system is inadequate has the potential to impact a contractor s business. For example, FAR provides that cost-reimbursement contracts may be used only when [t]he contractor s accounting system is adequate for determining costs applicable to the contract. Similarly, Defense FAR Supplement provides that contractors who receive cost-reimbursement contracts, incentive-type contracts or contracts that provide for progress payments based on costs shall maintain an accounting system and related internal controls... which provide reasonable assurance that they will, among other things, comply with applicable laws and regulations, generate reliable cost data, and minimize the risk of misallocation or mischarging of costs. Other regulations permit the suspension of progress payments or reimbursement of costs if the contractor s accounting system or internal controls are inadequate. See FAR (a) (b); (c), (g); DFARS Managing the Audit Process It is almost always in a contractor s interest to establish a proactive and cooperative relationship with its DCAA audit team. However, a contractor should also undertake to develop and document its position on whether an alleged failure to meet a control objective was properly treated as a significant deficiency/material weakness and the materiality of such an alleged deficiency or weakness. These steps can be important to possibly avoiding an adverse audit finding, as well as in connection with the subsequent consideration by the CO or ACO of a DCAA audit opinion (and, if applicable, a DCMA review board or other component management review), or, as discussed below, in the event of litigation. See also DCAA Contract Audit Manual (DCAM) f(1)(d) (June 2010), available at mil/cam.htm (requiring that a contractor s formal, written response to the audit be included as an appendix to the audit report). In that regard, the FAR and DFARS generally require that the contractor be given an opportunity to present its position to the CO before progress payments are suspended or costs are disallowed. See, e.g., FAR (a); (b); (a)(2); DFARS For example, FAR (a)(1)(i), relating to suspension of progress payments, requires the CO to, among other things, notify the contractor of the intended action and provide the contractor with an opportunity for discussion. Likewise, DFARS (a) requires the CO to provide the contractor with a copy of an audit report that identifies any The Government Contractor 2010 Thomson Reuters 3

4 The Government Contractor significant accounting system or internal control deficiencies and an opportunity to respond to the audit report. Consideration of Applicable Auditing Concepts and Standards: One potentially important consideration in addressing a DCAA audit of the adequacy of a contractor s internal controls is whether the audit findings are consistent with the auditing concepts and standards applicable to DCAA. The March 2008 guidance states that it incorporates new GAGAS definitions and clarifies existing guidance related to reporting internal control deficiencies. March 2008 guidance at 1. It further states that the new GAGAS standards, which were issued in July 2007 and apply to DCAA, see DCAM (2010), are applicable to attestation engagements beginning on or after Jan. 1, March 2008 guidance at 1. Most of DCAA s work, including internal control audits, involves attestation engagements. See DCAM 2-101(d); see also DCAM (discussing types of attestation engagements). Chapter 6 of GAGAS in turn sets forth standards, such as reporting standards, for attestation engagements, including standards related to reporting deficiencies in internal control, fraud, illegal acts, [and] violations of provisions of contracts or grant agreements. Government Auditing Standards (GAO G) 6.31, available at For example, GAGAS 6.33 states, For attestation engagements, auditors should report, as applicable to the objectives of the engagement, and based upon the work performed, (1) significant deficiencies in internal control, identifying those considered to be material weaknesses; (2) all instances of fraud and illegal acts unless inconsequential; and (3) violations of provisions of contracts or grant agreements and abuse that could have a material effect on the subject matter of the engagement. (Emphasis added.) In addition, GAGAS 6.34 goes on to provide the following definitions of significant deficiency and material weakness : a. Significant deficiency: a deficiency in internal control, or combination of deficiencies, that adversely affects the entity s ability to initiate, authorize, record, process, or report data reliably in accordance with the applicable criteria or framework such that there is more than a remote likelihood that a misstatement of the subject matter that is more than inconsequential will not be prevented or detected. b. Material weakness: a significant deficiency or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the subject matter will not be prevented or detected. (Emphasis added.) As these provisions recognize, not all significant deficiencies are material weaknesses, and not all violations of contract provisions are material in their effect. In addition, the phrases more than remote and more than inconsequential in these definitions are especially important in determining whether a failure to accomplish a particular internal control objective rises to the level of a significant deficiency or a material weakness. GAGAS explains as follows: The term more than remote used in the definitions for significant deficiency and material weakness means at least reasonably possible. The following definitions apply: (1) Remote The chance of the future events occurring is slight. (2) Reasonably possible The chance of the future events or their occurrence is more than remote but less than likely. (3) Probable The future events are likely to occur. Id n.85 (emphasis added). More than inconsequential indicates an amount that is less than material, yet has significance. A misstatement is inconsequential if a reasonable person would conclude that the misstatement, either individually or when aggregated with other misstatements, would clearly be immaterial to the subject matter. If a reasonable person would not reach such a conclusion, that misstatement is more than inconsequential. Id n.86 (emphasis added). Finally, GAGAS also indicates that audit findings must be reasonable and not arbitrary. For example, GAGAS 1.03 states that GAGAS contain requirements and guidance to assist auditors in objectively acquiring and evaluating sufficient, appropriate evidence and reporting the results. Id. (emphasis added). Likewise, GAGAS 6.04 references the two American Institute of Certified Public Accountants field work standards for attestation engagements that are incorporated in GAGAS. The second of those standards states that [t]he practitioner [auditor] must obtain sufficient evidence to provide a reasonable basis for the 4 The Government Contractor 2010 Thomson Reuters

5 Vol. 52, No. 33 /September 1, 2010 conclusion that is expressed in the report. GAGAS 6.04(b) (alteration in original). See also GAGAS 6.34 n.85 (which provides that determinations of whether there is more than a remote likelihood that a misstatement will be more than inconsequential are to be made objectively based on a reasonable person standard). Additionally, and importantly, GAGAS 6.43 states, Auditors should place their findings in perspective by describing the nature and extent of the issues being reported and the extent of the work performed that resulted in the finding. To give the reader a basis for judging the prevalence and consequences of these findings, auditors should, as applicable, relate the instances identified to the population or the number of cases examined and quantify the results in terms of dollar value or other measures, as appropriate. If the results cannot be projected, auditors should limit their conclusions appropriately. (Emphasis added.) As written, there is a significant risk that the December 2008 audit guidance will be interpreted and applied in a manner that is not consistent with these auditing concepts and standards. First, the December 2008 audit guidance appears to equate significant deficiencies with material weaknesses. However, as discussed above, that is not the case under applicable auditing standards because they involve different considerations and judgments. Second, the December 2008 audit guidance does not meaningfully address considerations of materiality and likelihood embedded in the GAGAS definitions of significant deficiency and material weakness. As noted above, the December 2008 audit guidance appears to assume that any failure to accomplish an internal control objective will be reported as a significant deficiency/material weakness without regard to the actual or potential significance of the cost impact. As such, it fails to give effect to the GAGAS requirements that a significant deficiency involve a matter or amount that, although possibly less than material, has significance, and that a material weakness requires consideration and determination (and not a presumption) of materiality. For example, as written, the December 2008 audit guidance could be interpreted as assuming that a failure to meet a control objective is a significant deficiency or material weakness without the auditor having to make a caseby-case assessment of its significance or materiality, respectively. Similarly, the December 2008 audit guidance does not adequately reflect consideration of the likelihood that unallowable costs will be charged to the Government. As noted above, GAGAS 6.34 n.85 defines remote as [t]he chance of the future events occurring is slight, and defines reasonable possibility as [t]he chance of the future events or their occurrence is more than remote but less than likely. These concepts are part of the definitions of significant deficiency and material weakness and are important in understanding the risks associated with a deficiency or weakness in a contractor s internal control system. Insofar as the December 2008 audit guidance provides that the audit report is to include an opinion that an internal control system is inadequate whenever the auditor finds a significant deficiency or material weakness in a contractor s internal controls, it puts contractors at risk of suspension of a percentage of progress payments or reimbursement of costs even if the chance that unallowable costs would be charged to the Government, although more than slight, is still less than likely. It compounds this problem by providing that failure to accomplish any control objective should be reported as a significant deficiency/material weakness, even if it does not have a direct relationship to charging costs to Government contracts. Third, as the discussion above indicates, an audit process that does not adequately consider likelihood and materiality (e.g., provides that failure to accomplish any internal control objective, even if it does not have a direct relationship to charging costs to Government contracts, should be reported as a significant deficiency/material weakness and then recommends disapproval of costs or suspension of payments) is inconsistent with GAGAS requirements that audit findings must be supported by sufficient evidence to provide a reasonable basis for the auditor s conclusions and that auditors put their findings in perspective. See GAGAS 6.04(b), It also fails to give effect to the GAGAS requirement that auditors consider whether they can reasonably project the results of their audit testing, and, if they cannot, limit their conclusions accordingly. See id Corrective Action: In addition to addressing the internal control issues on the merits, contractors should, if appropriate, consider developing and implementing a corrective action plan to address alleged significant deficiencies or material weaknesses in internal control systems identified in a DCAA audit (e.g., in a draft or The Government Contractor 2010 Thomson Reuters 5

6 The Government Contractor final audit report). Implementation of corrective action may not avoid an audit opinion that an internal control system is inadequate. See DCAM (a) (2) (5). However, establishing a record of corrective action could be important, as a practical matter, in determining how a CO or ACO or higher-level component management responds to a DCAA audit finding, and in avoiding or limiting the suspension of progress payments or cost reimbursements. Such actions can provide assurance to the Government that the alleged deficiency or weakness has in fact been corrected and that any risk of a material cost impact has been minimized or eliminated. For example, FAR (b)(1) and DFARS (a)(2) and (4) strongly suggest that notwithstanding an adverse DCAA audit opinion, progress payments and cost reimbursements should not be suspended if the contractor has taken effective corrective action. See also DCAM c(5). Next Steps If a CO or ACO disallows costs or suspends progress payments based on a DCAA audit finding that a contractor does not have an adequate accounting system, the contractor may need to consider proceeding under the Contract Disputes Act, which could provide an opportunity for further discussion of the audit findings with the CO or ACO. Assuming the CO or ACO denies the claim and the matter proceeds to a board of contract appeals or to the U.S. Court of Federal Claims, key issues may include whether the DCAA audit findings were reasonable and supportable, and whether the CO or ACO otherwise acted reasonably and consistent with the terms of the contract in relying on the findings. See Martin Marietta Corp., ASBCA 31255, 31248, 31271, 87-1 BCA 19875, aff d on recon., 88-1 BCA In Martin Marietta, the Armed Services Board of Contract Appeals upheld a claim for CDA interest on costs that had been suspended (and later paid) pursuant to a DCAA Form 1 based on an alleged denial of access to records. The Board essentially held that DCAA had acted arbitrarily and unreasonably in suspending the costs. In the present context, that decision suggests that the Government may be at risk if it suspends or withholds payments based on an audit finding regarding a contractor s internal controls that lacks a reasonable basis or involves an immaterial amount of costs. See also FAR (a)(1), (3) (which provide, respectively, that the CO shall suspend or reduce progress payments only in accordance with the contract terms and never precipitately or arbitrarily ; and that [i]n all cases the [CO] shall (i) [a]ct fairly and reasonably; [and] (ii) [b]ase decisions on substantial evidence ); Rumsfeld v. Freedom NY, Inc., 329 F.3d 1320 (Fed. Cir. 2003) (administration of progress payment clause, including decision to withhold payments, is subject to duty of good faith and fair dealing). Further, the Martin Marietta decision also suggests that the record developed by the contractor during and in response to an audit can affect how a board or court will view the issue of whether the Government s reliance on a DCAA audit report was arbitrary, unreasonable or inconsistent with the terms of the contract. Finally, the December 2008 audit guidance may lead to bid protests in cases in which a proposal is rejected based on DCAA audit findings on the inadequacy of an offeror s internal controls. Again, the record developed during the audit may be important in such protests. The Government Accountability Office recently sustained two protests in which an agency, relying on audit reports, rejected proposals on the ground that the protesters did not have adequate accounting systems. See PMO P ship Joint Venture, Comp. Gen. Dec. B , 2010 CPD 29; 52 GC 67; McKissak+Delcan JV II, Comp. Gen. Dec. B , 2010 CPD 28. In both cases, GAO found that whether an offeror has an acceptable cost accounting system is a matter of responsibility. (However, that may not be true in all cases. See A- TEK, Inc., Comp. Gen. Dec. B , 2007 CPD 89 (upholding agency s rejection of a proposal where the agency concluded that the offeror failed to comply with a request for proposals requirement to have an accounting system that had been verified by DCAA or another federal audit agency)). In PMO and McKissak+Delcan, GAO stated that although a CO has broad discretion in making a responsibility determination, the determination must have a reasonable basis and cannot be based primarily on unreasonable or unsupported conclusions. PMO, 2010 CPD 29 at 6; McKissak+Delcan, 2010 CPD 28 at 6. In sustaining the two protests, GAO noted that neither the agency nor the auditors had provided any analysis or legal authority in support of their position regarding an alleged CAS noncompliance. GAO also noted that although there may have been other legitimate legal or accounting reasons for questioning the offerors proposed indirect rates, they had not been provided to GAO. PMO, 2010 CPD 29 at 8 n.7; McKissak+Delcan, 2010 CPD 28 at 8 n.11. Finally, GAO reaffirmed the principle that an agency 6 The Government Contractor 2010 Thomson Reuters

7 Vol. 52, No. 33 /September 1, 2010 cannot reasonably base a source selection decision on erroneous information provided by DCAA. See PMO, 2010 CPD 29 at 6 (stating that an agency s reliance upon the advice of an auditor, such as [DCAA] does not insulate the agency from responsibility for error on the part of [DCAA] ); McKissak+Delcan, 2010 CPD 28 at 6 (same); see also Gen. Research Corp., Comp. Gen. Dec. B , 91-1 CPD 183 at 7 (stating that an agency cannot blindly rely upon... advice [from DCAA] where there is reason to doubt the validity of the information ). Conclusion DCAA s recent guidance on audits of contractor internal controls presents a number of issues and potential risks for contractors, and a contractor s response to the audit process can be important in managing and reducing those risks. F This Feature Comment was written for The Government Contractor by Thomas P. Barletta and William T. Keevan. Mr. Barletta is a partner in the Washington, D.C. office of Steptoe & Johnson LLP and is the head of the firm s Government Contracts Practice Group. Mr. Keevan is Senior Advisor to Chess Consulting LLC and has 40 years of Government contract accounting, auditing and disputes consulting experience. The Government Contractor 2010 Thomson Reuters 7