DCAA Audits of Compliance Systems and the Implications of Changes in the False Claims Act for Universities

Transcription

1 DCAA Audits of Compliance Systems and the Implications of Changes in the False Claims Act for Universities SCCE s Higher Education Compliance Conference Kwamina Thomas Williford Partner, Holland & Knight LLP June 14, 2011 Copyright 2010 Holland & Knight LLP All Rights Reserved

2 Presentation Overview 1. Background: Existing High Risk Regulatory Environment 2. Defense Contractor Audit Agency s (DCAA) Get Tough Audit Guidance 3. False Claims Act Considerations 4. Implications for Universities Contracting with the Government 5. Practical Take Aways 2

3 Background: Existing High Risk Regulatory Environment 3

4 Background: New Considerations and Higher Risk Environment For Universities Contracting with the Government Existing high risk environment for Universities contracting with the government DCAA - Government s primary audit agency increases scrutiny of compliance systems Expanded False Claims Act includes new perils for Universities New considerations to navigate to avoid scrutiny 4

5 Background: Mandatory Compliance Program Universities that have contracts in excess of $5 million with a performance period of more than 120 days must have an ongoing compliance program that: has a written code of business ethics and conduct; makes a copy of the code available to all working on the contract; emphasizes due diligence to prevent and detect improper conduct; and promotes an organizational culture of compliance. FAR (b). 5

6 Background: Mandatory Disclosure of Violations Such contractors must disclose credible evidence that a principal, employee or agent violated: a federal criminal law involving fraud, conflicts of interest, bribery or improper gratuity under Title 18 of the U.S. Code; or the Civil False Claims Act in connection with a federal government contract. FAR (b)(3). 6

7 Background: Required Internal Controls Such contractors are required to have an Internal Control System in place, which includes: High level assignment of responsibility for controls & adequate resources to ensure effectiveness Reasonable efforts not to include as principals people who engaged in conduct contrary to the code of business ethics & conduct Auditing and monitoring of procedures Internal reporting mechanisms (i.e. hotlines) Timely disclosure of improper conduct related to any government contract Disciplinary action for improper conduct Risk assessments and evaluations of effectiveness of program and controls FAR (c)(2). 7

8 Background: Full Cooperation Such contractors are required to fully cooperate with government audits and investigations. To fully cooperate means the: [D]isclosure to the Government of the information sufficient to identify the nature and extent of the offense and the individuals responsible for the conduct [T]imely and complete response to Government auditors and investigators request for documents and access to employees with information FAR (c)(2)(ii)(G). 8

9 DCAA s New Get Tough Audit Guidance 9

10 DCAA s Get Tough Audit Guidance: The Basics DCAA is the government s primary audit agency extends beyond contracts with the Department of Defense Most Universities who have contracts with the Government are subject to DCAA s Audit 10

11 DCAA s Get Tough Audit Guidance: Theory Contractors business systems and internal controls are a key line of defense against waste, fraud, and abuse Strong effective control systems decrease the risk of unallowable and unreasonable costs on government contracts 11

12 DCAA s Get Tough Audit Guidance: Evolution All internal control deficiencies that result in or could result in unallowable costs should be reported as significant deficiencies and considered material weaknesses Inadequate in part allowed if deficiencies affect only certain control objectives permits auditor judgment Suggestions to improve the system allowed if condition found does not materially impact contract costs, but the system is enhanced if needed. MRD Number 08-PAS-011(R), DCAA Audit Guidance on Reporting Internal Control Deficiencies, dated March 3,

13 DCAA s Get Tough Audit Guidance: Evolution DCAA challenged by U.S. Government Accountability Office (GAO) alleged failure to comply with government auditing standards Congressional demands for DCAA audit improvement Seeks dramatic changes in audit protocols, demands for information and audit results DCAA s new audit guidance emphasizes thorough implementation of compliance and ethics programs. 13

14 DCAA s Get Tough Audit Guidance: Current State DCAA audit reports are effectively pass/fail. Any significant deficiencies/material weaknesses will result in opinion that system is inadequate. DCAA no longer has inadequate in part as an option. DCAA will no longer offer suggestions on how to improve the system in an internal control audit report. If timely documentation not provided, auditor will follow procedures for denial of access to records, take action to suspend costs from billings and question costs. MRD Number 08-PAS-043(R), DCAA Audit Guidance on Significant Deficiencies/Material Weaknesses and Audit Opinions on Internal Control Systems, dated December 19,

15 DCAA s Formal Information Request DCAA created a formal request for information regarding a contractor s internal compliance system controls. Based on such information, DCAA will likely evaluate: Contractor s policies, procedures, training, and compliance with policies and procedures related to conveying integrity and ethical values; The contractor s self-governance and the making of adequate disclosures to the government; 15

16 DCAA s Formal Information Request DCAA will likely evaluate: (cont.) The intervention of contractor s management and any overrides (including assessing compliance with the contractor s policies and procedures); Internal and external audit functions and efforts related to the contractor s accounting system; and The most recent annual report and its internal control report (which should assess the internal control structure for financial reporting). 16

17 DCAA s Formal Information Request DCAA s formal requests for information are document intensive DCAA expects: These documents to be readily available That the contractor will provide access to personnel, including the person responsible for the information MRD Number 08-PAS-042(R), DCAA Audit Guidance on Denial of Access to Records Due to Contractor Delays, dated December 19,

18 False Claims Act: Additional Considerations 18

19 False Claims Act The civil False Claims Act imposes civil liability on a person if they knowingly: submit, or cause the submission of, a false or fraudulent claim for payment to the government; make, use, or cause to be made or used (through conspiracy or otherwise), a false record or statement material to a false or fraudulent claim for payment made to the government; or make a false record or statement to conceal or avoid an obligation for payment to the government. 29 U.S.C. 3729, et. seq. 19

20 False Claims Act Considerations Amendments to the False Claims Act increase exposure: Creates the reverse false claim by creating liability for the retention of an overpayment or other obligation to pay or transmit money or property to the government Expands reach to subcontractors Expands anti-retaliation provision to prevent retaliation for claims brought by contractors and agents as well as employees Allows liability to attach as long as claim is material, no longer is a specific intent to submit the false claim necessary Fraud Enforcement And Recovery Act of 2009, Pub. L , 123 Stat 1617 (May 2009) 20

21 Implications For Universities Contracting with the Government 21

22 Implications: Tougher Compliance Standards Compliance programs will receive substantial attention from DCAA. Discretion taken away from auditor regarding what it means to have a reportable significant deficiency/material weakness. Failure to properly implement elements of the required compliance program and related controls may be enough to constitute a reportable significant deficiency/material weakness. Control systems found adequate in past are now being found inadequate. 22

23 Implications: Monetary Consequences Internal Control systems found to be inadequate may result in: Disallowance of unsupported costs Suspension of percentage of progress payments MRD Number 08-PAS-043(R), DCAA Audit Guidance on Significant Deficiencies/Material Weaknesses and Audit Opinions on Internal Control Systems, dated December 19, 2008; DFARS Case 2009-D038, Business Systems Definition and Administration, Interim rule, 76 Fed. Reg , May 18,

24 Implications: Access to Information Considerations Understand your obligations regarding requests for information. DCAA right of access to contractor personnel should be managed. Full cooperation requirement -- does not require waiver of attorney-client privilege; does not require waiver of 5 th amendment privilege; and does not foreclose contractor internal investigation, or defense of any proceeding brought by the government 24

25 Implications: Access to Information Considerations (cont.) DCAA s formal request for information claims to be based on a contractor s purported requirement to report any suspected violation of law to government officials. The FAR does not require disclosure unless a Principal of the contractor has credible evidence that a violation has been committed. See e.g., FAR (b). 25

26 Implications: Access to Information Considerations (cont.) Government guidance on the mandatory disclosure requirement says contractors will have sufficient opportunity to investigate whether or not credible evidence of a reportable violation exists. Due to recent challenges to in-house attorney-client privilege, great care should be taken to document when inhouse lawyers are acting in purely legal functions Consider conducting serious compliance investigations through outside counsel 26

27 Implications: False Claims Act Considerations Already increased enforcement of False Claims Act, including enforcement against Universities Increased oversight and scrutiny by DCAA of Universities internal controls records request specifically looks at self governance controls DCAA may refer problems to Inspector General as a basis for False Claims Act action Mandatory reporting requirements now apply to retention of overpayments Mandatory reporting requires disclosure of facts that are material to a claim for payment 27

28 Practical Take Aways in light of New Environment 28

29 Practical Take-Aways Proactive engagement with DCAA chain of command understand intended audit plan, clarify protocol Enhance internal communications regarding audit activities Raise visibility of compliance department within University Perform internal/external compliance assessments 29

30 Practical Take-Aways (Cont.) Perform fraud risk assessments for special requirements of government relationships (Consider confidentiality and attorney-client privilege) Integrate and align key departments (Compliance, Internal Audit, Controller) to coordinate focus on controls and risks Anticipate DCAA requests for information Prompt response investigation, resolution, corrective action, disclosure of reported violations 30

31 Questions Kwamina Thomas Williford Holland & Knight LLP 2099 Pennsylvania, Ave., NW Washington, D.C., Phone: