SURVIVING A DCAA AUDIT (EXCERPT) STEPHEN A. AVERY DCAA COMPLIANCE, LLC 1
Copyright 2014 by Stephen A. Avery All rights reserved No part of this publication may be reproduced, stored in any retrieval system, or transmitted in any form or electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or Section 108 of the 1976 United States Copyright Act, without prior written approval of the Author. Limit of Liability/Disclaimer of Warranty: While the author has used his best efforts in preparing this book, he makes no representations or warranties with respect to the accuracy or completeness of the contents of this book. He specially disclaims any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. The author shall not be liable any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential or other damages. 2
3
THE FOUR P S I am going to describe surviving a DCAA audit in four parts: The Parties or You, Me, and DCAA The Process or Just What the Heck is Going On? The Pain or No One Told Me About This! The Product or My Approved Accounting System 4
THE PARTIES YOU You know who you are. Yes, you, the one trying to figure out just when DCAA is going to enter your life. Perhaps you already had the pleasure and are reading this simply to improve the experience (read recover from disaster ). ME I am the guy who is going to try and help you get through this in a couple of different ways. First, obviously, you are reading this book and I am optimistic about our relationship already. Second, another book I authored, Accounting Polices and Procedures for Small Business working with the DCAA and Other Agencies, is specifically written to help you, the small contractor, develop the tools necessary for DCAA compliance. This other book is three hundred plus pages and a guarantee cure for insomnia. It is available on our website (dcaacompliance.com) or on Amazon. Third, in addition to the books, I utilize the website to keep informed readers current on government contracting issues. There are even cartoons. The website, again, is www.dcaacompliance.com Fourth, I am available for personal appearances. If you skim through all of the above materials and decide you 5
would like your own personal advocate during the process, feel free to drop me a line. I can be reached at mail@dcaacompliance.com. THE GOVERNMENT You thought the next party was DCAA, didn t you? There are a lot of myths out there about DCAA. The most common myth is that DCAA approves contractor business systems. DCAA does not approve contractor business systems. DCAA audits the contractor s business system and makes recommendations to the approving party, typically the ACO (Administrative Contracting Officer). ADMINISTRATIVE CONTRACTING OFFICER (ACO) If your work is for the Department of Defense your ACO is usually 1 part of the Defense Contract Management Agency (DCMA). DCMA is the approving authority for contractor s business systems. Even if most of your work is for another government department such as the Department of Energy, they often 1 As discussed later, the world of DCAA suffers from a lack of precision and the number of exceptions and ignored regulations. This forces imprecise language on my part and I apologize in advance for the excess use of the terms usually, normally, and typically. 6
surrender cognizance 2 to DCMA and the Department of Defense. I once worked with a contractor that decided to make a CAS 410(j) special allocation that would move several million dollars off of two Department of Defense contracts (Cost type) to a Department of Energy contract (fixed price). The only thing stranger than a contractor trying to give back several million of properly allocated dollars was the two year effort it took to get the government to agree to take the money. The DCMA ACO did not want to receive nasty phone calls or packages from the Department of Energy contracting officer. 2 FAR 42.003 Cognizant Federal agency. (a) For contractors other than educational institutions and nonprofit organizations, the cognizant Federal agency normally will be the agency with the largest dollar amount of negotiated contracts, including options. For educational institutions and nonprofit organizations, the cognizant Federal agency is established according to Subsection G.11 of OMB Circular A-21, Cost Principles for Educational Institutions, and Attachment A, Subsection E.2, of OMB Circular A-122, Cost Principles for Nonprofit Organizations, respectively. (b) Once a Federal agency assumes cognizance for a contractor, it should remain cognizant for at least 5 years to ensure continuity and ease of administration. If, at the end of the 5-year period, another agency has the largest dollar amount of negotiated contracts, including options, the two agencies shall coordinate and determine which will assume cognizance. However, if circumstances warrant it and the affected agencies agree, cognizance may transfer prior to the expiration of the 5-year period. 7
Cognizance matters, especially as more and more contractors are disagreeing with DCAA recommendations. The cognizance agency, for example DCMA, is the actual decision maker not DCAA. It is also increasingly likely that the contracts people cannot even get DCAA to show up to audit the business systems and the ACO is forced to seek alternatives. With increasing frequency, contracts people are forced to make decisions about contractor accounting systems without access to DCAA auditors or sometimes any auditors at all. This happened to one client a couple of years ago. The Army simply could not get DCAA out to audit the accounting system and wanted the client s technology ASAP 3. In coordination with DCMA, the Army did their own audit report and it was extremely comprehensive (twenty-seven odd pages and even mentioned my name) and documented their decision to approve the accounting system. Both the contractor and I realized that the government had placed us in a high risk situation. The day after DCMA approved the contractor s accounting system based on the 3 The obvious question should be why the government did not issue a fixed price contract. I believe both President Regan and President Obama sked the same question over and over again during their administrations. 8
Army s audit, DCAA suddenly remembered the contractor and notified the ACO that they would do the audit. Yes, taxpayer s paid for two audits of the accounting system and I bet you can imagine how the second audit went. In the end, DCMA again approved the contractor s accounting system and after the involvement of the Department of Defense s Office of Inspector General. DCAA has disappeared from the contractor s life except for the approval of invoices by DCAA clerical staff and signing off on the contractor s first incurred cost proposal without an audit. This leads us to common myth number two: A contractor can contact DCAA and get them to come out to audit the contractor s business systems. This myth is so prevalent that I have seen proposal instructions from NASA instructing perspective bidders without an approved accounting system to contact their local DCAA office and schedule such an audit. I tell these clients to follow the instructions and contact the local DCAA office. I also told them not to hold their breath. DCAA did show up at one client a year and a half later after the client actually received a cost type contract out of another proposal. Contractors cannot order a DCAA Audit. If you still are experiencing problems believing this, go to DCAA s 9
website (www.dcaa.mil) and look under Guidance Request An Audit. AUDIT REQUEST Typically, the contracting staff or the ACO will request an audit of the contractor s accounting system in anticipation of the award to the contractor of a cost type contract. DCAA refers to this as a Preaward Audit. Often, DCAA will look at the client s proposed rates in addition to the accounting system. Over the years I worked with clients audited by DCAA without a cost type contract anywhere in sight. I also worked one audit (over my objections) where the contractor had zero government participation (one of the client s prime contractor included the client on their reports to DCAA as a subcontractor on other contracts. DCAA decided to audit my client the subcontractor despite the fact that the client had no government participation). Historically, this means DCAA can show up at any point in a contractor s government cycle (Fixed Price, Time and Materials, Letter Agreements, and Cost Type). In reality, today DCAA appears not to have the time for this. Notice the use of the term appears. Now we turn to the introduction we all awaited eagerly. 10
THE DEFENSE CONTRACT AUDIT AGENCY (DCAA) The Federal Acquisition Regulations (FAR) 4 legally govern most contracting activities of the federal government and the FAR defines the DCAA as the de facto auditor for most government contractors (FAR 42.101(b)). This expands DCAA s scope past the Department of Defense and into virtually every government department and agency. DCAA enjoys two roles within the government. First and foremost, they are the auditors of government contracts and government contractors. Their second role is to act as CFO s for various segments of the Department of Defense. This second role is under question as to use of resources and may continue to fade away over time. According to DCAA s Information for Contractors (http://www.dcaa.mil/dcaam_7641.90.pdf) DCAA s major areas of emphasis are: a. DCAA's major areas of emphasis include: (1) business systems, (2) management policies and procedures, (3) accuracy and reasonableness of contractors forward pricing and incurred cost representations, (4) adequacy and reliability of records and accounting systems, and (5) contractor compliance with contractual provisions having accounting or financial significance such as the Cost Principles (FAR Part 31), the Cost Accounting Standards (CAS) Clause (FAR 52.230-2), and the clauses pertaining to the Truth in Negotiations Act (TINA) (FAR 52.215-10, -11, -12, and -13). b. DCAA s audits are generally limited to pricing actions and contracts that fall under FAR Part 15, Contracting by Negotiation. The extent of DCAA's 4 We will talk a great deal about the FAR throughout this book, but at the moment understand that the FAR will dictate many of your contract activities and your relationship with DCAA. 11
involvement is determined by the type of contract that will be awarded. Generally, most DCAA efforts on firm-fixed price type contracts take place during the proposal stage rather than in the incurred cost stage. The reverse is true for cost reimbursable contracts. The allowable costs properly included in the final pricing of flexibly priced contracts are generally determined after they are incurred and audited. For additional details on the types of Government contracts reference FAR Part 16 This translates to the following: DCAA audits contractor s business systems for compliance and adequate internal controls DCAA is the first level of approval on most contractor s cost type invoices DCAA audits contractors rates DCAA audits contractor costs (Incurred Cost Proposal or Incurred Costs Electronically (ICE)) DCAA audits contractor proposals DCAA audits as requested by ACOs (Defective Pricing on a fixed price contract is an example) It is important to understand these are DCAA s assigned roles and historical responsibilities. Since 2008 contractors involvement with DCAA is best described as chaotic. DCAA IN CRISIS Most government contractors and consultants such as myself will assert that DCAA entered into a crisis mode in 2008 after a series of critical audits of the DCAA auditors themselves by the GAO (Government Accountability Office) and the DOD OIG (Department of Defense Office of Inspector General). 12
Access to the actual audits by the GAO and the OIG are available through my website (www.dcaacomplaince.com) and it is not unfair to say that both the GAO and the OIG raised serious allegations concerning the quality of DCAA s audit work. One fallout was the decision by the OIG to let their external peer review opinion of DCAA expire in 2009. To date, DCAA has not obtained the necessary peer review. You can even read about it on the DCAA website (http://www.dcaa.mil/external_peer_review.html). This is why every current DCAA audit contains wording, identical or similar, to the following recent DCAA audit:. We conducted our examination in accordance with Generally Accepted Government Auditing Standards (GAGAS), except DCAA does not currently have an external opinion on its quality control system as required by GAGAS. The most recent external quality control review opinion expired on August 26, 2009. Another fallout out is the apparent reduction in completed audits by the DCAA. As recorded in their 2012 Report to Congress, DCAA employed 4,492 auditors who completed 6,716 audit reports. That works out to 1.495 audit reports per auditor per year. That is down from 1.775 in 2011. DCAA tells us that it does not keep track of its backlog but acknowledges in the same report that it may be as high as 26,000 on incurred costs proposals alone. For reasons completely unrelated to either the backlog or the number of audit reports issued per year (yeah, right) 13
DCAA decided to stop issuing audit reports in many cases and simply issue a Memorandum for Contracting Officer (http://www.dcaa.mil/mmr/13-ppd-021.pdf) in place of an audit. They also decided in some cases, not to audit at all (The OIG had an opinion on that decision also -- see my website). This makes it almost impossible to evaluate how much work a DCAA auditor actually does and how much work is not done. A newly former DCAA auditor with previous employment with the IRS and now in the private sector posted the following on LinkedIn recently about her experience working with DCAA: I could go on and on... but I have work to do now... rather than sitting around and being told to charge time on an audit when I'm not actually doing anything (waiting for Supervisory review), and being bored out of my mind wishing that I could actually work on some of the audits that they were tossing out the door, I'm actually busy every day. I'm told that my former office manager keeps complaining about how they don't have enough auditors and need to hire more... all while auditors sit around with nothing to do and only have 1 audit assigned to them at a time, taking months to complete it because no one questions their hours. This is only a single report from a single DCAA auditor. My experience with DCAA auditors over the years proved positive time and time again. Their work is important and critical to our nation. Out of the countless auditors I worked with over the years only a few stood out as unprofessional and on only one occasion outs of hundreds of audits did I feel compelled to report an auditor to the OIG. 14
All of this adds up to the following: Government regulations assign DCAA the default role as the government auditor of contractors for all departments and agencies. Yet, the government allows DCAA to audit contractors without the required external peer opinion on the quality of their work. Since 2009, other government auditors (GAO and DOD OIG) began to issue their own highly critical audits of DCAA s audit performance. Since DCAA began reporting number of audits completed each year the number of audits per year per auditor has been less than two (2). The last report to Congress came out to under 1.5 audit reports per auditor per year. This said, there are thousands of hard working dedicated DCAA auditors out there just waiting to show up at your location. CONSEQUENCES OF A WORLD WITHOUT DCAA It appears many of DCAA s traditional customers such as the Department of Energy, outside the Department of Defense made the bold decision to move away from DCAA as opposed to waiting years for DCAA to finish outstanding projects, not to mention new ones. This is even happening within the Department of Defense as I completed a recent 15
accounting system audit (discussed above) with the Army who grew impatient with DCAA s ability to complete the initial audit after over a year. The emerging pattern seems to be letting the cost analysts within the departments or agencies assume most of the burden for cost audit and then bringing in an outside audit firm such as one of the Final Four accounting firms (Deloitte, E&Y, PW&C, KPMG) to provide the illusion of an independent audit. There are some major problems with this approach. INDEPENDENCE While no one working with DCAA will hold them up as a model of independence, the alternatives may be worse. DCAA at least has to pretend to follow auditing standards and government contracting compliance. Cost Analysts have no such standards or experience. I argued with an Army auditor who demanded the contractor move away from Total Cost Input (TCI) to Value Added because the change would benefit the Army over the Air Force. I told him that since he was trying to stand in DCAA s shoes he was obligated to represent the government and not just his branch. Outside CPA firms are working for the government with the hope of replacing DCAA on several thousands of audits each year by making their client, the government, happy, I 16
will allow the reader to ask themselves about the role of independence in that area. ACCOUNTABILITY DCAA ultimately got into this mess because they were accountable up the chain of command. Audit work slowed down as DCAA made sure everything was perfect before sending an audit up their chain of command for review. Since 2008, this appears to result in delay after delay. Every action reviewed all the way to the top, in theory. Without DCAA, this theory of accountability and double checking does not even exist. With DCAA out of the picture non DCAA government officials are making decisions (audit) without any formalized method of review (double checking). DOD s Inspector General Office started to raise the alarm on this area in a recent report (http://www.dodig.mil/pubs/documents/dodig-2013-015.html). EXPERIENCE No one in government enjoys the experience with accounting compliance held by DCAA, not even former DCAA auditors now working in other branches of the government 5. 5 My experience here indicates former DCAA auditors often have a romantic belief that they were the best auditors to ever work for DCAA 17
Another example of the lack of experience is a recent example of a Department of Energy cost analyst trying to change an argument about allocation to allowabilty without realizing that this raises the issue of fraud or at least penalties. His lack of experience almost changed an argument about allocation methodology to a criminal accusation. RELATIONSHIPS There is a fine line contractors must watch between getting along with the government and not letting the government walk all over them. The very institution of DCAA helps with this. Time after time I would argue with DCAA about various issues and on rare occasions, no matter how extensive the argument, they would issue audit opinions anyway. true or not, this attitude presents other problems since there is no peer review on their actions. There are simply no systems in place to double check their work in the absence of DCAA. 18
While I argued with DCAA, the contractor s program people, the DCMA, and the government s program people were blissfully unaware of the arguments. This allowed the contractor to maintain positive relationships with the government programs people while DCAA and I resolved the compliance issues. Now with DCAA out of the picture these discussions are coming a little too close to home as contractors must make their arguments directly with contracting officers and cost analysts. These are the very people that we worked to keep out of the arguments. This impinges on relationships built with program and contract people over years. *** I am sure there are some contractors benefitting from a world without DCAA which is also not what taxpayers want to hear. I am also sure just as many are not benefiting as they have to deal with: Lack of Independence (even more than usual) Accountability with the lack of second opinions and formalized systems Lack of experience and knowledge Possible damage to the customer relationship with the government. 19
REGULATION AND GUIDANCE The elephant in the room is not DCAA but how DCAA interprets the statutes and regulations the government created DCAA to enforce. Both contractors and DCAA enjoy a long history of taking regulation out of context or twisting it into shapes never intended. STATUTES Laws and case law are the absolute authority governing contract administration. This being said, Congress does not spend a lot of energy on contracting administration and case law is often subject to wide interpretations. The best examples of laws impacting contractors are Congress forbidding the charge of interest to government contracts (and thus the regulatory workaround referred to as cost of money ) and setting limits on executive compensation (which DCAA has successfully argued does not apply to small contractors under the reasonable and prudent rule allowing DCAA to ignore Congress and set its own executive compensation guidelines). REGULATIONS The overwhelming set of regulations guiding contract administration are the Federal Acquisition Regulations (FAR). Departments can supplement the FAR with their own additions such as the Department of Defense s Defense Federal Acquisition Regulation Supplement (DFARS). 20
The Cost Accounting Standards (CAS) are contained within the appendixes of the FAR. The CAS is the heart of government contracting and provides extensive regulatory guidance to all aspect of government contracting accounting. The relationship between the CAS and small government contractors is complicated as the FAR exempts small contractors from most CAS governance. For this reason, you will often see the following disclaimer in a DCAA audit: The contractor claims exemption under 48 CFR 99.03.201(b)(3) from the practices required by the Cost Accounting Standards Board rules and regulations because ti considers itself a small business concern. The spelling error is DCAA s. Before you get too excited you need to realize that DCAA, even while quoting it in the audit, pretty much ignores this provision for a couple of reasons: The Cost Accounting Standards are largely a practical implementation of statues and regulations elsewhere. DCAA can almost always find a FAR reference that covers the relevant CAS standard. For example CAS will provide guidance and standards for various methods of allocating indirect costs such as Total Cost Input or Value Added while the DFARS regulation requires A logical and consistent method for the accumulation and allocation of 21
indirect costs to intermediate and final cost objectives (DFARS 252.242-7006(b)(4)). DCAA often looks at CAS as a method for GAAP (see below) compliance and small contractors are required to follow GAAP. What choice does DCAA have? Given the absence of specific rules for small contractors DCAA follows the rules in place the rules for large contractors. This regulatory gap leads to problems in other areas as DCAA bends guidance to get the job done. GENERALLY ACCEPTABLE ACCOUNTING PRINCIPALS (GAAP) All contractors are required to follow GAAP. Unfortunately, this is GAAP as interpreted by DCAA and sometimes this can create a few issues. In the past, the most common issue proved DCAA s insistence that contractor s books be fully accrued. Many small contractors, based on legitimate advice from their tax accountants, maintain their books on a cash basis. A client called in a panic once after a conversation with DCAA where DCAA told her that her books were unauditable and they would so inform the ACO. When I inquired as to the conversation between her and the DCAA auditor, I discovered that she informed DCAA she kept the books on a cash basis and this comment generated DCAA s negative response. 22
I told the client that I would attempt to address the issue. I called the DCAA auditor and informed her that of course the client kept their books on a cash basis and that I entered the accruals each month in accordance with FASB Concept Paper No. 5. Thus everything was properly GAAP compliant. DCAA came out, did the audit, and recommended approval of the contractor s accounting system. After this incident the client refused to talk to DCAA unless I was present and preferred to channel all responses through me CONTRACT AUDIT MANUAL (CAM) The DCAA Contract Audit Manual is the roughly two thousand page handbook that provides guidance to DCAA auditors as they audit. The CAM is guidance, not law, not regulation as the CAM itself notes in the beginning of the manual: Unfortunately, as alluded to above concerning the CAS and GAAP, if there is no statutory or regulatory guidance than DCAA will often impose the CAM despite its own instructions not to. 23
A perfect example is the CAM requirement that timesheets are signed by a supervisor. Who signs for the CEO s timesheet? DCAA should not issue a finding based on the lack of supervisory signatures but they can issue one on the lack of adequate internal controls or adequate policies and procedures. INFORMATION OVERLOAD Dealing with DCAA on specific regulatory compliance issues is one area where the right consultant can be invaluable; however contractors need a basic understanding of regulatory compliance issues. THE PARTY IS OVER Now that those attending the party are introduced, we will move on to discuss the process. This section served as introductions as more information about the parties follows as the fun ends and the work begins. 24