Business Systems: Update on Proposed Rules Presented By: Mark Burroughs, Partner Topics Review of Business System requirements Observations on areas of focus by the government Enforcement of significant deficiencies How to correct a deficiency and release withhold New DCAA Guidance Proposed DOD Rule 2 1
Contractor Business Systems DFARS Interim Rule issued May 2011; Final issued Feb 24, 2012 Systems Identified Accounting MMAS Estimating EVMS Procurement Property 5% maximum withhold per system; 10% max for all systems Progress Payments Performance Based Payments Interim payments under cost, T&M, and labor hour contracts Corrective action plans may reduce withholds by 50% DCMA tracking status of contractor business systems in Contractor Business System Analysis Repository 3 Contractor Business Systems Contractor business systems means: Accounting system (252.242 7006) Earned value management system (252.234 7002) Estimating system (252.215 7002) Material management & accounting system (252.242 7004) Property management system (252.245 7003) Purchasing system (252.244 7001) 4 2
Overview of the Rule System review: DCMA/DCAA perform audit Initial ACO determination: ACO provides written initial determination to the contractor detailing any significant deficiencies Contractor response: Within 30 days of receipt of initial ACO determination, contractor responses in writing to ACO Final ACO determination: ACO evaluates contractor s response and will issue a final written determination and begin withholding, if significant deficiency exists Contractor corrective action: Within 45 days of receipt of final determination, contractor must correct deficiencies or submit an acceptable corrective action plan 5 DCMA Guidance Acceptable system: a contractor system that complies with the system criteria contained in the DFARS clause Significant deficiency: a shortcoming in the system that materially affects DoDs and the contractor s ability to rely upon the information produced by the system that is needed for management purposes 6 3
DCMA Guidance Deficiencies may be discovered at any time (inside or outside a system review). Deficiencies can be either: Contract specific, isolated, minor, not tied to DFARS business system criteria Systemic, i.e., impacting the system as a whole ties to DFARS system criteria 7 DCMA Guidance To be significant, a deficiency must have a material impact In order to have a material impact, a deficiency must have nexus to the business system criteria and must be systemic impacting the contractor s system as a whole One-off contractor employee mistakes do not generally rise to the level of a significant deficiency ACO initial determinations must: Always reference applicable DFARS clause criteria Describe each significant deficiency and their impact 8 4
DCAA Audits DCAA is focusing on identifying business system deficiencies during ongoing audits (e.g., proposals and incurred cost) DCAA is performing full-up audits at selected highrisk contractor locations based on concerns from buying activities and contracting officers DCAA is performing pre-award accounting system audits (SF 1408) as requested by buying activities 9 Business System Disapprovals A recent report says that 14 companies on DCMA s list face withholdings (some potential withholdings are in the hundreds of millions of dollars) System reviews with no significant deficiencies rare Engage with system auditors during system review/exit conference Have documents for review readily available (internal audit reports should be carefully considered) Make sure auditors understand system, explain framework of policies and procedures Respond to factual misunderstandings 10 5
Corrective Action Plans Elements of a good plan include: Effective and meaningful Addresses each deficiency Operating as intended Root causes identified Achievable milestones Ongoing evaluation of status Ongoing dialog with DCMA 11 Contractor Responses Contractor responses to initial determination Refute facts supporting deficiency Explain why deficiency is not significant Challenge applicability of system requirement Describe corrective actions Updates to policies and procedures Training Addresses all deficiencies and identified areas for improvement Best practice to have CAP in place immediately, ideally before response deadline Contractors conducting self-assessments have been in best position to respond timely 12 6
Not Evaluated Systems Determinations/status other than approved or disapproved The challenge: Lack of recent audit or functional specialist evaluations Insufficient documentation DCMA path forward Clarify the population Develop milestones for conversion to approved/disapproved For DCAA systems (accounting, estimating, and MMAS), DCAA has stated at public forums that system should be in approved status unless significant deficiencies have been reported 13 New DCAA Guidance June 26, 2014 DCAA Memo on Audit Guidance on Reporting Business System Deficiencies, 14 PAS 009(R) o Clarification to Business System Reporting Guidance Reporting Finding Less Severe than Significant Deficiencies/Material Weakness o Business System Noncompliances that are Less Severe Than Material Weakness but Warrant Attention of Those Charged with Governance 7
Proposed DOD Rules DFARS DFARS Proposed Business Systems Compliance Rule, 79 FR 41172, July 15 2014 In reaction to GAO November 3, 2011 Report (GAO 12 83) Would impose o Self Evaluations o Triennial CPA Audit 16 8
DFARS Under the revised rule, contractors would be required to provide a report on compliance with the relevant system criteria for the three systems. The report would include 1. A statement that the contractor has evaluated each system's compliance with the relevant system criteria; 2. the contractor's self assessment of each system's compliance, including a statement as to whether the system complies in all material respects, and a disclosure of any significant deficiencies; 3. The status of any disclosed significant deficiencies, including a CAP with milestones and actions to eliminate any significant deficiencies that have not been corrected as of the date of the report; and 4. A signature from an employee at a level no lower than a vice president or chief financial officer of the reporting business segment DFARS Under the new rule, for accounting and estimating systems, the report would be annual, and MMAS reporting would be required when the government requests an MMAS review, at least every three years. Accounting and estimating systems would be subject to a triennial audit by an independent contractor selected CPA to assess the contractor's compliance with system criteria. An MMAS audit by a CPA would be required when the government requests an MMAS review, at least every three years. Contractors would be required to ensure that CPAs are objective and qualified to provide the audit. 9
DFARS Contractors would be required to disclose: Documents to reasonably support the contractor's system assessment Information related to the contractor's selection of its CPA CPA working papers. DFARS Contractors with more than $100 million in qualifying sales, or that receive a government audit request also would be required to disclose: Their CPA's audit strategy Risk assessment Audit plan to the government for approval. A contractor's failure to comply with the applicable reporting and audit requirements would result in system disapproval and potential withholding. 10
DFARS Reaction Public Meeting August 18, 2014 Comments September 15, 2014 Good News Bad News 21 Questions? 22 11
Contact Information Mark Burroughs, Partner Dixon Hughes Goodman LLP 1410 Spring Hill Road, Suite 500 McLean, VA 22102 T 703.970.0519 mark.burroughs@dhgllp.com 12