DCAA Audits

Widespread Problems with Audit Quality Require Significant Reform Gao ID: GAO-09-1009T September 23, 2009

This testimony discusses our recent audit of the Defense Contract Audit Agency's (DCAA) overall management environment and quality assurance structure. DCAA is charged with a critical role in Department of Defense (DOD) contractor oversight by providing auditing, accounting, and financial advisory services in connection with the negotiation, administration, and settlement of contracts and subcontracts. DCAA's mission encompasses both audit and nonaudit services in support of DOD contracting and contract payment functions. DCAA audits of contractor internal controls in accounting, billing, estimating, and other key systems support decisions on pricing and contract awards. Internal control audits also impact the planning and reliability of other DCAA audits because DCAA uses the results of these audits to assess risk and plan the nature, extent, and timing of tests for other contractor audits and assignments. Last year, we reported the results of our investigation of allegations about certain DCAA audits at three locations in California, which substantiated claims that (1) audit documentation did not support the reported opinions; (2) DCAA supervisors dropped findings and changed audit opinions without adequate audit evidence for their changes; and (3) sufficient work was not performed to support the audit opinions and conclusions. At that time we were conducting a broader audit of DCAA's overall organizational environment and quality control system. Given the evidence presented at the Committee's September 2008 hearing, you requested that we expand our ongoing assessment. Our current report, which the Committee is releasing today, presents the results of our DCAA-wide audit, including (1) an assessment of DCAA's management environment and quality assurance structure; (2) an analysis of DCAA's corrective actions in response to our July 2008 report and two DOD reviews, and (3) potential legislative and other actions that could improve DCAA's effectiveness and independence.

A management environment and agency culture that focused on facilitating the award of contracts and an ineffective audit quality assurance structure are at the root of the agencywide audit failures we identified. DCAA's focus on a production-oriented mission led DCAA management to establish policies, procedures, and training that emphasized performing a large quantity of audits to support contracting decisions and gave inadequate attention to performing quality audits. An ineffective quality assurance structure, whereby DCAA gave passing scores to deficient audits compounded this problem. DCAA initiated a number of actions to address findings in our July 2008 report, the DOD Comptroller/CFO August 2008 "tiger team" review, and the Defense Business Board study, which was officially released in January 2009. Examples of key DCAA actions to date include the following. (1) Eliminating production metrics and implementing new metrics intended to focus on achieving quality audits. (2) Establishing an anonymous Web site to address management and hotline issues. DCAA's Assistant Director for Operations has been proactive in handling internal DCAA Web site hotline complaints. (3) Revising policy guidance to address auditor independence, assure management involvement in key decisions, and address audit quality issues. DCAA also took action to halt auditor participation in nonaudit services that posed independence concerns. In addition to correcting the fundamental weaknesses in DCAA's mission and overall management environment, we believe certain legislative measures as well as other actions could enhance DCAA's effectiveness and independence. For example, granting DCAA certain authorities and protections--similar to those offered to presidentially appointed inspectors general (IG) under the IG Act--could enhance DCAA's independence. In the longer term, Congress could consider changes in organizational placement after DCAA has had sufficient opportunity to effectively implement current reform efforts.



GAO-09-1009T, DCAA Audits: Widespread Problems with Audit Quality Require Significant Reform This is the accessible text file for GAO report number GAO-09-1009T entitled 'DCAA Audits: Widespread Problems with Audit Quality Require Significant Reform' which was released on September 23, 2009. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Testimony: Before the Committee on Homeland Security and Governmental Affairs, U.S. Senate: United States Government Accountability Office: GAO: For Release on Delivery: Expected at 10:00 a.m. EDT: Wednesday, September 23, 2009: DCAA Audits: Widespread Problems with Audit Quality Require Significant Reform: Statement of Gregory D. Kutz, Managing Director: Forensic Audits and Special Investigations: Gayle L. Fischer, Assistant Director: Financial Management and Assurance: GAO-09-1009T: [End of section] Mr. Chairman and Members of the Committee: Thank you for the opportunity to discuss our recent audit of the Defense Contract Audit Agency's (DCAA) overall management environment and quality assurance structure. DCAA is charged with a critical role in Department of Defense (DOD) contractor oversight by providing auditing, accounting, and financial advisory services in connection with the negotiation, administration, and settlement of contracts and subcontracts.[Footnote 1] DCAA's mission encompasses both audit and nonaudit services in support of DOD contracting and contract payment functions. DCAA audits of contractor internal controls in accounting, billing, estimating, and other key systems support decisions on pricing and contract awards. Internal control audits also impact the planning and reliability of other DCAA audits because DCAA uses the results of these audits to assess risk and plan the nature, extent, and timing of tests for other contractor audits and assignments. Last year, we reported[Footnote 2] the results of our investigation of allegations about certain DCAA audits at three locations in California, which substantiated claims that (1) audit documentation did not support the reported opinions; (2) DCAA supervisors dropped findings and changed audit opinions without adequate audit evidence for their changes; and (3) sufficient work was not performed to support the audit opinions and conclusions. At that time we were conducting a broader audit of DCAA's overall organizational environment and quality control system. Given the evidence presented at the Committee's September 2008 hearing, you requested that we expand our ongoing assessment. Our current report,[Footnote 3] which the Committee is releasing today, presents the results of our DCAA-wide audit, including (1) an assessment of DCAA's management environment and quality assurance structure; (2) an analysis of DCAA's corrective actions in response to our July 2008 report and two DOD reviews,[Footnote 4] and (3) potential legislative and other actions that could improve DCAA's effectiveness and independence. To assess DCAA's overall management environment and quality assurance structure, we analyzed DCAA's mission statement and strategic plan, performance metrics, policies and audit guidance, and system of quality control. We also reviewed audit documentation for 69 selected audits and cost-related assignments at certain field audit offices (FAO) in each of DCAA's five regions for compliance with generally accepted government auditing standards (GAGAS)[Footnote 5] and other applicable standards. We selected 37 audits of contractor internal control systems performed by seven geographically disperse DCAA field offices within the five DCAA regions during fiscal years 2004 through 2006.[Footnote 6] Our approach focused on DCAA offices that reported predominately adequate, or "clean," opinions on audits of contractor internal controls over cost accounting, billing, and cost estimating systems issued in fiscal years 2005 and 2006. [Footnote 7] We did this because contracting officers rely on these opinions for 3 or more years to make decisions on pricing and contract awards, and payment. For example, audits of estimating system controls support negotiation of fair and reasonable prices.[Footnote 8] Also, the FAR requires contractors to have an adequate accounting system prior to award of a cost- reimbursable or other flexibly priced contract.[Footnote 9] Billing system internal control audit results support decisions to authorize contractors to submit invoices directly to DOD and other federal agency disbursing offices for payment without government review.[Footnote 10] Because DCAA uses the results of internal control audits to assess risk and plan the nature, extent, and timing of tests for other contractor audits and assignments, the conclusions and opinions in these audits impact hundreds of other DCAA audits. At the same seven DCAA field offices, we selected an additional 32 cost-related assignments for review, including 16 paid voucher reviews, 10 overpayment assignments, 2 requests for equitable adjustment audits, and 4 incurred cost audits that were completed during fiscal years 2004 through 2006. We reviewed supporting documentation for the cost-related assignments to determine whether DCAA auditors were identifying and reporting contractor overpayments and billing errors.[Footnote 11] To assess DCAA corrective actions, we reviewed the status and analyzed several key actions that DCAA initiated as a result of our earlier investigation, including changes in performance metrics and policy and procedural guidance, as well as DCAA efforts in response to DOD Comptroller/Chief Financial Officer (CFO)[Footnote 12] and Defense Business Board[Footnote 13] recommendations. To identify potential legislative and other actions that could improve DCAA's effectiveness and independence, we considered DCAA's current role and responsibilities; the framework of statutory authority for auditor independence in the Inspector General Act of 1978, as amended;[Footnote 14] best practices of leading organizations that have made cultural and organizational transformations; our past work on DCAA organizational alternatives; GAGAS criteria for auditor integrity, objectivity, and independence; and GAO's Standards for Internal Control in the Federal Government[Footnote 15] on managerial leadership and oversight. Throughout our audit, we met with the DCAA Director and DCAA headquarters policy, quality assurance, and operations officials and DCAA region and FAO managers, supervisors, and auditors. We also met with DOD Office of Inspector General (OIG) auditors responsible for DCAA audit oversight and DOD OIG hotline office staff. In addition, we met with the former DOD Comptroller/CFO to discuss plans for the Office of Comptroller/CFO and Defense Business Board reviews, and we continued to meet with and obtain information from the new DOD Comptroller/CFO and his staff. We also met with the Comptroller's new DCAA Oversight Committee. We conducted our performance audit from August 2006 through December 2007, at which time we suspended this work to complete our investigation of hotline allegations regarding audits performed at three DCAA field offices. We resumed our work on the performance audit in October 2008 and performed additional work through mid-September 2009 to evaluate DCAA's quality assurance program during fiscal years 2007 and 2008, assess DCAA corrective actions on identified audit quality weaknesses, and consider legislative and organizational placement options for DCAA. We conducted our performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for findings and conclusions based on our audit objectives. We performed our investigative procedures in accordance with quality standards set forth by the Council of the Inspectors General on Integrity and Efficiency (formerly the President's Council on Integrity and Efficiency). Today, I will summarize the results of our audit. Widespread Management Environment and Audit Quality Problems: We found audit quality problems at DCAA offices nationwide. Of the 69 audits and cost-related assignments we reviewed,[Footnote 16] 65 exhibited serious GAGAS or other deficiencies similar to those found in our investigation, including compromise of auditor independence, insufficient audit testing, and inadequate planning and supervision. Although not as serious, the remaining four audits also had GAGAS compliance problems. In addition, while DCAA did not consider 26 of the 32 cost-related assignments we reviewed to be GAGAS audits, DCAA did not perform sufficient testing to support reported conclusions on that work. According to DCAA officials, DCAA rescinded 80 audit reports related to our prior investigation as well as the audit leading to today's report because the audit evidence was outdated, insufficient, or inconsistent with reported conclusions and opinions and reliance on the reports for contracting decisions could pose a problem. About one third of the rescinded reports relate to unsupported opinions on contractor internal controls and were used as the basis for risk- assessments and planning on subsequent internal control and cost- related audits. Other rescinded reports relate to Cost Accounting Standards (CAS) compliance and contract pricing decisions. Because the conclusions and opinions in the rescinded reports were used to assess risk in planning subsequent audits, they impact the reliability of hundreds of other audits and contracting decisions covering billions of dollars in DOD expenditures. A management environment and agency culture that focused on facilitating the award of contracts and an ineffective audit quality assurance structure are at the root of the agencywide audit failures we identified. DCAA's focus on a production-oriented mission led DCAA management to establish policies, procedures, and training that emphasized performing a large quantity of audits to support contracting decisions and gave inadequate attention to performing quality audits. An ineffective quality assurance structure, whereby DCAA gave passing scores to deficient audits compounded this problem. Although the reports for all 37 audits of contractor internal controls that we reviewed stated that the audits were performed in accordance with GAGAS, we found GAGAS compliance issues with all of these audits. The issues or themes are consistent with those identified in our prior investigation. Lack of independence. In seven audits, independence was compromised because auditors provided material nonaudit services to a contractor they later audited; experienced access to records problems that were not fully resolved; and significantly delayed report issuance, which allowed the contractors to resolve cited deficiencies so that they were not cited in the audit reports. GAGAS state that auditors should be free from influences that restrict access to records or that improperly modify audit scope.[Footnote 17] Insufficient testing. Thirty-three of 37 internal control audits did not include sufficient testing of internal controls to support auditor conclusions and opinions. GAGAS for examination-level attestation engagements require that sufficient evidence be obtained to provide a reasonable basis for the conclusion that is expressed in the report.[Footnote 18] For internal control audits, which are relied on for 2 to 4 years and sometimes longer, the auditors would be expected to test a representative selection of transactions across the year and not transactions for just one day, one month, or a couple of months.[Footnote 19] However, we found that for many controls, the procedures performed consisted of documenting the auditors' understanding of controls, and the auditors did not test the effectiveness of the implementation and operation of controls. Unsupported opinions. The lack of sufficient support for the audit opinions on 33 of the 37 internal control audits we reviewed rendered them unreliable for decision making on contract awards, direct-billing privileges, the reliability of cost estimates, and reported direct cost and indirect cost rates. For example, we found that: * For many controls, DCAA did not perform any testing at all. For example, audits of contractor accounting systems do not include any transaction testing. Instead, these audits focus on a review of the adequacy of contractor policies and procedures. At least six of the nine accounting audits we reviewed did not include procedures for confirming contractor segregation of allowable and unallowable cost. * DCAA issued an adequate opinion on the accounting system for a major DOD contractor after performing a walkthrough of the accounting process and interviewing two employees. * In billing system audits we reviewed, DCAA auditors often tested only two, three, or sometimes five transactions to support audit conclusions on contractor systems and related internal controls. Further, the auditors performed limited procedures such as determining whether the vouchers were mathematically correct and included current and cumulative billed amounts. Twenty of the 22 billing system audits we reviewed did not include tests to identify duplicate invoices. * DCAA auditors reported on the adequacy of a contractor's billing system based on tests of four vouchers, all issued on the same day. * In an audit of controls over indirect and other direct cost for a business segment of one of the top five DOD contractors, DCAA auditors tested 12 out of about 22,000 transactions processed from May through July 2005. We also found that reports did not adequately disclose the criteria used in performing individual audits. According to GAGAS, audit reports should, among other matters, identify the subject matter being reported and the criteria used to evaluate the subject matter. Criteria identify the required or desired state or expectation with respect to the program or operation and provide a context for evaluating evidence and understanding the findings.[Footnote 20] None of the 37 internal control audit reports we reviewed cited specific criteria used in individual audits. Instead, the reports uniformly used boilerplate language to state that DCAA audited for compliance with the "FAR, CAS, DFARS, and contract terms." As a result the user of the report does not know the specific Federal Acquisition Regulation (FAR), Cost Accounting Standards (CAS), or contract terms used as criteria to test contractor controls. This makes it difficult for users of the reports to determine whether the reports provide the level of assurance needed to make contracting decisions. Similarly, the 32 cost-related assignments we reviewed did not contain sufficient testing to provide reasonable assurance that overpayments and billing errors that might have occurred were identified. As a result, there is little assurance that any such errors, if they occurred, were corrected and that related improper contract payments, if any, were refunded or credited to the government. Contractors are responsible for ensuring that their billings reflect fair and reasonable prices and contain only allowable costs, and taxpayers expect DCAA to review these billings to provide reasonable assurance that the government is not paying more than it should for goods and services. We identified the following problems with these assignments. Paid voucher reviews. DCAA performs annual testing of paid vouchers (invoices) to determine if contractor voucher preparation procedures are adequate for continued contractor participation in the direct-bill program.[Footnote 21] Under the direct-bill program, contractors may submit their invoices directly to the DOD disbursing officer for payment without further review. Although DCAA does not consider its reviews of contractor paid vouchers to be GAGAS engagements, it has not determined what standards, if any, apply to these assignments. In addition, for the 16 paid voucher assignments we reviewed, we found that DCAA auditors failed to comply with DCAA Contract Audit Manual (CAM) guidance.[Footnote 22] Rather than documenting the population of vouchers, preparing sampling plans, and testing a random (statistical) sample, auditors generally did not identify the population of vouchers, did not create sampling plans, and made a small, nonrepresentative selection of as few as one or two invoices for testing to support conclusions on their work. The auditors performed limited procedures such as determining whether the vouchers were mathematically correct and included current and cumulative billed amounts. Based on this limited work, the auditors concluded that controls over invoice preparation were sufficient to support approval of the contractors' direct billing privileges. This is of particular concern because we determined that Defense Finance and Accounting Service (DFAS) certifying officers rely on DCAA voucher reviews, and they do not repeat review procedures they believe to be performed by DCAA. Overpayment assignments. DCAA performs overpayment assignments to verify that contractors have billing procedures and internal controls in place to identify and resolve contractor billing errors and overpayments in a timely manner. DCAA guidance states that these engagements should be conducted in accordance with GAGAS to the extent applicable under the circumstances.[Footnote 23] However, none of the 10 overpayment assignments we reviewed were performed or reported as GAGAS engagements. We found that auditor judgments about the population and selection of transactions for these assignments did not provide a representative universe for testing and concluding on contractor controls over billings and payments received. For example, for the 10 assignments we assessed, the auditors selectively reviewed an accounts receivable aging report to identify overpayments and determine if they had been resolved. As a result, this work does not provide reasonable assurance that contractors have adequate controls in place to identify and correct overpayments and billing errors and make appropriate, timely refunds and adjustments. Incurred cost audits. The purpose of incurred cost audits is to examine contractors' cost representations and opine on whether the costs are allowable, allocable to government contracts, and reasonable in accordance with the contract and applicable government acquisition regulations. [Footnote 24] DCAA performs these audits as GAGAS attestation engagements. For the four incurred cost audits we reviewed, we found that the auditors did not adequately document their judgments about control risk or the sampling and test methodologies used. In addition, we found that the auditors traced claimed pool and base costs (indirect costs) to the contractors' accounting books and records to determine their accuracy and allowability. However, the auditors did not perform sufficient, detailed testing of claimed indirect and direct costs. For example, the auditors traced and reconciled indirect costs to contractor accounting system data, but did not test a representative selection of direct costs. As a result, the scope of work performed was not sufficient to identify claimed costs, if any, that were not adequately supported or unallowable costs, if any, that should have been questioned. Production environment and audit quality issues. DCAA's mission statement, strategic plan, and metrics all focused on producing a large number of audit reports and provided little focus on assuring quality audits. For example, DCAA's current approach of performing 30,000 to 35,000 audits and issuing over 22,000 audit reports with 3,600 auditors substantially contributed to the widespread audit quality problems we identified. Within this environment, DCAA's audit quality assurance program was not properly implemented, resulting in an ineffective quality control process that accepted audits with significant deficiencies and noncompliance with GAGAS and DCAA policy. Moreover, even when DCAA's quality assurance documentation showed evidence of serious deficiencies within individual offices, those offices were given satisfactory ratings. Considering the large number of DCAA audit reports issued annually and the reliance the contracting and finance communities have placed on DCAA audit conclusions and opinions, an effective quality assurance program is key to protecting the public interest. Such a program would report review findings along with recommendations for any needed corrective actions; provide training and additional policy guidance, as appropriate; and perform follow-up reviews to assure that corrective actions were taken. GAGAS require that each audit organization performing audits and attestation engagements in accordance with GAGAS should have a system of quality control that is designed to provide the audit organization with reasonable assurance that the organization and its personnel comply with professional standards and applicable legal and regulatory requirements, and have an external peer review at least once every 3 years.[Footnote 25] DCAA officials advised us that going forward, DCAA will no longer rate an FAO's overall compliance with GAGAS and DOD policy. The officials told us that instead, DCAA headquarters plans to (1) report the detailed results of the audit quality reviews, (2) make recommendations to FAOs for any needed corrective actions, (3) conduct follow-up reviews for all FAOs with identified audit deficiencies to ensure that corrective actions are taken, and (4) provide training and policy guidance, as appropriate. If properly implemented, these procedures would help to assure an effective audit quality assurance program. In addition, the DOD IG reported an adequate ("clean") opinion on DCAA's most recent peer review results although the reported evidence indicated that numerous audits had serious deficiencies in audit quality.[Footnote 26] In conducting DOD's audit oversight review of DCAA audits, DOD IG audit oversight reviewers considered the same results of DCAA's internal audit quality assurance reviews that we analyzed and reviewed numerous additional audits, which also identified significant GAGAS noncompliance as evidenced by DOD IG peer review findings and recommendations. Although the DOD IG report contained evidence of significant, systemic noncompliance with professional standards throughout DCAA audits that OIG staff reviewed and the IG report included numerous findings and recommendations related to those issues, the DOD IG gave DCAA a "clean" peer review opinion,[Footnote 27] concluding that for audits and attestation engagements performed during fiscal year 2006, "—the internal quality control system was operating effectively to provide reasonable assurance that DCAA personnel were following established policies, procedures, and applicable auditing standards..." The overall report conclusion in the DOD IG report is inconsistent with the detailed observations in the report, which indicate numerous significant deficiencies in DCAA's system of quality control. Furthermore, of the 80 audit reports that DCAA rescinded, 39 of the rescinded reports were issued during fiscal year 2006--the period covered by the last DOD IG peer review. Therefore, we have concluded that DCAA's quality control system for the period covered by the last DOD IG peer review was not effectively designed and implemented to provide assurance that DCAA and its personnel comply with professional standards. DCAA Is Making Progress, but Sustained Leadership and Oversight Is Needed: Although DCAA has taken several positive steps, much more needs to be done to address widespread audit quality problems. DCAA's production- oriented culture is deeply imbedded and will likely take several years to change. Under DCAA's decentralized management environment, there had been little headquarters oversight of DCAA regions, as demonstrated by the nationwide audit quality problems. DCAA's mission focused primarily on producing reports to support procurement and contracting community decisions with no mention of quality audits that serve taxpayer interest. Further, DCAA's culture has focused on hiring at the entry level and promoting from within the agency and most training has been conducted by agency staff, which has led to an insular culture where there are limited perspectives on how to make effective organizational changes. DCAA corrective actions. DCAA initiated a number of actions to address findings in our July 2008 report, the DOD Comptroller/CFO August 2008 "tiger team" review, and the Defense Business Board study, which was officially released in January 2009. Examples of key DCAA actions to date include the following. * Eliminating production metrics and implementing new metrics intended to focus on achieving quality audits. * Establishing an anonymous Web site to address management and hotline issues. DCAA's Assistant Director for Operations has been proactive in handling internal DCAA Web site hotline complaints. * Revising policy guidance to address auditor independence, assure management involvement in key decisions, and address audit quality issues. DCAA also took action to halt auditor participation in nonaudit services that posed independence concerns. Further, DCAA has enlisted assistance from other agencies to develop a human capital strategic plan, assist in cultural transformation, and conduct a staffing study. In March 2009, the new DCAA Comptroller/CFO established a DCAA Oversight Committee to monitor and advise on DCAA corrective actions. While these are positive actions, other DCAA actions have focused on process improvements, and DCAA has not yet addressed the fundamental weaknesses in its mission, strategic plan, audit approach, and human capital practices. Although DCAA is making progress, we are concerned that DCAA actions to date evidence some of the past cultural problems that could limit their success. For example, DCAA identified the following six new performance metrics as focusing on the intended outcome-related goal of achieving quality audits that comply with GAGAS.[Footnote 28] 1. Obtaining an unqualified DOD IG peer review opinion. 2. DCAA's internal quality assurance program results show that 100 percent of the audits reviewed reflected professional judgment. 3. Checklist confirmation that issued reports did not include serious deficiencies. 4. A goal that 45 percent of audit reports will have findings as an indication of the tangible value of the audit work performed. 5. A goal that 15 percent of the audits will use quantitative methods to measure the extent to which advanced level audit techniques are used. 6. A goal that auditors will meet 100 percent of their continuing professional education requirements on time. Given the problems with DOD IG peer review results and DCAA's ineffective quality assurance program, for these metrics to achieve the intended audit quality goal, significant changes will be needed. DCAA also retained three performance metrics that address issuing reports within specified times to support contract awards and closeouts, for example: 1. A forward-pricing audit timeliness goal of 95 percent based on agreement with requesters. 2. Incurred cost audit timeliness goals of 90 percent of corporate audits completed within 12 months, 90 percent of major contractor audits completed in 15 months, and 95 percent of non-major contractor audits completed in 24 months. 3. An efficiency goal of cost per direct audit hour of less than $113.45 to be monitored at the agency level only. It is critical that agreements with the contracting community on timeliness goals for forward-pricing and incurred cost audits allow performance of sufficient audit procedures to help contracting officers ensure that prices paid by the government are fair and reasonable, and that contract costs comply with applicable laws, regulations, cost accounting standards, and contract terms. Risk-based audit approach. DCAA did not agree to develop a risk-based audit approach, as recommended by the Defense Business Board. DCAA lacks a risk-based audit approach to address how it will perform required audits with available audit resources, reassess the need to perform 30,000 or more audits annually and the appropriate level of audit resources, and establish priorities for performing quality audits that meet GAGAS within available resources. While resources are a key element of a risk-based planning approach, DCAA is performing the Defense Business Board recommended staffing study as a stand-alone effort rather than performing this study in concert with an effort to establish a risk-based planning process. DCAA policy guidance. DCAA's new policy guidance on adequate audit documentation and testing does not contain sufficient instruction to assure that auditors (1) adequately document significant decisions affecting the audit objectives, scope and methodology, findings, conclusions, and recommendations and (2) perform sufficient work to support decisions to approve contractors for direct-bill status. For example, * DCAA's new policy on "Workpaper Documentation of Judgmental Selections"--requires a description of the universe (population) from which items are selected for testing, identification of items and attributes to be tested, and an explanation to support that the judgmental selection will result in adequate audit coverage. Emphasizing the requirement that audit documentation include a description of the population used for sampling and identification of items and attributes to be tested is appropriate. However, the requirement for an explanation in the audit documentation that the judgmental selection will result in adequate audit coverage needs to be sufficiently justified. GAGAS and AICPA standards require that auditors document significant decisions affecting the audit objectives, scope and methodology, findings, conclusions, and recommendations resulting from professional judgment.[Footnote 29] * DCAA's new policy on "Audit Guidance for Annual Testing of Contractor Eligibility for Direct Bill" is intended to determine whether continued reliance can be placed on the contractor's procedures for preparation of interim vouchers. This policy change clarified and consolidated audit steps related to the contractor's compliance with contract provisions, added audit steps for reviewing vouchers under time-and- material and labor-hour contracts, and removed the requirement to verify that the contractor's Central Contractor Registration is current. The policy memorandum states that this scope of work performed does not constitute an audit or attestation engagement under GAGAS. While it is within DCAA's purview to determine whether these procedures constitute an audit, because direct-bill decisions present a risk of undetected improper contract payments, prudent decisions to continue a contractor's direct-bill authorization would necessarily be based on testing a statistical sample of invoices[Footnote 30] and include a review of supporting documentation, including documentation to confirm the government received goods and services noted on the billing invoice. We confirmed that Defense Finance and Accounting Service certifying officers rely on DCAA reviews and that they do not repeat review procedures they believe to be performed by DCAA. In addition, DCAA's policy to eliminate the "inadequate-in-part" opinion for contractor internal control systems audits does not recognize different levels of severity of control deficiencies and weaknesses and could unfairly penalize contractors whose systems have less severe deficiencies by giving them the same opinion--"inadequate"-- as contractors having material weaknesses or significant deficiencies that in combination would constitute a material weakness. DCAA would benefit from outside expertise to develop effective audit policy guidance and training on auditing standards. Legislative and Other Actions Could Further Improve DCAA: In addition to correcting the fundamental weaknesses in DCAA's mission and overall management environment, we believe certain legislative measures as well as other actions could enhance DCAA's effectiveness and independence. For example, granting DCAA certain authorities and protections--similar to those offered to presidentially appointed inspectors general (IG) under the IG Act[Footnote 31]--could enhance DCAA's independence. The IG Act contains provisions that enhance the independence of presidentially appointed IGs, including protections from removal without congressional notification, access to independent legal counsel, public reporting of audit results, rights to take statements from contractor and other personnel, and budget visibility. These provisions would enhance the important DCAA initiatives currently under way. In the longer term, Congress could consider changes in organizational placement after DCAA has had sufficient opportunity to effectively implement current reform efforts. However, moving DCAA as an organization would require careful analysis and planning before implementation. Continued monitoring and oversight will be essential to assuring the successful implementation of DCAA's management initiatives. Our Recommendations and DOD's Response: Our report contains several recommendations to DOD as well as matters for congressional consideration intended to strengthen DCAA in fulfilling its contract audit responsibilities. Our report also discusses matters for congressional consideration that could enhance DCAA's effectiveness and independence. These recommendations and matters are discussed below. We made 17 recommendations to improve DCAA's management environment, audit quality, and oversight, including 15 recommendations to DOD and 2 recommendations to the DOD IG regarding DCAA's last peer review. DOD fully agreed with 13 of the 15 recommendations, partially concurred on one recommendation and did not concur with one other recommendation. We view DOD comments as being generally responsive to the intent of our recommendations. DOD partially concurred with our recommendation that DCAA consult with DOD stakeholders and engage outside experts to develop a risk-based contract audit approach that identifies resource requirements and focuses on performing quality audits that meet GAGAS. DOD stated that DCAA already has a risk-based contract audit approach that identifies resource requirements and focuses on performing quality audits that meet GAGAS. However, DOD stated that DCAA will coordinate with the Under Secretary of Defense for Acquisition, Technology, and Logistics (USD (AT&L)) to assess DCAA audit requirements.[Footnote 32] DOD expects to complete its assessment of stakeholder needs based on regulatory and statutory requirements by December 2010. We appreciate these steps; however, we remain concerned that DCAA's current approach of performing 30,000 to 35,000 audits and issuing over 22,000 audit reports with 3,600 auditors substantially contributed to the widespread audit quality problems we identified. Generating that many reports and doing that many audits with 3,600 auditors leaves very little time to perform in-depth, complex audits of contractors. DOD did not concur on our recommendation to develop policies and procedures related to direct-billing decisions, stating that (1) the department believes that a review of the contractor's interim public vouchers is an integral function of DCAA's continued assessment of a contractor's billing system, (2) DCAA is in the best position to review and approve contract interim billings based on its thorough understanding of the contractor's system, (3) DOD believes that our concerns are mitigated based on comprehensive supervisory and audit manager reviews, and (4) DCAA does not believe that the approval of interim vouchers along with the approval for contractors to be on direct billing results in a lack of auditor objectivity. We continue to believe that DCAA's management (nonaudit) responsibility to perform prepayment reviews of contractor vouchers for DOD and the auditor's decision-making role of approving contractors for direct- billing privileges based on its audit conclusions about the strength of the contractor's system of internal controls, create audit objectivity issues. Under normal circumstances, DCAA auditors must review contractor vouchers prior to payment--a management support function for DOD. By obtaining direct-billing privileges, however, contractors can receive payment for goods and services without a voucher review by DCAA prior to payment. Because we found that this situation created an incentive for DCAA to reduce its workload by recommending that contractors are placed on direct billing, we recommended that DCAA develop new policies and procedures to ensure a separation between staff reviewing vouchers and staff making direct-bill decisions. DCAA did not explain the basis for its belief that DCAA administrative staff have a thorough understanding of the contractors' systems. Further, we disagree with DOD's statement that our concerns are mitigated based on the comprehensive supervisory and audit manager reviews because this is not supported by our findings. The fact that DCAA approvals of contractor direct-bill privileges were not based on sufficient audit procedures as demonstrated by our work and DCAA's removal of over 200 contractors from the direct-bill program since our July 2008 report [Footnote 33] support our concern that the existence of such an incentive presents an objectivity impairment. With regard to our two recommendations to the DOD IG, the IG concurred on our recommendation to reconsider the overall conclusions in its May 2007 peer review report on its audit of DCAA's system of quality control. However, the IG did not agree with our recommendation to determine whether the report should be rescinded or modified and did not take action to do so. The IG comments stated that the IG took alternative action that conformed to the intent of our recommendation, including notification of DCAA on August 24, 2009, that the May 2007 "adequate" opinion on DCAA's system of quality control would expire on August 26, 2009. In addition, the IG stated, "We have determined that it is not prudent to allow the adequate opinion from our May 2007 report to carry forward." However, peer review opinions neither "expire" nor "carry forward" beyond the period covered by the peer review. Based on the significant audit quality deficiencies identified in the IG peer review report, DCAA's decision to rescind 80 audit reports--39 of which relate to the period of the IG's peer review--and the findings in our audit, we concluded that DCAA's quality control system for the period covered by the DOD IG peer review was not effectively designed and implemented to provide assurance that DCAA and its personnel comply with professional standards. DOD also provided comments on our matters for congressional consideration. Although DOD disagreed with the matters we discussed, we continue to believe these are valid matters for congressional consideration. The IG Act provides many important authorities and protections for IG's that could enhance DCAA's independence and effectiveness. Further, if DCAA is unsuccessful in addressing our recommendations for resolving fundamental weaknesses in its mission and the overall management environment under the current organizational placement, additional options would need to be considered. Mr. Chairman and Members of the Committee, this concludes my statement. We would be pleased to answer any questions that you may have at this time. Contacts and Acknowledgments: For further information about this testimony, please contact Gregory D. Kutz at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. Major contributors to our testimony include F. Abe Dymond, Assistant General Counsel; Richard Cambosos; Jeremiah Cockrum; Andrew McIntosh; and Lerone Reid. [End of section] Footnotes: [1] DCAA also performs audit services for other federal agencies on a fee-for-service basis. [2] GAO, DCAA Audits: Allegations That Certain Audits at Three Locations Did Not Meet Professional Standards Were Substantiated, [hyperlink, http://www.gao.gov/products/GAO-08-857] (Washington, D.C.: July 22, 2008). [3] GAO, DCAA Audits: Widespread Problems with Audit Quality Require Significant Reform, [hyperlink, http://www.gao.gov/products/GAO-09-468] (Washington, D.C.: Sept. 23, 2009). [4] DOD reviews included (1) an Under Secretary of Defense (Comptroller/Chief Financial Officer (CFO)) tiger team review and (2) a Defense Business Board Study. [5] GAO, Generally Accepted Government Auditing Standards, [hyperlink, http://www.gao.gov/products/GAO-03-673G] (Washington, D.C.: June 2003) and GAO-07-731G (Washington, D.C.: July 2007). [6] Although our selection of the seven offices and 37 internal control audits was not statistical, it represented about 9 percent of the total 76 DCAA offices that issued audit reports on contractor internal controls and nearly 18 percent of the 40 offices that issued 8 or more reports on contractor internal controls during fiscal year 2006. Of the 37 internal control audits we reviewed, 32 reports were issued with adequate opinions and 5 reports were issued with inadequate-in-part opinions. In the case of follow-up audits, we also reviewed the documentation for the previous audit to gain an understanding of the scope of work and deficiencies identified in the prior audit. These were the most recently completed fiscal years at the time we initiated our audit. [7] In selecting the seven DCAA offices, we considered a 2-year history of internal control audit results. The seven DCAA offices we selected reported adequate opinions on 89 percent or more of the internal control reports they issued during fiscal year 2006. During fiscal year 2005, 4 of the 7 offices reported adequate opinions in 85 percent or more of the internal control reports they issued, and the other 3 offices issued adequate opinions in 50 to 69 percent of the internal control audit reports they issued. [8] DCAA Contract Audit Manual (CAM) 5-1202.1a and Defense Federal Acquisition Regulation Supplement (DFARS) 215.407-5. [9] FAR 16.104(h) and 16.301-3(a)(1). [10] FAR 42.101 and DFARS 242.803. [11] Contractor overpayments can occur as a result of errors made by paying offices, such as duplicate payments and payments in excess of amounts billed, and contractor billing errors, such as using the wrong overhead rate, failing to withhold designated amounts on progress payments, duplicate billings, or billing for unallowable cost. Recoveries of overpayments can be accomplished through refunds, subsequent billing offsets, or other adjustments to correct billing errors. [12] Under Secretary of Defense--Comptroller, Memorandum for Director Defense Contract Audit Agency, Subject: Implementation of Corrective Actions (Washington, D.C.: Aug. 20, 2008). [13] Defense Business Board, Report to the Secretary of Defense: Independent Review Panel Report on the Defense Contract Audit Agency, October 2008. [14] Codified in an appendix to Title 5 of the United States Code (hereafter 5 U.S.C. App.). [15] GAO, Standards for Internal Control in the Federal Government, [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] (Washington, D.C.: November 1999). [16] Of the 69 DCAA assignments we reviewed, 37 were audits of contractor systems and related internal controls and 32 were cost related audits and assignments. [17] See [hyperlink, http://www.gao.gov/products/GAO-03-673G], 3.19, and [hyperlink, http://www.gao.gov/products/GAO-07-731G], 3.10. [18] [hyperlink, http://www.gao.gov/products/GAO-03-673G], 6.04b. [19] AICPA Statements on Auditing Standards, AU 350 and Audit and Accounting Guide: Audit Sampling, 3.14, 3.29-3.34, 3.58, and 3.61. [20] [hyperlink, http://www.gao.gov/products/GAO-07-731G], 4.15. [21] DCAA does not perform paid voucher reviews during the year that it performs an audit of the contractor's billing system internal controls. [22] CAM 6-1007. [23] DCAA, "Audit Program: Audit of Contractor Overpayments," (Activity Code 17310), April 2004, September 2007, and May 2008. [24] CAM 6-102. [25] [hyperlink, http://www.gao.gov/products/GAO-07-731G], 3.50- 3.52. [26] All 10 categories of recommendations in the DOD IG's report related to GAGAS compliance problems. [27] DOD Inspector General, Oversight Review: Review of the Defense Contract Audit Agency Quality Control System, Report No. D-2007-6-006 (Arlington, VA: May 1, 2007). [28] DCAA also established contracting officer sustention rates related to questioned cost and net savings as an informational goal to show return to the taxpayer. [29] [hyperlink, http://www.gao.gov/products/GAO-07-731G], 3.38 and AU 339.12. [30] Disbursing officers are authorized to make payments on the authority of a voucher certified by an authorized certifying officer, who is responsible for the legality, accuracy, and propriety of the payment. 31 U.S.C. 3325, 3527(c). DOD 7000.14-R, Department of Defense Financial Management Regulation (DFMR), Vol. 5, Ch. 11 (March 2009), paras. 110102, 110203. In general, certifying officers designated in writing by the agency are financially liable for any improper, illegal, or incorrect payment made, and each payment made must be audited (or "examined"). 31 U.S.C. 3521(a), 3528(a). DFMR, Vol. 5, Ch. 33 (April 2005), para. 330303. However, 31 U.S.C. 3521(b) authorizes heads of agencies to carry out a statistical sampling procedure, within certain parameters, to audit vouchers when the head of the agency determines that economies will result. Further, 31 U.S.C. 3521(c) provides that certifying and disbursing officials are not liable for payments that are not audited if they were made in good faith under a statistical sampling procedure. See 68 Comp. Gen. 618 (1989); also see generally, GAO, Policy and Procedures Manual for Guidance of Federal Agencies, title 7, 6.5, 7.4, and 7.5 (Washington, D.C.: May 18, 1993). [31] Codified in an appendix to Title 5 of the United States Code. [32] The USD (AT&L) is responsible under 10 U.S.C. 133 for establishing DOD policies related to the negotiation, award, and administration of contracts, such as those related to the use of contract audit services, and for coordinating contract audit activities within DOD. [33] [hyperlink, http://www.gao.gov/products/GAO-08-857]. [End of section] GAO's Mission: The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Phone: The price of each GAO publication reflects GAO‘s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO‘s Web site, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, D.C. 20548: Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, D.C. 20548:

The Justia Government Accountability Office site republishes public reports retrieved from the U.S. GAO These reports should not be considered official, and do not necessarily reflect the views of Justia.