Contract Audits
Role in Helping Ensure Effective Oversight and Reducing Improper Payments Gao ID: GAO-11-331T February 1, 2011In Process
The contracting cycle consists of activities throughout the acquisition process, including preaward and award, contract administration and management, and ultimately the contract closeout. Strong internal controls contain a balance of preventive and detective controls appropriate for the agency's operation and help ensure an effective contract oversight process. Preventive controls--such as invoice review prior to payment--are controls designed to prevent improper payments, waste, and mismanagement, while detective controls--such as incurred cost audits--are designed to identify improper payments after the payment is made. While detective controls identify funds that may have been inappropriately paid and should be returned to the government, preventive controls help to reduce the risk of improper payments or waste before they occur. DOD accounts for the largest share of federal contract spending. DCAA was established in 1965 in response to studies which identified the need for consistency in contract audits at DOD. DCAA serves a critical role in DOD and other federal agency contractor oversight by providing auditing, accounting, and financial advisory services in connection with the negotiation, administration, and closeout of contracts and subcontracts. The majority of DCAA audits focus on cost-reimbursable and other nonfixed-price contracts, which pose the highest risk to the government. Reported federal contract obligations--which have increased by $100 billion in real terms since fiscal year 2005, from $435 billion to $535 billion in fiscal year 2010--poses significant risk if effective contract oversight is not in place. GAO's work has identified contract management weaknesses, significant problems with federal agency controls over contract payments, and internal control deficiencies throughout the contracting process, including contract auditing. GAO also found audit quality problems at DCAA offices nationwide, including compromise of auditor independence, insufficient audit testing, and inadequate planning and supervision. DCAA and the other federal agencies mentioned in GAO's testimony have completed some actions and have actions under way to address GAO's recommendations. GAO made17 recommendations to DOD and the DOD Inspector General (IG) to address the weaknesses it identified at DCAA. DOD and DCAA have taken a number of actions on these recommendations, including revising DCAA's mission statement, appointing a new DCAA Director and a Western Region Director, establishing an internal review office to perform periodic internal evaluations and address hotline complaints, initiating outside hiring, strengthening its audit quality review function, and providing training on auditing standards. DCAA has actions under way on other recommendations. DOD IG has expanded its oversight of DCAA's audit quality control process. In addition, the Centers for Medicare and Medicaid Services (CMS) have completed actions on two recommendations and expect to complete actions on all but one of the remaining 16 recommendations by March 31, 2011. Department of Energy official's stated that actions have been complete on all 11 GAO recommendations. GAO is following up to confirm.
GAO-11-331T, Contract Audits: Role in Helping Ensure Effective Oversight and Reducing Improper Payments
This is the accessible text file for GAO report number GAO-11-331T
entitled 'Contract Audits: Role in Helping Ensure Effective Oversight
and Reducing Improper Payments' which was released on February 1, 2011.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as
part of a longer term project to improve GAO products' accessibility.
Every attempt has been made to maintain the structural and data
integrity of the original printed product. Accessibility features,
such as text descriptions of tables, consecutively numbered footnotes
placed at the end of the file, and the text of agency comment letters,
are provided but may not exactly duplicate the presentation or format
of the printed version. The portable document format (PDF) file is an
exact electronic replica of the printed version. We welcome your
feedback. Please E-mail your comments regarding the contents or
accessibility features of this document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
United States Government Accountability Office:
GAO:
Testimony before the Subcommittee on Contracting Oversight, Committee
on Homeland Security and Governmental Affairs, U.S. Senate:
For Release on Delivery:
Expected at 2:30 p.m. EST:
Tuesday, February 1, 2011:
Contract Audits:
Role in Helping Ensure Effective Oversight and Reducing Improper
Payments:
Statement of Jeanette M. Franzel:
Managing Director:
Accompanied by Gayle L. Fischer:
Assistant Director:
Financial Management and Assurance:
GAO-11-331T:
GAO Highlights:
Highlights of GAO-11-331T, a testimony before the Subcommittee on
Contracting Oversight, Committee on Homeland Security and Governmental
Affairs, U.S. Senate.
Why GAO Did This Study:
Agencies across the government are increasingly reliant on contractors
to execute their missions. With hundreds of billions of taxpayer
dollars at stake, the government needs strong controls to provide
reasonable assurance that these contract funds are not being lost to
improper payments (fraud and errors), waste, and mismanagement.
Effective contract oversight, which includes effective internal
controls throughout the contracting process, is essential to
protecting government and taxpayer interests. Standards for Internal
Control in the Federal Government provides the overall framework for
internal control, which includes the control environment, risk
assessment, control activities, information and communication, and
monitoring.
Contract auditing is a control mechanism intended to provide those
responsible for government procurement with financial information and
advice relating to contractual matters and the effectiveness,
efficiency, and economy of contractors‘ operations.
Today‘s testimony describes the (1) contracting cycle and related
internal controls, (2) Defense Contract Audit Agency (DCAA) and its
role in performing contract audits for the Department of Defense (DOD)
and other federal agencies, and (3) risks associated with ineffective
contract controls and auditing.
GAO‘s testimony is based on prior reports and testimonies, as listed
at the end of this statement.
What GAO Found:
The contracting cycle consists of activities throughout the
acquisition process, including preaward and award, contract
administration and management, and ultimately the contract closeout.
Strong internal controls contain a balance of preventive and detective
controls appropriate for the agency‘s operation and help ensure an
effective contract oversight process. Preventive controls”-such as
invoice review prior to payment”-are controls designed to prevent
improper payments, waste, and mismanagement, while detective controls-”
such as incurred cost audits-”are designed to identify improper
payments after the payment is made. While detective controls identify
funds that may have been inappropriately paid and should be returned
to the government, preventive controls help to reduce the risk of
improper payments or waste before they occur.
DOD accounts for the largest share of federal contract spending. DCAA
was established in 1965 in response to studies which identified the
need for consistency in contract audits at DOD. DCAA serves a critical
role in DOD and other federal agency contractor oversight by providing
auditing, accounting, and financial advisory services in connection
with the negotiation, administration, and closeout of contracts and
subcontracts. The majority of DCAA audits focus on cost-reimbursable
and other nonfixed-price contracts, which pose the highest risk to the
government.
Reported federal contract obligations-”which have increased by $100
billion in real terms since fiscal year 2005, from $435 billion to
$535 billion in fiscal year 2010”-poses significant risk if effective
contract oversight is not in place. GAO‘s work has identified contract
management weaknesses, significant problems with federal agency
controls over contract payments, and internal control deficiencies
throughout the contracting process, including contract auditing. GAO
also found audit quality problems at DCAA offices nationwide,
including compromise of auditor independence, insufficient audit
testing, and inadequate planning and supervision.
DCAA and the other federal agencies mentioned in GAO‘s testimony have
completed some actions and have actions under way to address GAO‘s
recommendations. GAO made17 recommendations to DOD and the DOD
Inspector General (IG) to address the weaknesses it identified at
DCAA. DOD and DCAA have taken a number of actions on these
recommendations, including revising DCAA‘s mission statement,
appointing a new DCAA Director and a Western Region Director,
establishing an internal review office to perform periodic internal
evaluations and address hotline complaints, initiating outside hiring,
strengthening its audit quality review function, and providing
training on auditing standards. DCAA has actions under way on other
recommendations. DOD IG has expanded its oversight of DCAA‘s audit
quality control process. In addition, the Centers for Medicare and
Medicaid Services (CMS) have completed actions on two recommendations
and expect to complete actions on all but one of the remaining 16
recommendations by March 31, 2011. Department of Energy official‘s
stated that actions have been complete on all 11 GAO recommendations.
GAO is following up to confirm.
View [hyperlink, http://www.gao.gov/products/GAO-11-331T] or key
components. For more information, contact Jeanette M. Franzel at (202)
512-9471 or franzelj@gao.gov.
[End of section]
Dear Madam Chairman and Members of the Subcommittee:
Thank you for the opportunity to be here today to discuss the role
that contract audits can serve in contract oversight processes and
helping to reduce the risk of improper payments. The purpose of
contract auditing is to assist in achieving prudent contracting by
providing those responsible for government procurement with financial
information and advice relating to contractual matters and the
effectiveness, efficiency, and economy of contractors' operations.
With reported federal contract spending topping the $500 billion mark
annually, effective contract oversight, which includes effective
internal control throughout the contracting process, is essential to
protecting the government and taxpayer interests. The Standards for
Internal Control in the Federal Government provide the overall
framework for establishing and maintaining internal control and for
identifying and addressing areas at greatest risk of fraud, waste,
abuse, and mismanagement.[Footnote 1]
Today, I will describe the (1) contracting cycle and the general
nature of internal controls that should be in place, (2) Defense
Contract Audit Agency (DCAA) and its role in performing contract
audits, and (3) risks associated with ineffective contract controls
and auditing. I will conclude by outlining some potential actions that
could improve the effectiveness of DCAA and its role in performing
contract audits for the Department of Defense (DOD) and other federal
agencies.
In preparing this testimony, we relied on the work we performed during
our DCAA engagements,[Footnote 2] as well as our extensive body of
work on federal agency contract management. More detail on our scope
and methodology is included in each issued product. Our audit work was
conducted in accordance with generally accepted government auditing
standards (GAGAS). Those standards require that we plan and perform
our audits to obtain sufficient, appropriate evidence to provide a
reasonable basis for our findings and conclusions based on our audit
objectives. We believe that the evidence obtained provides a
reasonable basis for our findings and conclusions based on our audit
objectives.
The Contracting Cycle and Internal Controls:
The contracting cycle consists of activities throughout the
acquisition process, including preaward and award, contract
administration and management, and ultimately the contract closeout.
Generally, prior to contract award, an agency identifies a need;
develops a requirements package; determines the method of acquisition;
solicits and evaluates bids or proposals; determines the adequacy of
the contractor's accounting system for billing purposes; and
ultimately negotiates a price and contract terms, resulting in the
contract awards. After contract award, the agency performs activities
related to contract administration and management. Contract
administration and management involves monitoring the contractor's
performance as well as reviewing and approving (or disapproving) the
contractor's requests for payments. As discussed in more detail later
in this statement, there are various types of contract audit
activities that can occur in the preaward and award, and
administration and management phases of a contract. The contract
closeout process involves verifying that the goods or services were
provided and that administrative matters are completed, including a
contract audit of costs billed to the government and adjusting for any
over-or underpayments based on the final invoice. Effective contract
oversight includes effective internal control throughout the
contracting process.
Internal Control:
Generally, the government manages its risk, in part, through
establishing effective internal controls, which includes performing
oversight activities. Standards for Internal Control provides that to
be effective, an entity's management should establish both a
supportive overall control environment and specific control activities
directed at carrying out its objectives.[Footnote 3] As such, an
entity's management should establish and maintain an environment that
sets a positive and supportive attitude towards control and
conscientious management. A positive control environment provides
discipline and structure as well as a climate supportive of quality
internal control, and includes an assessment of the risks the agency
faces from both external and internal sources. Control activities are
the policies, procedures, techniques, and mechanisms that enforce
management's directives and help ensure that actions are taken to
address risks. The standards further provide that information should
be recorded and communicated to management and oversight officials in
a form and within a time frame that enables them to carry out their
responsibilities. Finally, an entity should have internal control
monitoring activities in place to assess the quality of performance
over time and ensure that the findings of audits and other reviews are
promptly resolved.
Control activities include both preventive and detective controls.
Preventive controls--such as invoice review prior to payment--are
controls designed to prevent improper payments (errors and fraud),
[Footnote 4] waste, and mismanagement, while detective controls--such
as incurred cost audits--are designed to identify errors or improper
payments after the payment is made. A sound system of internal control
contains a balance of both preventive and detective controls that is
appropriate for the agency's operations. While detective controls are
beneficial in that they identify funds that may have been
inappropriately paid and should be returned to the government,
preventive controls such as accounting system reviews and invoice
reviews help to reduce the risk of improper payments or waste before
they occur. A key concept in the standards is that the cost of control
activities should not outweigh the benefit. Generally, it is more
effective and efficient to prevent improper payments. A control
activity can be preventive, detective, or both, based on when the
control occurs in the contract life cycle.
Contract Types and Related Risks:
Agencies may choose among different contract types to acquire goods
and services.[Footnote 5] This choice is the principal means that
agencies have for allocating risk between the government and the
contractor. The choice of a contract type will also impact the types
of internal control and contract auditing activities needed to help
protect the government's interests and reduce the risk of improper
payments. Contract types can be grouped into two broad categories:
fixed-price contracts and nonfixed-price contracts, such as cost-
reimbursable contracts and time and materials (T&M) contracts.
Although the Federal Acquisition Regulation (FAR) places limitations
on the use of cost-reimbursement and T&M contract types, these
contract types may be used to provide the flexibility needed by the
government to acquire the large variety and volume of supplies and
services it needs. The three types of contracts place different levels
of risk on the government and the contractor. For example,
* For fixed-price contracts, the government agrees to pay a set price
for goods or services regardless of the actual cost to the contractor.
A fixed-price contract is ordinarily in the government's interest when
the risks involving the project and the project's price are minimal or
can be predicted with an acceptable degree of certainty and a sound
basis for pricing exists, as the contractor assumes the risk for cost
overruns.
* Under cost-reimbursement contracts, the government agrees to pay
those costs of the contractor that are allowable, reasonable, and
allocable to the extent prescribed by the contract. Consequently, the
government assumes most of the cost risk. The contractor is required
to provide its best effort to meet contract objectives within the
estimated cost. If this cannot be done, the government can provide
additional funds to complete the effort, decide not to provide
additional funds, or terminate the contract. Cost-reimbursement
contracts may be used only when the contractor's accounting system is
adequate for determining costs applicable to the contract and
appropriate government surveillance during contract performance will
provide reasonable assurance that efficient methods and effective cost
controls are used.[Footnote 6] In order to determine if the contractor
has efficient methods and effective cost controls, contracting
officers and other contracting oversight personnel may perform reviews
of various contractor systems, as well as a comprehensive review of
contractor invoices to determine if the contractor is billing costs in
accordance with the contract terms and applicable government
regulations. In addition, the establishment of provisional and final
indirect cost rates helps to ensure that the government makes payments
for costs that are allowable, reasonable, and allocable to the extent
prescribed by the contract.
* For T&M contracts, the government agrees to pay fixed, per-hour
labor rates and to reimburse other costs directly related to the
contract, such as materials, equipment, or travel, based on cost. Like
cost-reimbursement contracts, the government assumes the cost risk
because the contractor is only required to make a good faith effort to
meet the government's needs within a ceiling price. A T&M contract may
be used only if the contracting officer prepares a determination and
findings that no other contract type is suitable and if the contract
includes a ceiling price that the contractor exceeds at its own risk.
[Footnote 7] In addition, since these contracts provide no positive
profit incentive for the contractor to control costs or use labor
efficiently, the government must conduct appropriate surveillance of
contractor performance to ensure efficient methods and effective cost
controls are being used.
* As discussed in more detail later in this statement, most contract
audit activity is focused on cost-reimbursable and other nonfixed-
price contracts, due to the higher risks to the federal government.
DCAA's Origin and Contract Audit Role:
Audits of military contracts can be traced back to at least the World
War I era. Initially, the various branches of the military had their
own contract audit function and associated instructions and accounting
rulings. Contractors and government personnel recognized the need for
consistency in both contract administration and audit. The Navy and
the Army Air Corps made the first attempt to perform joint audits in
1939. By December 1942, the Navy, the Army Air Corps, and the Ordnance
Department had established audit coordination committees for selected
areas where plants were producing different items under contracts for
more than one service. On June 18, 1952, the three military services
jointly issued a contract audit manual that later became the DCAA
Contract Audit Manual (CAM).[Footnote 8] The CAM has been regularly
updated over the years and is still in use today.
In May 1962, Secretary of Defense Robert S. McNamara instituted
"Project 60" to examine the feasibility of centrally managing the
field activities concerned with contract administration and audit.
[Footnote 9] An outcome of this study was the decision to establish a
single contract audit capability within DOD and DCAA was established
on June 8, 1965.[Footnote 10] At that time, DCAA's mission was to
perform all necessary contract audits for DOD and provide accounting
and financial advisory services regarding contracts and subcontracts
to all DOD components responsible for procurement and contract
administration. DCAA was placed under management control of the Under
Secretary of Defense (Comptroller), where it remains today. Other
audit organizations, including the DOD and other federal agency
Inspectors General (IG), the Special IGs for Iraq and Afghanistan, and
the military service audit agencies also have a role in the oversight
of federal contracts.
DCAA consists of a headquarters office at Fort Belvoir, Virginia, and
six major organizational components--a field detachment office, which
handles audits of classified contracting activity, and five regional
offices within the United States. The regional offices manage field
audit offices (FAO), which are identified as branch offices, resident
offices, or suboffices. Resident offices are located at larger
contractor facilities in order to facilitate DCAA audit work. In
addition, regional office directors can establish suboffices as
extensions of FAOs to provide contract audit services more
economically. A suboffice depends on its parent FAO for release of
audit reports and other administrative support. In total, there are
currently 382 DCAA offices, including 114 FAOs, throughout the United
States and overseas. At the end of fiscal year 2010, DCAA employed
about 4,700 staff, of which 85 percent are auditors, at DCAA's various
offices throughout the United States, Europe, the Middle East, and in
the Pacific to perform audits and provide nonaudit services in support
of contract negotiations related to approximately 9,000 contractors.
DCAA contract audits are intended to be a key control to help ensure
that prices paid by the government for needed goods and services are
fair and reasonable and that contractors are charging the government
in accordance with applicable laws, the Federal Acquisition Regulation
(FAR), Cost Accounting Standards (CAS), and contract terms. DCAA's
mission encompasses both audit and nonaudit services in support of DOD
and other federal agencies' contracting and contract payment
functions. FAR subpart 42.1, "Contract Audit Services," and DOD
Directive 5105.36, Defense Contract Audit Agency (DCAA), establish
DCAA as the department's contract audit agency[Footnote 11] and set
forth DCAA's responsibilities.
FAR 42.101 prescribes contract audit responsibilities as submitting
information and advice to the requesting activity, based on the
analysis of contractor financial and accounting records or other
related data as to the acceptability of the contractors' incurred and
estimated costs; reviewing the financial and accounting aspects of
contractor cost control systems; and performing other analyses and
reviews that require access to contractor financial and accounting
records supporting proposed and incurred costs.
DOD's acquisition life cycle includes many contract and administrative
activities. As illustrated in figure 1, these activities fall into
three contract phases--preaward and award, administration and
management, and closeout--that involve several activities and numerous
types of audits. DCAA and other federal agencies are not consistent in
their definitions of contract audits and reviews and other federal
agencies generally do not perform the full range of audits that DCAA
performs. While the majority of DCAA's audit effort supports the DOD
contract community, in fiscal year 2010, based on DCAA records, about
12 percent of DCAA's audit hours were used to respond to other federal
agency requests for contractor audits. DCAA performs audit services
for other federal agencies on a fee-for-service basis. Appendix I
contains information on DCAA audits and nonaudit services provided by
DCAA in support of contracting and contract payment.
Figure 1: Relationship of Contract Phases, Contract Events, and DCAA
Audits:
[Refer to PDF for image: table]
Contract phases: Preaward and award;
Contract events:
* Proposal;
* Contract negotiations;
* Contract award;
Audit activities:
* Full proposal;
* Rate review;
* Financial capability;
* Preaward accounting survey;
* Initial Disclosure Statement review;
* Other.
Contract phases: Administration and management;
Contract events:
* Contract performance;
Audit activities:
* Provisional billing rates;
* Progress payments (fixed price and fixed price incentive fee
contracts only);
* Earned value management system (if required);
* Other requested special audits;
* Annual incurred cost reviews (flexibly priced contracts only);
* Audits of contractor internal control systems;
* Cost accounting standard (CAS) compliance;
* Paid voucher reviews;
* Overpayment review.
Contract phases: Closeout;
Contract events:
* Contract physically complete;
* Contract closed;
Audit activities:
* Final price submissions (fixed price incentive fee contracts);
* Contract audit closing statement (cost type and time and materials
contracts);
* Termination.
Source: GAO analysis of DCAA information.
[End of figure]
The majority of DCAA audits focus on cost-reimbursable and other
nonfixed-price contracts, including progress payments on major weapon
systems and time-and-materials contracts. These contract types pose
the highest risk to the government because the government is generally
not promised a completed deliverable or service at a set price. DCAA
audits of contractor business systems and related internal controls
support decisions on pricing, contract awards, and billing. For
example, the FAR requires government contracting officers to determine
the adequacy of a contractor's accounting system before awarding a
cost-reimbursement or other nonfixed-price contract.[Footnote 12]
Audits of estimating system controls support negotiation of fair and
reasonable prices.[Footnote 13] Also, billing system audits support
decisions to authorize contractors to submit invoices directly to DOD
payment offices for payment without government review.[Footnote 14]
Internal control audits also impact the planning and reliability of
other DCAA audits, such as audits of contractors' pricing proposals
and annual incurred cost claims, because DCAA uses the results of its
internal control audits to assess risk and plan the nature, extent,
and timing of tests for these audits.
Risks of Ineffective Contract Controls and Auditing:
Agencies across the government are increasingly reliant on contractors
to execute their missions. In fiscal year 2010, federal agencies
reported obligating approximately $535 billion on goods and services--
more than double the amount obligated at the start of the last decade
in real terms. Our analysis of Federal Procurement Data System-Next
Generation (FPDS-NG) contract obligations[Footnote 15] determined that
although federal contract spending increases have slowed and decreased
slightly in recent years, over the past 5 years federal contract
spending has increased by $100 billion.[Footnote 16] As illustrated in
figure 2, the sheer size of federal contract spending poses
significant risk if effective processes, controls, and oversight are
not in place. DOD accounts for approximately 70 percent of the federal
government's FPDS-NG reported annual contract spending--$367 billion
in fiscal year 2010--and other federal agencies accounted for $168
billion in contract spending. With hundreds of billions in taxpayer
dollars spent on government contracts, strong contract oversight is
essential.
Figure 2: DOD and Other Federal Agency Contract Obligations Related to
Actions over $25,000 for Fiscal Years 2005 through 2010[A]:
[Refer to PDF for image: stacked vertical bar graph]
Year: 2005;
DOD contract obligations: $302 billion;
Other federal agency contract obligations: $134 billion;
Total: $435 billion.
Year: 2006;
DOD contract obligations: $321 billion;
Other federal agency contract obligations: $142 billion;
Total: $462 billion.
Year: 2007;
DOD contract obligations: $355 billion;
Other federal agency contract obligations: $141 billion;
Total: $496 billion.
Year: 2008[B];
DOD contract obligations: $391 billion;
Other federal agency contract obligations: $147 billion;
Total: $538 billion.
Year: 2009[B];
DOD contract obligations: $390 billion;
Other federal agency contract obligations: $168 billion;
Total: $558 billion.
Year: 2010;
DOD contract obligations: $367 billion;
Other federal agency contract obligations: $168 billion;
Total: $535 billion.
Source: GAO analysis of unaudited obligations data from the Federal
Procurement Data System.
[A] Contract obligations are adjusted for inflation using the fiscal
year 2010 Gross Domestic Price Index.
[B] DOD's reported obligations in fiscal year 2008 and 2009 reflected
an approximately $13.9 billion adjustment to correct an error made in
fiscal year 2008.
[End of figure]
GAO's work has shown that agencies confront several interrelated
challenges, including separating wants from needs; executing
acquisition programs within available funding and established time
frames; using sound contracting arrangements with appropriate
incentives and effective oversight; assuring that contractors are used
only in appropriate circumstances and play proper roles; and
sustaining a capable and accountable acquisition workforce. In
addition, since 1997, we have reported that the nonacquisition
workforce, such as contracting officer representatives and unit
leaders, also have a role in contract management and must be trained.
These challenges have contributed to GAO's designating contract
management as a high-risk area at DOD, the Department of Energy, and
the National Aeronautical and Space Administration. Weapon system
acquisition is also designated as a high-risk area at DOD.
Governmentwide, GAO also designated the management and use of
interagency contracting as high risk. Other agencies face many of the
same challenges. Collectively, these challenges expose hundreds of
billions of taxpayer dollars to potential risks of improper payments,
waste, and mismanagement.
Contracting Control Weaknesses Identified in GAO Work:
Our work has identified significant contract management weaknesses,
problems with federal agency controls over contract payments , as well
as weaknesses in contract auditing.[Footnote 17] We have identified
internal control deficiencies that have occurred throughout the
contracting process and phases. These weaknesses and deficiencies
increase the risk of improper payments, and fraud, waste, abuse, and
mismanagement. For example, we found:
Department of Energy (DOE). DOE's internal controls over payments to
its Waste Treatment Plant (WTP) contractor did not provide reasonable
assurance against the risk of improper payments, particularly given
the WTP project's substantial inherent risks.[Footnote 18] Several
factors combine to pose an inherent risk to the government of improper
payments on this project, including the size and complexity of this
one-of-a-kind nuclear construction project, the multibillion-dollar
cost and schedule overruns the project had already experienced, and
the substantial volume of transactions billed by the contractor to DOE
on each invoice. Despite these risks, in fiscal years 2005 and 2006,
DOE performed little or no review of the contractor's invoices or
supporting documents for $40 million to $60 million billed by the
contractor to DOE each month. The need for close, ongoing review of
invoiced transactions and support is particularly compelling given
that the contractor's invoices provided little detail as to the items
purchased, contrary to FAR and contract requirements. However, DOE
officials chose instead to rely primarily on DCAA's review and
approval of the contractor's corporatewide financial systems, which
DOE officials believed allowed them to rely on the contractor's
systems with little or no DOE oversight. In addition, DOE relied
primarily on the contractor to review and validate subcontractor
charges without having a process in place to assess whether the
contractor was properly carrying out its subcontractor oversight
responsibility. DOE's heavy reliance on DCAA and the contractor, with
little oversight of its own, exposed the hundreds of millions of
dollars it spent annually on the WTP project to an unnecessarily high
risk of improper payments. Our July 2007 report made 11
recommendations to improve DOE's oversight of and accountability for
WTP expenditures. DOE officials advised us that they have completed
action on all 11 recommendations. We are currently following up to
confirm DOE's actions.
Centers for Medicare and Medicaid Services (CMS). We evaluated CMS's
Medicare Modernization Act (MMA) program contracting activity and
found that CMS did not fulfill critical contractor oversight
responsibilities, such as reviewing contractors' indirect cost rate
information and assessing the adequacy of the contractors' accounting
systems, thereby increasing risks of fraud, waste, and abuse not only
to CMS but to other federal agencies that may use the same
contractors.[Footnote 19] Specifically, we identified numerous
questionable payments totaling nearly $90 million that represented
potentially improper, unsubstantiated, or wasteful payments. For
example, we found payments for costs that did not comply with the
terms of the contract or applicable regulation, such as costs for
unapproved labor categories, costs exceeding contract indirect rate
ceiling amounts, and travel costs in excess of allowable limits. In
other cases, we were unable to obtain adequate documentation, such as
vendor invoices or time sheets, to support costs billed. In addition,
we identified payments for which risks in CMS's contracting practices
resulted in potential waste. In some cases, due to the facts and
circumstances involved, we were unable to determine whether or to what
extent the costs were allowable, reasonable, and allocable. Our
November 2007 report made nine recommendations to the Administrator of
CMS to improve internal control and accountability in the contracting
process and related payments to contractors. CMS completed actions to
develop agency-specific policies and procedures for the review of
contractor invoices and create a centralized tracking mechanism that
records the training taken by personnel assigned to contract oversight
activities. In addition, CMS officials advised that CMS has recovered
$2.8 million, deemed $7.5 million in questioned payments to be proper,
and anticipate the remaining questioned cost will be found to have
been proper after indirect rate audits are complete. We are continuing
to follow up on CMS's progress in addressing the remaining seven open
recommendations.
As a result of the contracting weaknesses we found in the MMA program,
GAO was asked to evaluate CMS's internal controls over its contracting
activities.[Footnote 20] Based on our audit, we found pervasive
deficiencies in CMS's internal controls over contracting and payments
to contractors. The internal control deficiencies occurred throughout
the contracting process phases. These deficiencies were due in part to
a lack of agency-specific policies and procedures to ensure that FAR
requirements and other control objectives were met. CMS also did not
take appropriate steps to ensure that existing policies were properly
implemented nor maintained adequate documentation in its contract
files. As a result of our work, we estimated that at least 84.3
percent of FAR-based contract actions made by CMS in fiscal year 2008
contained at least one instance in which a key control[Footnote 21]
was not adequately implemented. We also estimated that at least 37.2
percent of FAR-based contract actions made in fiscal year 2008 had
three or more instances in which a key control was not adequately
implemented. The high percentage of deficiencies indicated a serious
failure of control procedures over FAR-based acquisitions, thereby
creating a heightened risk of making improper payments or waste. Our
October 2009 report made nine additional recommendations to the CMS
Administrator to develop and implement policies and procedures to
ensure that FAR requirements and other control objectives are met. We
have obtained documentation on CMS's actions and are in the process of
validating this information. CMS officials told us they expect to
complete actions on all but one of our recommendations by March 31,
2011.
Ineffective Contract Auditing:
In 2009, we reported on audit quality problems at DCAA offices
nationwide, including compromise of auditor independence, insufficient
audit testing, and inadequate planning and supervision. In addition,
DCAA's management environment and quality assurance structure were
based on a production-oriented mission that put DCAA in the role of
facilitating DOD contracting without also protecting the public
interest.[Footnote 22] We found serious quality problems in the 69
audits and cost-related assignments we reviewed.[Footnote 23] For
example, 65 of these assignments exhibited serious noncompliance with
generally accepted government auditing standards (GAGAS) or other
deficiencies similar to those found in our investigation,[Footnote 24]
including compromise of auditor independence, insufficient audit
testing, and inadequate planning and supervision. DCAA has taken
action on many of our recommendations but continues to experience
significant audit quality problems across offices in all DCAA regions.
As a result of our work, DCAA rescinded over 80 audit reports because
its underlying audit evidence was outdated, insufficient, or
inconsistent with reported conclusions and opinions. Those rescinded
audits had been issued to support decisions on contract pricing and
awards and impacted the planning and reliability of hundreds of other
DCAA audits, representing billions of dollars in DOD expenditures.
About one-third of the rescinded reports relate to unsupported
opinions on contractor internal controls and were used as the basis
for risk assessments and planning on subsequent internal control and
cost-related audits. Other rescinded reports relate to Cost Accounting
Standards (CAS) compliance and contract pricing decisions. Because the
conclusions and opinions in the rescinded reports were used to assess
risk in planning subsequent audits, they impact the reliability of
hundreds of other audits and contracting decisions covering billions
of dollars in DOD expenditures.
A management environment and agency culture that focused on
facilitating the award of contracts and an ineffective audit quality
assurance structure are at the root of DCAA's agencywide audit
failures we identified. DCAA's focus on a production-oriented mission
led DCAA management to establish policies, procedures, and training
that emphasized performing a large quantity of audits to support
contracting decisions and gave inadequate attention to performing
quality audits. An ineffective quality assurance structure, whereby
DCAA gave passing scores to deficient audits, compounded this problem.
Lack of independence. In seven audits, independence was compromised
because auditors provided material nonaudit services to a contractor
they later audited; experienced access to records problems that were
not fully resolved; and significantly delayed report issuance, which
allowed the contractors to resolve cited deficiencies so that they
were not cited in the audit reports.
Unsupported opinions. Thirty-three of 37 internal control audits did
not include sufficient testing of internal controls to support auditor
conclusions and opinions, which are relied on for 2 to 4 years, and
sometimes longer. The lack of sufficient support for those audit
opinions rendered them unreliable for decision making on contract
awards, direct-billing privileges, the reliability of cost estimates,
and reported direct cost and indirect cost rates. For example, we
found that:
* For many controls, DCAA did not perform any testing at all. For
example, audits of contractor accounting systems focus on a review of
the adequacy of contractor policies and procedures. At least six of
the nine accounting audits we reviewed did not include procedures for
confirming contractor segregation of allowable and unallowable cost.
* DCAA issued an "adequate" opinion on the accounting system for a
major DOD contractor, indicating that system controls were effective,
after performing only a walkthrough of the accounting process and
interviewing two employees.
* In billing system audits we reviewed, DCAA auditors often tested
only two, three, or sometimes five transactions to support audit
conclusions on contractor systems and related internal controls.
Twenty of the 22 billing system audits we reviewed did not include
tests to identify duplicate invoices.
* In one audit, DCAA auditors reported on the adequacy of a
contractor's billing system based on tests of only four vouchers--all
issued on the same day.
* In an audit of controls over indirect and other direct cost for a
business segment of one of the top five DOD contractors, DCAA auditors
tested only 12 out of about 22,000 transactions processed from May
through July 2005.
Similarly, the 32 cost-related assignments we reviewed did not contain
sufficient testing to provide reasonable assurance that overpayments
and billing errors that might have occurred were identified. As a
result, there is little assurance that any such errors, if they
occurred, were corrected and that related improper contract payments,
if any, were refunded or credited to the government. Contractors are
responsible for ensuring that their billings reflect fair and
reasonable prices and contain only allowable costs, and taxpayers
expect DCAA to review these billings to provide reasonable assurance
that the government is not paying more than it should for goods and
services. We identified the following problems with these assignments.
* Paid voucher reviews. Under the direct-bill program, contractors may
submit their invoices directly to the DOD disbursing officer for
payment without further review. DCAA performs annual testing of paid
vouchers (invoices) to determine if contractor voucher preparation
procedures are adequate for continued contractor participation in the
direct-bill program.[Footnote 25] For the 16 paid voucher assignments
we reviewed, we found that DCAA auditors failed to comply with DCAA
Contract Audit Manual (CAM) guidance.[Footnote 26] Auditors generally
did not identify the population of vouchers, did not create sampling
plans, and made a small, nonrepresentative selection of as few as one
or two invoices for testing to support conclusions on their work.
Based on the limited work that was performed, the auditors concluded
that controls over invoice preparation were sufficient to support
approval of the contractors' direct billing privileges. This is of
particular concern because we determined that Defense Finance and
Accounting Service (DFAS) certifying officers rely on DCAA voucher
reviews.
* Overpayment assignments. DCAA performs overpayment assignments to
verify that contractors have billing procedures and internal controls
in place to identify and resolve contractor billing errors and
overpayments in a timely manner. We found that auditor judgments about
the population and selection of transactions for these assignments did
not provide a representative universe for testing and concluding on
contractor controls over billings and payments received. As a result,
this work does not provide reasonable assurance that contractors have
adequate controls in place to identify and correct overpayments and
billing errors and make appropriate, timely refunds and adjustments.
* Incurred cost audits. The purpose of incurred cost audits is to
examine contractors' cost representations and opine on whether the
costs are allowable, allocable to government contracts, and reasonable
in accordance with the contract and applicable government acquisition
regulations.[Footnote 27] For the four incurred cost audits we
reviewed, we found that the auditors did not perform sufficient,
detailed testing of claimed indirect and direct costs. As a result,
the scope of work performed was not sufficient to identify claimed
costs, if any, that were not adequately supported or unallowable
costs, if any, that should have been questioned.
DCAA's mission statement, strategic plan, and metrics all focused on
producing a large number of audit reports and provided little focus on
assuring quality audits. For example, in fiscal year 2008, DCAA
performed approximately 30,000 audits with 3,600 auditors. This
workload substantially contributed to the widespread audit quality
problems we identified. While DCAA has increased its staff to about
4,700, of which about 85 percent are auditors, and reduced the number
of reports issued in fiscal year 2010 to about 10,000. Based on
routine audit follow-up work, we have determined that DCAA has
allocated resources to the highest risk contracts but not yet fully
completed actions on a risk-based audit approach, with consideration
of resources and auditing standards, that is effective in protecting
taxpayer interest. In addition, DCAA has not yet resolved fundamental
weaknesses in its strategic plan, metrics, and human capital practices
that had a detrimental effect on audit quality. In addition, DCAA and
the Defense Contract Management Agency (DCMA) identified as part of
their current cost recovery initiative that there is a significant
backlog of Cost Accounting Standards (CAS) cost impact issues
requiring disposition and resolution by administrative contracting
officers. According to DOD Inspector General officials, these CAS
issues represent billions of dollars of unresolved audit findings and
the 6-year statute of limitations is running out on many of them.
Considering the large number of DCAA audit reports issued annually and
the reliance the contracting and finance communities place on DCAA
audit conclusions and opinions, effective and reliable contract audits
are necessary to protecting the public interest.
In our 2009 report, we made 17 specific recommendations to DOD and the
DOD Inspector General (IG) to improve DCAA's management environment,
audit quality, and oversight. DOD and DCAA have taken a number of
actions on our recommendations, including revising DCAA's mission
statement, appointing a new DCAA Director and a Western Region
Director, establishing an internal review office to perform periodic
internal evaluations and address hotline complaints, initiating
outside hiring, expanding its audit quality review function, and
providing training on auditing standards. While DCAA has initiated
actions on our other recommendations, as discussed in our report, DCAA
will need more time to complete those actions. Those include achieving
changes in its management environment and culture, developing a
strategic plan that links to performance metrics and a human capital
strategic plan, developing a well-supported risk-based contract audit
approach, obtaining outside expertise on auditing standards to assist
in revising its contract auditing policies and procedures, and
providing guidance on sampling and testing for the various types of
audits it performs. DOD IG has expanded its oversight of DCAA's audit
quality control process.
Our 2009 report also offered some potential actions for strengthening
the organizational effectiveness of DCAA and the contract audit
function in the federal government. These potential actions would
require further study as well as congressional action, and include
actions intended to (1) increase DCAA's authority and independence,
(2) provide for additional reporting and oversight of audit results,
and (3) evaluate whether certain organizational changes to DCAA could
strengthen its independence and improve audit quality. We have
reprinted the detail of these options in appendix II.
Madam Chairman and Members of the Subcommittee, this concludes my
statement. We would be pleased to answer any questions that you may
have at this time.
Contacts and Acknowledgments:
For further information about this testimony, please contact Jeanette
M. Franzel at 202-512-9471 or franzelj@gao.gov. Contact points for our
Offices of Congressional Relations and Public Affairs may be found on
the last page of this testimony. Major contributors to our testimony
include Gayle Fischer, Assistant Director; F. Abe Dymond, Assistant
General Counsel; Omar Torres, Auditor-in-Charge; and Yiming Wu,
auditor.
[End of section]
Appendix I: DCAA Audit and Nonaudit Services:
Table 1 lists several audit and nonaudit services performed by the
Defense Contract Audit Agency (DCAA) during the three phases of the
contracting process--preaward and award, contract administration and
management, and closeout--and cites the statutory and regulatory
provisions that authorize or establish the need to have DCAA perform
the service. DCAA audits also support the contract payment process
both directly and indirectly. For example, audits of contractor-
incurred cost claims and voucher reviews directly support the contract
payment process by providing the information necessary to certify
payment of claimed costs. [Footnote 28] Other audits of contractor
systems, including audits of contractor internal controls, CAS
compliance, and defective pricing, indirectly support the payment
process by providing assurance about contractor controls over cost
accounting, cost estimating, purchases, and billings that the agency
may rely upon when making contract decisions, such as determinations
of reasonable and fair prices on negotiated contracts. For example, an
accounting system deemed to be adequate by a DCAA audit permits
progress payments based on costs to be made without further audit.
[Footnote 29]
Table 1: Examples of DCAA Audit and Nonaudit Services.
Preaward and award phase:
Contract phase and assignment: Accounting system[A];
Audit and nonaudit services: Audit: DCAA determines adequacy of the
contractor's accounting system prior to award of a cost-reimbursable
or other flexibly priced contract. FAR § 16.301-3(a)(1);
Contracting support: [Check];
Payment support: Indirect.
Contract phase and assignment: Contractor accounting disclosure
statements;
Audit and nonaudit services: Audit: DCAA reviews the contractor's
Disclosure Statement for adequacy and CAS compliance and determines
whether the contractor's Disclosure Statement is current, accurate,
and complete. DCAA also reviews Disclosure Statements during the
postaward phase if contractors revise them. FAR §§ 30.202-6(c), 30.202-
7 and 30.601(c);
Contracting support: [Check];
Payment support: Indirect.
Contract phase and assignment: Estimating system[A];
Audit and nonaudit services: Audit: DCAA determines adequacy of
contractor estimating systems. FAR § 15.407-5 and DFARS § 252.215-
7002(d),(e);
Contracting support: [Check];
Payment support: Indirect.
Contract phase and assignment: Contract price proposals and forward
pricing proposals[B];
Audit and nonaudit services: Audit: DCAA examines contractor records
to ensure that cost or pricing data are accurate, current, and
complete and supports the determination of fair and reasonable prices.
10 U.S.C. §§ 2306a and 2313 (DOD) and 41 U.S.C. § 254d (other
agencies); FAR Subpart 15.4 (esp. FAR § 15.404-2(c)) and § 52.215-
2(c); and DFARS § 215.404-1;
Contracting support: [Check];
Payment support: Indirect.
Contract phase and assignment: Financial liaison advisory services[B];
Audit and nonaudit services: Nonaudit: DCAA Director establishes and
maintains liaison auditors and financial advisors, as appropriate, at
major procuring and contract administration offices. These services
are also provided during the postaward phase, as needed. DODD 5105.36,
paras. 7.1.1 and 5.9;
Contracting support: [Check];
Payment support: Indirect.
Postaward/administration and management phase:
Contract phase and assignment: Internal control system audits
(generally);
Audit and nonaudit services: Audit: DCAA reviews the financial and
accounting aspects of the contractor's cost control systems, including
the contractor's internal control systems. FAR § 42.101(a)(3) and
DFARS § 242.7501;
Contracting support: [Check];
Payment support: Indirect.
Contract phase and assignment: Billing system audits[A];
Audit and nonaudit services: Audit: DCAA determines adequacy of
contractors' billing system controls and reviews accuracy of paid
vouchers. DCAA uses audit results to support approval of contractors
to participate in the direct-bill program. FAR § 42.101 and DFARS §
42.803 (b)(i)(C);
Contracting support: [Check];
Payment support: Direct.
Contract phase and assignment: Purchasing system review[B];
Audit and nonaudit services: Audit: DCAA determines adequacy of a
contractor's or subcontractor's purchasing system. FAR Subpart 44.3;
Contracting support: [Check];
Payment support: Indirect.
Contract phase and assignment: Progress payments[B];
Audit and nonaudit services: Audit: DCAA verifies amount claimed,
determines allowability of contractor requests for cost-based progress
payments, and determines if the payment will result in undue financial
risk to the government. FAR §§ 32.503-3, 32.503-4, and 52.232-16;
Contracting support: [Check];
Payment support: Direct.
Contract phase and assignment: Incurred cost claims[A];
Audit and nonaudit services: Audit: DCAA determines acceptability of
the contractors' claimed costs incurred and submitted by contractors
for reimbursement under cost-reimbursable, fixed-price incentive, and
other types of flexibly priced contracts and compliance with contract
terms, FAR, and CAS, if applicable. FAR §§ 42.101, 42.803(b), and
DFARS § 242.803;
Contracting support: [Check];
Payment support: Direct.
Contract phase and assignment: Billing rates and final indirect cost
rates[A];
Audit and nonaudit services: Audit: DCAA establishes billing rates for
interim indirect costs and final indirect cost rates. FAR §§ 42.704,
42.705 and 42.705-2 and DFARS § 42.705-2;
Contracting support: [Check];
Payment support: Direct.
Contract phase and assignment: Defective pricing[B];
Audit and nonaudit services: Audit: DCAA determines the amount of cost
adjustments related to defective pricing. See above authorities to
audit contractor cost and pricing data and FAR § 15.407-1;
Contracting support: [Check];
Payment support: Indirect.
Contract phase and assignment: CAS compliance[B];
Audit and nonaudit services: DCAA determines contractor and
subcontractor compliance with CAS set forth in 48 CFR § 9903.201 and
determines cost impacts of noncompliance. FAR §§ 1.602-2, 30.202-7,
and 30.601(C);
Contracting support: [Check];
Payment support: Direct.
Contract phase and assignment: Other specially requested services;
Audit and nonaudit services: Audit and nonaudit services: DCAA
conducts performance audits and other audits based on requests from
DOD components and requests from other federal agencies. DOD Directive
5105.36, Sec. 5;
Contracting support: [Check];
Payment support: Indirect.
Contract phase and assignment: Paid voucher reviews[A];
Audit and nonaudit services: Nonaudit services: DCAA reviews vouchers
after payment to support continued contractor participation in the
direct bill program. CAM 6-1007.6; FAR § 42.803; DFARS § 242.803;
DODD 5105.36, paras. 5.4 and 5.5; and DOD Financial Management
Regulation (FMR), vol. 10, ch. 10, para. 100202;
Contracting support: [Check];
Payment support: Direct.
Contract phase and assignment: Approval of vouchers prior to
payment[A];
Audit and nonaudit services: Nonaudit: DCAA reviews and approves
contractor interim vouchers for payment and suspends payment of
questionable costs. FAR § 42.803; DFARS § 242.803(b)(i)(B);
DOD Directive 5105.36, paras. 5.4 and 5.5; and DOD FMR vol. 10, ch.
10, para. 100202;
Contracting support: [Check];
Payment support: Direct.
Contract phase and assignment: Overpayment reviews[A];
Audit and nonaudit services: Nonaudit services: At the request of the
contracting officer, DCAA reviews contractor data to identify
potential contract overpayments. FAR §§ 2.605, 52.216-7(g), (h)2;
Contracting support: [Check];
Payment support: Direct.
Closeout phase:
Contract phase and assignment: Contract closeout procedures and
audits[A];
Audit and nonaudit services: Audit: DCAA reviews final completion
vouchers and the cumulative allowable cost worksheet and may review
contract closing statements. DFARS § 242.803(b)(i)(D);
Contracting support: [Check];
Payment support: Direct.
Source: GAO analysis.
[A] Indicates DCAA audit and nonaudit services covered in this audit.
[B] Indicates types of audits covered in our prior investigation (GAO-
08-857). We reviewed progress payment and contract closeout audits
that related to audits in our earlier investigation or this audit
where the auditors considered the evidence in those audits.
[End of table]
[End of section]
Appendix II: Potential Legislative and Other Actions for Strengthening
DCAA and the Contract Audit Function:
In our September 2009 report,[Footnote 30] we identified certain
legislative and other actions, such as authorities and protections
similar to those granted to federal agency Inspectors general (IG) in
the IG Act, and changes in organizational placement, that could
enhance Defense Contract Audit Agency (DCAA) effectiveness and
independence.[Footnote 31] Successful management initiatives for
cultural and organizational change in large private and public sector
organizations can often take several years to accomplish. We caution
that changing DCAA's organizational placement without first correcting
fundamental weaknesses in mission and the overall management
environment would not assure effective audits.
Short-term Legislative Actions:
In addition to DCAA management reforms already under way and our
additional recommendations, our 2009 report identified certain
legislative protections and authorities under the IG Act that could
enhance DCAA's effectiveness. Legislation would be needed in order to
grant DCAA such protections and authorities.
Leadership. The IG Act provides for the President to appoint the IG,
with Senate confirmation, at many federal agencies.[Footnote 32] Under
the act, Congress must be notified in advance of removing the IG, and
only Congress can eliminate the office of an IG. Currently, the head
of DCAA is appointed and can be removed by the Secretary of Defense.
Further, DCAA was created and can be reorganized or reassigned by
departmental order without notice. IG Act protections Congress could
grant to DCAA would therefore include (1) Senate confirmation of a
presidentially appointed DCAA Director[Footnote 33] and (2) removal of
the DCAA Director conditioned on congressional notification. [Footnote
34] Specifically, the act provides that an IG may be removed from
office by the President and any removal is to be reported to both
Houses of Congress 30 days prior to the removal. In addition to these
IG Act protections, Congress could build additional provisions into
legislation, to include the following:
* Requirements that the DCAA Director possess the appropriate
professional qualifications. For example, provisions for appointment
of the DCAA Director could require selection from among individuals
who possess demonstrated ability in managing and leading
organizations, specific accounting or auditing background, general
knowledge of contract management, and knowledge of and extensive
practical experience in financial management practices in large
governmental or business entities.
* A mandate permitting the DCAA Director to hold a renewable term
appointment of between 5 to 7 years. Legislation should provide that
the DCAA Director can be removed only for cause or other stated
reasons. These protections would allow the head of DCAA to provide
stability and continuity of leadership that span presidential
administrations and prevent removal except for cause or other
disclosed reasons.
* Conflict of interest provisions for the DCAA Director and other key
staff in addition to those provisions currently in law. This would be
intended to ensure that selection of the audit agency head would not
involve a "revolving door" situation between contractors and the
contract audit agency.
Access to independent legal counsel. The IG Act provides for
independent legal advice for IGs rather than requiring the use of
agency legal counsel.[Footnote 35] Currently, DCAA relies upon DOD
legal counsel.[Footnote 36] DCAA officials told us that the DCAA
Director has not always been apprised of legal decisions by DOD
counsel that have impacted DCAA operations. Further, according to the
DCAA Director, the lack of independent counsel led to a situation
where DOD attorneys provided questionable legal counsel to a DCAA
field office supervisor without the DCAA Director's knowledge.
Obtaining independent legal counsel would avoid conflicts of interest
between DOD and DCAA, thereby helping to improve DCAA's effectiveness.
Budget. The IG Act requires separate budgets for Offices of Inspector
General (OIG) within agency budgets, allowing Congress to review IG
budget requests separately. DCAA currently does not have this
protection. IGs that are appointed by the President with Senate
confirmation receive a separate appropriation, preventing agencies
from reprogramming IG funds to other programs and activities. However,
there is currently little visibility over DCAA's budget because it is
funded under the Operations and Maintenance, Defense-wide
appropriation, which includes numerous DOD agencies, such as the
Defense Contract Management Agency (DCMA), the Defense Logistics
Agency, the Defense Finance and Accounting Service, and some buying
command activities. Therefore, DCAA's share of annual appropriations
is subject to reprogramming, sometimes without congressional
notification. According to the DCAA Director and documentation
provided by the Director and Office of Comptroller/CFO, in the past,
DOD has reprogrammed funding between DCAA and other DOD activities on
numerous occasions. Because these reprogrammings were below the $15
million threshold for congressional notification, Congress did not
have notice of these funding decreases at the time they occurred. For
fiscal year 2009, DOD reprogramming increased DCAA's funding by $3.5
million. Legislation similar to the IG Act could grant DCAA a separate
budget[Footnote 37] to provide visibility and protections from
reprogramming of funds to other agency priorities.
Increased authority and independence. Legislation could strengthen
DCAA's audit authority by providing the same level of access to
records and personnel available to IGs.[Footnote 38] Currently, DCAA
has statutory access to certain records related to cost-type contracts
or those that contain cost and pricing data, but not to contractor
personnel. As a result, DCAA's subpoena power is limited to certain
records and does not cover contractor personnel. While we recognize
that DCAA auditors have ongoing discussions with contractor personnel,
they do not have statutory authority to compel contractor officials to
meet with them and submit to interviews. IGs have authority, including
subpoena power, to access all records, reports, audits, reviews,
documents, papers, recommendations, or other material available that
relate to programs and operations for which the IG has
responsibilities. Further, IG subpoena authority extends beyond access
to records and documents in that IG auditors can administer or take an
oath in order to obtain information. Our discussions with DCAA
auditors and reviews of audit documentation identified numerous
instances where requests for contractor records were not met.[Footnote
39] Obtaining increased access to contracting companies, especially
their staff and documentation, would be an important provision to
improve the effectiveness of DCAA audit staff.
Reporting and oversight of audit results. The IG Act provides for
semiannual reports to the agency head and appropriate committees of
Congress summarizing results of significant audits and
investigations.[Footnote 40] DCAA currently has no external reporting
requirement, reducing opportunities for oversight and transparency.
Congress could mandate some form of external DCAA reporting in
legislation similar to the IG Act. Moreover, DCAA does not currently
provide copies of its audit reports to other federal agencies that use
the same contractors that DOD uses. According to the DCAA Director,
DCAA's appropriations are specific to DOD contractor audits, and
unless federal agencies request and reimburse DCAA for audit services,
DCAA cannot provide them with copies of its audit reports even though
these reports may cover their contractors. Legislation could also
expressly allow DCAA to provide audit results to other agencies, a
step that would improve its visibility and effectiveness for the
government as a whole.
Legislation to grant DCAA similar protections and authorities as those
provided in the IG Act could enhance reform efforts that are already
under way. Although we found that a lack of DOD Comptroller/CFO and IG
oversight has impaired DCAA's effectiveness, DOD has begun work to
provide improved oversight of DCAA's operations. In August 2008, the
DOD Comptroller/CFO conducted a "tiger team" review of DCAA's audit
quality assurance program, and DOD approved a more comprehensive
Defense Business Board (DBB) study. The new DOD Comptroller/CFO
recognized the need for DCAA oversight and on March 16, 2009, approved
the charter for a DCAA Oversight Committee. Committee members include
the Auditors General of the Army, the Navy, and the Air Force; the DOD
Director of Defense Procurement and Acquisition Policy; and the DOD
Deputy General Counsel for Acquisition and Technology. The committee
held its first meeting in early April 2009. During May 2009, the DCAA
Oversight Committee members reviewed selected DCAA audits and visited
a DCAA field office. The committee is continuing to assess DCAA
actions on recommendations in these reports and identify any gaps for
further action. DCAA has already taken numerous actions to respond to
our initial investigative report as well as DOD Comptroller/CFO and
DBB recommendations.
Longer-term actions:
In the longer term, Congress could consider changes in DCAA's
organizational placement. However, moving DCAA as an organization or
establishing a new federal contract audit agency would require careful
analysis and planning before implementation. For example, numerous
governmentwide acquisition management reform efforts are currently
under way that could impact the contract audit function. These efforts
include congressional oversight and reform legislation and
Presidential direction on developing governmentwide guidance for
reviews of existing contracts to identify contracts that are wasteful,
inefficient, or otherwise unlikely to meet agencies' needs, and to
formulate corrective action in a timely manner, as well as interest
group studies.
Depending on the outcome of the various contract reform initiatives
and the successful implementation of DCAA management reforms, Congress
may also want to consider increasing the efficacy of these reforms by
establishing an independent governmentwide contract audit agency. The
creation of a statutory governmentwide contract audit agency could
enhance contract auditor effectiveness and independence by placing the
audit agency outside DOD and other federal agencies that make
procurement and contract management decisions. Centralizing the
contract audit function and mandating its use by all federal agencies
also could provide for consistent audit coverage and bring
efficiencies and economies of scale to the contract audit process
across the government. However, our 2009 report cautioned that this
would likely entail significant costs and operational and
accountability considerations and would be an extremely costly option
involving significant infrastructure and reorganization and would
require substantial planning and analysis before deciding whether to
proceed and how to implement any changes. Some of the issues that
would need further study and analysis include the following:
Governance. Governance is the framework of rules and practices by
which a governing body, such as a board of directors, ensures
accountability, fairness, and transparency in the entity's
relationship with all of its stakeholders, including management,
employees, and government. In order to improve governance and
accountability at federal agencies, a variety of laws covering a range
of management and administrative practices and processes have been
enacted. Consideration of such provisions for a governmentwide
contract audit agency should include application of general laws
related to funds control, performance and financial reporting,
accounting and internal control systems, human resources management,
and recordkeeping and access to information, among others. Further,
governance issues unique to a contract audit agency, such as its
relationships to agency contracting officers and the Congress, should
be assessed.
Scope of Work. Scope of work considerations would include roles,
responsibilities, and relationships of the governmentwide contract
audit agency and IGs with regard to contract audits. Another
consideration would be whether the new agency would be available for
consultation as an outside expert on federal agency preaward issues.
In addition, a determination would need to be made on the handling of
fraud referrals. For example, the central new agency could have an
investigative division or it could refer potential contract fraud to
federal agency IGs for further investigation.
Funding. Congress would need to determine how to fund the new contract
audit agency. For example, funding could be provided through
appropriations or from reimbursement by federal agencies. This
decision would likely be tied to decisions on the governmentwide
contract audit agency's mandate and scope of work and any realignment
of contract audit resources.
Further study and analysis of this potential action would involve
input from the federal agency IGs and agency contracting and finance
communities as well as government contractors and public interest
groups. Numerous additional issues would potentially be identified and
require substantial time and cost for effective consideration and
resolution.
[End of section]
Related GAO Reports and Testimonies:
High-Risk Series:
DOD's High-Risk Areas: Actions Needed to Reduce Vulnerabilities and
Improve Business Outcome, [hyperlink,
http://www.gao.gov/products/GAO-09-460T], Washington, D.C.: March 12,
2009.
High-Risk Series: An Update, [hyperlink,
http://www.gao.gov/products/GAO-09-271], Washington, D.C.: January
2009.
DCAA Audits:
Defense Management: Widespread DCAA Audit Problems Leave Billions of
Taxpayer Dollars Vulnerable to Fraud, Waste, Abuse, and Mismanagement,
[hyperlink, http://www.gao.gov/products/GAO-10-163T], Washington,
D.C.: Oct. 15, 2009.
DCAA Audits: Widespread Problems with Audit Quality Require
Significant Reform, [hyperlink,
http://www.gao.gov/products/GAO-09-468], Washington, D.C.: Sept. 23,
2009.
DCAA Audits: Widespread Problems with Audit Quality Require
Significant Reform, [hyperlink,
http://www.gao.gov/products/GAO-09-1009T], Washington, D.C.: Sept. 23,
2009.
DCAA Audits: Allegations That Certain Audits at Three Locations Did
Not Meet Professional Standards Were Substantiated, [hyperlink,
http://www.gao.gov/products/GAO-08-993T], Washington, D.C.: Sept. 10,
2008.
DCAA Audits: Allegations That Certain Audits at Three Locations Did
Not Meet Professional Standards Were Substantiated, [hyperlink,
http://www.gao.gov/products/GAO-08-857], Washington, D.C.: July 22,
2008.
Iraq Contract Costs: DOD Consideration of Defense Contract Audit
Agency's Findings, [hyperlink,
http://www.gao.gov/products/GAO-06-1132], Washington, D.C.: Sept. 25,
2006.
Contract Management:
Centers for Medicare and Medicaid Services: Pervasive Internal Control
Weaknesses Hindered Effective Contract Management, [hyperlink,
http://www.gao.gov/products/GAO-10-637T], Washington, D.C.: Apr. 28,
2010.
Centers for Medicare and Medicaid Services: Deficiencies in Contract
Management Internal Control Are Pervasive, [hyperlink,
http://www.gao.gov/products/GAO-10-60], Washington, D.C.: Oct. 23,
2009.
Contract Management: Minimal Compliance with New Safeguards for Time-
and-Materials Contracts for Commercial Services and Safeguards Have
Not Been Applied to GSA Schedules Program, [hyperlink,
http://www.gao.gov/products/GAO-09-579], Washington, D.C.: June 24,
2009.
Defense Acquisitions: Charting a Course for Lasting Reform,
[hyperlink, http://www.gao.gov/products/GAO-09-663T], Washington,
D.C.: April 30, 2009.
Global War on Terrorism: DOD Needs to More Accurately Capture and
Report the Costs of Operation Iraqi Freedom and Operation Enduring
Freedom, [hyperlink, http://www.gao.gov/products/GAO-09-302],
Washington, D.C.: Mar. 17, 2009.
Defense Acquisitions: Perspectives on Potential Changes to Department
of Defense Acquisition Management Framework, [hyperlink,
http://www.gao.gov/products/GAO-09-295R], Washington, D.C.: February
27, 2009.
Defense Management: Actions Needed to Overcome Long-standing
Challenges with Weapon Systems Acquisition and Service Contract
Management, [hyperlink, http://www.gao.gov/products/GAO-09-362T],
Washington, D.C.: Feb. 11, 2009.
Defense Management: Actions Needed to Overcome Long-standing
Challenges with Weapon Systems Acquisition and Service Contract
Management, [hyperlink, http://www.gao.gov/products/GAO-09-362T],
Washington, D.C.: February 11, 2009.
Space Acquisitions: Uncertainties in the Evolved Expendable Launch
Vehicle Program Pose Management and Oversight Challenges, [hyperlink,
http://www.gao.gov/products/GAO-08-1039], Washington, D.C.: September
26, 2008.
Financial Management: FBI Has Designed and Implemented Stronger
Internal Controls over Sentinel Contractor Invoice Review and
Equipment Purchases, but Additional Actions Are Needed, [hyperlink,
http://www.gao.gov/products/GAO-08-716R], Washington, D.C.: July 15,
2008.
Defense Contracting: Post-Government Employment of Former DOD
Officials Needs Greater Transparency, [hyperlink,
http://www.gao.gov/products/GAO-08-485], Washington, D.C.: May 21,
2008.
Defense Contracting: Army Case Study Delineates Concerns with Use of
Contractors as Contract Specialists, [hyperlink,
http://www.gao.gov/products/GAO-08-360], Washington, D.C.: March 26,
2008.
Defense Contracting: Additional Personal Conflict of Interest
Safeguards Needed for Certain DOD Contractor Employees, [hyperlink,
http://www.gao.gov/products/GAO-08-169], Washington, D.C.: March 7,
2008.
Centers for Medicare and Medicaid Services: Internal Control
Deficiencies Resulted in Millions of Dollars of Questionable Contract
Payments, [hyperlink, http://www.gao.gov/products/GAO-08-54],
Washington, D.C.: Nov. 15, 2007.
Defense Contract Management: DOD's Lack of Adherence to Key
Contracting Principles on Iraq Oil Contract Put Government Interests
at Risk, [hyperlink, http://www.gao.gov/products/GAO-07-839],
Washington, D.C.: July 31, 2007.
Hanford Waste Treatment Plant: Department of Energy Needs to
Strengthen Controls over Contractor Payments and Project Assets,
[hyperlink, http://www.gao.gov/products/GAO-07-888], Washington, D.C.:
July 20, 2007.
Defense Contracting: Improved Insight and Controls Needed over DOD's
Time-and-Materials Contracts, [hyperlink,
http://www.gao.gov/products/GAO-07-273], Washington, D.C.: June 29,
2007.
Defense Contracting: Use of Undefinitized Contract Actions Understated
and Definitization Time Frames Often Not Met, [hyperlink,
http://www.gao.gov/products/GAO-07-559], Washington, D.C.: June 19,
2007.
Defense Acquisitions: Improved Management and Oversight Needed to
Better Control DOD's Acquisition of Services, [hyperlink,
http://www.gao.gov/products/GAO-07-832T], Washington, D.C.: May 10,
2007.
Defense Acquisitions: Tailored Approach Needed to Improve Service
Acquisition Outcomes, [hyperlink,
http://www.gao.gov/products/GAO-07-20], Washington, D.C.: November 9,
2006.
Department of Energy, Office of Worker Advocacy: Deficient Controls
Led to Millions of Dollars in Improper and Questionable Payments to
Contractors, [hyperlink, http://www.gao.gov/products/GAO-06-547],
Washington, D.C.: May 31, 2006.
Federal Bureau of Investigation: Weak Controls over Trilogy Project
Led to Payment of Questionable Contractor Costs and Missing Assets,
[hyperlink, http://www.gao.gov/products/GAO-06-306], Washington, D.C.:
Feb. 28, 2006.
[End of section]
Footnotes:
[1] GAO, Standards for Internal Control in the Federal Government,
[hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] (November
1999).
[2] GAO, Defense Management: Widespread DCAA Audit Problems Leave
Billions of Taxpayer Dollars Vulnerable to Fraud, Waste, Abuse, and
Mismanagement, [hyperlink, http://www.gao.gov/products/GAO-10-163T]
(Washington, D.C.: Oct. 15, 2009); DCAA Audits: Widespread Problems
with Audit Quality Require Significant Reform, [hyperlink,
http://www.gao.gov/products/GAO-09-468] (Washington, D.C.: Sept. 23,
2009); DCAA Audits: Widespread Problems with Audit Quality Require
Significant Reform, [hyperlink,
http://www.gao.gov/products/GAO-09-1009T] (Washington, D.C.: Sept. 23,
2009); DCAA Audits: Allegations that Certain Audits at Three Locations
Did Not Meet Professional Standards Were Substantiated, [hyperlink,
http://www.gao.gov/products/GAO-08-993T] (Washington, D.C.: Sept. 10,
2008); DCAA Audits: Allegations that Certain Audits at Three Locations
Did Not Meet Professional Standards Were Substantiated, [hyperlink,
http://www.gao.gov/products/GAO-08-857] (Washington, D.C.: July 22,
2008).
[3] Standards for Internal Control cover the control environment, risk
assessment, control activities (policies, procedures, techniques, and
mechanisms that enforce management's directives), information and
communication, and monitoring (performance assessments and audits).
[4] Improper payments are defined in the Improper Payments Information
Act of 2002 as any payment that should not have been made or that was
made in an incorrect amount (including overpayments and underpayments)
under statutory, contractual, administrative, or other legally
applicable requirements. It also includes any payment to an ineligible
recipient or ineligible service, duplicate payments, payments for
services not received, and any payment for an incorrect amount.
[5] Agencies may acquire goods and services under contracts with
private entities or they may enter into interagency agreements
(interagency acquisitions) to acquire goods and services from other
federal agencies, which may acquire the goods and services under
contracts with private entities.
[6] 48 C.F.R. §§ 16.104(h), 16.301-3(a).
[7] 48 C.F.R. § 16.601(d).
[8] DCAA, Contract Audit Manual (CAM) DCAAM 7640.1.
[9] Project 60 also resulted in consolidation of the military
services' contract management activities under the Defense Contract
Management Agency (DCMA), formerly the Defense Contract Management
Command (DCMC) within the Defense Logistics Agency. On March 27, 2000,
DCMC was established as DCMA under the authority of the Under
Secretary of Defense (Acquisition, Technology, and Logistics).
[10] DOD, General Plan: Consolidation of Department of Defense
Contract Audit Activities into the Defense Contract Audit Agency (Feb.
17, 1965).
[11] DODD 5105.36, paragraph 4.2, reissued on January 4, 2010, to
include DCAA's new mission statement.
[12] FAR §§ 16.104(h) and 16.301-3(a)(1).
[13] DCAA, Contract Audit Manual (CAM) 5-1202.1.a and Defense Federal
Acquisition Regulation Supplement (DFARS) § 215.407-5.
[14] FAR § 42.101 and DFARS § 242.803.
[15] The obligation amount generally is the amount of the contract
award, such as the firm-fixed price or estimated value of cost
reimbursements for a particular fiscal year.
[16] Our analysis is based on contract actions over $25,000 adjusted
for fiscal year 2010 inflation factor.
[17] See list of related products at the end of this testimony.
[18] GAO, Hanford Waste Treatment Plant: Department of Energy Needs to
Strengthen Controls over Contractor Payments and Project Assets,
[hyperlink, http://www.gao.gov/products/GAO-07-888] (Washington, D.C.:
July 20, 2007).
[19] GAO, Centers for Medicare and Medicaid Services: Internal Control
Deficiencies Resulted in Millions of Dollars of Questionable Contract
Payments, [hyperlink, http://www.gao.gov/products/GAO-08-54]
(Washington, D.C.: Nov. 15, 2007).
[20] GAO, Centers for Medicare and Medicaid Services: Deficiencies in
Contract Management Internal Control Are Pervasive, [hyperlink,
http://www.gao.gov/products/GAO-10-60] (Washington, D.C.: Oct. 23,
2009).
[21] We determined a control to be "key" based on our review of the
standards for internal control as well as the FAR, Health and Human
Services Acquisition Regulations, and agency policies and whether
inadequate implementation would significantly increase the risk of
improper payments or waste.
[22] GAO, DCAA Audits: Widespread Problems with Audit Quality Require
Significant Reform, [hyperlink,
http://www.gao.gov/products/GAO-09-468] (Washington, D.C.: Sept. 23,
2009).
[23] Of the 69 DCAA assignments we reviewed, 37 were audits of
contractor systems and related internal controls and 32 were cost-
related audits and assignments.
[24] [hyperlink, http://www.gao.gov/products/GAO-08-857].
[25] DCAA does not perform paid voucher reviews during the year that
it performs an audit of the contractor's billing system internal
controls.
[26] CAM 6-1007.
[27] CAM 6-102.
[28] Disbursing officers are authorized to make payments on the
authority of a voucher certified by an authorized certifying officer,
who is responsible for the legality, accuracy, and propriety of the
payment. 31 U.S.C. §§ 3325, 3521(a), and 3528(a).
[29] FAR § 32.503-4.
[30] [hyperlink, http://www.gao.gov/products/GAO-09-468].
[31] Codified in an appendix to Title 5 of the United States Code
(hereafter 5 U.S.C. App.)
[32] The IG Act also requires the heads of many "designated federal
entities" to appoint an inspector general for each entity. 5 U.S.C. §
App. 8G.
[33] 5 U.S.C. App. § 3(a).
[34] 5 U.S.C. App. § 3(b).
[35] 5 U.S.C. App. ß 8F(4)(A).
[36] Section 893(g) of the Ike Skelton National Defense Authorization
Act for Fiscal Year 2011 requires the Secretary of Defense to ensure
that DCAA has sufficient legal resources and expertise to conduct its
work in a manner that is consistent with audit independence.
[37] 5 U.S.C. App. ß 6(f)(1).
[38] 5 U.S.C. App. ß 6(a)(1), (4), and (5).
[39] As noted previously, in these cases, there was no evidence that
DCAA supervisors elevated the issue to management or to procurement
officials to initiate enforcement action, as set out in DCAA policy.
[40] 5 U.S.C. App. ß 5(a).
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Phone:
The price of each GAO publication reflects GAO‘s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO‘s Web site,
[hyperlink, http://www.gao.gov/ordering.htm].
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional
information.
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
