DCAA Audits
Widespread Problems with Audit Quality Require Significant Reform Gao ID: GAO-09-1009T September 23, 2009This testimony discusses our recent audit of the Defense Contract Audit Agency's (DCAA) overall management environment and quality assurance structure. DCAA is charged with a critical role in Department of Defense (DOD) contractor oversight by providing auditing, accounting, and financial advisory services in connection with the negotiation, administration, and settlement of contracts and subcontracts. DCAA's mission encompasses both audit and nonaudit services in support of DOD contracting and contract payment functions. DCAA audits of contractor internal controls in accounting, billing, estimating, and other key systems support decisions on pricing and contract awards. Internal control audits also impact the planning and reliability of other DCAA audits because DCAA uses the results of these audits to assess risk and plan the nature, extent, and timing of tests for other contractor audits and assignments. Last year, we reported the results of our investigation of allegations about certain DCAA audits at three locations in California, which substantiated claims that (1) audit documentation did not support the reported opinions; (2) DCAA supervisors dropped findings and changed audit opinions without adequate audit evidence for their changes; and (3) sufficient work was not performed to support the audit opinions and conclusions. At that time we were conducting a broader audit of DCAA's overall organizational environment and quality control system. Given the evidence presented at the Committee's September 2008 hearing, you requested that we expand our ongoing assessment. Our current report, which the Committee is releasing today, presents the results of our DCAA-wide audit, including (1) an assessment of DCAA's management environment and quality assurance structure; (2) an analysis of DCAA's corrective actions in response to our July 2008 report and two DOD reviews, and (3) potential legislative and other actions that could improve DCAA's effectiveness and independence.
A management environment and agency culture that focused on facilitating the award of contracts and an ineffective audit quality assurance structure are at the root of the agencywide audit failures we identified. DCAA's focus on a production-oriented mission led DCAA management to establish policies, procedures, and training that emphasized performing a large quantity of audits to support contracting decisions and gave inadequate attention to performing quality audits. An ineffective quality assurance structure, whereby DCAA gave passing scores to deficient audits compounded this problem. DCAA initiated a number of actions to address findings in our July 2008 report, the DOD Comptroller/CFO August 2008 "tiger team" review, and the Defense Business Board study, which was officially released in January 2009. Examples of key DCAA actions to date include the following. (1) Eliminating production metrics and implementing new metrics intended to focus on achieving quality audits. (2) Establishing an anonymous Web site to address management and hotline issues. DCAA's Assistant Director for Operations has been proactive in handling internal DCAA Web site hotline complaints. (3) Revising policy guidance to address auditor independence, assure management involvement in key decisions, and address audit quality issues. DCAA also took action to halt auditor participation in nonaudit services that posed independence concerns. In addition to correcting the fundamental weaknesses in DCAA's mission and overall management environment, we believe certain legislative measures as well as other actions could enhance DCAA's effectiveness and independence. For example, granting DCAA certain authorities and protections--similar to those offered to presidentially appointed inspectors general (IG) under the IG Act--could enhance DCAA's independence. In the longer term, Congress could consider changes in organizational placement after DCAA has had sufficient opportunity to effectively implement current reform efforts.
GAO-09-1009T, DCAA Audits: Widespread Problems with Audit Quality Require Significant Reform
This is the accessible text file for GAO report number GAO-09-1009T
entitled 'DCAA Audits: Widespread Problems with Audit Quality Require
Significant Reform' which was released on September 23, 2009.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Testimony:
Before the Committee on Homeland Security and Governmental Affairs,
U.S. Senate:
United States Government Accountability Office:
GAO:
For Release on Delivery:
Expected at 10:00 a.m. EDT:
Wednesday, September 23, 2009:
DCAA Audits:
Widespread Problems with Audit Quality Require Significant Reform:
Statement of Gregory D. Kutz, Managing Director:
Forensic Audits and Special Investigations:
Gayle L. Fischer, Assistant Director:
Financial Management and Assurance:
GAO-09-1009T:
[End of section]
Mr. Chairman and Members of the Committee:
Thank you for the opportunity to discuss our recent audit of the
Defense Contract Audit Agency's (DCAA) overall management environment
and quality assurance structure. DCAA is charged with a critical role
in Department of Defense (DOD) contractor oversight by providing
auditing, accounting, and financial advisory services in connection
with the negotiation, administration, and settlement of contracts and
subcontracts.[Footnote 1] DCAA's mission encompasses both audit and
nonaudit services in support of DOD contracting and contract payment
functions. DCAA audits of contractor internal controls in accounting,
billing, estimating, and other key systems support decisions on pricing
and contract awards. Internal control audits also impact the planning
and reliability of other DCAA audits because DCAA uses the results of
these audits to assess risk and plan the nature, extent, and timing of
tests for other contractor audits and assignments.
Last year, we reported[Footnote 2] the results of our investigation of
allegations about certain DCAA audits at three locations in California,
which substantiated claims that (1) audit documentation did not support
the reported opinions; (2) DCAA supervisors dropped findings and
changed audit opinions without adequate audit evidence for their
changes; and (3) sufficient work was not performed to support the audit
opinions and conclusions. At that time we were conducting a broader
audit of DCAA's overall organizational environment and quality control
system. Given the evidence presented at the Committee's September 2008
hearing, you requested that we expand our ongoing assessment. Our
current report,[Footnote 3] which the Committee is releasing today,
presents the results of our DCAA-wide audit, including (1) an
assessment of DCAA's management environment and quality assurance
structure; (2) an analysis of DCAA's corrective actions in response to
our July 2008 report and two DOD reviews,[Footnote 4] and (3) potential
legislative and other actions that could improve DCAA's effectiveness
and independence.
To assess DCAA's overall management environment and quality assurance
structure, we analyzed DCAA's mission statement and strategic plan,
performance metrics, policies and audit guidance, and system of quality
control. We also reviewed audit documentation for 69 selected audits
and cost-related assignments at certain field audit offices (FAO) in
each of DCAA's five regions for compliance with generally accepted
government auditing standards (GAGAS)[Footnote 5] and other applicable
standards. We selected 37 audits of contractor internal control systems
performed by seven geographically disperse DCAA field offices within
the five DCAA regions during fiscal years 2004 through 2006.[Footnote
6] Our approach focused on DCAA offices that reported predominately
adequate, or "clean," opinions on audits of contractor internal
controls over cost accounting, billing, and cost estimating systems
issued in fiscal years 2005 and 2006. [Footnote 7] We did this because
contracting officers rely on these opinions for 3 or more years to make
decisions on pricing and contract awards, and payment. For example,
audits of estimating system controls support negotiation of fair and
reasonable prices.[Footnote 8] Also, the FAR requires contractors to
have an adequate accounting system prior to award of a cost-
reimbursable or other flexibly priced contract.[Footnote 9] Billing
system internal control audit results support decisions to authorize
contractors to submit invoices directly to DOD and other federal agency
disbursing offices for payment without government review.[Footnote 10]
Because DCAA uses the results of internal control audits to assess risk
and plan the nature, extent, and timing of tests for other contractor
audits and assignments, the conclusions and opinions in these audits
impact hundreds of other DCAA audits. At the same seven DCAA field
offices, we selected an additional 32 cost-related assignments for
review, including 16 paid voucher reviews, 10 overpayment assignments,
2 requests for equitable adjustment audits, and 4 incurred cost audits
that were completed during fiscal years 2004 through 2006. We reviewed
supporting documentation for the cost-related assignments to determine
whether DCAA auditors were identifying and reporting contractor
overpayments and billing errors.[Footnote 11]
To assess DCAA corrective actions, we reviewed the status and analyzed
several key actions that DCAA initiated as a result of our earlier
investigation, including changes in performance metrics and policy and
procedural guidance, as well as DCAA efforts in response to DOD
Comptroller/Chief Financial Officer (CFO)[Footnote 12] and Defense
Business Board[Footnote 13] recommendations. To identify potential
legislative and other actions that could improve DCAA's effectiveness
and independence, we considered DCAA's current role and
responsibilities; the framework of statutory authority for auditor
independence in the Inspector General Act of 1978, as amended;[Footnote
14] best practices of leading organizations that have made cultural and
organizational transformations; our past work on DCAA organizational
alternatives; GAGAS criteria for auditor integrity, objectivity, and
independence; and GAO's Standards for Internal Control in the Federal
Government[Footnote 15] on managerial leadership and oversight.
Throughout our audit, we met with the DCAA Director and DCAA
headquarters policy, quality assurance, and operations officials and
DCAA region and FAO managers, supervisors, and auditors. We also met
with DOD Office of Inspector General (OIG) auditors responsible for
DCAA audit oversight and DOD OIG hotline office staff. In addition, we
met with the former DOD Comptroller/CFO to discuss plans for the Office
of Comptroller/CFO and Defense Business Board reviews, and we continued
to meet with and obtain information from the new DOD Comptroller/CFO
and his staff. We also met with the Comptroller's new DCAA Oversight
Committee. We conducted our performance audit from August 2006 through
December 2007, at which time we suspended this work to complete our
investigation of hotline allegations regarding audits performed at
three DCAA field offices. We resumed our work on the performance audit
in October 2008 and performed additional work through mid-September
2009 to evaluate DCAA's quality assurance program during fiscal years
2007 and 2008, assess DCAA corrective actions on identified audit
quality weaknesses, and consider legislative and organizational
placement options for DCAA. We conducted our performance audit in
accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe that
the evidence obtained provides a reasonable basis for findings and
conclusions based on our audit objectives. We performed our
investigative procedures in accordance with quality standards set forth
by the Council of the Inspectors General on Integrity and Efficiency
(formerly the President's Council on Integrity and Efficiency).
Today, I will summarize the results of our audit.
Widespread Management Environment and Audit Quality Problems:
We found audit quality problems at DCAA offices nationwide. Of the 69
audits and cost-related assignments we reviewed,[Footnote 16] 65
exhibited serious GAGAS or other deficiencies similar to those found in
our investigation, including compromise of auditor independence,
insufficient audit testing, and inadequate planning and supervision.
Although not as serious, the remaining four audits also had GAGAS
compliance problems. In addition, while DCAA did not consider 26 of the
32 cost-related assignments we reviewed to be GAGAS audits, DCAA did
not perform sufficient testing to support reported conclusions on that
work. According to DCAA officials, DCAA rescinded 80 audit reports
related to our prior investigation as well as the audit leading to
today's report because the audit evidence was outdated, insufficient,
or inconsistent with reported conclusions and opinions and reliance on
the reports for contracting decisions could pose a problem. About one
third of the rescinded reports relate to unsupported opinions on
contractor internal controls and were used as the basis for risk-
assessments and planning on subsequent internal control and cost-
related audits. Other rescinded reports relate to Cost Accounting
Standards (CAS) compliance and contract pricing decisions. Because the
conclusions and opinions in the rescinded reports were used to assess
risk in planning subsequent audits, they impact the reliability of
hundreds of other audits and contracting decisions covering billions of
dollars in DOD expenditures.
A management environment and agency culture that focused on
facilitating the award of contracts and an ineffective audit quality
assurance structure are at the root of the agencywide audit failures we
identified. DCAA's focus on a production-oriented mission led DCAA
management to establish policies, procedures, and training that
emphasized performing a large quantity of audits to support contracting
decisions and gave inadequate attention to performing quality audits.
An ineffective quality assurance structure, whereby DCAA gave passing
scores to deficient audits compounded this problem.
Although the reports for all 37 audits of contractor internal controls
that we reviewed stated that the audits were performed in accordance
with GAGAS, we found GAGAS compliance issues with all of these audits.
The issues or themes are consistent with those identified in our prior
investigation.
Lack of independence. In seven audits, independence was compromised
because auditors provided material nonaudit services to a contractor
they later audited; experienced access to records problems that were
not fully resolved; and significantly delayed report issuance, which
allowed the contractors to resolve cited deficiencies so that they were
not cited in the audit reports. GAGAS state that auditors should be
free from influences that restrict access to records or that improperly
modify audit scope.[Footnote 17]
Insufficient testing. Thirty-three of 37 internal control audits did
not include sufficient testing of internal controls to support auditor
conclusions and opinions. GAGAS for examination-level attestation
engagements require that sufficient evidence be obtained to provide a
reasonable basis for the conclusion that is expressed in the
report.[Footnote 18] For internal control audits, which are relied on
for 2 to 4 years and sometimes longer, the auditors would be expected
to test a representative selection of transactions across the year and
not transactions for just one day, one month, or a couple of
months.[Footnote 19] However, we found that for many controls, the
procedures performed consisted of documenting the auditors'
understanding of controls, and the auditors did not test the
effectiveness of the implementation and operation of controls.
Unsupported opinions. The lack of sufficient support for the audit
opinions on 33 of the 37 internal control audits we reviewed rendered
them unreliable for decision making on contract awards, direct-billing
privileges, the reliability of cost estimates, and reported direct cost
and indirect cost rates. For example, we found that:
* For many controls, DCAA did not perform any testing at all. For
example, audits of contractor accounting systems do not include any
transaction testing. Instead, these audits focus on a review of the
adequacy of contractor policies and procedures. At least six of the
nine accounting audits we reviewed did not include procedures for
confirming contractor segregation of allowable and unallowable cost.
* DCAA issued an adequate opinion on the accounting system for a major
DOD contractor after performing a walkthrough of the accounting process
and interviewing two employees.
* In billing system audits we reviewed, DCAA auditors often tested only
two, three, or sometimes five transactions to support audit conclusions
on contractor systems and related internal controls. Further, the
auditors performed limited procedures such as determining whether the
vouchers were mathematically correct and included current and
cumulative billed amounts. Twenty of the 22 billing system audits we
reviewed did not include tests to identify duplicate invoices.
* DCAA auditors reported on the adequacy of a contractor's billing
system based on tests of four vouchers, all issued on the same day.
* In an audit of controls over indirect and other direct cost for a
business segment of one of the top five DOD contractors, DCAA auditors
tested 12 out of about 22,000 transactions processed from May through
July 2005.
We also found that reports did not adequately disclose the criteria
used in performing individual audits. According to GAGAS, audit reports
should, among other matters, identify the subject matter being reported
and the criteria used to evaluate the subject matter. Criteria identify
the required or desired state or expectation with respect to the
program or operation and provide a context for evaluating evidence and
understanding the findings.[Footnote 20] None of the 37 internal
control audit reports we reviewed cited specific criteria used in
individual audits. Instead, the reports uniformly used boilerplate
language to state that DCAA audited for compliance with the "FAR, CAS,
DFARS, and contract terms." As a result the user of the report does not
know the specific Federal Acquisition Regulation (FAR), Cost Accounting
Standards (CAS), or contract terms used as criteria to test contractor
controls. This makes it difficult for users of the reports to determine
whether the reports provide the level of assurance needed to make
contracting decisions.
Similarly, the 32 cost-related assignments we reviewed did not contain
sufficient testing to provide reasonable assurance that overpayments
and billing errors that might have occurred were identified. As a
result, there is little assurance that any such errors, if they
occurred, were corrected and that related improper contract payments,
if any, were refunded or credited to the government. Contractors are
responsible for ensuring that their billings reflect fair and
reasonable prices and contain only allowable costs, and taxpayers
expect DCAA to review these billings to provide reasonable assurance
that the government is not paying more than it should for goods and
services. We identified the following problems with these assignments.
Paid voucher reviews. DCAA performs annual testing of paid vouchers
(invoices) to determine if contractor voucher preparation procedures
are adequate for continued contractor participation in the direct-bill
program.[Footnote 21] Under the direct-bill program, contractors may
submit their invoices directly to the DOD disbursing officer for
payment without further review. Although DCAA does not consider its
reviews of contractor paid vouchers to be GAGAS engagements, it has not
determined what standards, if any, apply to these assignments. In
addition, for the 16 paid voucher assignments we reviewed, we found
that DCAA auditors failed to comply with DCAA Contract Audit Manual
(CAM) guidance.[Footnote 22] Rather than documenting the population of
vouchers, preparing sampling plans, and testing a random (statistical)
sample, auditors generally did not identify the population of vouchers,
did not create sampling plans, and made a small, nonrepresentative
selection of as few as one or two invoices for testing to support
conclusions on their work. The auditors performed limited procedures
such as determining whether the vouchers were mathematically correct
and included current and cumulative billed amounts. Based on this
limited work, the auditors concluded that controls over invoice
preparation were sufficient to support approval of the contractors'
direct billing privileges. This is of particular concern because we
determined that Defense Finance and Accounting Service (DFAS)
certifying officers rely on DCAA voucher reviews, and they do not
repeat review procedures they believe to be performed by DCAA.
Overpayment assignments. DCAA performs overpayment assignments to
verify that contractors have billing procedures and internal controls
in place to identify and resolve contractor billing errors and
overpayments in a timely manner. DCAA guidance states that these
engagements should be conducted in accordance with GAGAS to the extent
applicable under the circumstances.[Footnote 23] However, none of the
10 overpayment assignments we reviewed were performed or reported as
GAGAS engagements. We found that auditor judgments about the population
and selection of transactions for these assignments did not provide a
representative universe for testing and concluding on contractor
controls over billings and payments received. For example, for the 10
assignments we assessed, the auditors selectively reviewed an accounts
receivable aging report to identify overpayments and determine if they
had been resolved. As a result, this work does not provide reasonable
assurance that contractors have adequate controls in place to identify
and correct overpayments and billing errors and make appropriate,
timely refunds and adjustments.
Incurred cost audits. The purpose of incurred cost audits is to examine
contractors' cost representations and opine on whether the costs are
allowable, allocable to government contracts, and reasonable in
accordance with the contract and applicable government acquisition
regulations. [Footnote 24] DCAA performs these audits as GAGAS
attestation engagements. For the four incurred cost audits we reviewed,
we found that the auditors did not adequately document their judgments
about control risk or the sampling and test methodologies used. In
addition, we found that the auditors traced claimed pool and base costs
(indirect costs) to the contractors' accounting books and records to
determine their accuracy and allowability. However, the auditors did
not perform sufficient, detailed testing of claimed indirect and direct
costs. For example, the auditors traced and reconciled indirect costs
to contractor accounting system data, but did not test a representative
selection of direct costs. As a result, the scope of work performed was
not sufficient to identify claimed costs, if any, that were not
adequately supported or unallowable costs, if any, that should have
been questioned.
Production environment and audit quality issues. DCAA's mission
statement, strategic plan, and metrics all focused on producing a large
number of audit reports and provided little focus on assuring quality
audits. For example, DCAA's current approach of performing 30,000 to
35,000 audits and issuing over 22,000 audit reports with 3,600 auditors
substantially contributed to the widespread audit quality problems we
identified. Within this environment, DCAA's audit quality assurance
program was not properly implemented, resulting in an ineffective
quality control process that accepted audits with significant
deficiencies and noncompliance with GAGAS and DCAA policy. Moreover,
even when DCAA's quality assurance documentation showed evidence of
serious deficiencies within individual offices, those offices were
given satisfactory ratings. Considering the large number of DCAA audit
reports issued annually and the reliance the contracting and finance
communities have placed on DCAA audit conclusions and opinions, an
effective quality assurance program is key to protecting the public
interest. Such a program would report review findings along with
recommendations for any needed corrective actions; provide training and
additional policy guidance, as appropriate; and perform follow-up
reviews to assure that corrective actions were taken. GAGAS require
that each audit organization performing audits and attestation
engagements in accordance with GAGAS should have a system of quality
control that is designed to provide the audit organization with
reasonable assurance that the organization and its personnel comply
with professional standards and applicable legal and regulatory
requirements, and have an external peer review at least once every 3
years.[Footnote 25]
DCAA officials advised us that going forward, DCAA will no longer rate
an FAO's overall compliance with GAGAS and DOD policy. The officials
told us that instead, DCAA headquarters plans to (1) report the
detailed results of the audit quality reviews, (2) make recommendations
to FAOs for any needed corrective actions, (3) conduct follow-up
reviews for all FAOs with identified audit deficiencies to ensure that
corrective actions are taken, and (4) provide training and policy
guidance, as appropriate. If properly implemented, these procedures
would help to assure an effective audit quality assurance program.
In addition, the DOD IG reported an adequate ("clean") opinion on
DCAA's most recent peer review results although the reported evidence
indicated that numerous audits had serious deficiencies in audit
quality.[Footnote 26] In conducting DOD's audit oversight review of
DCAA audits, DOD IG audit oversight reviewers considered the same
results of DCAA's internal audit quality assurance reviews that we
analyzed and reviewed numerous additional audits, which also identified
significant GAGAS noncompliance as evidenced by DOD IG peer review
findings and recommendations. Although the DOD IG report contained
evidence of significant, systemic noncompliance with professional
standards throughout DCAA audits that OIG staff reviewed and the IG
report included numerous findings and recommendations related to those
issues, the DOD IG gave DCAA a "clean" peer review opinion,[Footnote
27] concluding that for audits and attestation engagements performed
during fiscal year 2006, "—the internal quality control system was
operating effectively to provide reasonable assurance that DCAA
personnel were following established policies, procedures, and
applicable auditing standards..."
The overall report conclusion in the DOD IG report is inconsistent with
the detailed observations in the report, which indicate numerous
significant deficiencies in DCAA's system of quality control.
Furthermore, of the 80 audit reports that DCAA rescinded, 39 of the
rescinded reports were issued during fiscal year 2006--the period
covered by the last DOD IG peer review. Therefore, we have concluded
that DCAA's quality control system for the period covered by the last
DOD IG peer review was not effectively designed and implemented to
provide assurance that DCAA and its personnel comply with professional
standards.
DCAA Is Making Progress, but Sustained Leadership and Oversight Is
Needed:
Although DCAA has taken several positive steps, much more needs to be
done to address widespread audit quality problems. DCAA's production-
oriented culture is deeply imbedded and will likely take several years
to change. Under DCAA's decentralized management environment, there had
been little headquarters oversight of DCAA regions, as demonstrated by
the nationwide audit quality problems. DCAA's mission focused primarily
on producing reports to support procurement and contracting community
decisions with no mention of quality audits that serve taxpayer
interest. Further, DCAA's culture has focused on hiring at the entry
level and promoting from within the agency and most training has been
conducted by agency staff, which has led to an insular culture where
there are limited perspectives on how to make effective organizational
changes.
DCAA corrective actions. DCAA initiated a number of actions to address
findings in our July 2008 report, the DOD Comptroller/CFO August 2008
"tiger team" review, and the Defense Business Board study, which was
officially released in January 2009. Examples of key DCAA actions to
date include the following.
* Eliminating production metrics and implementing new metrics intended
to focus on achieving quality audits.
* Establishing an anonymous Web site to address management and hotline
issues. DCAA's Assistant Director for Operations has been proactive in
handling internal DCAA Web site hotline complaints.
* Revising policy guidance to address auditor independence, assure
management involvement in key decisions, and address audit quality
issues. DCAA also took action to halt auditor participation in nonaudit
services that posed independence concerns.
Further, DCAA has enlisted assistance from other agencies to develop a
human capital strategic plan, assist in cultural transformation, and
conduct a staffing study. In March 2009, the new DCAA Comptroller/CFO
established a DCAA Oversight Committee to monitor and advise on DCAA
corrective actions.
While these are positive actions, other DCAA actions have focused on
process improvements, and DCAA has not yet addressed the fundamental
weaknesses in its mission, strategic plan, audit approach, and human
capital practices.
Although DCAA is making progress, we are concerned that DCAA actions to
date evidence some of the past cultural problems that could limit their
success. For example, DCAA identified the following six new performance
metrics as focusing on the intended outcome-related goal of achieving
quality audits that comply with GAGAS.[Footnote 28]
1. Obtaining an unqualified DOD IG peer review opinion.
2. DCAA's internal quality assurance program results show that 100
percent of the audits reviewed reflected professional judgment.
3. Checklist confirmation that issued reports did not include serious
deficiencies.
4. A goal that 45 percent of audit reports will have findings as an
indication of the tangible value of the audit work performed.
5. A goal that 15 percent of the audits will use quantitative methods
to measure the extent to which advanced level audit techniques are
used.
6. A goal that auditors will meet 100 percent of their continuing
professional education requirements on time.
Given the problems with DOD IG peer review results and DCAA's
ineffective quality assurance program, for these metrics to achieve the
intended audit quality goal, significant changes will be needed. DCAA
also retained three performance metrics that address issuing reports
within specified times to support contract awards and closeouts, for
example:
1. A forward-pricing audit timeliness goal of 95 percent based on
agreement with requesters.
2. Incurred cost audit timeliness goals of 90 percent of corporate
audits completed within 12 months, 90 percent of major contractor
audits completed in 15 months, and 95 percent of non-major contractor
audits completed in 24 months.
3. An efficiency goal of cost per direct audit hour of less than
$113.45 to be monitored at the agency level only.
It is critical that agreements with the contracting community on
timeliness goals for forward-pricing and incurred cost audits allow
performance of sufficient audit procedures to help contracting officers
ensure that prices paid by the government are fair and reasonable, and
that contract costs comply with applicable laws, regulations, cost
accounting standards, and contract terms.
Risk-based audit approach. DCAA did not agree to develop a risk-based
audit approach, as recommended by the Defense Business Board. DCAA
lacks a risk-based audit approach to address how it will perform
required audits with available audit resources, reassess the need to
perform 30,000 or more audits annually and the appropriate level of
audit resources, and establish priorities for performing quality audits
that meet GAGAS within available resources. While resources are a key
element of a risk-based planning approach, DCAA is performing the
Defense Business Board recommended staffing study as a stand-alone
effort rather than performing this study in concert with an effort to
establish a risk-based planning process.
DCAA policy guidance. DCAA's new policy guidance on adequate audit
documentation and testing does not contain sufficient instruction to
assure that auditors (1) adequately document significant decisions
affecting the audit objectives, scope and methodology, findings,
conclusions, and recommendations and (2) perform sufficient work to
support decisions to approve contractors for direct-bill status. For
example,
* DCAA's new policy on "Workpaper Documentation of Judgmental
Selections"--requires a description of the universe (population) from
which items are selected for testing, identification of items and
attributes to be tested, and an explanation to support that the
judgmental selection will result in adequate audit coverage.
Emphasizing the requirement that audit documentation include a
description of the population used for sampling and identification of
items and attributes to be tested is appropriate. However, the
requirement for an explanation in the audit documentation that the
judgmental selection will result in adequate audit coverage needs to be
sufficiently justified. GAGAS and AICPA standards require that auditors
document significant decisions affecting the audit objectives, scope
and methodology, findings, conclusions, and recommendations resulting
from professional judgment.[Footnote 29]
* DCAA's new policy on "Audit Guidance for Annual Testing of Contractor
Eligibility for Direct Bill" is intended to determine whether continued
reliance can be placed on the contractor's procedures for preparation
of interim vouchers. This policy change clarified and consolidated
audit steps related to the contractor's compliance with contract
provisions, added audit steps for reviewing vouchers under time-and-
material and labor-hour contracts, and removed the requirement to
verify that the contractor's Central Contractor Registration is
current. The policy memorandum states that this scope of work performed
does not constitute an audit or attestation engagement under GAGAS.
While it is within DCAA's purview to determine whether these procedures
constitute an audit, because direct-bill decisions present a risk of
undetected improper contract payments, prudent decisions to continue a
contractor's direct-bill authorization would necessarily be based on
testing a statistical sample of invoices[Footnote 30] and include a
review of supporting documentation, including documentation to confirm
the government received goods and services noted on the billing
invoice. We confirmed that Defense Finance and Accounting Service
certifying officers rely on DCAA reviews and that they do not repeat
review procedures they believe to be performed by DCAA.
In addition, DCAA's policy to eliminate the "inadequate-in-part"
opinion for contractor internal control systems audits does not
recognize different levels of severity of control deficiencies and
weaknesses and could unfairly penalize contractors whose systems have
less severe deficiencies by giving them the same opinion--"inadequate"--
as contractors having material weaknesses or significant deficiencies
that in combination would constitute a material weakness. DCAA would
benefit from outside expertise to develop effective audit policy
guidance and training on auditing standards.
Legislative and Other Actions Could Further Improve DCAA:
In addition to correcting the fundamental weaknesses in DCAA's mission
and overall management environment, we believe certain legislative
measures as well as other actions could enhance DCAA's effectiveness
and independence. For example, granting DCAA certain authorities and
protections--similar to those offered to presidentially appointed
inspectors general (IG) under the IG Act[Footnote 31]--could enhance
DCAA's independence. The IG Act contains provisions that enhance the
independence of presidentially appointed IGs, including protections
from removal without congressional notification, access to independent
legal counsel, public reporting of audit results, rights to take
statements from contractor and other personnel, and budget visibility.
These provisions would enhance the important DCAA initiatives currently
under way. In the longer term, Congress could consider changes in
organizational placement after DCAA has had sufficient opportunity to
effectively implement current reform efforts. However, moving DCAA as
an organization would require careful analysis and planning before
implementation. Continued monitoring and oversight will be essential to
assuring the successful implementation of DCAA's management
initiatives.
Our Recommendations and DOD's Response:
Our report contains several recommendations to DOD as well as matters
for congressional consideration intended to strengthen DCAA in
fulfilling its contract audit responsibilities. Our report also
discusses matters for congressional consideration that could enhance
DCAA's effectiveness and independence. These recommendations and
matters are discussed below.
We made 17 recommendations to improve DCAA's management environment,
audit quality, and oversight, including 15 recommendations to DOD and 2
recommendations to the DOD IG regarding DCAA's last peer review. DOD
fully agreed with 13 of the 15 recommendations, partially concurred on
one recommendation and did not concur with one other recommendation. We
view DOD comments as being generally responsive to the intent of our
recommendations.
DOD partially concurred with our recommendation that DCAA consult with
DOD stakeholders and engage outside experts to develop a risk-based
contract audit approach that identifies resource requirements and
focuses on performing quality audits that meet GAGAS. DOD stated that
DCAA already has a risk-based contract audit approach that identifies
resource requirements and focuses on performing quality audits that
meet GAGAS. However, DOD stated that DCAA will coordinate with the
Under Secretary of Defense for Acquisition, Technology, and Logistics
(USD (AT&L)) to assess DCAA audit requirements.[Footnote 32] DOD
expects to complete its assessment of stakeholder needs based on
regulatory and statutory requirements by December 2010.
We appreciate these steps; however, we remain concerned that DCAA's
current approach of performing 30,000 to 35,000 audits and issuing over
22,000 audit reports with 3,600 auditors substantially contributed to
the widespread audit quality problems we identified. Generating that
many reports and doing that many audits with 3,600 auditors leaves very
little time to perform in-depth, complex audits of contractors.
DOD did not concur on our recommendation to develop policies and
procedures related to direct-billing decisions, stating that (1) the
department believes that a review of the contractor's interim public
vouchers is an integral function of DCAA's continued assessment of a
contractor's billing system, (2) DCAA is in the best position to review
and approve contract interim billings based on its thorough
understanding of the contractor's system, (3) DOD believes that our
concerns are mitigated based on comprehensive supervisory and audit
manager reviews, and (4) DCAA does not believe that the approval of
interim vouchers along with the approval for contractors to be on
direct billing results in a lack of auditor objectivity.
We continue to believe that DCAA's management (nonaudit) responsibility
to perform prepayment reviews of contractor vouchers for DOD and the
auditor's decision-making role of approving contractors for direct-
billing privileges based on its audit conclusions about the strength of
the contractor's system of internal controls, create audit objectivity
issues. Under normal circumstances, DCAA auditors must review
contractor vouchers prior to payment--a management support function for
DOD. By obtaining direct-billing privileges, however, contractors can
receive payment for goods and services without a voucher review by DCAA
prior to payment. Because we found that this situation created an
incentive for DCAA to reduce its workload by recommending that
contractors are placed on direct billing, we recommended that DCAA
develop new policies and procedures to ensure a separation between
staff reviewing vouchers and staff making direct-bill decisions. DCAA
did not explain the basis for its belief that DCAA administrative staff
have a thorough understanding of the contractors' systems. Further, we
disagree with DOD's statement that our concerns are mitigated based on
the comprehensive supervisory and audit manager reviews because this is
not supported by our findings. The fact that DCAA approvals of
contractor direct-bill privileges were not based on sufficient audit
procedures as demonstrated by our work and DCAA's removal of over 200
contractors from the direct-bill program since our July 2008 report
[Footnote 33] support our concern that the existence of such an
incentive presents an objectivity impairment.
With regard to our two recommendations to the DOD IG, the IG concurred
on our recommendation to reconsider the overall conclusions in its May
2007 peer review report on its audit of DCAA's system of quality
control. However, the IG did not agree with our recommendation to
determine whether the report should be rescinded or modified and did
not take action to do so. The IG comments stated that the IG took
alternative action that conformed to the intent of our recommendation,
including notification of DCAA on August 24, 2009, that the May 2007
"adequate" opinion on DCAA's system of quality control would expire on
August 26, 2009. In addition, the IG stated, "We have determined that
it is not prudent to allow the adequate opinion from our May 2007
report to carry forward." However, peer review opinions neither
"expire" nor "carry forward" beyond the period covered by the peer
review. Based on the significant audit quality deficiencies identified
in the IG peer review report, DCAA's decision to rescind 80 audit
reports--39 of which relate to the period of the IG's peer review--and
the findings in our audit, we concluded that DCAA's quality control
system for the period covered by the DOD IG peer review was not
effectively designed and implemented to provide assurance that DCAA and
its personnel comply with professional standards.
DOD also provided comments on our matters for congressional
consideration. Although DOD disagreed with the matters we discussed, we
continue to believe these are valid matters for congressional
consideration. The IG Act provides many important authorities and
protections for IG's that could enhance DCAA's independence and
effectiveness. Further, if DCAA is unsuccessful in addressing our
recommendations for resolving fundamental weaknesses in its mission and
the overall management environment under the current organizational
placement, additional options would need to be considered.
Mr. Chairman and Members of the Committee, this concludes my statement.
We would be pleased to answer any questions that you may have at this
time.
Contacts and Acknowledgments:
For further information about this testimony, please contact Gregory D.
Kutz at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices
of Congressional Relations and Public Affairs may be found on the last
page of this testimony. Major contributors to our testimony include F.
Abe Dymond, Assistant General Counsel; Richard Cambosos; Jeremiah
Cockrum; Andrew McIntosh; and Lerone Reid.
[End of section]
Footnotes:
[1] DCAA also performs audit services for other federal agencies on a
fee-for-service basis.
[2] GAO, DCAA Audits: Allegations That Certain Audits at Three
Locations Did Not Meet Professional Standards Were Substantiated,
[hyperlink, http://www.gao.gov/products/GAO-08-857] (Washington, D.C.:
July 22, 2008).
[3] GAO, DCAA Audits: Widespread Problems with Audit Quality Require
Significant Reform, [hyperlink, http://www.gao.gov/products/GAO-09-468]
(Washington, D.C.: Sept. 23, 2009).
[4] DOD reviews included (1) an Under Secretary of Defense
(Comptroller/Chief Financial Officer (CFO)) tiger team review and (2) a
Defense Business Board Study.
[5] GAO, Generally Accepted Government Auditing Standards, [hyperlink,
http://www.gao.gov/products/GAO-03-673G] (Washington, D.C.: June 2003)
and GAO-07-731G (Washington, D.C.: July 2007).
[6] Although our selection of the seven offices and 37 internal control
audits was not statistical, it represented about 9 percent of the total
76 DCAA offices that issued audit reports on contractor internal
controls and nearly 18 percent of the 40 offices that issued 8 or more
reports on contractor internal controls during fiscal year 2006. Of the
37 internal control audits we reviewed, 32 reports were issued with
adequate opinions and 5 reports were issued with inadequate-in-part
opinions. In the case of follow-up audits, we also reviewed the
documentation for the previous audit to gain an understanding of the
scope of work and deficiencies identified in the prior audit. These
were the most recently completed fiscal years at the time we initiated
our audit.
[7] In selecting the seven DCAA offices, we considered a 2-year history
of internal control audit results. The seven DCAA offices we selected
reported adequate opinions on 89 percent or more of the internal
control reports they issued during fiscal year 2006. During fiscal year
2005, 4 of the 7 offices reported adequate opinions in 85 percent or
more of the internal control reports they issued, and the other 3
offices issued adequate opinions in 50 to 69 percent of the internal
control audit reports they issued.
[8] DCAA Contract Audit Manual (CAM) 5-1202.1a and Defense Federal
Acquisition Regulation Supplement (DFARS) 215.407-5.
[9] FAR §§ 16.104(h) and 16.301-3(a)(1).
[10] FAR § 42.101 and DFARS § 242.803.
[11] Contractor overpayments can occur as a result of errors made by
paying offices, such as duplicate payments and payments in excess of
amounts billed, and contractor billing errors, such as using the wrong
overhead rate, failing to withhold designated amounts on progress
payments, duplicate billings, or billing for unallowable cost.
Recoveries of overpayments can be accomplished through refunds,
subsequent billing offsets, or other adjustments to correct billing
errors.
[12] Under Secretary of Defense--Comptroller, Memorandum for Director
Defense Contract Audit Agency, Subject: Implementation of Corrective
Actions (Washington, D.C.: Aug. 20, 2008).
[13] Defense Business Board, Report to the Secretary of Defense:
Independent Review Panel Report on the Defense Contract Audit Agency,
October 2008.
[14] Codified in an appendix to Title 5 of the United States Code
(hereafter 5 U.S.C. App.).
[15] GAO, Standards for Internal Control in the Federal Government,
[hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]
(Washington, D.C.: November 1999).
[16] Of the 69 DCAA assignments we reviewed, 37 were audits of
contractor systems and related internal controls and 32 were cost
related audits and assignments.
[17] See [hyperlink, http://www.gao.gov/products/GAO-03-673G], § 3.19,
and [hyperlink, http://www.gao.gov/products/GAO-07-731G], § 3.10.
[18] [hyperlink, http://www.gao.gov/products/GAO-03-673G], § 6.04b.
[19] AICPA Statements on Auditing Standards, AU 350 and Audit and
Accounting Guide: Audit Sampling, §§ 3.14, 3.29-3.34, 3.58, and 3.61.
[20] [hyperlink, http://www.gao.gov/products/GAO-07-731G], § 4.15.
[21] DCAA does not perform paid voucher reviews during the year that it
performs an audit of the contractor's billing system internal controls.
[22] CAM 6-1007.
[23] DCAA, "Audit Program: Audit of Contractor Overpayments," (Activity
Code 17310), April 2004, September 2007, and May 2008.
[24] CAM 6-102.
[25] [hyperlink, http://www.gao.gov/products/GAO-07-731G], §§ 3.50-
3.52.
[26] All 10 categories of recommendations in the DOD IG's report
related to GAGAS compliance problems.
[27] DOD Inspector General, Oversight Review: Review of the Defense
Contract Audit Agency Quality Control System, Report No. D-2007-6-006
(Arlington, VA: May 1, 2007).
[28] DCAA also established contracting officer sustention rates related
to questioned cost and net savings as an informational goal to show
return to the taxpayer.
[29] [hyperlink, http://www.gao.gov/products/GAO-07-731G], § 3.38 and
AU § 339.12.
[30] Disbursing officers are authorized to make payments on the
authority of a voucher certified by an authorized certifying officer,
who is responsible for the legality, accuracy, and propriety of the
payment. 31 U.S.C. §§ 3325, 3527(c). DOD 7000.14-R, Department of
Defense Financial Management Regulation (DFMR), Vol. 5, Ch. 11 (March
2009), paras. 110102, 110203. In general, certifying officers
designated in writing by the agency are financially liable for any
improper, illegal, or incorrect payment made, and each payment made
must be audited (or "examined"). 31 U.S.C. §§ 3521(a), 3528(a). DFMR,
Vol. 5, Ch. 33 (April 2005), para. 330303. However, 31 U.S.C. § 3521(b)
authorizes heads of agencies to carry out a statistical sampling
procedure, within certain parameters, to audit vouchers when the head
of the agency determines that economies will result. Further, 31 U.S.C.
§ 3521(c) provides that certifying and disbursing officials are not
liable for payments that are not audited if they were made in good
faith under a statistical sampling procedure. See 68 Comp. Gen. 618
(1989); also see generally, GAO, Policy and Procedures Manual for
Guidance of Federal Agencies, title 7, §§ 6.5, 7.4, and 7.5
(Washington, D.C.: May 18, 1993).
[31] Codified in an appendix to Title 5 of the United States Code.
[32] The USD (AT&L) is responsible under 10 U.S.C. § 133 for
establishing DOD policies related to the negotiation, award, and
administration of contracts, such as those related to the use of
contract audit services, and for coordinating contract audit activities
within DOD.
[33] [hyperlink, http://www.gao.gov/products/GAO-08-857].
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Phone:
The price of each GAO publication reflects GAO‘s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO‘s Web site,
[hyperlink, http://www.gao.gov/ordering.htm].
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional
information.
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
