T
he
G
overnmenT
C
onTraCTor
®Information and Analysis on Legal Aspects of Procurement
Focus
¶ 298
FEATURE COMMENT: Legal, Accounting
And Practical Considerations In
Responding To DCAA Audits Of
Contractor Internal Controls Systems
Current Defense Contract Audit Agency guid-ance regarding audits of contractor internal control systems takes the position that “a contractor’s failure to accomplish any appli-cable control objective should be reported as a significant deficiency/material weakness,” and that “any significant deficiencies/material weaknesses will result in an [audit] opinion that the system is inadequate.” DCAA, Memorandum for Regional Directors: Audit Guidance on Significant Deficiencies/Material Weaknesses and Audit Opin-ions on Internal Controls, 08-PAS-043(R) at 2 (Dec. 19, 2008), available at www.dcaa.mil/mmr/08-PAS-043.pdf (December 2008 audit guidance). Such an opinion can create a risk of suspension of progress payments or disallowance of costs, and also can put awards of contracts or task orders at risk.
An important issue for contracting officers and contractors is whether a DCAA audit opinion based on the recent audit guidance provides a rea-sonable basis for taking actions such as suspend-ing payments or disallowsuspend-ing costs. Contractors should anticipate this issue in responding to DCAA audits of internal controls. As discussed below, rel-evant considerations can include whether a DCAA audit finding (or proposed finding) regarding the contractor’s internal control system is consistent with generally accepted Government auditing standards (GAGAS), and the likelihood that an alleged significant deficiency or material weakness will result in unallowable costs being charged to
Government contracts and, if so, the materiality of those costs.
Contractors should also consider taking correc-tive action in response to an audit if appropriate. A contractor’s response to the audit process can be important in determining how a CO or higher-level agency management responds to a DCAA audit opinion finding that the contractor’s internal con-trol system is “inadequate,” and the record created in the audit process can be important in contract disputes or bid protests challenging Government actions based on such an audit.
DCAA’s December 2008 Audit Guidance on Contractor Internal Controls—DCAA’s
De-cember 2008 audit guidance states that it “clarifies what constitutes a significant deficiency/material weakness and establishes new guidance on report-ing audit opinions on contractors’ internal control systems.” December 2008 audit guidance at 1. As the December 2008 guidance notes, prior DCAA audit guidance had stated,
[A] significant deficiency/material weakness is an internal control deficiency that; (1) adverse-ly affects the contractor’s ability to initiate, au-thorize, record, process or report Government contract costs in accordance with applicable Government contract laws and regulations, (2) results in a reasonable possibility that un-allowable costs will be charged to the Govern-ment, and (3) the potential unallowable cost is not clearly immaterial.
Id. (citing DCAA, Memorandum for Regional Direc-tors: Audit Guidance on Reporting Internal Con-trol Deficiencies, 08-PAS-011(R) (March 3, 2008), available at www.dcaa.mil/mmr/08-PAS-011.pdf (March 2008 guidance)); see 50 GC ¶ 100.
However, the December 2008 audit guidance pro-vides a “further clarification” of that earlier guidance and states that a “contractor’s failure to accomplish any control objective tested for in DCAA’s internal control audits will or could ultimately result in unal-lowable costs charged to Government contracts, even when the control objective does not have a direct
lationship to charging costs to Government contracts” (emphasis added). It cites control objectives relating to contractor ethics and integrity as an example. December 2008 audit guidance at 1. See also DCAA, Memorandum for Regional Directors: Audit Guidance on Federal Acquisition Regulation (FAR) Revisions Related to Contractor Code of Business Ethics and Conduct, 09-PAS-014(R) (July 23, 2009), available at www.dcaa.mil/mmr/09-PAS-014.pdf; also discussed at DCAA Audit Guidance on FAR Provisions Regard-ing Contractor Code of Business Ethics and Conduct (2009), available at www.steptoe.com/assets/attach-ments/3935.pdf. Likewise, the December 2008 audit guidance states that “[i]t is not necessary to demon-strate actual questioned cost to report a significant deficiency/material weakness.” December 2008 audit guidance at 1.
Thus, DCAA’s position appears to be that any fail-ure to accomplish an internal control objective will be presumed to have a material impact on costs charged to the Government and therefore will be reported as a “significant deficiency/material weakness,” without regard to the actual or potential materiality of any cost impact. DCAA’s December 2008 audit guidance explains this position as follows:
By limiting internal control audits to major con-tractors, DCAA only performs audits of contractor systems that are material to Government contract costs. As a result, internal control deficiencies identified in DCAA audits will generally have an impact or potential impact to Government con-tract costs that is material. Therefore, a contrac-tor’s failure to accomplish any applicable control objective should be reported as a significant defi-ciency/material weakness.
December 2008 audit guidance at 1–2.
Finally, the December 2008 audit guidance ad-dresses future DCAA audit opinions. It states that “any significant deficiencies/material weaknesses will result in an [audit] opinion that the system is inadequate,” and that DCAA will no longer issue “inadequate in part” opinions. Id. at 2. It also indi-cates that DCAA audit reports will no longer include suggestions to improve contractor systems because, according to DCAA, such suggestions “caused confu-sion in the past.” Id.
DPAP Policy for Resolving Audit Disagree-ments—In response to the December 2008 audit
guidance, the director of defense procurement and acquisition policy issued a memo on Dec. 4, 2009, which
set out Department of Defense policy for addressing and resolving disagreements with DCAA audit recom-mendations. Office of the Under Secretary of Defense, Memorandum: Resolving Contract Audit Recommen-dations (Dec. 4, 2009), available at www.acq.osd.mil/ dpap/policy/policyvault/USA006857-09-DPAP.pdf (DPAP memo); see 51 GC ¶ 429(b). The DPAP memo recognizes that agreement between a CO and DCAA “was neither expected nor necessary ... on every issue,” and concludes that the CO has “ultimate responsibil-ity to determine fair and reasonable contract values.” Id. at 2.
The DPAP memo focuses on “significant disagree-ments”—situations in which the CO, in establishing a prenegotiation objective, “plans to sustain less than 75%” of the total costs questioned in a DCAA audit report on proposals valued at $10 million or more. Id. at 1. (Other disagreements are not specifically addressed.) It requires COs to discuss significant disagreements with DCAA and to document the dis-cussion and basis for disagreement in the CO’s prene-gotiation objective. The CO is also required to advise DCAA in writing of his or her position following the discussion or prior to starting negotiations. After this process is completed and the negotiation objective is approved, the CO may proceed with negotiations. Id.
The DPAP memo gives DCAA the opportunity to request higher-level review in the relevant DOD component if it disagrees with the CO’s position. (Such requests must be made within three business days after receipt of the communication from the CO regarding the disagreement.) Id. at 2. The DCAA director may also raise a disagreement with DPAP if the component-level review does not resolve the mat-ter and, if necessary, subsequently elevate the matmat-ter to the undersecretaries for defense, acquisition and logistics, and the DOD comptroller.
Finally, the DPAP memo directs DOD components to develop procedures to implement the policy, which the Defense Contract Management Agency, Army, De-fense Logistics Agency, Air Force and Navy have now done. For example, DCMA has provided for a process that includes elevation of disagreements on contrac-tor internal control systems issues to operations and headquarters contract management boards of review. DCMA, Contract Mgmt. Boards of Review (June 2010), available at guidebook.dcma.mil/282/index.cfm.
DCMA requires an administrative CO to obtain board approval before negotiating or taking any ac-tion to settle an issue. The guidance describes the
documentation the ACO is required to provide to the board, and states that the board will review a matter and provide its written approval or recommendations within 15 working days after its receipt of the required documentation, or any supplemental documentation it requests. Finally, the procedure also permits DCAA to escalate the matter to the DCMA director if it does not agree with a headquarters board’s decision. (The DCMA procedure also provides for boarding of other issues, such as Cost Accounting Standards noncom-pliances, changes to accounting practices, questioned costs in forward pricing rate agreements, notices of intent to disallow costs and final overhead rate deter-minations, with the availability and level of review subject to various dollar thresholds.) DLA and the uniformed services have also promulgated procedures pursuant to the DPAP memo. Those procedures gen-erally track the DPAP memo and identify individuals in their respective management chains who will be involved in higher-level reviews if requested by DCAA. See, e.g., Dep’t of the Navy, Memorandum: Resolving Contract Audit Recommendations (April 7, 2010), available at acquisition.navy.mil/rda/content/down-load/6669/30777/version/1/file/RSOLVING+CONT RACT+AUDIT+MEMO+of+7+APR+2010.pdf.
DCAA’s May 27, 2010 Memo—In response to the
DPAP memo, DCAA issued further guidance on resolv-ing disagreements on audit recommendations in May 2010. See DCAA, Memorandum for Regional Directors: Guidance on Resolving Contract Audit Recommenda-tions, 10-PAS-015(R) (May 27, 2010), available at www. dcaa.mil/mmr/10-PAS-015.pdf. It recapitulates the policy in the DPAP memo and specifically notes that requests for higher-level component management review must be made within three days after DCAA’s receipt of notice from the CO. It also notes that the DPAP memo permits the DCAA director to elevate “any disagreement he believes requires the DPAP Director’s attention (e.g., precedent setting or of high interest to the Department).” Id. at 1. Finally, the May 27 memo indicates that disagreements should be re-solved at the lowest level possible, but also notes that “[c]onsistent with DCAA’s current practices, DCAA should continue to elevate disagreements or signifi-cant issues up through the DOD Component’s chain of command.” Id.
Potential Implications of a DCAA Audit Opinion Finding Inadequate Internal Con-trols—An audit opinion finding that a contractor’s
internal control system is “inadequate” has the
po-tential to impact a contractor’s business. For example, FAR 16.301-3 provides that cost-reimbursement contracts may be used “only when—[t]he contrac-tor’s accounting system is adequate for determining costs applicable to the contract.” Similarly, Defense FAR Supplement 242.7501 provides that contrac-tors who receive cost-reimbursement contracts, incentive-type contracts or contracts that provide for progress payments based on costs “shall maintain an accounting system and related internal controls ... which provide reasonable assurance” that they will, among other things, comply with applicable laws and regulations, generate reliable cost data, and minimize the risk of misallocation or mischarging of costs. Other regulations permit the suspension of progress payments or reimbursement of costs if the contractor’s accounting system or internal controls are inadequate. See FAR 32.503-6(a)–(b); 52.232-16(c), (g); DFARS 242.7502.
Managing the Audit Process—It is almost
always in a contractor’s interest to establish a proac-tive and cooperaproac-tive relationship with its DCAA audit team. However, a contractor should also undertake to develop and document its position on whether an al-leged failure to meet a control objective was properly treated as a significant deficiency/material weakness and the materiality of such an alleged deficiency or weakness. These steps can be important to possibly avoiding an adverse audit finding, as well as in con-nection with the subsequent consideration by the CO or ACO of a DCAA audit opinion (and, if applicable, a DCMA review board or other component management review), or, as discussed below, in the event of litiga-tion. See also DCAA Contract Audit Manual (DCAM) § 10-408.2.f(1)(d) (June 2010), available at www.dcaa. mil/cam.htm (requiring that a contractor’s formal, written response to the audit be included as an ap-pendix to the audit report).
In that regard, the FAR and DFARS generally require that the contractor be given an opportunity to present its position to the CO before progress payments are suspended or costs are disallowed. See, e.g., FAR 32.503-6(a); 42.801(b); 52.242-1(a)(2); DFARS 242.7502. For example, FAR 32.503-6(a)(1)(i), relating to suspension of progress payments, requires the CO to, among other things, notify the contractor of the intended action and provide the contractor with “an opportunity for discussion.” Likewise, DFARS 242.7502(a) requires the CO to provide the contrac-tor with a copy of an audit report that identifies any
significant accounting system or internal control deficiencies and an opportunity to respond to the audit report.
Consideration of Applicable Auditing Concepts and Standards: One potentially important consider-ation in addressing a DCAA audit of the adequacy of a contractor’s internal controls is whether the audit findings are consistent with the auditing concepts and standards applicable to DCAA.
The March 2008 guidance states that it “incor-porates new GAGAS definitions and clarifies exist-ing guidance related to reportexist-ing internal control deficiencies.” March 2008 guidance at 1. It further states that the new GAGAS standards, which were issued in July 2007 and apply to DCAA, see DCAM § 2-101 (2010), are applicable to attestation engage-ments beginning on or after Jan. 1, 2008. March 2008 guidance at 1.
Most of DCAA’s work, including internal control audits, involves attestation engagements. See DCAM § 2-101(d); see also DCAM § 2-102.1 (discussing types of attestation engagements). Chapter 6 of GAGAS in turn sets forth standards, such as reporting dards, for attestation engagements, including stan-dards related to “reporting deficiencies in internal control, fraud, illegal acts, [and] violations of provi-sions of contracts or grant agreements.” Government Auditing Standards (GAO-07-731G) § 6.31, avail-able at www.gao.gov/new.items/d07731g.pdf. For example, GAGAS § 6.33 states,
For attestation engagements, auditors should report, as applicable to the objectives of the en-gagement, and based upon the work performed, (1) significant deficiencies in internal control,
identifying those considered to be material weak-nesses; (2) all instances of fraud and illegal acts
unless inconsequential; and (3) violations of provisions of contracts or grant agreements and abuse that could have a material effect on the subject matter of the engagement.
(Emphasis added.)
In addition, GAGAS § 6.34 goes on to provide the following definitions of “significant deficiency” and “material weakness”:
a. Significant deficiency: a deficiency in inter-nal control, or combination of deficiencies, that adversely affects the entity’s ability to initiate, authorize, record, process, or report data reli-ably in accordance with the applicable criteria or framework such that there is more than a remote
likelihood that a misstatement of the subject
matter that is more than inconsequential will not be prevented or detected.
b. Material weakness: a significant deficiency or combination of significant deficiencies, that results in more than a remote likelihood that a
material misstatement of the subject matter will
not be prevented or detected.
(Emphasis added.) As these provisions recognize, not all significant deficiencies are material weaknesses, and not all violations of contract provisions are mate-rial in their effect.
In addition, the phrases “more than remote” and “more than inconsequential” in these definitions are especially important in determining whether a failure to accomplish a particular internal control objective rises to the level of a significant deficiency or a mate-rial weakness. GAGAS explains as follows:
The term “more than remote” used in the defi-nitions for significant deficiency and material weakness means “at least reasonably possible.” The following definitions apply: (1) Remote—The chance of the future events occurring is slight. (2) Reasonably possible—The chance of the future events or their occurrence is more than remote
but less than likely. (3) Probable—The future
events are likely to occur.
Id. § 6.34 n.85 (emphasis added).
“More than inconsequential” indicates an amount that is less than material, yet has significance. A misstatement is “inconsequential” if a reasonable person would conclude that the misstatement, ei-ther individually or when aggregated with oei-ther misstatements, would clearly be immaterial to the subject matter. If a reasonable person would not reach such a conclusion, that misstatement is “more than inconsequential.”
Id. § 6.34 n.86 (emphasis added).
Finally, GAGAS also indicates that audit findings must be reasonable and not arbitrary. For example, GAGAS § 1.03 states that “GAGAS contain require-ments and guidance to assist auditors in objectively acquiring and evaluating sufficient, appropriate evi-dence and reporting the results.” Id. (emphasis added). Likewise, GAGAS § 6.04 references the two American Institute of Certified Public Accountants field work standards for attestation engagements that are in-corporated in GAGAS. The second of those standards states that “[t]he practitioner [auditor] must obtain sufficient evidence to provide a reasonable basis for the
conclusion that is expressed in the report.” GAGAS § 6.04(b) (alteration in original). See also GAGAS § 6.34 n.85 (which provides that determinations of whether there is more than a remote likelihood that a misstate-ment will be more than inconsequential are to be made objectively—based on a “reasonable person” standard). Additionally, and importantly, GAGAS § 6.43 states,
Auditors should place their findings in perspec-tive by describing the nature and extent of the
issues being reported and the extent of the work performed that resulted in the finding. To give the reader a basis for judging the prevalence and
consequences of these findings, auditors should,
as applicable, relate the instances identified to the population or the number of cases examined and quantify the results in terms of dollar value or other measures, as appropriate. If the results
cannot be projected, auditors should limit their conclusions appropriately.
(Emphasis added.)
As written, there is a significant risk that the De-cember 2008 audit guidance will be interpreted and applied in a manner that is not consistent with these auditing concepts and standards. First, the December 2008 audit guidance appears to equate significant deficiencies with material weaknesses. However, as discussed above, that is not the case under applicable auditing standards because they involve different considerations and judgments.
Second, the December 2008 audit guidance does not meaningfully address considerations of material-ity and likelihood embedded in the GAGAS defini-tions of significant deficiency and material weakness. As noted above, the December 2008 audit guidance appears to assume that any failure to accomplish an internal control objective will be reported as a “significant deficiency/material weakness” without regard to the actual or potential significance of the cost impact. As such, it fails to give effect to the GAGAS requirements that a significant deficiency in-volve a matter or amount that, although possibly less than material, has significance, and that a material weakness requires consideration and determination (and not a presumption) of materiality. For example, as written, the December 2008 audit guidance could be interpreted as assuming that a failure to meet a control objective is a significant deficiency or material weakness without the auditor having to make a case-by-case assessment of its significance or materiality, respectively.
Similarly, the December 2008 audit guidance does not adequately reflect consideration of the likelihood that unallowable costs will be charged to the Govern-ment. As noted above, GAGAS § 6.34 n.85 defines remote as “[t]he chance of the future events occurring is slight,” and defines reasonable possibility as “[t]he chance of the future events or their occurrence is more than remote but less than likely.” These concepts are part of the definitions of significant deficiency and material weakness and are important in understand-ing the risks associated with a deficiency or weakness in a contractor’s internal control system.
Insofar as the December 2008 audit guidance provides that the audit report is to include an opin-ion that an internal control system is “inadequate” whenever the auditor finds a “significant deficiency” or “material weakness” in a contractor’s internal controls, it puts contractors at risk of suspension of a percentage of progress payments or reimbursement of costs even if the chance that unallowable costs would be charged to the Government, although more than “slight,” is still “less than likely.” It compounds this problem by providing that failure to accomplish any control objective should be reported as a significant deficiency/material weakness, even if it does not have a direct relationship to charging costs to Government contracts.
Third, as the discussion above indicates, an audit process that does not adequately consider likelihood and materiality (e.g., provides that failure to accom-plish any internal control objective, even if it does not have a direct relationship to charging costs to Govern-ment contracts, should be reported as a significant deficiency/material weakness and then recommends disapproval of costs or suspension of payments) is inconsistent with GAGAS requirements that audit findings must be supported by sufficient evidence to provide a reasonable basis for the auditor’s conclusions and that auditors put their findings “in perspective.” See GAGAS §§ 6.04(b), 6.43. It also fails to give effect to the GAGAS requirement that auditors consider whether they can reasonably project the results of their audit testing, and, if they cannot, limit their con-clusions accordingly. See id. § 6.43.
Corrective Action: In addition to addressing the in-ternal control issues on the merits, contractors should, if appropriate, consider developing and implementing a corrective action plan to address alleged significant deficiencies or material weaknesses in internal control systems identified in a DCAA audit (e.g., in a draft or
final audit report). Implementation of corrective ac-tion may not avoid an audit opinion that an internal control system is inadequate. See DCAM § 10.408.2(a) (2)–(5). However, establishing a record of corrective action could be important, as a practical matter, in determining how a CO or ACO or higher-level compo-nent management responds to a DCAA audit finding, and in avoiding or limiting the suspension of progress payments or cost reimbursements. Such actions can provide assurance to the Government that the alleged deficiency or weakness has in fact been corrected and that any risk of a material cost impact has been mini-mized or eliminated. For example, FAR 32.503-6(b)(1) and DFARS 242.7502(a)(2) and (4) strongly suggest that notwithstanding an adverse DCAA audit opinion, progress payments and cost reimbursements should not be suspended if the contractor has taken effective corrective action. See also DCAM § 5-110.c(5).
Next Steps—If a CO or ACO disallows costs or
suspends progress payments based on a DCAA audit finding that a contractor does not have an adequate accounting system, the contractor may need to consider proceeding under the Contract Disputes Act, which could provide an opportunity for further discussion of the audit findings with the CO or ACO. Assuming the CO or ACO denies the claim and the matter proceeds to a board of contract appeals or to the U.S. Court of Federal Claims, key issues may include whether the DCAA audit findings were reasonable and supportable, and whether the CO or ACO otherwise acted reason-ably and consistent with the terms of the contract in relying on the findings. See Martin Marietta Corp., ASBCA 31255, 31248, 31271, 87-1 BCA ¶ 19875, aff’d on recon., 88-1 BCA ¶ 20422.
In Martin Marietta, the Armed Services Board of Contract Appeals upheld a claim for CDA interest on costs that had been suspended (and later paid) pursuant to a DCAA Form 1 based on an alleged denial of access to records. The Board essentially held that DCAA had acted arbitrarily and unreason-ably in suspending the costs. In the present context, that decision suggests that the Government may be at risk if it suspends or withholds payments based on an audit finding regarding a contractor’s internal controls that lacks a reasonable basis or in-volves an immaterial amount of costs. See also FAR 32.503-6(a)(1), (3) (which provide, respectively, that the CO “shall” suspend or reduce progress payments “only in accordance with the contract terms and never precipitately or arbitrarily”; and that “[i]n all cases
the [CO] shall (i) [a]ct fairly and reasonably; [and] (ii) [b]ase decisions on substantial evidence”); Rums-feld v. Freedom NY, Inc., 329 F.3d 1320 (Fed. Cir. 2003) (administration of progress payment clause, including decision to withhold payments, is subject to duty of good faith and fair dealing). Further, the Martin Mari-etta decision also suggests that the record developed by the contractor during and in response to an audit can affect how a board or court will view the issue of whether the Government’s reliance on a DCAA audit report was arbitrary, unreasonable or inconsistent with the terms of the contract.
Finally, the December 2008 audit guidance may lead to bid protests in cases in which a proposal is rejected based on DCAA audit findings on the inad-equacy of an offeror’s internal controls. Again, the record developed during the audit may be important in such protests. The Government Accountability Office recently sustained two protests in which an agency, relying on audit reports, rejected proposals on the ground that the protesters did not have ad-equate accounting systems. See PMO P’ship Joint Venture, Comp. Gen. Dec. B-401973.3, 2010 CPD ¶ 29; 52 GC ¶ 67; McKissak+Delcan JV II, Comp. Gen. Dec. B-401973.2, 2010 CPD ¶ 28. In both cases, GAO found that whether an offeror has an acceptable cost accounting system is a matter of responsibility. (However, that may not be true in all cases. See A-TEK, Inc., Comp. Gen. Dec. B-299557, 2007 CPD ¶ 89 (upholding agency’s rejection of a proposal where the agency concluded that the offeror failed to comply with a request for proposals requirement to have an accounting system that had been verified by DCAA or another federal audit agency)).
In PMO and McKissak+Delcan, GAO stated that although a CO has broad discretion in making a re-sponsibility determination, the determination must have a reasonable basis and cannot be based pri-marily on unreasonable or unsupported conclusions. PMO, 2010 CPD ¶ 29 at 6; McKissak+Delcan, 2010 CPD ¶ 28 at 6. In sustaining the two protests, GAO noted that neither the agency nor the auditors had provided any “analysis or legal authority” in support of their position regarding an alleged CAS noncompli-ance. GAO also noted that although there may have been other “legitimate legal or accounting reasons for questioning” the offerors’ proposed indirect rates, they had not been provided to GAO. PMO, 2010 CPD ¶ 29 at 8 n.7; McKissak+Delcan, 2010 CPD ¶ 28 at 8 n.11. Finally, GAO reaffirmed the principle that an agency
cannot reasonably base a source selection decision on erroneous information provided by DCAA. See PMO, 2010 CPD ¶ 29 at 6 (stating that “an agency’s reliance upon the advice of an auditor, such as [DCAA] does not insulate the agency from responsibility for error on the part of [DCAA]”); McKissak+Delcan, 2010 CPD ¶ 28 at 6 (same); see also Gen. Research Corp., Comp. Gen. Dec. B-241569, 91-1 CPD ¶ 183 at 7 (stating that “an agency cannot blindly rely upon ... advice [from DCAA] where there is reason to doubt the validity of the information”).
Conclusion—DCAA’s recent guidance on audits
of contractor internal controls presents a number
of issues and potential risks for contractors, and a contractor’s response to the audit process can be im-portant in managing and reducing those risks.
F
This Feature Comment was written for the Govern -ment ContraCtor by Thomas P. Barletta and
Wil-liam T. Keevan. Mr. Barletta is a partner in the
Washington, D.C. office of Steptoe & Johnson LLP and is the head of the firm’s Government Contracts Practice Group. Mr. Keevan is Senior Advisor to Chess Consulting LLC and has 40 years of Govern-ment contract accounting, auditing and disputes consulting experience.
