oversight

Contractor Business Systems: DOD Needs Better Information to Monitor and Assess Review Process

Published by the Government Accountability Office on 2019-02-07.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                United States Government Accountability Office
                Report to Congressional Committees




                CONTRACTOR
February 2019




                BUSINESS
                SYSTEMS

                DOD Needs Better
                Information to Monitor
                and Assess Review
                Process




GAO-19-212
                                               February 2019

                                               CONTRACTOR BUSINESS SYSTEMS
                                               DOD Needs Better Information to Monitor and Assess
                                               Review Process
Highlights of GAO-19-212, a report to
congressional committees




Why GAO Did This Study                         What GAO Found
Contractor business systems produce            Since 2011, the Department of Defense (DOD) has implemented several
critical data that contracting officers        changes to its processes for reviewing contractor business systems—which
use to help negotiate and manage               include systems such as accounting, estimating, and purchasing. Among other
defense contracts. These systems and           changes, DOD
their related internal controls act as
important safeguards against fraud,            •   clarified the roles and responsibilities of the Defense Contract Management
waste, and abuse of federal funding.               Agency (DCMA) and the Defense Contract Audit Agency (DCAA)—the two
Federal and defense acquisition                    agencies that are responsible for conducting the reviews;
regulations and DOD policies require           •   clarified timeframes for business system reviews and established criteria for
that DOD take steps to review the                  business systems; and
adequacy of certain business systems,          •   withheld payments from contractors that were found to have significant
but GAO and other oversight entities               deficiencies in their business systems.
have raised questions about the
sufficiency and consistency of DOD’s           DOD does not have a mechanism to monitor and ensure that these reviews are
review process.                                being conducted in a timely manner. For its part, DCAA has conducted few
                                               business system audits since 2013, as it focused its efforts on other types of
The National Defense Authorization
                                               audits. DCAA plans to significantly increase the number of business system
Act for Fiscal Year 2018 contained a
provision for GAO to evaluate how
                                               audits over the next 4 years, but its success in doing so depends on its ability to
DOD implemented legislation intended           shift resources from other audits; to use public accounting firms to conduct other,
to improve its business system review          non-business system audits; and DCAA staff’s ability to execute new audit plans
process. Among other things, this              in a timely manner.
report examines (1) the changes DOD
made to its review process and (2) the
extent to which DOD is ensuring timely
business system reviews.
GAO analyzed DOD acquisition
regulations, policies, and procedures
for conducting contractor business
system reviews and analyzed data on
reviews conducted between fiscal
years 2013 and 2018.

What GAO Recommends
GAO recommends that DCMA, in
collaboration with DCAA, develop a
mechanism to monitor and ensure
contractor business system reviews
are conducted in a timely fashion. DOD          DCMA relies on the three offices responsible for conducting DCMA-led reviews
concurred with the recommendation.              to manage the reviews, but DCMA does not formally monitor whether these
                                                reviews are being conducted consistent with policy nor does it monitor DCAA’s
                                                efforts to complete the audits for which it is responsible. DCMA is ultimately
                                                responsible for approving a contractor’s business systems. DCMA currently lacks
                                                a mechanism based on relevant and reliable information, such as the number of
                                                reviews that are outstanding and the resources available to conduct such
View GAO-19-212. For more information,
                                                reviews, to ensure reviews are being completed in a timely fashion. Such
contact Timothy J. DiNapoli, (202) 512-4841,   information could help inform more strategic oversight on whether the current
dinapolit@gao.gov                              review process is achieving its intended results, or whether additional changes to
                                               the timing of or criteria for conducting reviews are needed.
                                                                                       United States Government Accountability Office
Contents


Letter                                                                                  1
             Background                                                                 4
             DOD Revised Its Policies and Procedures Related to the
               Contractor Business System Review Process                              12
             DOD Does Not Have a Mechanism to Monitor and Ensure That
               Contractor Business System Reviews and Audits Are
               Conducted in a Timely Manner                                           22
             DOD Has Not Yet Implemented Recent Legislative Provisions to
               Change the Definition of a Covered Contractor or to Enable the
               Use of Public Accounting Firms                                         28
             Conclusions                                                              30
             Recommendation for Executive Action                                      30
             Agency Comments                                                          30

Appendix I   Comments from the Department of Defense                                  33


Tables
             Table 1: Description of the Six Major Contractor Business
                     Systems and the Factors for Including the Business
                     System Criteria in Contracts                                       4
             Table 2: Roles and Responsibilities of the Defense Contract
                     Management Agency (DCMA) and the Defense Contract
                     Audit Agency (DCAA)                                                6
             Table 3: Contractor Business System Review Frequency and
                     Responsible Agencies                                             15
             Table 4: Deficiencies Identified Between Fiscal Years 2015 and
                     2017 for Completed DOD Contractor Business System
                     Reviews                                                          18

Figures
             Figure 1: Reports and Congressional Actions Related to DOD’s
                      Contractor Business System Reviews and Other Audits             11
             Figure 2: Contractor Business System (CBS) Review
                      Responsibilities Before and After the National Defense
                      Authorization Act (NDAA) for Fiscal Year 2011                   14
             Figure 3: Number of Hours and Audits Related to Contractor
                      Business Systems Completed and Planned by Defense
                      Contract Audit Agency (DCAA) Fiscal Years 2013-2020,
                      and Hours Related to Incurred Cost Audits                       24



             Page i                                 GAO-19-212 Contractor Business Systems
Abbreviations

ACO               Administrative Contracting Officer
CBAR              Contract Business Analysis Repository
CBS               Contractor Business System
DCAA              Defense Contract Audit Agency
DCMA              Defense Contract Management Agency
DFARS             Defense Federal Acquisition Regulation Supplement
DPC               Defense Pricing and Contracting
DOD               Department of Defense
FAR               Federal Acquisition Regulation
IG                Inspector General
NDAA              National Defense Authorization Act




This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.




Page ii                                          GAO-19-212 Contractor Business Systems
                       Letter




441 G St. N.W.
Washington, DC 20548




                       February 7, 2019

                       Congressional Committees

                       Contractor business systems, which include a contractor’s accounting,
                       estimating, and property management systems, produce critical data that
                       Department of Defense (DOD) contracting officers use to help negotiate
                       and manage hundreds of billions of contract dollars each year. These
                       business systems and their related internal controls act as the first line of
                       defense against fraud, waste, and abuse of federal funding. For example,
                       an approved accounting system can help prevent contractors from
                       overcharging or mischarging federal contracts. Federal and defense
                       acquisition regulations and DOD policy require DOD to take steps to
                       review the adequacy of these business systems and to ensure that
                       contractors correct identified deficiencies. These reviews and audits are
                       conducted primarily by two defense agencies: the Defense Contract
                       Management Agency (DCMA) and the Defense Contract Audit Agency
                       (DCAA). DCMA generally has responsibility for approving contractors’
                       business systems; DCMA and DCAA have specific responsibilities for
                       reviewing these systems.

                       In 2009, the Commission on Wartime Contracting and GAO highlighted
                       significant concerns about how DOD was conducting CBS reviews at that
                       time. Congress later enacted Section 893 of the National Defense
                       Authorization Act (NDAA) for Fiscal Year 2011. 1 This provision mandated
                       that DOD develop a program to improve contractor business systems.
                       Subsequently, Section 893 of the NDAA for Fiscal Year 2017 amended
                       the earlier provision to 1) define “covered” contractors generally as those
                       with government contracts subject to cost accounting standards that
                       account for more than 1 percent of the company’s total gross revenue
                       and 2) allow contractors to use registered public accounting firms to
                       review their systems in place of DOD’s review. 2


                       1
                       Pub. L. No. 111-383, § 893 (2011).
                       2
                        Pub. L. No. 114-328, § 893 (2016). The cost accounting standards are rules designed to
                       ensure contractors consistently apply cost accounting practices to contracts with the
                       government. Regulations establish applicability and criteria for full and modified cost
                       accounting standards coverage. See 48 C.F.R. part 9903. Section 893’s definition of a
                       covered contractor excludes contractors that are exempt from the full cost accounting
                       standards.




                       Page 1                                          GAO-19-212 Contractor Business Systems
Section 890 of the NDAA for Fiscal Year 2018 contained a provision for
GAO to evaluate the implementation and effectiveness of these changes
to the contractor business system (CBS) review process. 3 This report (1)
describes the changes DOD made to its CBS review process; (2)
examines the extent to which DOD is ensuring CBS reviews are being
conducted in a timely fashion; and (3) describes the steps DOD has taken
to implement selected provisions of Section 893 of the NDAA for fiscal
year 2017.

To determine what changes DOD made to its CBS review process, we
reviewed Section 893 of the NDAA for Fiscal Year 2011, applicable
Federal Acquisition Regulation (FAR) and Defense Federal Acquisition
Regulation Supplement (DFARS) sections and clauses, and relevant
DCMA and DCAA policies, instructions, and memoranda. We compared
current steps in the CBS review process to those used by DCMA and
DCAA prior to the Fiscal Year 2011 NDAA to gain a better understanding
of the changes made and discussed those changes with DCMA and
DCAA officials. We also analyzed DCMA and DCAA data to determine
the number of business systems reviewed by either agency from fiscal
years 2015 through 2017—the last three fiscal years for which we could
obtain data for all CBS systems. To determine the reliability of these data,
we interviewed appropriate DCMA and DCAA officials and collected
information on the steps taken by their agencies to ensure data reliability.
Based on these steps, we determined the data were sufficiently reliable
for the purposes of reporting the number of systems reviewed and how
many deficiencies were found.

To further our understanding of how changes to the CBS review process
were implemented and to gain insight into the effect they had on
contractors and program offices, we selected a nongeneralizable sample
of six defense contractors based on such factors as the amount of DOD
contract obligations awarded to the contractor in fiscal year 2017; the
contractor’s size (i.e., large or small); and whether one or more of the
contractor’s business systems were disapproved as reported in DOD’s
Contract Business Analysis Repository (CBAR) as of November 2017. To
better understand the process of identifying and resolving system

3
 Pub. L. No. 115-91 § 890 (2017). The mandate included several elements, including a
request that we describe the known costs of the CBS review process to the government
and covered contractors. With regard to this element, we found that neither the
government nor contractors maintained reliable and verifiable information that would allow
us to sufficiently assess the known costs of the CBS review process.




Page 2                                           GAO-19-212 Contractor Business Systems
deficiencies, we selected five contractors that had at least one business
system that had been found to be materially deficient and one contractor
that had not had any material deficiencies identified. We interviewed
representatives from each of the six contractors as well as DCMA officials
responsible for approving the contractor’s business systems. Finally, we
interviewed contracting officers from military department buying
commands to determine how these officials mitigate risk when awarding
contracts or overseeing contractors with business system deficiencies.
When available, we collected and analyzed contract file documentation
describing how business system deficiencies affected contract awards.

To determine the extent to which DCMA and DCAA are ensuring CBS
reviews are being conducted in a timely fashion, we reviewed DCMA and
DCAA policies, instructions, and memoranda to identify the offices and
individuals responsible for providing management oversight, conducting
CBS audits and reviews, and approving contractor business systems. We
interviewed DCMA and DCAA officials and collected relevant data, such
as DCAA’s planned audits for fiscal years 2019 through 2022, to
understand their approach to prioritizing reviews and the challenges, if
any, in completing the reviews in a timely fashion.

To determine the extent to which DOD has implemented changes to its
CBS review process in response to the NDAA for Fiscal Year 2017, we
interviewed DOD Defense Pricing and Contracting (DPC) officials
responsible for drafting the proposed regulations. We also interviewed
DCMA and DCAA policy officials, contractors, and program offices to
obtain their perspectives on the potential benefits and challenges
associated with these changes. We reviewed selected contractors’ annual
U.S. Securities and Exchange Commission filings to gauge what effect, if
any, the amended statutory definition of what is considered a covered
contractor may have on these contractors. The 20 contractors we
reviewed represented 86 percent of obligations in fiscal year 2016 on
contracts that were identified in the Federal Procurement Data System-
Next Generation as covered by cost accounting standards.

We conducted this performance audit from September 2017 to February
2019 in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit to
obtain sufficient, appropriate evidence to provide a reasonable basis for
our findings and conclusions based on our audit objectives. We believe
that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objectives.



Page 3                                  GAO-19-212 Contractor Business Systems
                                            Federal acquisition regulations require certain contractors who do
Background                                  business with the government to maintain acceptable business systems
                                            that reduce risk to the government and taxpayer. Contractors may have
                                            up to six major business systems that require review. DOD’s acquisition
                                            regulation establishes criteria for each of the six types of contractor
                                            business systems, which are implemented by the inclusion of certain
                                            contract clauses. Where a contract includes these clauses, the
                                            contractor’s business systems generally must meet the criteria. Factors
                                            such as the type of contract and the dollar value determine whether the
                                            clauses are included in a contract (see table 1).

Table 1: Description of the Six Major Contractor Business Systems and the Factors for Including the Business System
Criteria in Contracts

                                                                                     Factors for Including the Business System
System              Description                                                      Criteria in Contracts
Accounting          System or systems for accounting methods, procedures,            Cost-reimbursement, incentive type, time-and-
                    and controls established to gather, record, classify, analyze,   materials, or labor-hour contracts; or contracts that
                    summarize, interpret, and present accurate and timely            provide for progress payments based on costs or
                    financial data for reporting in compliance with applicable       on a percentage or stage of completion.
                    laws, regulations, and management decisions. Systems may
                    include subsystems for specific areas such as indirect and
                    other direct costs, compensation, billing, labor, and general
                    information technology.
Estimating          Policies, procedures, and practices for budgeting and            Contracts awarded on the basis of certified cost or
                    planning controls, and generating estimates of costs and         pricing data. Additional requirements apply when
                    other data included in proposals submitted to the                the contractor is considered a large business and,
                    government in the expectation of receiving contract awards.      in the preceding fiscal year, either received
                                                                                     Department of Defense prime contracts or
                                                                                     subcontracts, totaling
                                                                                     •    $50 million or more for which certified cost or
                                                                                          pricing data were required; or
                                                                                     •    $10 million or more (but less than $50 million)
                                                                                          for which certified cost or pricing data were
                                                                                          required; and the procuring contracting officer,
                                                                                          with concurrence or request of the
                                                                                          administrative contracting officer, determines it
                                                                                          to be in the best interests of the government.
Material            Manual or automated system or systems for planning,              Contracts for non-commercial items that exceed
Management and      controlling, and accounting for the acquisition, use, issuing,   the simplified acquisition threshold and are either
Accounting          and disposition of material, which may be integrated with        cost-type contracts or fixed-price contracts with
                    other systems such as estimating, purchasing, inventory,         progress payments based upon costs incurred as
                    and accounting.                                                  work in progress. This does not apply to
                                                                                     contractors that are small businesses, educational
                                                                                     institutions, or nonprofit organizations.




                                            Page 4                                             GAO-19-212 Contractor Business Systems
                                                                                                                      Factors for Including the Business System
 System                        Description                                                                            Criteria in Contracts
 Purchasing                    System or systems for purchasing and subcontracting,                                   Contracts that include the standard FAR
                                                                                                                                            a
                               including make-or-buy decisions, the selection of vendors,                             subcontracts clause. The subcontracts clause
                               analysis of quoted prices, negotiation of prices with vendors,                         generally is included in cost-type contracts and
                               placing and administering of orders, and expediting delivery                           certain other types of contracts that exceed the
                                                                                                                                                        b
                               of materials.                                                                          simplified acquisition threshold.
 Property                      System or systems for managing and controlling                                         Contracts that include the standard FAR
                                                                                                                                                    c
 Management                    government property.                                                                   government property clause. The government
                                                                                                                      property clause generally is included in cost-
                                                                                                                      reimbursement, time-and-material/ labor hour, or
                                                                                                                      fixed price contracts where property is expected to
                                                                                                                      be furnished by the government or a contract for
                                                                                                                      commercial items where government property
                                                                                                                      exceeds the simplified acquisition threshold and the
                                                                                                                      contractor is directed to use government property.
 Earned Value                  A system for project management that effectively integrates                            Cost or incentive contracts valued at $20 million or
 Management                    the project scope of work with cost, schedule and                                      more and certain other contracts for which earned
                               performance elements for optimum project planning and                                  value management is applied.
                               control.
Source: GAO analysis of the Federal Acquisition Regulation, Defense Federal Acquisition Regulation Supplement, and Defense Contract Audit Agency and Defense Contract Management Agency
instructions I GAO-19-212
                                                               a
                                                                   FAR § 52.244-2.
                                                               b
                                                                Purchasing system requirements also are included in contracts that include the DFARS counterfeit
                                                               electronic part detection and avoidance system clause (DFARS § 252.246-7007).
                                                               c
                                                                FAR § 52.245-1.


                                                               In certain cases, the absence of an adequate system may preclude the
                                                               government from using a particular contract type or may require
                                                               additional oversight or analysis. For example, the FAR states that:

                                                               •      A cost-reimbursement contract may be used only when, among other
                                                                      things, contractors’ accounting systems are adequate for
                                                                      determining costs applicable to the contracts or orders; an adequate
                                                                      accounting system is also required for the use of progress payments. 4
                                                               •      Without an approved purchasing system, contractors may require
                                                                      additional oversight of their subcontracting decisions. 5
                                                               •      Significant deficiencies with contractors’ estimating systems shall be
                                                                      considered during negotiation. Alternatively, an adequate estimating
                                                                      system may reduce the scope of reviews to be performed on


                                                               4
                                                                   FAR §§ 16.301-3(a)(3), 32.503-3.
                                                               5
                                                                   See FAR § 44.201-1.




                                                               Page 5                                                               GAO-19-212 Contractor Business Systems
                                                                  individual proposals, expedite the negotiation process, and increase
                                                                  the reliability of proposals. 6
                                                            DCMA and DCAA are responsible for providing contracting and audit
                                                            support to the military departments and are responsible for conducting
                                                            business system reviews, along with a host of other responsibilities (see
                                                            table 2).

Table 2: Roles and Responsibilities of the Defense Contract Management Agency (DCMA) and the Defense Contract Audit
Agency (DCAA)

                                     DCMA                                                                   DCAA
Mission                              DCMA performs contract administration services                         While serving the public interest as its primary
                                     and contingency contract administration service for                    customer, DCAA performs all necessary contract
                                     the Department of Defense (DOD), other federal                         audits for DOD and provides accounting and financial
                                     agencies, foreign governments, international                           advisory services regarding contracts and
                                     organizations, and others as authorized.                               subcontracts to all DOD components responsible for
                                                                                                            procurement and contract administration.
Background                           DCMA plays a significant role in DOD’s oversight                       DCAA was established to provide more efficient and
                                     and management of contracts and provides                               consistent audit support by centralizing these duties
                                     analytical support for award decisions made by                         in a single defense organization. It performs contract
                                     contracting officers. The Director, DCMA, reports to                   audits for DOD and provides accounting and financial
                                     the Under Secretary of Defense for Acquisition and                     advisory services regarding contracts and
                                     Sustainment.                                                           subcontracts to DOD components. The Director,
                                                                                                            DCAA, reports to the Under Secretary of Defense –
                                                                                                            Comptroller.
Roles and responsibilities           •     Provides advice and information to help DOD                      •     Audits primarily cost-reimbursable and other
                                           prepare solicitations, identify acquisition risks,                     non-fixed-price contracts, which generally pose
                                           select capable contractors, and write contracts                        the highest risk to the government.
                                           that meet the needs of DOD, other federal                        •     Performs pre-award services such as pre-award
                                           agencies, and allied government agencies.                              accounting system surveys, price proposal
                                     •     Monitors contractors’ performance and                                  audits, and forward pricing rate audits.
                                           management systems to ensure that cost,                          •     Performs post-award services such as incurred
                                           product performance, and delivery schedules                            cost audits and Cost Accounting Standards
                                           are in compliance with contracts.                                      compliance and adequacy reviews
                                     •     Administers, manages, and operates                               •     May perform analysis of contractor information
                                           procurement management review programs,                                following audit report completion and support
                                           providing oversight of acquisition processes                           contracting officers during contract negotiations.
                                           employed by DOD components.
Source: GAO analysis of DODD 5105.36 Defense Contract Audit Agency (DCAA), DODD 5105.64 Defense Contract Management Agency (DCMA), and Defense Contract Audit Agency and Defense
Contract Management Agency information I GAO-19-212

                                                            Under DCMA’s November 2013 instruction, the final determination of
                                                            adequacy for all of the contractor business systems resides with the
                                                            DCMA administrative contracting officers (ACO). 7 An ACO may have
                                                            6
                                                             FAR § 15.407-5.
                                                            7
                                                             DCMA Instruction 131, Contractor Business Systems, Nov. 6, 2013. This instruction was
                                                            revised in December 2015 (DCMA Immediate Policy Change-1 (IPC-1) (Dec. 1, 2015)).




                                                            Page 6                                                            GAO-19-212 Contractor Business Systems
                        responsibility for all or a portion of a single large business or may be
                        responsible for a number of smaller contractors within a particular region.
                        To help inform their system determinations, an ACO can request that
                        either DCMA or DCAA conduct business system reviews or audits when
                        needed. Among other responsibilities, ACOs are responsible for taking
                        actions to impose consequences when contractors do not comply with
                        business system standards.


Prior Reports by GAO,   Throughout the last 10 years, GAO and other accountability organizations
Other Accountability    have reported on challenges DOD faces when conducting CBS reviews
                        or other critical contracting audits, such as incurred cost audits. 8 Over this
Organizations, and
                        time Congress has also taken actions through various NDAAs to initiate
Legislative Actions     changes to the CBS review process.

                        In 2009, the Commission on Wartime Contracting and GAO highlighted
                        significant concerns about how DOD was conducting CBS reviews at that
                        time. For example:

                        •   The Commission reported that billions of dollars in contingency-
                            contract costs in Iraq and Afghanistan could not be verified by
                            government auditors and that inadequate internal controls over
                            contractor business systems hampered the government’s insight into
                            cost errors and material misstatements. 9 The report highlighted
                            instances where DCMA and DCAA came to different conclusions
                            when reviewing the same contracts and had inadequate resources to
                            complete business system reviews. It also stated that DCMA was not
                            aggressive in motivating contractors to improve their business
                            systems because it accepted corrective action plans as sufficient
                            progress to address deficiencies. The commission made
                            recommendations to address each of these issues.

                        8
                         DCAA conducts incurred cost audits to identify whether costs incurred on flexibly-priced
                        contracts are allowable, allocable, and reasonable—information that contracting officers
                        need to close the contracts.
                        9
                         Commission on Wartime Contracting in Iraq and Afghanistan, Special Report on
                        Contractor Business Systems: Defense agencies must improve their oversight of
                        contractor business systems to reduce waste, fraud, and abuse, CWC Special Report 1,
                        September 21, 2009. The topic was revisited in its final report as one of a variety of
                        weaknesses that undermine the government’s ability to protect its interest in economical
                        and effective performance of contingency contracting. See Commission on Wartime
                        Contracting in Iraq and Afghanistan. Transforming Wartime Contracting: Controlling costs,
                        reducing risks, Final Report to Congress, August 2011.




                        Page 7                                           GAO-19-212 Contractor Business Systems
•    We found issues with independence of auditors, sufficiency of
     evidence, and incomplete reporting of DCAA’s findings. 10 As result,
     we made 17 recommendations to DOD to help improve the quality of
     DCAA’s audits, most of which the agency has implemented.
Since then, subsequent GAO and DOD Inspector General (IG) reports
have pointed to other issues with the CBS review process and DCAA’s
incurred cost audit process. Namely,

•    In November 2011, we found that DCAA could not complete the
     number of CBS reviews needed to be consistent with its guidelines
     because it was focused on higher priority areas—such as incurred
     cost audits—and, as a result, DCMA contracting officers maintained
     systems’ determinations as adequate even though the systems had
     not been audited by DCAA in a number of years. 11 Among our
     recommendations, we proposed that DCMA and DCAA identify
     options, such as hiring external auditors, to assist in the conduct of
     CBS reviews until DCAA could adequately fulfill those responsibilities
     with its own workforce. In July 2014, DOD published a proposal to
     change the DFARS to allow public accounting firms to perform
     reviews of accounting, estimating, and material management and
     accounting systems. According to DPC officials, however, the
     department’s IG raised concerns about consistency between the
     proposed change and statutory and regulatory requirements for IG
     oversight of outside audit services. Further, the private sector
     expressed concerns that CBS audit criteria did not align with generally
     accepted accounting principles used in the private sector. As result of
     these challenges, DOD did not implement the proposed regulation
     change.
•    In December 2012, we found that DCAA’s backlog of incomplete
     incurred cost audits was a contributing factor in DOD’s inability to
     close out contracts in a timely manner. 12 To address this backlog,
     DCAA began implementing a new, risk-based approach that was

10
 GAO, DCAA Audits: Widespread Problems with Audit Quality Require Significant
Reform, GAO-09-468 (Washington, D.C.: Sept. 23, 2009).
11
  GAO, Defense Contract Management Agency: Amid Ongoing Efforts to Rebuild
Capacity, Several Factors Present Challenges in Meeting Its Missions, GAO-12-83
(Washington, D.C.: Nov. 3, 2011).
12
  GAO, Defense Contracting: DOD Initiative to Address Audit Backlog Shows Promise,
but Additional Management Attention Needed to Close Aging Contracts, GAO-13-131
(Washington, D.C.: Dec. 18, 2012).




Page 8                                         GAO-19-212 Contractor Business Systems
     expected to shift DCAA’s resources to focus on incurred cost audits
     involving high-dollar value and high risk proposals.
•    In October 2015, the DOD IG found that DCMA contracting officers
     did not always comply with requirements to report business system
     deficiencies and found instances where CBS determinations based on
     DCAA-led reviews were not reported within required timeframes. The
     IG concluded that this likely caused delays in correcting significant
     business system deficiencies and lengthened the time the
     government was unable to rely on data generated by those business
     systems.
•    In September 2017, we found that despite efforts by DCAA to reduce
     the backlog of incurred cost proposals awaiting audit, the agency was
     not able to meet its goals to eliminate the backlog by fiscal year 2016
     and that it was unlikely to meet a revised goal of fiscal year 2018. 13
     We recommended that DCAA assess and implement options for
     reducing the length of time to begin incurred cost audits and establish
     related performance measures. DCAA concurred with these
     recommendations and took actions to reduce the time it takes to begin
     audits.
Most recently, in a January 2018 report, the Advisory Panel on
Streamlining and Codifying Acquisition Regulations—commonly referred
to as the Section 809 panel after the legislative provision that created it—
reiterated the importance of business system internal controls. 14 Noting
that DOD’s CBS reviews are untimely and inconsistent, the Panel made
several recommendations that seek to complete reviews, especially for
accounting systems, in a more timely way. Among these
recommendations are the use of public accounting firms to supplement
the DOD audit workforce, a change to accounting system review
standards and criteria, and the development of new guidance for the
conduct of business system reviews.




13
  GAO, Federal Contracting: Additional Management Attention and Action Needed to
Close Contracts and Reduce Audit Backlog, GAO-17-738 (Washington, D.C.: Sept. 28,
2017).
14
  Advisory Panel on Streamlining and Codifying Acquisition Regulations, Report of the
Advisory Panel on Streamlining and Codifying Acquisition Regulations Volume 1 of 3,
(Arlington, VA.: Jan. 2018). The panel was established pursuant to Section 809 of the
National Defense Authorization Act for Fiscal Year 2016. The panel also released Volume
2 in June 2018 and Volume 3 in January 2019.




Page 9                                         GAO-19-212 Contractor Business Systems
During the past 10 years, Congress also enacted three provisions related
to improving how DOD conducts business system reviews and incurred
cost audits. Specifically,

•     Section 893 of the NDAA for Fiscal Year 2011 directed the Secretary
      of Defense to initiate a program to improve contractor business
      systems so that the systems provide timely and reliable information. 15
      The NDAA required that this program, among other things, establish
      requirements for each system and a process for identifying significant
      deficiencies within systems. It also required that DOD identify those
      officials responsible for approval and disapproval of a system, and
      that approval or disapproval of a system would be based on whether
      the system has a significant deficiency. Further, the law authorized
      DOD to withhold up to 10 percent of contract progress payments,
      interim payments, and performance-based payments from certain
      contracts when systems are disapproved based on a significant
      deficiency. Contractors that require review—or “covered
      contractors”—were defined as those subject to the cost accounting
      standards.
•     Section 893 of the NDAA for Fiscal Year 2017 amended the fiscal
      year 2011 NDAA provisions by (1) revising the definition of a “covered
      contractor” to generally mean those with government contracts
      subject to the cost accounting standards accounting for more than 1
      percent of the contractor’s total gross revenue and (2) allowing public
      accounting firms to conduct contractor business system
      assessments. 16
•     Section 803 of the NDAA for Fiscal Year 2018 required DOD to be
      compliant with certain standards of risk and materiality in the
      performance of incurred cost audits for its contracts. It also required
      that DOD use public accounting firms to, among other things, perform
      a sufficient number of incurred cost audits to eliminate the incurred


15
    Pub. L. No. 111-383, § 893 (2011).
16
   Regarding the use of public accounting firms, Section 893 of the NDAA for Fiscal Year
2017 provides that if a registered public accounting firm attests to the internal control
assessments of a contractor pursuant to the Sarbanes-Oxley Act of 2002, the submission
of documentation from the public accounting firm that the contractor meets CBS
requirements generally eliminates the need for further review by DOD. The Sarbanes-
Oxley Act of 2002 establishes requirements for assessments of a company’s internal
controls for financial reporting by corporate management and registered public accounting
firms. See, e.g., 15 U.S.C. § 7262.




Page 10                                         GAO-19-212 Contractor Business Systems
                                           cost audit backlog by October 1, 2020 and to allow DCAA to allocate
                                           resources to higher-risk and more complicated audits.
                                       Figure 1 below summarizes these reports and congressional actions
                                       related to contractor business system activities over the last decade.

Figure 1: Reports and Congressional Actions Related to DOD’s Contractor Business System Reviews and Other Audits




                                       Page 11                                    GAO-19-212 Contractor Business Systems
                          Since 2011, DOD has taken actions to (1) clarify the roles and
DOD Revised Its           responsibilities of DCMA and DCAA in conducting CBS reviews and
Policies and              consolidate the number of reviews to be performed; (2) clarify how often
                          DOD should conduct CBS reviews; (3) establish what criteria are used to
Procedures Related        evaluate a contractor’s business system; (4) establish timeframes by
to the Contractor         which ACOs are to make a determination on the adequacy of the
                          contractors’ business systems; and (5) implement the use of payment
Business System           withholds for contractors that are found to have significant deficiencies in
Review Process            their contractor business systems. DCMA and DCAA officials noted that
                          these changes were implemented primarily to address the 2011 statutory
                          provisions. Our review of six selected contractors’ business system
                          reviews found that the whole process from the review or audit, to the
                          follow up and resolution, can be lengthy. In three out of six selected cases
                          we reviewed, it took 4 or more years for a contractor’s system to be
                          approved.


DOD Clarified DCMA and    Prior to 2011, DCAA conducted a series of 10 internal control audits on a
DCAA’s Roles and          cyclical basis, while DCMA performed more targeted testing on three
                          systems. During that time, both DCMA and DCAA could review a
Responsibilities and
                          contractor’s purchasing or earned value management (EVM) system but
Consolidated the Number   would evaluate different aspects of each system. As a result, DCMA and
of Business System        DCAA reviewers could issue deficiency reports based on their separate
Reviews                   reviews of the same contractor business systems for the consideration of
                          ACOs. As reported in August 2009 by the Commission on Wartime
                          Contracting, these overlapping reviews led to instances where DCMA and
                          DCAA came to different conclusions about the adequacy of the same
                          business system.

                          To address this issue and clarify roles and responsibilities, in November
                          2013 DCMA established policies that guide oversight and implementation
                          of the CBS review process, to include approval responsibilities and
                          procedures for the conduct and reporting of reviews. 17 DCMA has
                          separate instructions for each type of contractor business system with the
                          exception of accounting. These separate instructions provide more details
                          about appropriate stakeholders for specific reviews, noting particular
                          functional experts such as offices within DCMA or DCAA that are to lead
                          the conduct of the reviews. DCAA issued a separate memorandum in


                          17
                           DCMA Instruction 131.




                          Page 12                                  GAO-19-212 Contractor Business Systems
April 2012 that details changes made to accounting system reviews as a
result of changes from the NDAA for fiscal year 2011. 18

Under these revised processes, DCMA now has responsibility for
reviewing three contractor business systems and DCAA is responsible for
the other three. In all cases, the DCMA ACO makes the final
determination on whether a system is approved or disapproved. Further,
the revised process consolidated the number of audits that DCAA
conducts on the adequacy of the contractor’s accounting system from five
separate audits to one comprehensive system audit. According to DCAA,
this consolidation was based on a comprehensive reassessment of the
processes for assessing accounting systems and combined elements
from previous internal control reviews. Figure 2 shows DCMA and DCAA
responsibilities before and after the changes implemented from the NDAA
for Fiscal Year 2011.




18
 DCAA Memorandum 12-PAS-012(R), Audit Guidance on Auditing Contractor Business
Systems and Contractor Compliance with DFARS 252.242-7006, Accounting System
Administration, April 24, 2012.




Page 13                                    GAO-19-212 Contractor Business Systems
Figure 2: Contractor Business System (CBS) Review Responsibilities Before and
After the National Defense Authorization Act (NDAA) for Fiscal Year 2011




Note: the administrative contracting officer at DCMA makes the final determination on whether a
system is approved or disapproved.




Page 14                                               GAO-19-212 Contractor Business Systems
Revised Process Clarified                                      The revised DCMA instructions and related DCAA memorandums for the
Specific Timeframes for                                        CBS review process also clarified timeframes for how often a contractor’s
                                                               business system must be reviewed. Generally, each system should be
How Often DOD Should
                                                               reviewed every 3 years unless the ACO makes a determination that a
Conduct Business System                                        review is not necessary based on a risk assessment or other factors (see
Reviews                                                        table 3).

Table 3: Contractor Business System Review Frequency and Responsible Agencies

 Agency Responsible for Review                            Business System                          Frequency of Business System Reviews
 Defense Contract Audit Agency                            Accounting                               Every 3 years
 (DCAA)                                                   Estimating                               Every 3 years unless a risk assessment deems
                                                                                                   otherwise
                                                          Material Management and                  Every 3 years unless substantiated evidence suggests
                                                          Accounting                               that the contractor’s systems are adequate
 Defense Contract Management                              Purchasing                               Every 3-5 years based on an assessment of risk
 Agency (DCMA)                                                                                     completed by DCMA administrative contracting officer
                                                          Property Management                      Every 1-3 years based on a risk assessment competed
                                                                                                   by DCMA property administrator
                                                          Earned Value Management                  Every 3 years based on results of annual surveillance;
                                                                                                   full system reviews are performed based on an
                                                                                                   administrative contracting officer’s determination or at
                                                                                                   the time of initial contract award
Source: GAO analysis of DOD policies and regulations I GAO-19-212

                                                               Note: For DCAA, auditors perform the audits under DCAA’s purview. For DCMA, a procurement
                                                               analyst performs the purchasing system reviews; a property administrator performs the property
                                                               system reviews, and an Earned Value Management specialist performs system surveillance and full
                                                               reviews. DCMA’s administrative contracting officer makes the final determination about whether the
                                                               system is approved or disapproved.




DFARS Revisions                                                DOD also revised the DFARS in 2012 to provide definitions for
Established Specific                                           acceptable contractor business systems and established individual
                                                               DFARS clauses that define the criteria for each of the six business
Criteria for Business
                                                               systems. As appropriate, these clauses are included in contracts and
Systems                                                        generally require the contractor to maintain adequate business systems,
                                                               allow for the government to withhold payments when systems are found
                                                               to have significant deficiencies, and list the criteria that the systems must
                                                               meet. The number of criteria varies by system. For example, the DFARS
                                                               clause for accounting systems includes 18 criteria used to evaluate
                                                               system features such as proper segregation of direct and indirect costs,




                                                               Page 15                                               GAO-19-212 Contractor Business Systems
                         timekeeping, and exclusion of unallowable costs. 19 For EVM systems, a
                         contractor’s system must comply with private, institutional standards and
                         includes procedures that generate timely, reliable, and verifiable reports.

                         To test how DCAA-led audits were being implemented under these new
                         criteria, DCAA began a pilot program in 2014 comprised of a team of
                         dedicated auditors to conduct CBS reviews who, in turn, were to
                         recommend changes in audit plans and other practices. DCAA initially
                         focused on material management and accounting systems audits, then
                         moved to estimating systems, and finally accounting systems. As result of
                         this pilot, DCAA issued new audit guidance for all three systems in 2018,
                         with the latest guidance for accounting system audits issued in October
                         2018. DCAA officials told us that they are implementing lessons learned
                         from the pilot program and developing training on how to conduct the
                         revised audit plans.


DCMA Established         The revised DCMA instructions provide timeframes for ACOs to
Timeframes for ACOs to   communicate their initial and final determinations to contractors (see
                         textbox) and define the responsibilities of DCMA management and ACOs
Make Adequacy
                         for confirming significant deficiencies and resolving disagreements
Determinations           between functional specialists and the ACO.

                         Revised Contractor Business System Review Process Timeframes
                         According to the revised contractor business system review process, when significant
                         deficiencies are found:
                         •    Administrative Contracting Officers (ACO) have 10 days to communicate an initial
                              determination of business system compliance to the contractor under review.
                         •    The contractor is requested to respond to the letter within 30 days after that to
                              respond to the letter communicating whether or not it concurs with the determination.
                         •    The ACO issues a final determination 30 days after receipt of the contractor’s
                              response.
                         According to Defense Contract Management Agency (DCMA) officials, data for fiscal year
                         2017 indicated that 80 percent of final determination letters were issued within this
                         required timeframes.
                         Source: GAO analysis of DCMA instruction I GAO-19-212




                         19
                           One of the recommendations of the Advisory Panel on Streamlining and Codifying
                         Acquisition Regulations was to replace the 18 system criteria in the DFARS clause with an
                         internal control audit to assess the adequacy of contractors’ accounting systems based on
                         7 system criteria. See recommendation number 72 in the Report of the Advisory Panel on
                         Streamlining and Codifying Acquisition Regulations Volume 3 of 3, (Arlington, VA.: Jan.
                         2019)




                         Page 16                                                 GAO-19-212 Contractor Business Systems
                           In instances where deficiencies are found, these findings are reviewed by
                           a panel within DCMA to help ensure standards are consistently applied.
                           When there is disagreement between the ACO and functional specialist
                           concerning the nature or severity of deficiencies found, a DCMA board of
                           review may be requested by the ACO to resolve differences and produce
                           a final determination. According to DCMA officials responsible for
                           maintaining business system review policies, differences between
                           functional specialists and contracting officers are generally resolved
                           without the need for a board discussion. These officials said that only a
                           few board discussions have been convened since implementation of the
                           new review structure.


Mandatory Payment          Section 893 of the NDAA for Fiscal Year 2011 generally established that
Withholds Drive Timely     DOD be allowed to withhold payments under certain contracts when DOD
                           disapproves one or more of a covered contractor’s business systems. 20
Contractor Response to
                           DCMA officials previously had the latitude to withhold a portion of the
Significant Deficiencies   payments owed to contractors as result of deficiencies identified in their
                           reviews, but were not required to do so. From 2011 through 2013, DOD
                           revised the DFARS and related agency instructions to generally require
                           that ACOs apply a 2 to 5 percent contract payment withholding for a
                           single deficient system and a maximum of a 10 percent withhold when
                           multiple systems are found to have significant deficiencies. 21 ACOs are
                           authorized to reduce the amount being withheld after the ACO determines
                           that the contractor has submitted an adequate corrective action plan and
                           began its implementation.

                           Our review of DCMA and DCAA information indicates that for all the CBS
                           reviews conducted between fiscal years 2015 and 2017, DCMA and
                           DCAA often identified significant deficiencies in three business systems.
                           These were the cost estimating, material management and accounting,
                           and purchasing systems. For example, DCAA identified a significant
                           deficiency in nine of the 12 material management and accounting
                           systems reviewed, while DCMA identified significant deficiencies in 260 of
                           the 330 purchasing systems reviewed (see table 4).

                           20
                             Section 893 established that DOD’s program to improve contractor business systems is
                           to provide for the disapproval of a business system when it has a significant deficiency.
                           Section 893 defined a significant deficiency as a shortcoming in a system that materially
                           affects the ability of DOD and contractor officials to rely upon information produced by the
                           system that is needed for management purposes.
                           21
                            DFARS §§ 242.7000, 252.242-7005; and DCMA Instruction 131.




                           Page 17                                           GAO-19-212 Contractor Business Systems
Table 4: Deficiencies Identified Between Fiscal Years 2015 and 2017 for Completed DOD Contractor Business System
Reviews

                                                                                                                    Reviews where               Percentage of reviews
                                                                                       Reviews             significant deficiencies                   where significant
 Agency                                 Business system                              completed                          were found             deficiencies were found
 Defense Contract Audit                 Accounting                                                 3                                      0                        0%
 Agency                                 Estimating                                                 9                                      7                       78%
                                        Material Management
                                        and Accounting                                            12                                      9                       75%
 Defense Contract                       Purchasing                                              330                                      260                      79%
 Management Agency                      Property Management                                  2,934                                        26                       1%
                                        Earned Value
                                        Management                                              891                                       9                        1%
Source: GAO analysis of data from Defense Contract Management Agency functional offices and Defense Contract Audit Agency I GAO-19-212

                                                               Note: These figures reflect only business system reviews evaluating compliance with Defense
                                                               Federal Acquisition Regulation Supplement criteria; they exclude follow-up and limited scope reviews.
                                                               Earned Value Management system reviews include annual surveillance reviews that evaluate
                                                               contractor business systems over a 3 year period.


                                                               Because DCMA and DCAA officials do not maintain historical data on
                                                               payment withholdings, it is not possible to determine the number of
                                                               payment withholdings that were implemented over these years as a result
                                                               of these significant deficiencies. 22 The system used to track the status of
                                                               systems and payment withholdings, CBAR, is updated by ACOs as
                                                               corrective actions are completed and payment withholdings are removed,
                                                               and thus shows only a snapshot in time. Our review of CBAR data from
                                                               July 2018 found that DOD was withholding payments from 11 contractors
                                                               with a total collective value of approximately $238 million at that time. 23
                                                               One third of these payment withholdings were associated with significant
                                                               deficiencies found in contractors’ estimating systems. DCMA and DCAA
                                                               officials we spoke with noted that the withhold provision has led to
                                                               contractors’ increased response to deficiencies, but they did not have
                                                               data to determine the extent to which contractors’ responsiveness has
                                                               22
                                                                 Payments withheld as result of contractor business system disapproval are provided to
                                                               the contractor after the contracting officer determines that all significant deficiencies have
                                                               been corrected.
                                                               23
                                                                 In some instances, multiple payment withholds were implemented based on deficiencies
                                                               found at more than one location for the same contractor. In the course of our review, we
                                                               identified certain erroneous data entries for payment withholds which were investigated by
                                                               DCMA and resulted in changes to CBAR reporting requirements to help ensure the
                                                               accuracy of dollar amounts associated with payment withholds. These changes included
                                                               more detailed instruction to ACOs.




                                                               Page 18                                                             GAO-19-212 Contractor Business Systems
                            increased. Some contractors we spoke with stated that because
                            deficiencies will affect the company’s cash flow, senior management and
                            board members have become more engaged in matters of business
                            system compliance.


CBS Review and              Our review of six selected contractors’ business system reviews
Corrective Action Process   illustrates the challenges in identifying and resolving deficiencies in a
                            timely manner. Overall, our review of these six cases found that it took
Can Be Lengthy
                            from 15 months to 5 years or more to resolve deficiencies initially
                            identified by DCAA or DCMA. Factors contributing to the time it took to
                            resolve these issues included contractors submitting inadequate
                            corrective action plans, DCMA or DCAA identifying additional deficiencies
                            in subsequent reviews or audits, and the use of different auditors to
                            conduct the reviews.

                            While the selected cases are not generalizable to all CBS reviews, they
                            do highlight issues that can arise during the process. For example:

                            •   In one case it took almost 4 years to resolve deficiencies identified in
                                a contractor’s accounting system. In this case, DCAA issued an audit
                                report in July 2014 that found seven significant deficiencies including
                                inadequate monitoring and adjusting of rates the contractor was billing
                                the government. DCMA subsequently issued an initial determination 7
                                days later disapproving the system, citing three of the seven
                                deficiencies identified by DCAA. In August 2014, the contractor
                                responded by providing a corrective action plan for the three
                                deficiencies DCMA cited. DCMA sent a second determination letter
                                the next month citing two additional deficiencies identified by DCAA.
                                In October, the assigned ACO for the contractor left and new staff was
                                assigned to the review. Ten days later, the contractor submitted a
                                second corrective action plan to address the two deficiencies
                                identified. Disagreement between the ACO and DCAA on the
                                inclusion of the two remaining deficiencies identified by DCAA for the
                                accounting system resulted in a need to convene a board of review by
                                DCMA. The board decided that the two deficiencies would be included
                                in the final determination. This, in turn, delayed issuance of a final
                                determination until mid-December 2014. According to contractor
                                representatives, over the next 3 years, they submitted various
                                corrective action plans that DCMA determined were inadequate to
                                address the deficiencies. Each time, the ACO requested additional
                                information and follow-up DCAA audits to help assess the adequacy




                            Page 19                                  GAO-19-212 Contractor Business Systems
     of the contractor’s corrective action plans. Eventually the contractor’s
     accounting system was approved in June 2018.
•    In another case, a contractor’s estimating system has been
     disapproved for over 5 years. In June 2013, DCAA identified four
     significant deficiencies in the contractor’s system, including
     inadequate support for commerciality determinations. 24 As a result,
     following a final determination of inadequacy, DCMA implemented a
     payment withhold of 5 percent. In response, the contractor submitted
     a corrective action plan in September 2013 addressing the
     deficiencies that was accepted by DCMA and the withhold was
     reduced to 2 percent. In a follow-up review in July 2014, DCAA
     identified two new deficiencies, which the contractor corrected. In
     March 2015 DCAA reviewed the contractor’s forward pricing rate
     proposal and identified 11 new deficiencies in the estimating system.
     By August 2015, the contractor had corrected the new deficiencies but
     the system remained disapproved because the previous four
     deficiencies remained uncorrected. Finally, in September 2016, DCAA
     canceled its audit of the estimating system because these four
     deficiencies remained. According to officials, the contractor was not
     ready for re-evaluation. At the time of this review the system remains
     disapproved.
•    In another case, a contractor’s property management system was
     disapproved for more than 4 years. In November 2013, DCMA
     reviewed the contractor’s property management system and,
     according to officials, identified nine significant deficiencies, including
     those related to missing records and supporting documentation for all
     contracts. DCMA issued an initial determination of disapproval. DCMA
     officials stated that they did not receive an adequate response from
     the contractor for nearly 7 months, and in June 2014, DCMA issued a
     final determination of system disapproval. The contractor
     subsequently submitted a corrective action plan in August to address
     the deficiencies. A DCMA official stated that they re-analyzed the
     system in November 2014 and found one outstanding issue.
     According to the official, the DCMA property administrator in charge of
     the review elevated the issue to the assigned ACO, but received no
     response. According to contractor representatives, they requested a

24
   Under certain circumstances, contractors must determine whether a particular
subcontract item meets the definition of a commercial item. The FAR defines commercial
items to include items customarily used by and sold (or offered for sale) to the general
public, including products with minor modifications. For a complete definition of
commercial item, see FAR § 2.101.




Page 20                                         GAO-19-212 Contractor Business Systems
    follow-up review from the DCMA ACO several times from August
    2014 to June 2015 but did not receive a response until after June
    2015. According to a DCMA official, this was due to resource issues
    as the review went dormant because the new ACO assigned to the
    contractor went overseas. The system was reviewed again in
    November 2017 and the contractor’s system was approved in January
    2018.
•   In another case, an audit of a contractor’s estimating system took
    DCAA 2 years to complete. The DCAA audit began in November
    2014. According to contractor representatives, they were initially told
    that the review would take 9 to 12 months, but a number of different
    DCAA auditors were assigned to the review over time and each
    identified different findings which led to a prolonged process. DCMA
    approved the contractor’s estimating system in December 2016.
•   In another case, a contractor’s estimating system was disapproved for
    15 months. In June 2016 DCMA disapproved a contractor’s estimating
    system due to three significant deficiencies, including one related to
    performing adequate price and cost analysis on subcontractor
    proposals. According to contractor representatives, they submitted a
    corrective action plan, but after submitting the plan DCAA performed
    an audit of the contractor’s forward pricing rates and identified
    additional deficiencies. In December 2016 DCMA officials determined
    that the corrective action plan the contractor provided was not
    sufficient. DCMA subsequently approved the contractor’s estimating
    system in September 2017.
DCMA and DCAA officials believe the cases we analyzed were not
representative of the length of time needed to complete the CBS review
process, but could not provide data to support their views because DCMA
and DCAA do not track data on the length of time it takes to complete the
entire CBS review process (i.e., from the start of an audit or review to the
resolution of system deficiencies and final determination). Our review of
selected cases was not intended to be projectable to all reviews and
audits conducted by DCMA and DCAA, but rather to be illustrative of the
challenges that may be encountered during the review process.

From the perspective of program and contracting officers, the status of a
contractor’s business system may have an impact on both contract award
decisions and contract monitoring, but officials stated that they can
mitigate the risks associated with a disapproved system. For example,
Army and Air Force program officials noted that a contractor leading
certain weapon system development and logistics efforts had a deficient
cost estimating system. According to the contracting officials, as the



Page 21                                  GAO-19-212 Contractor Business Systems
                           government could not rely on the contractor’s proposed costs to use a
                           fixed-price contract, they awarded a fixed-price incentive contract for the
                           program to better monitor the contractor’s cost reporting compared to
                           under a fixed-price contract.


                           DCMA and DCAA do not have a mechanism to monitor and ensure that
DOD Does Not Have          CBS reviews and audits are conducted in a timely manner. DCAA’s data
a Mechanism to             show that it conducted few business system audits in the past 6 years,
                           due, in part, to the need for it to reduce its backlog on completing incurred
Monitor and Ensure         cost audits. Looking to the future, DCAA has developed plans for the
That Contractor            number of CBS audits it intends to perform over the next 3 years and
                           expects that it will be caught up in conducting the audits for which it is
Business System            responsible by fiscal year 2022. Successfully executing its plan is
Reviews and Audits         dependent on several factors, including the ability to shift resources from
                           conducting incurred cost audits to business systems audits, the use of
Are Conducted in a         public accounting firms to perform a portion of the incurred cost audits,
Timely Manner              and the ability of DCAA auditors to use new audit plans and complete the
                           required audits in a timely manner. For its part, DCMA relies on the
                           offices that perform the reviews of the three systems to maintain the
                           information on the reviews completed and to plan for future reviews, but
                           DCMA headquarters does not centrally track its reviews or whether audits
                           conducted by DCAA are being completed within the timeframes described
                           in policy.


DCAA Plans to Address      DCAA officials acknowledged they have not been able to conduct audits
Previous Shortfalls in     of contractor business systems within the timeframes outlined in DCMA
                           instructions. DCAA officials attributed their inability to do so to the need to
Conducting CBS Audits
                           conduct higher priority audits—such as incurred cost audits—and staffing
Are Dependent on Several   constraints. For example, in fiscal year 2017, DCAA initially proposed to
Factors                    perform a total of 76 CBS audits for the three business systems in its
                           purview. However, DCAA completed only nine audits after assessing
                           available resources. Further, DCAA estimates that in fiscal year 2017 it
                           spent approximately 44 percent of its resources addressing incurred cost
                           audits, and 17 percent on other audits such as forward pricing rate
                           agreements. In contrast, only 6 percent of its resources were devoted to
                           business system audits and related activities.

                           Recognizing that it cannot perform all of the required CBS audits in a
                           timely fashion to meet current DCMA policy requirements, DCAA officials
                           told us they focus their audits on business systems they identify as high-
                           risk. To do so, DCAA officials consider factors such as the contractor’s


                           Page 22                                    GAO-19-212 Contractor Business Systems
current system status, the contractor size in terms of dollars on contract,
the amount of cost-type contracts, organizational changes, audit requests
by a DOD contracting officer or an ACO, and the types of deficiencies
identified and its impact on cost and schedule. DCAA headquarters
officials assess the candidates at an annual DCAA planning meeting to
determine which audits can be performed given the level of resources
available. DCAA officials told us, however, that the current policy
requirement—which generally requires review of the systems every three
years—would require DCAA to dedicate substantial resources to CBS
audits to maintain currency. As of November 2018, DCAA identified 285
systems that require an audit. 25 DCAA officials stated that a risk based
approach to reviewing these systems would provide more value than a
routine 3 year cycle. DCAA officials stated they are willing to work with
others within DOD to develop risk factors that can be used to determine
when a business system needs a review.

To better assess and plan future workload, DCAA issued a memorandum
in January 2017 to introduce a strategic workload resource initiative that
will project workload and resource availability in the out-years. Under this
process, DCAA field management teams provide information on workload
projections in March, and DCAA executive level officials make workload
planning recommendations in June that result in an agency-wide plan.
DCAA officials noted, however, that the projection for the second year is
less accurate, and as a result, the further out year projections are
reviewed every six months with adjustments made as needed. DCAA
officials also told us that the planning process is currently being expanded
to allow the agency to plan three years out. DCAA officials stated that the
fiscal year 2021 plans will be tentatively approved by the end of January
2019 and fiscal year 2022 plans will be approved by June 2019.

Based on these planning efforts, DCAA plans to conduct a total of 285
CBS audits from fiscal years 2019 through 2022, including 50 audits in
fiscal year 2019 and 104 in fiscal year 2020. It also plans to shift some of
the hours previously devoted to incurred cost audits to CBS audits (see
figure 3).




25
  In its projections for fiscal years 2019 through 2022, as of November 2018, DCAA
identified 125 accounting systems that require an audit, 48 material management and
accounting systems, and 112 estimating systems.




Page 23                                        GAO-19-212 Contractor Business Systems
Figure 3: Number of Hours and Audits Related to Contractor Business Systems Completed and Planned by Defense Contract
Audit Agency (DCAA) Fiscal Years 2013-2020, and Hours Related to Incurred Cost Audits




                                       Note: DCAA was not able to provide us with estimated hours to perform CBS and incurred cost audits
                                       for fiscal years 2021 and 2022.
                                       Our analysis indicates that successfully executing this plan is dependent
                                       on several factors, including the ability to shift resources from conducting
                                       incurred cost audits to business systems audits, the use of public
                                       accounting firms to perform a portion of the incurred cost audits, and the
                                       ability of DCAA auditors to use new audit plans and complete the required
                                       audits in a timely manner.

                                       •   First, the plan is contingent upon DCAA being able to successfully
                                           shift resources from incurred cost audits to CBS audits. According to
                                           DCAA data, DCAA plans to shift more than 378,000 hours from


                                       Page 24                                              GAO-19-212 Contractor Business Systems
     incurred cost audits to CBS audits between fiscal years 2018 and
     2020. DCAA officials noted, however, that although they have made
     significant progress in addressing incurred cost audits, the fiscal year
     2018 NDAA requires DCAA to have all incurred cost audits performed
     within 12 months. DCAA officials noted that this means it will have to
     continue to spend significant resources on incurred cost audits in
     fiscal year 2019 to meet this legislative requirement.
•    Second, DCAA officials stated that these estimates include the
     resources that are expected to become available to perform CBS
     audits as DCAA starts using public accounting firms to perform
     incurred cost audits. 26 In its October 2018 report to Congress on the
     progress made to implement Section 803 of the Fiscal Year 2018
     NDAA, DCAA estimated that public accounting firms would be able to
     perform 100 incurred cost audits per year for 2019 and 2020, which
     would then increase to 200 each year for 2021 through 2025. DCAA
     further projected, for example, that about 147,500 hours would
     become available in 2020 based on the proposed plan to use public
     accounting firms. DCAA officials told us they are in the process of
     developing a solicitation to contract for these services, which they
     anticipate releasing in the spring of 2019.
•    Lastly, these plans assume that each audit conducted by DCAA can
     be completed within an average number of hours based on the
     experiences of the team that developed the revised audit plans
     released in 2018. DCAA officials noted that these hours assume that
     DCAA audit teams will experience some challenges conducting the
     initial set of audits, but will be able to conduct them in fewer hours as
     they gain more experience in implementing the new audit plans.
     DCAA officials told us that, if successful, this plan will enable it to be
     caught up on CBS reviews by 2022.




26
  Section 803 of the Fiscal Year 2018 NDAA requires DCAA to contract with qualified
private auditors to perform incurred cost audits on its behalf. This provision differs from
Section 893 of the Fiscal Year 2017 NDAA, which generally allows DOD to enable
contractors to use registered public accounting firms to perform business system audits
and eliminate the need for further review by DCMA or DCAA. We discuss the status of
DOD’s efforts to implement Section 893 later in the report.




Page 25                                            GAO-19-212 Contractor Business Systems
DCMA Headquarters          For the DCMA-led reviews, DCMA relies on its functional offices that
Makes Limited Use of       perform reviews of their respective systems to monitor the status of CBS
                           reviews, but does not use the information to ensure that all three reviews
Data Collected by
                           are conducted within the timeframes established under DCMA’s
Functional Offices to      instructions. The three DCMA functional offices use spreadsheets to
Assess the CBS Review      manually track reviews their office has completed, and track data on
Process and does not       when the next review should be scheduled. Each functional office plans
Monitor DCAA’s Progress    and tracks this data individually. For example,
In Completing Its Audits   •   The property management functional office identifies the number of
                               contractor property systems requiring review on a monthly basis, and
                               tracks its progress in completing these reviews. In fiscal year 2018,
                               this functional office completed over 95 percent of the 850 property
                               system reviews required.
                           •   The EVM system functional office identifies the number of reviews
                               that should be conducted annually. In fiscal year 2018, the office
                               reported completion of 92 percent of the 125 required EVM system
                               reviews.
                           •   The purchasing functional office uses a rolling process to determine
                               which systems require a review. To do this, the ACO performs a
                               required risk assessment every 3 years to identify whether a full
                               business system review is required and then the purchasing functional
                               office develops a prioritization plan for the systems flagged for review.
                               The exact number of reviews conducted in a single year is dependent
                               upon the risk assessments; however, an official from the purchasing
                               system functional office estimated that their office is staffed to
                               complete approximately 125 reviews per year. The official also noted
                               that they do track to ensure all systems are reviewed in the required
                               timeframes.
                           Officials from the functional offices described to us what information they
                           provide to senior leadership, but DCMA headquarters does not collect or
                           use this information to oversee the CBS review process. For example, a
                           supervisor from the property management functional office told us that the
                           office reports monthly to their supervisors on the status of their reviews
                           and whether they are on schedule, which also serves as a method for
                           requesting additional resources if necessary. EVM system functional
                           officials told us they report the number of planned and completed reviews
                           to a DCMA internal website for senior leadership to review, but did not
                           know what senior leadership does with this information. Purchasing
                           officials said their office provides monthly reports on the status of reviews
                           for specific large contractors, and weekly reports of the number of reviews
                           completed to the agency director and component heads. DCMA


                           Page 26                                   GAO-19-212 Contractor Business Systems
headquarters officials stated that they informally share information with
ACOs in a variety of ways, including quarterly meetings, but headquarters
officials could not provide documentation on how this information is used
to monitor and assess whether CBS reviews were being conducted in
accordance with the policy timeframes.

Further, DCMA officials indicated that they do not formally monitor
DCAA’s efforts to complete the audits for which DCAA is responsible.
Despite being the agency responsible for issuing the instructions and
whose ACOs are responsible for making final determinations of business
system compliance, DCMA officials indicated that it is not their
responsibility to monitor or assess DCAA’s efforts to complete the reviews
in DCAA’s area of responsibility. DCMA and DCAA officials stated,
however, that they recently began to hold quarterly meetings, during
which time they can discuss CBS issues, including potential revisions to
the criteria and timeframes for conducting CBS reviews. But it is uncertain
what outcomes will come from this or the extent to which this will
contribute to improved management of CBS reviews.

According to federal standards for internal controls, an agency should use
quality information to help ensure that it achieves its objectives. 27 These
internal controls also state that monitoring activities should be conducted
to ensure that agency objectives are being met. Developing a mechanism
to track and monitor the number of CBS reviews that are outstanding, the
risk level assigned to those systems and the resources available to
conduct such reviews, would help DCMA and DCAA better manage the
CBS review process to ensure that contractor systems that are reviewed
and approved in a timely fashion.




27
  GAO, Standards for Internal Control in the Federal Government, GAO-14-704G
(Washington, D.C.: Sept. 10, 2014).




Page 27                                       GAO-19-212 Contractor Business Systems
                         Section 893 of the Fiscal Year 2017 NDAA amended the CBS provisions
DOD Has Not Yet          of the Fiscal Year 2011 NDAA by revising the statutory definition of a
Implemented Recent       covered contractor and by allowing contractors to use registered public
                         accounting firms to review their business systems in place of DOD’s
Legislative Provisions   review. As of November 2018, DOD had not yet proposed regulations to
to Change the            implement these legislative changes, and therefore we were unable to
                         fully evaluate the potential effects of these provisions. The Fiscal Year
Definition of a          2017 NDAA did not provide a specific timeframe for DOD to revise its
Covered Contractor       regulations, but the Director of the Defense Acquisition Regulation
                         Council—who is responsible for promulgating proposed and final rule
or to Enable the Use     changes to the DFARS— tasked her staff to draft a proposed rule by
of Public Accounting     March 2017. 28 This deadline was subsequently extended to January 23,
                         2019. In November 2018, Defense Pricing and Contracting (DPC) officials
Firms                    told us that they now expect to issue the proposed rule for public
                         comment in the third or fourth quarter of fiscal year 2019. DPC officials
                         attributed this delay, in part, to a recent executive order that calls for the
                         reduction and control of regulatory costs, as well as the complexity of
                         having public accounting firms perform CBS reviews. 29

                         Section 893 of the Fiscal Year 2017 NDAA changed the definition of
                         covered contractors—those contractors that may require CBS reviews—
                         from contractors subject to cost accounting standards to generally only
                         those with contracts subject to cost accounting standards that account for
                         more than 1 percent of their gross revenue. DPC officials stated that DOD
                         may require contractors to self-report on their revenue levels to determine
                         whether the contractor’s systems require review. DPC officials told us,
                         however, that they had not yet considered certain aspects of how
                         contractors may calculate revenues. For example, DPC officials had not
                         yet decided whether revenue should be determined based on specific

                         28
                           The process by which DOD and federal agencies develop and issue procurement
                         regulations generally includes publication of a notice of the proposed regulation in the
                         Federal Register, allowing interested parties an opportunity to provide comments on the
                         proposed regulation, followed by agency consideration of the comments received. See 41
                         U.S.C. § 1707. This process gives the public an opportunity to provide information to
                         agencies on the potential effects of the regulation or to suggest alternatives for agencies
                         to consider. For additional information on the federal rule making process, see GAO,
                         Federal Rulemaking: OMB Should Work with Agencies to Improve Congressional Review
                         Act Compliance during and at the End of Presidents’ Terms, GAO-18-183 (Washington,
                         D.C.: Mar 13, 2018).
                         29
                          Exec. Order No. 13,771, Reducing Regulation and Controlling Regulatory Costs, 82
                         Fed. Reg. 9,339 (Feb. 3, 2017).




                         Page 28                                           GAO-19-212 Contractor Business Systems
business segments, or whether it should include international sales
revenue. These officials also had not yet decided how many years of
revenue should be included in the analysis. Further, DPC officials could
not yet estimate the potential effect of implementing this provision on
contractors. Based on our analysis of publicly available contractor
financial data for the 20 contractors that we reviewed, the lowest
percentage of total revenue derived from government contracts was
10 percent. 30

Section 893 of the 2017 NDAA also authorized the use of registered
public accounting firms to assess compliance with DOD’s CBS
requirements. Under this provision, if a registered public accounting firm
certifies that a contractor’s business system meets DOD’s requirements,
it would eliminate the need for further review by DOD. 31 Some
government acquisition officials we spoke with expressed concerns that
would need to be addressed to effectively implement the legislation,
including:

•    Ensuring that public accounting firms have sufficient understanding of
     the processes or regulations to conduct the audits and provide
     conclusions that DOD could rely upon.
•    Encouraging DCMA and DCAA functional experts and auditors to
     accept public accounting firms’ findings rather than conduct additional
     reviews and audits on their own, which would undermine the ability to
     save both government and contractor resources.
•    Determining the potential for the cost of public accounting firm reviews
     being passed on to the government through the contracts of the
     businesses under review.
The DPC official responsible for implementing this provision stated that
they are aware of these concerns. He also stated that, as a first step in
implementation, his office has requested that DCMA and DCAA review
the criteria and audit plans used by their staff and identify areas where
these criteria and plans could be adjusted to make them more consistent
with criteria that public accounting firms use in the private sector.
30
  We reviewed publicly available contractor financial data for the 20 contractors that
represented 86 percent of obligations in fiscal year 2016 on contracts that were identified
in the Federal Procurement Data System-Next Generation as covered by cost accounting
standards.
31
  The provision also notes that a milestone decision authority may require review of a
contractor business system in certain situations.




Page 29                                           GAO-19-212 Contractor Business Systems
                     By clarifying DCMA and DCAA’s roles and responsibilities as well as the
Conclusions          timeframes for conducting the audits, DOD has improved the CBS review
                     process. But there are still issues that need to be addressed. DCAA
                     acknowledges it is well behind in its efforts to complete the three CBS
                     audits for which it is responsible but believes that it can be caught up by
                     the end of fiscal year 2022 if significantly more resources are available. In
                     addition, DCMA does not monitor progress of either its functional offices
                     or of DCAA against the policies that the six systems each be reviewed
                     generally every 3 years. This is because DOD currently lacks a
                     mechanism based on relevant and reliable information, such as the
                     number of CBS reviews that are outstanding, the risk level assigned to
                     those systems, and the resources available to conduct such reviews, to
                     ensure CBS reviews are being completed in a timely fashion. Such
                     information could help inform more strategic oversight to determine
                     whether the current CBS review process is achieving intended results, or
                     whether additional changes to the timing of or criteria for conducting CBS
                     reviews are needed. As the agency that is responsible for issuing the
                     overarching policies that govern CBS reviews and is ultimately
                     responsible for approving contractor business systems, DCMA is in the
                     best position to lead the effort to develop this mechanism. As each
                     agency is responsible for executing its mission and managing its
                     resources, however, this effort should be conducted in collaboration with
                     DCAA.


                     We recommend that the Director, DCMA, in collaboration with the
Recommendation for   Director, DCAA, develop a mechanism to monitor and assess whether
Executive Action     contractor business systems reviews are being completed in a timely
                     manner. (Recommendation 1)


                     DOD agreed with the recommendation. In an email, a DPC official stated
Agency Comments      that DCMA and DCAA are collaborating to determine the best way to
                     implement the recommendation. DOD’s comments are reprinted in
                     Appendix I.


                     We are sending copies of this report to the appropriate congressional
                     committees; the Acting Secretary of Defense; the Under Secretary of
                     Defense for Acquisition and Sustainment; the Under Secretary of Defense
                     – Comptroller; the Director, DCMA; the Director, DCAA; and other



                     Page 30                                   GAO-19-212 Contractor Business Systems
interested parties. In addition, the report is available at no charge on the
GAO website at http://www.gao.gov.

If you or your staff have any questions concerning this report, please
contact me at (202) 512-4841 or by e-mail at dinapolit@gao.gov. Contact
points for our Office of Congressional Relations and Public Affairs may be
found on the last page of this report. GAO staff who made key
contributions to this report were Tatiana Winger (Assistant Director),
Emily Bond, Matthew T. Crosby, Suellen Foth, Sameena Ismailjee, Jean
McSween, Ramzi Nemo, Miranda Riemer, Christy Smith, Roxanna Sun,
Tom Twambly, and Jacqueline Wade.




Timothy J. DiNapoli
Director, Contracting and National Security Acquisitions




Page 31                                   GAO-19-212 Contractor Business Systems
List of Committees

The Honorable James M. Inhofe
Chairman
The Honorable Jack Reed
Ranking Member
Committee on Armed Services
United States Senate

The Honorable Richard Shelby
Chairman
The Honorable Dick Durbin
Ranking Member
Subcommittee on Defense
Committee on Appropriations
United States Senate

The Honorable Adam Smith
Chairman
The Honorable Mac Thornberry
Ranking Member
Committee on Armed Services
House of Representatives

The Honorable Pete Visclosky
Chairman
The Honorable Ken Calvert
Ranking Member
Subcommittee on Defense
Committee on Appropriations
House of Representatives




Page 32                         GAO-19-212 Contractor Business Systems
Appendix I: Comments from the Department
             Appendix I: Comments from the Department of
             Defense



of Defense




             Page 33                                       GAO-19-212 Contractor Business Systems
           Appendix I: Comments from the Department of
           Defense




(102329)
           Page 34                                       GAO-19-212 Contractor Business Systems
                         The Government Accountability Office, the audit, evaluation, and investigative
GAO’s Mission            arm of Congress, exists to support Congress in meeting its constitutional
                         responsibilities and to help improve the performance and accountability of the
                         federal government for the American people. GAO examines the use of public
                         funds; evaluates federal programs and policies; and provides analyses,
                         recommendations, and other assistance to help Congress make informed
                         oversight, policy, and funding decisions. GAO’s commitment to good government
                         is reflected in its core values of accountability, integrity, and reliability.

                         The fastest and easiest way to obtain copies of GAO documents at no cost is
Obtaining Copies of      through GAO’s website (https://www.gao.gov). Each weekday afternoon, GAO
GAO Reports and          posts on its website newly released reports, testimony, and correspondence. To
                         have GAO e-mail you a list of newly posted products, go to https://www.gao.gov
Testimony                and select “E-mail Updates.”

Order by Phone           The price of each GAO publication reflects GAO’s actual cost of production and
                         distribution and depends on the number of pages in the publication and whether
                         the publication is printed in color or black and white. Pricing and ordering
                         information is posted on GAO’s website, https://www.gao.gov/ordering.htm.
                         Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
                         TDD (202) 512-2537.
                         Orders may be paid for using American Express, Discover Card, MasterCard,
                         Visa, check, or money order. Call for additional information.

                         Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Connect with GAO         Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.
                         Visit GAO on the web at https://www.gao.gov.

                         Contact:
To Report Fraud,
                         Website: https://www.gao.gov/fraudnet/fraudnet.htm
Waste, and Abuse in
                         Automated answering system: (800) 424-5454 or (202) 512-7700
Federal Programs
                         Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400,
Congressional            U.S. Government Accountability Office, 441 G Street NW, Room 7125,
Relations                Washington, DC 20548

                         Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
Public Affairs           U.S. Government Accountability Office, 441 G Street NW, Room 7149
                         Washington, DC 20548

                         James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707
Strategic Planning and   U.S. Government Accountability Office, 441 G Street NW, Room 7814,
External Liaison         Washington, DC 20548




                            Please Print on Recycled Paper.