United States Government Accountability Office Report to Congressional Committees CONTRACTOR February 2019 BUSINESS SYSTEMS DOD Needs Better Information to Monitor and Assess Review Process GAO-19-212 February 2019 CONTRACTOR BUSINESS SYSTEMS DOD Needs Better Information to Monitor and Assess Review Process Highlights of GAO-19-212, a report to congressional committees Why GAO Did This Study What GAO Found Contractor business systems produce Since 2011, the Department of Defense (DOD) has implemented several critical data that contracting officers changes to its processes for reviewing contractor business systems—which use to help negotiate and manage include systems such as accounting, estimating, and purchasing. Among other defense contracts. These systems and changes, DOD their related internal controls act as important safeguards against fraud, • clarified the roles and responsibilities of the Defense Contract Management waste, and abuse of federal funding. Agency (DCMA) and the Defense Contract Audit Agency (DCAA)—the two Federal and defense acquisition agencies that are responsible for conducting the reviews; regulations and DOD policies require • clarified timeframes for business system reviews and established criteria for that DOD take steps to review the business systems; and adequacy of certain business systems, • withheld payments from contractors that were found to have significant but GAO and other oversight entities deficiencies in their business systems. have raised questions about the sufficiency and consistency of DOD’s DOD does not have a mechanism to monitor and ensure that these reviews are review process. being conducted in a timely manner. For its part, DCAA has conducted few business system audits since 2013, as it focused its efforts on other types of The National Defense Authorization audits. DCAA plans to significantly increase the number of business system Act for Fiscal Year 2018 contained a provision for GAO to evaluate how audits over the next 4 years, but its success in doing so depends on its ability to DOD implemented legislation intended shift resources from other audits; to use public accounting firms to conduct other, to improve its business system review non-business system audits; and DCAA staff’s ability to execute new audit plans process. Among other things, this in a timely manner. report examines (1) the changes DOD made to its review process and (2) the extent to which DOD is ensuring timely business system reviews. GAO analyzed DOD acquisition regulations, policies, and procedures for conducting contractor business system reviews and analyzed data on reviews conducted between fiscal years 2013 and 2018. What GAO Recommends GAO recommends that DCMA, in collaboration with DCAA, develop a mechanism to monitor and ensure contractor business system reviews are conducted in a timely fashion. DOD DCMA relies on the three offices responsible for conducting DCMA-led reviews concurred with the recommendation. to manage the reviews, but DCMA does not formally monitor whether these reviews are being conducted consistent with policy nor does it monitor DCAA’s efforts to complete the audits for which it is responsible. DCMA is ultimately responsible for approving a contractor’s business systems. DCMA currently lacks a mechanism based on relevant and reliable information, such as the number of reviews that are outstanding and the resources available to conduct such View GAO-19-212. For more information, reviews, to ensure reviews are being completed in a timely fashion. Such contact Timothy J. DiNapoli, (202) 512-4841, information could help inform more strategic oversight on whether the current firstname.lastname@example.org review process is achieving its intended results, or whether additional changes to the timing of or criteria for conducting reviews are needed. United States Government Accountability Office Contents Letter 1 Background 4 DOD Revised Its Policies and Procedures Related to the Contractor Business System Review Process 12 DOD Does Not Have a Mechanism to Monitor and Ensure That Contractor Business System Reviews and Audits Are Conducted in a Timely Manner 22 DOD Has Not Yet Implemented Recent Legislative Provisions to Change the Definition of a Covered Contractor or to Enable the Use of Public Accounting Firms 28 Conclusions 30 Recommendation for Executive Action 30 Agency Comments 30 Appendix I Comments from the Department of Defense 33 Tables Table 1: Description of the Six Major Contractor Business Systems and the Factors for Including the Business System Criteria in Contracts 4 Table 2: Roles and Responsibilities of the Defense Contract Management Agency (DCMA) and the Defense Contract Audit Agency (DCAA) 6 Table 3: Contractor Business System Review Frequency and Responsible Agencies 15 Table 4: Deficiencies Identified Between Fiscal Years 2015 and 2017 for Completed DOD Contractor Business System Reviews 18 Figures Figure 1: Reports and Congressional Actions Related to DOD’s Contractor Business System Reviews and Other Audits 11 Figure 2: Contractor Business System (CBS) Review Responsibilities Before and After the National Defense Authorization Act (NDAA) for Fiscal Year 2011 14 Figure 3: Number of Hours and Audits Related to Contractor Business Systems Completed and Planned by Defense Contract Audit Agency (DCAA) Fiscal Years 2013-2020, and Hours Related to Incurred Cost Audits 24 Page i GAO-19-212 Contractor Business Systems Abbreviations ACO Administrative Contracting Officer CBAR Contract Business Analysis Repository CBS Contractor Business System DCAA Defense Contract Audit Agency DCMA Defense Contract Management Agency DFARS Defense Federal Acquisition Regulation Supplement DPC Defense Pricing and Contracting DOD Department of Defense FAR Federal Acquisition Regulation IG Inspector General NDAA National Defense Authorization Act This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Page ii GAO-19-212 Contractor Business Systems Letter 441 G St. N.W. Washington, DC 20548 February 7, 2019 Congressional Committees Contractor business systems, which include a contractor’s accounting, estimating, and property management systems, produce critical data that Department of Defense (DOD) contracting officers use to help negotiate and manage hundreds of billions of contract dollars each year. These business systems and their related internal controls act as the first line of defense against fraud, waste, and abuse of federal funding. For example, an approved accounting system can help prevent contractors from overcharging or mischarging federal contracts. Federal and defense acquisition regulations and DOD policy require DOD to take steps to review the adequacy of these business systems and to ensure that contractors correct identified deficiencies. These reviews and audits are conducted primarily by two defense agencies: the Defense Contract Management Agency (DCMA) and the Defense Contract Audit Agency (DCAA). DCMA generally has responsibility for approving contractors’ business systems; DCMA and DCAA have specific responsibilities for reviewing these systems. In 2009, the Commission on Wartime Contracting and GAO highlighted significant concerns about how DOD was conducting CBS reviews at that time. Congress later enacted Section 893 of the National Defense Authorization Act (NDAA) for Fiscal Year 2011. 1 This provision mandated that DOD develop a program to improve contractor business systems. Subsequently, Section 893 of the NDAA for Fiscal Year 2017 amended the earlier provision to 1) define “covered” contractors generally as those with government contracts subject to cost accounting standards that account for more than 1 percent of the company’s total gross revenue and 2) allow contractors to use registered public accounting firms to review their systems in place of DOD’s review. 2 1 Pub. L. No. 111-383, § 893 (2011). 2 Pub. L. No. 114-328, § 893 (2016). The cost accounting standards are rules designed to ensure contractors consistently apply cost accounting practices to contracts with the government. Regulations establish applicability and criteria for full and modified cost accounting standards coverage. See 48 C.F.R. part 9903. Section 893’s definition of a covered contractor excludes contractors that are exempt from the full cost accounting standards. Page 1 GAO-19-212 Contractor Business Systems Section 890 of the NDAA for Fiscal Year 2018 contained a provision for GAO to evaluate the implementation and effectiveness of these changes to the contractor business system (CBS) review process. 3 This report (1) describes the changes DOD made to its CBS review process; (2) examines the extent to which DOD is ensuring CBS reviews are being conducted in a timely fashion; and (3) describes the steps DOD has taken to implement selected provisions of Section 893 of the NDAA for fiscal year 2017. To determine what changes DOD made to its CBS review process, we reviewed Section 893 of the NDAA for Fiscal Year 2011, applicable Federal Acquisition Regulation (FAR) and Defense Federal Acquisition Regulation Supplement (DFARS) sections and clauses, and relevant DCMA and DCAA policies, instructions, and memoranda. We compared current steps in the CBS review process to those used by DCMA and DCAA prior to the Fiscal Year 2011 NDAA to gain a better understanding of the changes made and discussed those changes with DCMA and DCAA officials. We also analyzed DCMA and DCAA data to determine the number of business systems reviewed by either agency from fiscal years 2015 through 2017—the last three fiscal years for which we could obtain data for all CBS systems. To determine the reliability of these data, we interviewed appropriate DCMA and DCAA officials and collected information on the steps taken by their agencies to ensure data reliability. Based on these steps, we determined the data were sufficiently reliable for the purposes of reporting the number of systems reviewed and how many deficiencies were found. To further our understanding of how changes to the CBS review process were implemented and to gain insight into the effect they had on contractors and program offices, we selected a nongeneralizable sample of six defense contractors based on such factors as the amount of DOD contract obligations awarded to the contractor in fiscal year 2017; the contractor’s size (i.e., large or small); and whether one or more of the contractor’s business systems were disapproved as reported in DOD’s Contract Business Analysis Repository (CBAR) as of November 2017. To better understand the process of identifying and resolving system 3 Pub. L. No. 115-91 § 890 (2017). The mandate included several elements, including a request that we describe the known costs of the CBS review process to the government and covered contractors. With regard to this element, we found that neither the government nor contractors maintained reliable and verifiable information that would allow us to sufficiently assess the known costs of the CBS review process. Page 2 GAO-19-212 Contractor Business Systems deficiencies, we selected five contractors that had at least one business system that had been found to be materially deficient and one contractor that had not had any material deficiencies identified. We interviewed representatives from each of the six contractors as well as DCMA officials responsible for approving the contractor’s business systems. Finally, we interviewed contracting officers from military department buying commands to determine how these officials mitigate risk when awarding contracts or overseeing contractors with business system deficiencies. When available, we collected and analyzed contract file documentation describing how business system deficiencies affected contract awards. To determine the extent to which DCMA and DCAA are ensuring CBS reviews are being conducted in a timely fashion, we reviewed DCMA and DCAA policies, instructions, and memoranda to identify the offices and individuals responsible for providing management oversight, conducting CBS audits and reviews, and approving contractor business systems. We interviewed DCMA and DCAA officials and collected relevant data, such as DCAA’s planned audits for fiscal years 2019 through 2022, to understand their approach to prioritizing reviews and the challenges, if any, in completing the reviews in a timely fashion. To determine the extent to which DOD has implemented changes to its CBS review process in response to the NDAA for Fiscal Year 2017, we interviewed DOD Defense Pricing and Contracting (DPC) officials responsible for drafting the proposed regulations. We also interviewed DCMA and DCAA policy officials, contractors, and program offices to obtain their perspectives on the potential benefits and challenges associated with these changes. We reviewed selected contractors’ annual U.S. Securities and Exchange Commission filings to gauge what effect, if any, the amended statutory definition of what is considered a covered contractor may have on these contractors. The 20 contractors we reviewed represented 86 percent of obligations in fiscal year 2016 on contracts that were identified in the Federal Procurement Data System- Next Generation as covered by cost accounting standards. We conducted this performance audit from September 2017 to February 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Page 3 GAO-19-212 Contractor Business Systems Federal acquisition regulations require certain contractors who do Background business with the government to maintain acceptable business systems that reduce risk to the government and taxpayer. Contractors may have up to six major business systems that require review. DOD’s acquisition regulation establishes criteria for each of the six types of contractor business systems, which are implemented by the inclusion of certain contract clauses. Where a contract includes these clauses, the contractor’s business systems generally must meet the criteria. Factors such as the type of contract and the dollar value determine whether the clauses are included in a contract (see table 1). Table 1: Description of the Six Major Contractor Business Systems and the Factors for Including the Business System Criteria in Contracts Factors for Including the Business System System Description Criteria in Contracts Accounting System or systems for accounting methods, procedures, Cost-reimbursement, incentive type, time-and- and controls established to gather, record, classify, analyze, materials, or labor-hour contracts; or contracts that summarize, interpret, and present accurate and timely provide for progress payments based on costs or financial data for reporting in compliance with applicable on a percentage or stage of completion. laws, regulations, and management decisions. Systems may include subsystems for specific areas such as indirect and other direct costs, compensation, billing, labor, and general information technology. Estimating Policies, procedures, and practices for budgeting and Contracts awarded on the basis of certified cost or planning controls, and generating estimates of costs and pricing data. Additional requirements apply when other data included in proposals submitted to the the contractor is considered a large business and, government in the expectation of receiving contract awards. in the preceding fiscal year, either received Department of Defense prime contracts or subcontracts, totaling • $50 million or more for which certified cost or pricing data were required; or • $10 million or more (but less than $50 million) for which certified cost or pricing data were required; and the procuring contracting officer, with concurrence or request of the administrative contracting officer, determines it to be in the best interests of the government. Material Manual or automated system or systems for planning, Contracts for non-commercial items that exceed Management and controlling, and accounting for the acquisition, use, issuing, the simplified acquisition threshold and are either Accounting and disposition of material, which may be integrated with cost-type contracts or fixed-price contracts with other systems such as estimating, purchasing, inventory, progress payments based upon costs incurred as and accounting. work in progress. This does not apply to contractors that are small businesses, educational institutions, or nonprofit organizations. Page 4 GAO-19-212 Contractor Business Systems Factors for Including the Business System System Description Criteria in Contracts Purchasing System or systems for purchasing and subcontracting, Contracts that include the standard FAR a including make-or-buy decisions, the selection of vendors, subcontracts clause. The subcontracts clause analysis of quoted prices, negotiation of prices with vendors, generally is included in cost-type contracts and placing and administering of orders, and expediting delivery certain other types of contracts that exceed the b of materials. simplified acquisition threshold. Property System or systems for managing and controlling Contracts that include the standard FAR c Management government property. government property clause. The government property clause generally is included in cost- reimbursement, time-and-material/ labor hour, or fixed price contracts where property is expected to be furnished by the government or a contract for commercial items where government property exceeds the simplified acquisition threshold and the contractor is directed to use government property. Earned Value A system for project management that effectively integrates Cost or incentive contracts valued at $20 million or Management the project scope of work with cost, schedule and more and certain other contracts for which earned performance elements for optimum project planning and value management is applied. control. Source: GAO analysis of the Federal Acquisition Regulation, Defense Federal Acquisition Regulation Supplement, and Defense Contract Audit Agency and Defense Contract Management Agency instructions I GAO-19-212 a FAR § 52.244-2. b Purchasing system requirements also are included in contracts that include the DFARS counterfeit electronic part detection and avoidance system clause (DFARS § 252.246-7007). c FAR § 52.245-1. In certain cases, the absence of an adequate system may preclude the government from using a particular contract type or may require additional oversight or analysis. For example, the FAR states that: • A cost-reimbursement contract may be used only when, among other things, contractors’ accounting systems are adequate for determining costs applicable to the contracts or orders; an adequate accounting system is also required for the use of progress payments. 4 • Without an approved purchasing system, contractors may require additional oversight of their subcontracting decisions. 5 • Significant deficiencies with contractors’ estimating systems shall be considered during negotiation. Alternatively, an adequate estimating system may reduce the scope of reviews to be performed on 4 FAR §§ 16.301-3(a)(3), 32.503-3. 5 See FAR § 44.201-1. Page 5 GAO-19-212 Contractor Business Systems individual proposals, expedite the negotiation process, and increase the reliability of proposals. 6 DCMA and DCAA are responsible for providing contracting and audit support to the military departments and are responsible for conducting business system reviews, along with a host of other responsibilities (see table 2). Table 2: Roles and Responsibilities of the Defense Contract Management Agency (DCMA) and the Defense Contract Audit Agency (DCAA) DCMA DCAA Mission DCMA performs contract administration services While serving the public interest as its primary and contingency contract administration service for customer, DCAA performs all necessary contract the Department of Defense (DOD), other federal audits for DOD and provides accounting and financial agencies, foreign governments, international advisory services regarding contracts and organizations, and others as authorized. subcontracts to all DOD components responsible for procurement and contract administration. Background DCMA plays a significant role in DOD’s oversight DCAA was established to provide more efficient and and management of contracts and provides consistent audit support by centralizing these duties analytical support for award decisions made by in a single defense organization. It performs contract contracting officers. The Director, DCMA, reports to audits for DOD and provides accounting and financial the Under Secretary of Defense for Acquisition and advisory services regarding contracts and Sustainment. subcontracts to DOD components. The Director, DCAA, reports to the Under Secretary of Defense – Comptroller. Roles and responsibilities • Provides advice and information to help DOD • Audits primarily cost-reimbursable and other prepare solicitations, identify acquisition risks, non-fixed-price contracts, which generally pose select capable contractors, and write contracts the highest risk to the government. that meet the needs of DOD, other federal • Performs pre-award services such as pre-award agencies, and allied government agencies. accounting system surveys, price proposal • Monitors contractors’ performance and audits, and forward pricing rate audits. management systems to ensure that cost, • Performs post-award services such as incurred product performance, and delivery schedules cost audits and Cost Accounting Standards are in compliance with contracts. compliance and adequacy reviews • Administers, manages, and operates • May perform analysis of contractor information procurement management review programs, following audit report completion and support providing oversight of acquisition processes contracting officers during contract negotiations. employed by DOD components. Source: GAO analysis of DODD 5105.36 Defense Contract Audit Agency (DCAA), DODD 5105.64 Defense Contract Management Agency (DCMA), and Defense Contract Audit Agency and Defense Contract Management Agency information I GAO-19-212 Under DCMA’s November 2013 instruction, the final determination of adequacy for all of the contractor business systems resides with the DCMA administrative contracting officers (ACO). 7 An ACO may have 6 FAR § 15.407-5. 7 DCMA Instruction 131, Contractor Business Systems, Nov. 6, 2013. This instruction was revised in December 2015 (DCMA Immediate Policy Change-1 (IPC-1) (Dec. 1, 2015)). Page 6 GAO-19-212 Contractor Business Systems responsibility for all or a portion of a single large business or may be responsible for a number of smaller contractors within a particular region. To help inform their system determinations, an ACO can request that either DCMA or DCAA conduct business system reviews or audits when needed. Among other responsibilities, ACOs are responsible for taking actions to impose consequences when contractors do not comply with business system standards. Prior Reports by GAO, Throughout the last 10 years, GAO and other accountability organizations Other Accountability have reported on challenges DOD faces when conducting CBS reviews or other critical contracting audits, such as incurred cost audits. 8 Over this Organizations, and time Congress has also taken actions through various NDAAs to initiate Legislative Actions changes to the CBS review process. In 2009, the Commission on Wartime Contracting and GAO highlighted significant concerns about how DOD was conducting CBS reviews at that time. For example: • The Commission reported that billions of dollars in contingency- contract costs in Iraq and Afghanistan could not be verified by government auditors and that inadequate internal controls over contractor business systems hampered the government’s insight into cost errors and material misstatements. 9 The report highlighted instances where DCMA and DCAA came to different conclusions when reviewing the same contracts and had inadequate resources to complete business system reviews. It also stated that DCMA was not aggressive in motivating contractors to improve their business systems because it accepted corrective action plans as sufficient progress to address deficiencies. The commission made recommendations to address each of these issues. 8 DCAA conducts incurred cost audits to identify whether costs incurred on flexibly-priced contracts are allowable, allocable, and reasonable—information that contracting officers need to close the contracts. 9 Commission on Wartime Contracting in Iraq and Afghanistan, Special Report on Contractor Business Systems: Defense agencies must improve their oversight of contractor business systems to reduce waste, fraud, and abuse, CWC Special Report 1, September 21, 2009. The topic was revisited in its final report as one of a variety of weaknesses that undermine the government’s ability to protect its interest in economical and effective performance of contingency contracting. See Commission on Wartime Contracting in Iraq and Afghanistan. Transforming Wartime Contracting: Controlling costs, reducing risks, Final Report to Congress, August 2011. Page 7 GAO-19-212 Contractor Business Systems • We found issues with independence of auditors, sufficiency of evidence, and incomplete reporting of DCAA’s findings. 10 As result, we made 17 recommendations to DOD to help improve the quality of DCAA’s audits, most of which the agency has implemented. Since then, subsequent GAO and DOD Inspector General (IG) reports have pointed to other issues with the CBS review process and DCAA’s incurred cost audit process. Namely, • In November 2011, we found that DCAA could not complete the number of CBS reviews needed to be consistent with its guidelines because it was focused on higher priority areas—such as incurred cost audits—and, as a result, DCMA contracting officers maintained systems’ determinations as adequate even though the systems had not been audited by DCAA in a number of years. 11 Among our recommendations, we proposed that DCMA and DCAA identify options, such as hiring external auditors, to assist in the conduct of CBS reviews until DCAA could adequately fulfill those responsibilities with its own workforce. In July 2014, DOD published a proposal to change the DFARS to allow public accounting firms to perform reviews of accounting, estimating, and material management and accounting systems. According to DPC officials, however, the department’s IG raised concerns about consistency between the proposed change and statutory and regulatory requirements for IG oversight of outside audit services. Further, the private sector expressed concerns that CBS audit criteria did not align with generally accepted accounting principles used in the private sector. As result of these challenges, DOD did not implement the proposed regulation change. • In December 2012, we found that DCAA’s backlog of incomplete incurred cost audits was a contributing factor in DOD’s inability to close out contracts in a timely manner. 12 To address this backlog, DCAA began implementing a new, risk-based approach that was 10 GAO, DCAA Audits: Widespread Problems with Audit Quality Require Significant Reform, GAO-09-468 (Washington, D.C.: Sept. 23, 2009). 11 GAO, Defense Contract Management Agency: Amid Ongoing Efforts to Rebuild Capacity, Several Factors Present Challenges in Meeting Its Missions, GAO-12-83 (Washington, D.C.: Nov. 3, 2011). 12 GAO, Defense Contracting: DOD Initiative to Address Audit Backlog Shows Promise, but Additional Management Attention Needed to Close Aging Contracts, GAO-13-131 (Washington, D.C.: Dec. 18, 2012). Page 8 GAO-19-212 Contractor Business Systems expected to shift DCAA’s resources to focus on incurred cost audits involving high-dollar value and high risk proposals. • In October 2015, the DOD IG found that DCMA contracting officers did not always comply with requirements to report business system deficiencies and found instances where CBS determinations based on DCAA-led reviews were not reported within required timeframes. The IG concluded that this likely caused delays in correcting significant business system deficiencies and lengthened the time the government was unable to rely on data generated by those business systems. • In September 2017, we found that despite efforts by DCAA to reduce the backlog of incurred cost proposals awaiting audit, the agency was not able to meet its goals to eliminate the backlog by fiscal year 2016 and that it was unlikely to meet a revised goal of fiscal year 2018. 13 We recommended that DCAA assess and implement options for reducing the length of time to begin incurred cost audits and establish related performance measures. DCAA concurred with these recommendations and took actions to reduce the time it takes to begin audits. Most recently, in a January 2018 report, the Advisory Panel on Streamlining and Codifying Acquisition Regulations—commonly referred to as the Section 809 panel after the legislative provision that created it— reiterated the importance of business system internal controls. 14 Noting that DOD’s CBS reviews are untimely and inconsistent, the Panel made several recommendations that seek to complete reviews, especially for accounting systems, in a more timely way. Among these recommendations are the use of public accounting firms to supplement the DOD audit workforce, a change to accounting system review standards and criteria, and the development of new guidance for the conduct of business system reviews. 13 GAO, Federal Contracting: Additional Management Attention and Action Needed to Close Contracts and Reduce Audit Backlog, GAO-17-738 (Washington, D.C.: Sept. 28, 2017). 14 Advisory Panel on Streamlining and Codifying Acquisition Regulations, Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations Volume 1 of 3, (Arlington, VA.: Jan. 2018). The panel was established pursuant to Section 809 of the National Defense Authorization Act for Fiscal Year 2016. The panel also released Volume 2 in June 2018 and Volume 3 in January 2019. Page 9 GAO-19-212 Contractor Business Systems During the past 10 years, Congress also enacted three provisions related to improving how DOD conducts business system reviews and incurred cost audits. Specifically, • Section 893 of the NDAA for Fiscal Year 2011 directed the Secretary of Defense to initiate a program to improve contractor business systems so that the systems provide timely and reliable information. 15 The NDAA required that this program, among other things, establish requirements for each system and a process for identifying significant deficiencies within systems. It also required that DOD identify those officials responsible for approval and disapproval of a system, and that approval or disapproval of a system would be based on whether the system has a significant deficiency. Further, the law authorized DOD to withhold up to 10 percent of contract progress payments, interim payments, and performance-based payments from certain contracts when systems are disapproved based on a significant deficiency. Contractors that require review—or “covered contractors”—were defined as those subject to the cost accounting standards. • Section 893 of the NDAA for Fiscal Year 2017 amended the fiscal year 2011 NDAA provisions by (1) revising the definition of a “covered contractor” to generally mean those with government contracts subject to the cost accounting standards accounting for more than 1 percent of the contractor’s total gross revenue and (2) allowing public accounting firms to conduct contractor business system assessments. 16 • Section 803 of the NDAA for Fiscal Year 2018 required DOD to be compliant with certain standards of risk and materiality in the performance of incurred cost audits for its contracts. It also required that DOD use public accounting firms to, among other things, perform a sufficient number of incurred cost audits to eliminate the incurred 15 Pub. L. No. 111-383, § 893 (2011). 16 Regarding the use of public accounting firms, Section 893 of the NDAA for Fiscal Year 2017 provides that if a registered public accounting firm attests to the internal control assessments of a contractor pursuant to the Sarbanes-Oxley Act of 2002, the submission of documentation from the public accounting firm that the contractor meets CBS requirements generally eliminates the need for further review by DOD. The Sarbanes- Oxley Act of 2002 establishes requirements for assessments of a company’s internal controls for financial reporting by corporate management and registered public accounting firms. See, e.g., 15 U.S.C. § 7262. Page 10 GAO-19-212 Contractor Business Systems cost audit backlog by October 1, 2020 and to allow DCAA to allocate resources to higher-risk and more complicated audits. Figure 1 below summarizes these reports and congressional actions related to contractor business system activities over the last decade. Figure 1: Reports and Congressional Actions Related to DOD’s Contractor Business System Reviews and Other Audits Page 11 GAO-19-212 Contractor Business Systems Since 2011, DOD has taken actions to (1) clarify the roles and DOD Revised Its responsibilities of DCMA and DCAA in conducting CBS reviews and Policies and consolidate the number of reviews to be performed; (2) clarify how often DOD should conduct CBS reviews; (3) establish what criteria are used to Procedures Related evaluate a contractor’s business system; (4) establish timeframes by to the Contractor which ACOs are to make a determination on the adequacy of the contractors’ business systems; and (5) implement the use of payment Business System withholds for contractors that are found to have significant deficiencies in Review Process their contractor business systems. DCMA and DCAA officials noted that these changes were implemented primarily to address the 2011 statutory provisions. Our review of six selected contractors’ business system reviews found that the whole process from the review or audit, to the follow up and resolution, can be lengthy. In three out of six selected cases we reviewed, it took 4 or more years for a contractor’s system to be approved. DOD Clarified DCMA and Prior to 2011, DCAA conducted a series of 10 internal control audits on a DCAA’s Roles and cyclical basis, while DCMA performed more targeted testing on three systems. During that time, both DCMA and DCAA could review a Responsibilities and contractor’s purchasing or earned value management (EVM) system but Consolidated the Number would evaluate different aspects of each system. As a result, DCMA and of Business System DCAA reviewers could issue deficiency reports based on their separate Reviews reviews of the same contractor business systems for the consideration of ACOs. As reported in August 2009 by the Commission on Wartime Contracting, these overlapping reviews led to instances where DCMA and DCAA came to different conclusions about the adequacy of the same business system. To address this issue and clarify roles and responsibilities, in November 2013 DCMA established policies that guide oversight and implementation of the CBS review process, to include approval responsibilities and procedures for the conduct and reporting of reviews. 17 DCMA has separate instructions for each type of contractor business system with the exception of accounting. These separate instructions provide more details about appropriate stakeholders for specific reviews, noting particular functional experts such as offices within DCMA or DCAA that are to lead the conduct of the reviews. DCAA issued a separate memorandum in 17 DCMA Instruction 131. Page 12 GAO-19-212 Contractor Business Systems April 2012 that details changes made to accounting system reviews as a result of changes from the NDAA for fiscal year 2011. 18 Under these revised processes, DCMA now has responsibility for reviewing three contractor business systems and DCAA is responsible for the other three. In all cases, the DCMA ACO makes the final determination on whether a system is approved or disapproved. Further, the revised process consolidated the number of audits that DCAA conducts on the adequacy of the contractor’s accounting system from five separate audits to one comprehensive system audit. According to DCAA, this consolidation was based on a comprehensive reassessment of the processes for assessing accounting systems and combined elements from previous internal control reviews. Figure 2 shows DCMA and DCAA responsibilities before and after the changes implemented from the NDAA for Fiscal Year 2011. 18 DCAA Memorandum 12-PAS-012(R), Audit Guidance on Auditing Contractor Business Systems and Contractor Compliance with DFARS 252.242-7006, Accounting System Administration, April 24, 2012. Page 13 GAO-19-212 Contractor Business Systems Figure 2: Contractor Business System (CBS) Review Responsibilities Before and After the National Defense Authorization Act (NDAA) for Fiscal Year 2011 Note: the administrative contracting officer at DCMA makes the final determination on whether a system is approved or disapproved. Page 14 GAO-19-212 Contractor Business Systems Revised Process Clarified The revised DCMA instructions and related DCAA memorandums for the Specific Timeframes for CBS review process also clarified timeframes for how often a contractor’s business system must be reviewed. Generally, each system should be How Often DOD Should reviewed every 3 years unless the ACO makes a determination that a Conduct Business System review is not necessary based on a risk assessment or other factors (see Reviews table 3). Table 3: Contractor Business System Review Frequency and Responsible Agencies Agency Responsible for Review Business System Frequency of Business System Reviews Defense Contract Audit Agency Accounting Every 3 years (DCAA) Estimating Every 3 years unless a risk assessment deems otherwise Material Management and Every 3 years unless substantiated evidence suggests Accounting that the contractor’s systems are adequate Defense Contract Management Purchasing Every 3-5 years based on an assessment of risk Agency (DCMA) completed by DCMA administrative contracting officer Property Management Every 1-3 years based on a risk assessment competed by DCMA property administrator Earned Value Management Every 3 years based on results of annual surveillance; full system reviews are performed based on an administrative contracting officer’s determination or at the time of initial contract award Source: GAO analysis of DOD policies and regulations I GAO-19-212 Note: For DCAA, auditors perform the audits under DCAA’s purview. For DCMA, a procurement analyst performs the purchasing system reviews; a property administrator performs the property system reviews, and an Earned Value Management specialist performs system surveillance and full reviews. DCMA’s administrative contracting officer makes the final determination about whether the system is approved or disapproved. DFARS Revisions DOD also revised the DFARS in 2012 to provide definitions for Established Specific acceptable contractor business systems and established individual DFARS clauses that define the criteria for each of the six business Criteria for Business systems. As appropriate, these clauses are included in contracts and Systems generally require the contractor to maintain adequate business systems, allow for the government to withhold payments when systems are found to have significant deficiencies, and list the criteria that the systems must meet. The number of criteria varies by system. For example, the DFARS clause for accounting systems includes 18 criteria used to evaluate system features such as proper segregation of direct and indirect costs, Page 15 GAO-19-212 Contractor Business Systems timekeeping, and exclusion of unallowable costs. 19 For EVM systems, a contractor’s system must comply with private, institutional standards and includes procedures that generate timely, reliable, and verifiable reports. To test how DCAA-led audits were being implemented under these new criteria, DCAA began a pilot program in 2014 comprised of a team of dedicated auditors to conduct CBS reviews who, in turn, were to recommend changes in audit plans and other practices. DCAA initially focused on material management and accounting systems audits, then moved to estimating systems, and finally accounting systems. As result of this pilot, DCAA issued new audit guidance for all three systems in 2018, with the latest guidance for accounting system audits issued in October 2018. DCAA officials told us that they are implementing lessons learned from the pilot program and developing training on how to conduct the revised audit plans. DCMA Established The revised DCMA instructions provide timeframes for ACOs to Timeframes for ACOs to communicate their initial and final determinations to contractors (see textbox) and define the responsibilities of DCMA management and ACOs Make Adequacy for confirming significant deficiencies and resolving disagreements Determinations between functional specialists and the ACO. Revised Contractor Business System Review Process Timeframes According to the revised contractor business system review process, when significant deficiencies are found: • Administrative Contracting Officers (ACO) have 10 days to communicate an initial determination of business system compliance to the contractor under review. • The contractor is requested to respond to the letter within 30 days after that to respond to the letter communicating whether or not it concurs with the determination. • The ACO issues a final determination 30 days after receipt of the contractor’s response. According to Defense Contract Management Agency (DCMA) officials, data for fiscal year 2017 indicated that 80 percent of final determination letters were issued within this required timeframes. Source: GAO analysis of DCMA instruction I GAO-19-212 19 One of the recommendations of the Advisory Panel on Streamlining and Codifying Acquisition Regulations was to replace the 18 system criteria in the DFARS clause with an internal control audit to assess the adequacy of contractors’ accounting systems based on 7 system criteria. See recommendation number 72 in the Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations Volume 3 of 3, (Arlington, VA.: Jan. 2019) Page 16 GAO-19-212 Contractor Business Systems In instances where deficiencies are found, these findings are reviewed by a panel within DCMA to help ensure standards are consistently applied. When there is disagreement between the ACO and functional specialist concerning the nature or severity of deficiencies found, a DCMA board of review may be requested by the ACO to resolve differences and produce a final determination. According to DCMA officials responsible for maintaining business system review policies, differences between functional specialists and contracting officers are generally resolved without the need for a board discussion. These officials said that only a few board discussions have been convened since implementation of the new review structure. Mandatory Payment Section 893 of the NDAA for Fiscal Year 2011 generally established that Withholds Drive Timely DOD be allowed to withhold payments under certain contracts when DOD disapproves one or more of a covered contractor’s business systems. 20 Contractor Response to DCMA officials previously had the latitude to withhold a portion of the Significant Deficiencies payments owed to contractors as result of deficiencies identified in their reviews, but were not required to do so. From 2011 through 2013, DOD revised the DFARS and related agency instructions to generally require that ACOs apply a 2 to 5 percent contract payment withholding for a single deficient system and a maximum of a 10 percent withhold when multiple systems are found to have significant deficiencies. 21 ACOs are authorized to reduce the amount being withheld after the ACO determines that the contractor has submitted an adequate corrective action plan and began its implementation. Our review of DCMA and DCAA information indicates that for all the CBS reviews conducted between fiscal years 2015 and 2017, DCMA and DCAA often identified significant deficiencies in three business systems. These were the cost estimating, material management and accounting, and purchasing systems. For example, DCAA identified a significant deficiency in nine of the 12 material management and accounting systems reviewed, while DCMA identified significant deficiencies in 260 of the 330 purchasing systems reviewed (see table 4). 20 Section 893 established that DOD’s program to improve contractor business systems is to provide for the disapproval of a business system when it has a significant deficiency. Section 893 defined a significant deficiency as a shortcoming in a system that materially affects the ability of DOD and contractor officials to rely upon information produced by the system that is needed for management purposes. 21 DFARS §§ 242.7000, 252.242-7005; and DCMA Instruction 131. Page 17 GAO-19-212 Contractor Business Systems Table 4: Deficiencies Identified Between Fiscal Years 2015 and 2017 for Completed DOD Contractor Business System Reviews Reviews where Percentage of reviews Reviews significant deficiencies where significant Agency Business system completed were found deficiencies were found Defense Contract Audit Accounting 3 0 0% Agency Estimating 9 7 78% Material Management and Accounting 12 9 75% Defense Contract Purchasing 330 260 79% Management Agency Property Management 2,934 26 1% Earned Value Management 891 9 1% Source: GAO analysis of data from Defense Contract Management Agency functional offices and Defense Contract Audit Agency I GAO-19-212 Note: These figures reflect only business system reviews evaluating compliance with Defense Federal Acquisition Regulation Supplement criteria; they exclude follow-up and limited scope reviews. Earned Value Management system reviews include annual surveillance reviews that evaluate contractor business systems over a 3 year period. Because DCMA and DCAA officials do not maintain historical data on payment withholdings, it is not possible to determine the number of payment withholdings that were implemented over these years as a result of these significant deficiencies. 22 The system used to track the status of systems and payment withholdings, CBAR, is updated by ACOs as corrective actions are completed and payment withholdings are removed, and thus shows only a snapshot in time. Our review of CBAR data from July 2018 found that DOD was withholding payments from 11 contractors with a total collective value of approximately $238 million at that time. 23 One third of these payment withholdings were associated with significant deficiencies found in contractors’ estimating systems. DCMA and DCAA officials we spoke with noted that the withhold provision has led to contractors’ increased response to deficiencies, but they did not have data to determine the extent to which contractors’ responsiveness has 22 Payments withheld as result of contractor business system disapproval are provided to the contractor after the contracting officer determines that all significant deficiencies have been corrected. 23 In some instances, multiple payment withholds were implemented based on deficiencies found at more than one location for the same contractor. In the course of our review, we identified certain erroneous data entries for payment withholds which were investigated by DCMA and resulted in changes to CBAR reporting requirements to help ensure the accuracy of dollar amounts associated with payment withholds. These changes included more detailed instruction to ACOs. Page 18 GAO-19-212 Contractor Business Systems increased. Some contractors we spoke with stated that because deficiencies will affect the company’s cash flow, senior management and board members have become more engaged in matters of business system compliance. CBS Review and Our review of six selected contractors’ business system reviews Corrective Action Process illustrates the challenges in identifying and resolving deficiencies in a timely manner. Overall, our review of these six cases found that it took Can Be Lengthy from 15 months to 5 years or more to resolve deficiencies initially identified by DCAA or DCMA. Factors contributing to the time it took to resolve these issues included contractors submitting inadequate corrective action plans, DCMA or DCAA identifying additional deficiencies in subsequent reviews or audits, and the use of different auditors to conduct the reviews. While the selected cases are not generalizable to all CBS reviews, they do highlight issues that can arise during the process. For example: • In one case it took almost 4 years to resolve deficiencies identified in a contractor’s accounting system. In this case, DCAA issued an audit report in July 2014 that found seven significant deficiencies including inadequate monitoring and adjusting of rates the contractor was billing the government. DCMA subsequently issued an initial determination 7 days later disapproving the system, citing three of the seven deficiencies identified by DCAA. In August 2014, the contractor responded by providing a corrective action plan for the three deficiencies DCMA cited. DCMA sent a second determination letter the next month citing two additional deficiencies identified by DCAA. In October, the assigned ACO for the contractor left and new staff was assigned to the review. Ten days later, the contractor submitted a second corrective action plan to address the two deficiencies identified. Disagreement between the ACO and DCAA on the inclusion of the two remaining deficiencies identified by DCAA for the accounting system resulted in a need to convene a board of review by DCMA. The board decided that the two deficiencies would be included in the final determination. This, in turn, delayed issuance of a final determination until mid-December 2014. According to contractor representatives, over the next 3 years, they submitted various corrective action plans that DCMA determined were inadequate to address the deficiencies. Each time, the ACO requested additional information and follow-up DCAA audits to help assess the adequacy Page 19 GAO-19-212 Contractor Business Systems of the contractor’s corrective action plans. Eventually the contractor’s accounting system was approved in June 2018. • In another case, a contractor’s estimating system has been disapproved for over 5 years. In June 2013, DCAA identified four significant deficiencies in the contractor’s system, including inadequate support for commerciality determinations. 24 As a result, following a final determination of inadequacy, DCMA implemented a payment withhold of 5 percent. In response, the contractor submitted a corrective action plan in September 2013 addressing the deficiencies that was accepted by DCMA and the withhold was reduced to 2 percent. In a follow-up review in July 2014, DCAA identified two new deficiencies, which the contractor corrected. In March 2015 DCAA reviewed the contractor’s forward pricing rate proposal and identified 11 new deficiencies in the estimating system. By August 2015, the contractor had corrected the new deficiencies but the system remained disapproved because the previous four deficiencies remained uncorrected. Finally, in September 2016, DCAA canceled its audit of the estimating system because these four deficiencies remained. According to officials, the contractor was not ready for re-evaluation. At the time of this review the system remains disapproved. • In another case, a contractor’s property management system was disapproved for more than 4 years. In November 2013, DCMA reviewed the contractor’s property management system and, according to officials, identified nine significant deficiencies, including those related to missing records and supporting documentation for all contracts. DCMA issued an initial determination of disapproval. DCMA officials stated that they did not receive an adequate response from the contractor for nearly 7 months, and in June 2014, DCMA issued a final determination of system disapproval. The contractor subsequently submitted a corrective action plan in August to address the deficiencies. A DCMA official stated that they re-analyzed the system in November 2014 and found one outstanding issue. According to the official, the DCMA property administrator in charge of the review elevated the issue to the assigned ACO, but received no response. According to contractor representatives, they requested a 24 Under certain circumstances, contractors must determine whether a particular subcontract item meets the definition of a commercial item. The FAR defines commercial items to include items customarily used by and sold (or offered for sale) to the general public, including products with minor modifications. For a complete definition of commercial item, see FAR § 2.101. Page 20 GAO-19-212 Contractor Business Systems follow-up review from the DCMA ACO several times from August 2014 to June 2015 but did not receive a response until after June 2015. According to a DCMA official, this was due to resource issues as the review went dormant because the new ACO assigned to the contractor went overseas. The system was reviewed again in November 2017 and the contractor’s system was approved in January 2018. • In another case, an audit of a contractor’s estimating system took DCAA 2 years to complete. The DCAA audit began in November 2014. According to contractor representatives, they were initially told that the review would take 9 to 12 months, but a number of different DCAA auditors were assigned to the review over time and each identified different findings which led to a prolonged process. DCMA approved the contractor’s estimating system in December 2016. • In another case, a contractor’s estimating system was disapproved for 15 months. In June 2016 DCMA disapproved a contractor’s estimating system due to three significant deficiencies, including one related to performing adequate price and cost analysis on subcontractor proposals. According to contractor representatives, they submitted a corrective action plan, but after submitting the plan DCAA performed an audit of the contractor’s forward pricing rates and identified additional deficiencies. In December 2016 DCMA officials determined that the corrective action plan the contractor provided was not sufficient. DCMA subsequently approved the contractor’s estimating system in September 2017. DCMA and DCAA officials believe the cases we analyzed were not representative of the length of time needed to complete the CBS review process, but could not provide data to support their views because DCMA and DCAA do not track data on the length of time it takes to complete the entire CBS review process (i.e., from the start of an audit or review to the resolution of system deficiencies and final determination). Our review of selected cases was not intended to be projectable to all reviews and audits conducted by DCMA and DCAA, but rather to be illustrative of the challenges that may be encountered during the review process. From the perspective of program and contracting officers, the status of a contractor’s business system may have an impact on both contract award decisions and contract monitoring, but officials stated that they can mitigate the risks associated with a disapproved system. For example, Army and Air Force program officials noted that a contractor leading certain weapon system development and logistics efforts had a deficient cost estimating system. According to the contracting officials, as the Page 21 GAO-19-212 Contractor Business Systems government could not rely on the contractor’s proposed costs to use a fixed-price contract, they awarded a fixed-price incentive contract for the program to better monitor the contractor’s cost reporting compared to under a fixed-price contract. DCMA and DCAA do not have a mechanism to monitor and ensure that DOD Does Not Have CBS reviews and audits are conducted in a timely manner. DCAA’s data a Mechanism to show that it conducted few business system audits in the past 6 years, due, in part, to the need for it to reduce its backlog on completing incurred Monitor and Ensure cost audits. Looking to the future, DCAA has developed plans for the That Contractor number of CBS audits it intends to perform over the next 3 years and expects that it will be caught up in conducting the audits for which it is Business System responsible by fiscal year 2022. Successfully executing its plan is Reviews and Audits dependent on several factors, including the ability to shift resources from conducting incurred cost audits to business systems audits, the use of Are Conducted in a public accounting firms to perform a portion of the incurred cost audits, Timely Manner and the ability of DCAA auditors to use new audit plans and complete the required audits in a timely manner. For its part, DCMA relies on the offices that perform the reviews of the three systems to maintain the information on the reviews completed and to plan for future reviews, but DCMA headquarters does not centrally track its reviews or whether audits conducted by DCAA are being completed within the timeframes described in policy. DCAA Plans to Address DCAA officials acknowledged they have not been able to conduct audits Previous Shortfalls in of contractor business systems within the timeframes outlined in DCMA instructions. DCAA officials attributed their inability to do so to the need to Conducting CBS Audits conduct higher priority audits—such as incurred cost audits—and staffing Are Dependent on Several constraints. For example, in fiscal year 2017, DCAA initially proposed to Factors perform a total of 76 CBS audits for the three business systems in its purview. However, DCAA completed only nine audits after assessing available resources. Further, DCAA estimates that in fiscal year 2017 it spent approximately 44 percent of its resources addressing incurred cost audits, and 17 percent on other audits such as forward pricing rate agreements. In contrast, only 6 percent of its resources were devoted to business system audits and related activities. Recognizing that it cannot perform all of the required CBS audits in a timely fashion to meet current DCMA policy requirements, DCAA officials told us they focus their audits on business systems they identify as high- risk. To do so, DCAA officials consider factors such as the contractor’s Page 22 GAO-19-212 Contractor Business Systems current system status, the contractor size in terms of dollars on contract, the amount of cost-type contracts, organizational changes, audit requests by a DOD contracting officer or an ACO, and the types of deficiencies identified and its impact on cost and schedule. DCAA headquarters officials assess the candidates at an annual DCAA planning meeting to determine which audits can be performed given the level of resources available. DCAA officials told us, however, that the current policy requirement—which generally requires review of the systems every three years—would require DCAA to dedicate substantial resources to CBS audits to maintain currency. As of November 2018, DCAA identified 285 systems that require an audit. 25 DCAA officials stated that a risk based approach to reviewing these systems would provide more value than a routine 3 year cycle. DCAA officials stated they are willing to work with others within DOD to develop risk factors that can be used to determine when a business system needs a review. To better assess and plan future workload, DCAA issued a memorandum in January 2017 to introduce a strategic workload resource initiative that will project workload and resource availability in the out-years. Under this process, DCAA field management teams provide information on workload projections in March, and DCAA executive level officials make workload planning recommendations in June that result in an agency-wide plan. DCAA officials noted, however, that the projection for the second year is less accurate, and as a result, the further out year projections are reviewed every six months with adjustments made as needed. DCAA officials also told us that the planning process is currently being expanded to allow the agency to plan three years out. DCAA officials stated that the fiscal year 2021 plans will be tentatively approved by the end of January 2019 and fiscal year 2022 plans will be approved by June 2019. Based on these planning efforts, DCAA plans to conduct a total of 285 CBS audits from fiscal years 2019 through 2022, including 50 audits in fiscal year 2019 and 104 in fiscal year 2020. It also plans to shift some of the hours previously devoted to incurred cost audits to CBS audits (see figure 3). 25 In its projections for fiscal years 2019 through 2022, as of November 2018, DCAA identified 125 accounting systems that require an audit, 48 material management and accounting systems, and 112 estimating systems. Page 23 GAO-19-212 Contractor Business Systems Figure 3: Number of Hours and Audits Related to Contractor Business Systems Completed and Planned by Defense Contract Audit Agency (DCAA) Fiscal Years 2013-2020, and Hours Related to Incurred Cost Audits Note: DCAA was not able to provide us with estimated hours to perform CBS and incurred cost audits for fiscal years 2021 and 2022. Our analysis indicates that successfully executing this plan is dependent on several factors, including the ability to shift resources from conducting incurred cost audits to business systems audits, the use of public accounting firms to perform a portion of the incurred cost audits, and the ability of DCAA auditors to use new audit plans and complete the required audits in a timely manner. • First, the plan is contingent upon DCAA being able to successfully shift resources from incurred cost audits to CBS audits. According to DCAA data, DCAA plans to shift more than 378,000 hours from Page 24 GAO-19-212 Contractor Business Systems incurred cost audits to CBS audits between fiscal years 2018 and 2020. DCAA officials noted, however, that although they have made significant progress in addressing incurred cost audits, the fiscal year 2018 NDAA requires DCAA to have all incurred cost audits performed within 12 months. DCAA officials noted that this means it will have to continue to spend significant resources on incurred cost audits in fiscal year 2019 to meet this legislative requirement. • Second, DCAA officials stated that these estimates include the resources that are expected to become available to perform CBS audits as DCAA starts using public accounting firms to perform incurred cost audits. 26 In its October 2018 report to Congress on the progress made to implement Section 803 of the Fiscal Year 2018 NDAA, DCAA estimated that public accounting firms would be able to perform 100 incurred cost audits per year for 2019 and 2020, which would then increase to 200 each year for 2021 through 2025. DCAA further projected, for example, that about 147,500 hours would become available in 2020 based on the proposed plan to use public accounting firms. DCAA officials told us they are in the process of developing a solicitation to contract for these services, which they anticipate releasing in the spring of 2019. • Lastly, these plans assume that each audit conducted by DCAA can be completed within an average number of hours based on the experiences of the team that developed the revised audit plans released in 2018. DCAA officials noted that these hours assume that DCAA audit teams will experience some challenges conducting the initial set of audits, but will be able to conduct them in fewer hours as they gain more experience in implementing the new audit plans. DCAA officials told us that, if successful, this plan will enable it to be caught up on CBS reviews by 2022. 26 Section 803 of the Fiscal Year 2018 NDAA requires DCAA to contract with qualified private auditors to perform incurred cost audits on its behalf. This provision differs from Section 893 of the Fiscal Year 2017 NDAA, which generally allows DOD to enable contractors to use registered public accounting firms to perform business system audits and eliminate the need for further review by DCMA or DCAA. We discuss the status of DOD’s efforts to implement Section 893 later in the report. Page 25 GAO-19-212 Contractor Business Systems DCMA Headquarters For the DCMA-led reviews, DCMA relies on its functional offices that Makes Limited Use of perform reviews of their respective systems to monitor the status of CBS reviews, but does not use the information to ensure that all three reviews Data Collected by are conducted within the timeframes established under DCMA’s Functional Offices to instructions. The three DCMA functional offices use spreadsheets to Assess the CBS Review manually track reviews their office has completed, and track data on Process and does not when the next review should be scheduled. Each functional office plans Monitor DCAA’s Progress and tracks this data individually. For example, In Completing Its Audits • The property management functional office identifies the number of contractor property systems requiring review on a monthly basis, and tracks its progress in completing these reviews. In fiscal year 2018, this functional office completed over 95 percent of the 850 property system reviews required. • The EVM system functional office identifies the number of reviews that should be conducted annually. In fiscal year 2018, the office reported completion of 92 percent of the 125 required EVM system reviews. • The purchasing functional office uses a rolling process to determine which systems require a review. To do this, the ACO performs a required risk assessment every 3 years to identify whether a full business system review is required and then the purchasing functional office develops a prioritization plan for the systems flagged for review. The exact number of reviews conducted in a single year is dependent upon the risk assessments; however, an official from the purchasing system functional office estimated that their office is staffed to complete approximately 125 reviews per year. The official also noted that they do track to ensure all systems are reviewed in the required timeframes. Officials from the functional offices described to us what information they provide to senior leadership, but DCMA headquarters does not collect or use this information to oversee the CBS review process. For example, a supervisor from the property management functional office told us that the office reports monthly to their supervisors on the status of their reviews and whether they are on schedule, which also serves as a method for requesting additional resources if necessary. EVM system functional officials told us they report the number of planned and completed reviews to a DCMA internal website for senior leadership to review, but did not know what senior leadership does with this information. Purchasing officials said their office provides monthly reports on the status of reviews for specific large contractors, and weekly reports of the number of reviews completed to the agency director and component heads. DCMA Page 26 GAO-19-212 Contractor Business Systems headquarters officials stated that they informally share information with ACOs in a variety of ways, including quarterly meetings, but headquarters officials could not provide documentation on how this information is used to monitor and assess whether CBS reviews were being conducted in accordance with the policy timeframes. Further, DCMA officials indicated that they do not formally monitor DCAA’s efforts to complete the audits for which DCAA is responsible. Despite being the agency responsible for issuing the instructions and whose ACOs are responsible for making final determinations of business system compliance, DCMA officials indicated that it is not their responsibility to monitor or assess DCAA’s efforts to complete the reviews in DCAA’s area of responsibility. DCMA and DCAA officials stated, however, that they recently began to hold quarterly meetings, during which time they can discuss CBS issues, including potential revisions to the criteria and timeframes for conducting CBS reviews. But it is uncertain what outcomes will come from this or the extent to which this will contribute to improved management of CBS reviews. According to federal standards for internal controls, an agency should use quality information to help ensure that it achieves its objectives. 27 These internal controls also state that monitoring activities should be conducted to ensure that agency objectives are being met. Developing a mechanism to track and monitor the number of CBS reviews that are outstanding, the risk level assigned to those systems and the resources available to conduct such reviews, would help DCMA and DCAA better manage the CBS review process to ensure that contractor systems that are reviewed and approved in a timely fashion. 27 GAO, Standards for Internal Control in the Federal Government, GAO-14-704G (Washington, D.C.: Sept. 10, 2014). Page 27 GAO-19-212 Contractor Business Systems Section 893 of the Fiscal Year 2017 NDAA amended the CBS provisions DOD Has Not Yet of the Fiscal Year 2011 NDAA by revising the statutory definition of a Implemented Recent covered contractor and by allowing contractors to use registered public accounting firms to review their business systems in place of DOD’s Legislative Provisions review. As of November 2018, DOD had not yet proposed regulations to to Change the implement these legislative changes, and therefore we were unable to fully evaluate the potential effects of these provisions. The Fiscal Year Definition of a 2017 NDAA did not provide a specific timeframe for DOD to revise its Covered Contractor regulations, but the Director of the Defense Acquisition Regulation Council—who is responsible for promulgating proposed and final rule or to Enable the Use changes to the DFARS— tasked her staff to draft a proposed rule by of Public Accounting March 2017. 28 This deadline was subsequently extended to January 23, 2019. In November 2018, Defense Pricing and Contracting (DPC) officials Firms told us that they now expect to issue the proposed rule for public comment in the third or fourth quarter of fiscal year 2019. DPC officials attributed this delay, in part, to a recent executive order that calls for the reduction and control of regulatory costs, as well as the complexity of having public accounting firms perform CBS reviews. 29 Section 893 of the Fiscal Year 2017 NDAA changed the definition of covered contractors—those contractors that may require CBS reviews— from contractors subject to cost accounting standards to generally only those with contracts subject to cost accounting standards that account for more than 1 percent of their gross revenue. DPC officials stated that DOD may require contractors to self-report on their revenue levels to determine whether the contractor’s systems require review. DPC officials told us, however, that they had not yet considered certain aspects of how contractors may calculate revenues. For example, DPC officials had not yet decided whether revenue should be determined based on specific 28 The process by which DOD and federal agencies develop and issue procurement regulations generally includes publication of a notice of the proposed regulation in the Federal Register, allowing interested parties an opportunity to provide comments on the proposed regulation, followed by agency consideration of the comments received. See 41 U.S.C. § 1707. This process gives the public an opportunity to provide information to agencies on the potential effects of the regulation or to suggest alternatives for agencies to consider. For additional information on the federal rule making process, see GAO, Federal Rulemaking: OMB Should Work with Agencies to Improve Congressional Review Act Compliance during and at the End of Presidents’ Terms, GAO-18-183 (Washington, D.C.: Mar 13, 2018). 29 Exec. Order No. 13,771, Reducing Regulation and Controlling Regulatory Costs, 82 Fed. Reg. 9,339 (Feb. 3, 2017). Page 28 GAO-19-212 Contractor Business Systems business segments, or whether it should include international sales revenue. These officials also had not yet decided how many years of revenue should be included in the analysis. Further, DPC officials could not yet estimate the potential effect of implementing this provision on contractors. Based on our analysis of publicly available contractor financial data for the 20 contractors that we reviewed, the lowest percentage of total revenue derived from government contracts was 10 percent. 30 Section 893 of the 2017 NDAA also authorized the use of registered public accounting firms to assess compliance with DOD’s CBS requirements. Under this provision, if a registered public accounting firm certifies that a contractor’s business system meets DOD’s requirements, it would eliminate the need for further review by DOD. 31 Some government acquisition officials we spoke with expressed concerns that would need to be addressed to effectively implement the legislation, including: • Ensuring that public accounting firms have sufficient understanding of the processes or regulations to conduct the audits and provide conclusions that DOD could rely upon. • Encouraging DCMA and DCAA functional experts and auditors to accept public accounting firms’ findings rather than conduct additional reviews and audits on their own, which would undermine the ability to save both government and contractor resources. • Determining the potential for the cost of public accounting firm reviews being passed on to the government through the contracts of the businesses under review. The DPC official responsible for implementing this provision stated that they are aware of these concerns. He also stated that, as a first step in implementation, his office has requested that DCMA and DCAA review the criteria and audit plans used by their staff and identify areas where these criteria and plans could be adjusted to make them more consistent with criteria that public accounting firms use in the private sector. 30 We reviewed publicly available contractor financial data for the 20 contractors that represented 86 percent of obligations in fiscal year 2016 on contracts that were identified in the Federal Procurement Data System-Next Generation as covered by cost accounting standards. 31 The provision also notes that a milestone decision authority may require review of a contractor business system in certain situations. Page 29 GAO-19-212 Contractor Business Systems By clarifying DCMA and DCAA’s roles and responsibilities as well as the Conclusions timeframes for conducting the audits, DOD has improved the CBS review process. But there are still issues that need to be addressed. DCAA acknowledges it is well behind in its efforts to complete the three CBS audits for which it is responsible but believes that it can be caught up by the end of fiscal year 2022 if significantly more resources are available. In addition, DCMA does not monitor progress of either its functional offices or of DCAA against the policies that the six systems each be reviewed generally every 3 years. This is because DOD currently lacks a mechanism based on relevant and reliable information, such as the number of CBS reviews that are outstanding, the risk level assigned to those systems, and the resources available to conduct such reviews, to ensure CBS reviews are being completed in a timely fashion. Such information could help inform more strategic oversight to determine whether the current CBS review process is achieving intended results, or whether additional changes to the timing of or criteria for conducting CBS reviews are needed. As the agency that is responsible for issuing the overarching policies that govern CBS reviews and is ultimately responsible for approving contractor business systems, DCMA is in the best position to lead the effort to develop this mechanism. As each agency is responsible for executing its mission and managing its resources, however, this effort should be conducted in collaboration with DCAA. We recommend that the Director, DCMA, in collaboration with the Recommendation for Director, DCAA, develop a mechanism to monitor and assess whether Executive Action contractor business systems reviews are being completed in a timely manner. (Recommendation 1) DOD agreed with the recommendation. In an email, a DPC official stated Agency Comments that DCMA and DCAA are collaborating to determine the best way to implement the recommendation. DOD’s comments are reprinted in Appendix I. We are sending copies of this report to the appropriate congressional committees; the Acting Secretary of Defense; the Under Secretary of Defense for Acquisition and Sustainment; the Under Secretary of Defense – Comptroller; the Director, DCMA; the Director, DCAA; and other Page 30 GAO-19-212 Contractor Business Systems interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-4841 or by e-mail at email@example.com. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report were Tatiana Winger (Assistant Director), Emily Bond, Matthew T. Crosby, Suellen Foth, Sameena Ismailjee, Jean McSween, Ramzi Nemo, Miranda Riemer, Christy Smith, Roxanna Sun, Tom Twambly, and Jacqueline Wade. Timothy J. DiNapoli Director, Contracting and National Security Acquisitions Page 31 GAO-19-212 Contractor Business Systems List of Committees The Honorable James M. Inhofe Chairman The Honorable Jack Reed Ranking Member Committee on Armed Services United States Senate The Honorable Richard Shelby Chairman The Honorable Dick Durbin Ranking Member Subcommittee on Defense Committee on Appropriations United States Senate The Honorable Adam Smith Chairman The Honorable Mac Thornberry Ranking Member Committee on Armed Services House of Representatives The Honorable Pete Visclosky Chairman The Honorable Ken Calvert Ranking Member Subcommittee on Defense Committee on Appropriations House of Representatives Page 32 GAO-19-212 Contractor Business Systems Appendix I: Comments from the Department Appendix I: Comments from the Department of Defense of Defense Page 33 GAO-19-212 Contractor Business Systems Appendix I: Comments from the Department of Defense (102329) Page 34 GAO-19-212 Contractor Business Systems The Government Accountability Office, the audit, evaluation, and investigative GAO’s Mission arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is Obtaining Copies of through GAO’s website (https://www.gao.gov). Each weekday afternoon, GAO GAO Reports and posts on its website newly released reports, testimony, and correspondence. To have GAO e-mail you a list of newly posted products, go to https://www.gao.gov Testimony and select “E-mail Updates.” Order by Phone The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, https://www.gao.gov/ordering.htm. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO on Facebook, Flickr, Twitter, and YouTube. Connect with GAO Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. Visit GAO on the web at https://www.gao.gov. Contact: To Report Fraud, Website: https://www.gao.gov/fraudnet/fraudnet.htm Waste, and Abuse in Automated answering system: (800) 424-5454 or (202) 512-7700 Federal Programs Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400, Congressional U.S. Government Accountability Office, 441 G Street NW, Room 7125, Relations Washington, DC 20548 Chuck Young, Managing Director, firstname.lastname@example.org, (202) 512-4800 Public Affairs U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, DC 20548 James-Christian Blockwood, Managing Director, email@example.com, (202) 512-4707 Strategic Planning and U.S. Government Accountability Office, 441 G Street NW, Room 7814, External Liaison Washington, DC 20548 Please Print on Recycled Paper.
Contractor Business Systems: DOD Needs Better Information to Monitor and Assess Review Process
Published by the Government Accountability Office on 2019-02-07.
Below is a raw (and likely hideous) rendition of the original report. (PDF)