The Government Accountability Office Report: Contractor Business Systems Reviews

Background

On February 7, 2019, the Government Accountability Office (GAO) released its report to congressional committees (GAO-19-212) on the Defense Contract Audit Agency’s (DCAA) and the Defense Contract Management Agency’s (DCMA) effectiveness in monitoring and managing contractor business system evaluations. The National Defense Authorization Act (NDAA) for fiscal year 2018 contained a provision for GAO to evaluate how the U.S. Department of Defense (DoD) implemented legislation intended to improve its business system review process. In order to do this, GAO analyzed DoD acquisition regulations, policies and procedures for conducting contractor business system reviews, and analyzed data on reviews conducted between fiscal years 2013 and 2018.

The GAO had previously found that DoD was years behind on some of these business systems reviews and had recommended that DoD monitor and report whether it is completing these reviews as planned. Therefore, the new report included an examination of: 1) the changes DoD made to its review process, and 2) the extent to which DoD is ensuring timely business system reviews. 

 

History of the Defense Federal Acquisition Regulation Supplement Business Systems Rule

The Defense Federal Acquisition Regulation Supplement (DFARS) Business Systems Rule was first issued as an interim rule on May 18, 2011, and then finalized on February 24, 2012. The rule, as written, is applicable to any DoD contracts or subcontracts awarded subsequent to May 18, 2011, for which no exemptions from the Cost Accounting Standards (CAS) are available. The six contractor business systems addressed by the rule—Accounting System, Estimating System, Purchasing System, Earned Value Management Systems (EVMS), Material Management and Accounting System (MMAS) and Property Management System—produce critical data that contracting officers use to help negotiate and manage defense contracts. These systems and their related internal controls are considered to be the “first line of defense” against waste, fraud and abuse of federal funding. DoD must review contractors’ business systems to ensure that they produce reliable data and conform to the applicable system criteria. The Contractor Business Systems clause at DFARS 252.242-7005 also includes a provision allowing for the contracting officer to impose withholds to payments whenever they make a final determination that the contractor’s business system contains a “significant deficiency.”  “Significant Deficiency” is broadly defined as, “a shortcoming in the system that materially affects the ability of officials of the Department of Defense to rely upon information produced by the system that is needed for management purposes.”

Even if a contractor does not have the DFARS clauses in its contracts, it will likely be held to the standards created by those clauses as they have been incorporated into the audit and review programs used by DCAA and DCMA. In fact, DCAA has audit guidance which states that, “the DFARS criteria are suitable standards to use in determining the acceptability of any Government contractor’s system.” Hence, any business system touched by a DCAA audit is at risk for issues involving compliance with one or more of the DFARS Business Systems Criteria.

Contractors have been required to comply with the business system criteria since mid-2011, however, government review and oversight of those systems has been sporadic at best. The reality is that few business system reviews have actually been performed.

 

Results of the GAO Report 

The GAO report contained a good deal of information, but not a lot of concrete findings. GAO did conclude, however, that, “DoD does not have a mechanism to monitor and ensure that these business system reviews are being conducted in a timely manner,” and recommended that, “DCMA, in collaboration with DCAA, develop a mechanism to monitor and ensure contractor business system reviews are conducted in a timely fashion.” DoD concurred with the recommendation.

Per the GAO report: “DCMA relies on the three offices responsible for conducting DCMA-led reviews to manage the reviews, but DCMA does not formally monitor whether these reviews are being conducted consistent with policy nor does it monitor DCAA’s efforts to complete the audits for which it is responsible. DCMA is ultimately responsible for approving a contractor’s business systems. DCMA currently lacks a mechanism based on relevant and reliable information, such as the number of reviews that are outstanding and the resources available to conduct such reviews, to ensure reviews are being completed in a timely fashion. Such information could help inform more strategic oversight on whether the current review process is achieving its intended results, or whether additional changes to the timing of or criteria for conducting reviews are needed.”

Even though DoD’s plan to catch up on these reviews in three years is ambitious, the GAO report should still serve as a fair warning to contractors that business systems reviews will be a higher priority for DoD over the next few years.

 

Competing Priorities at DCAA

As the GAO report indicates, “DCAA plans to significantly increase the number of business system audits over the next 4 years. However, its success in doing so depends on its ability to 1) shift resources from other audits, 2) to use public accounting firms to conduct other, non-business system audits, and 3) DCAA staff’s ability to execute new audit plans in a timely manner.”

In order to accommodate these system audits, DCAA is saying it will shift 378,000 hours from incurred cost audits to contractor business system reviews between 2018 and 2020. To keep pace with incurred cost audit requirements, part of that shift will be using certified third-party accounting firms for those audits. 

Performing these business system reviews creates resource challenges for DCAA as it tries to manage competing priorities. For example, the fiscal year 2018 National Defense Authorization Act (NDAA) requires DCAA to complete incurred cost adequacy reviews within 60 days and incurred cost audits within one year. The NDAA also includes a mandate from Congress that audit backlog must not exceed one year. As GAO noted, DCAA has struggled to burn down incurred cost audit backlog in order to achieve these metrics—and sustaining that level of audit performance will strain resources even if 3rd Party firms are utilized. Whether DCAA can manage business system review priorities and still maintain the incurred cost backlog mandated by the 2018 NDAA remains to be seen.

 

Bottom Line for Contractors

It is clear that contractors should expect significantly more focus on business systems reviews by DCAA and DCMA over the next few years. Many contractors have been notified that their business systems are scheduled for review and quite a few of those reviews are already underway.

While the system reviews that have been performed over the past several years have largely been conducted at larger contractors, BDO is now seeing more reviews scheduled with mid-market and smaller players. It is therefore critical, that all contractors proactively assess the processes, controls and documentation around their business systems. Contractors who wait until they hear from DCAA or DCMA before they begin to prepare have generally waited too long.

 

---