INSPECTION MEMORANDUM

TO: William D. Hansen

##  Deputy Secretary

FROM: Mary Mitchelson

##  Assistant Inspector General

Analysis and Inspection Services

## SUBJECT: Review of Contracting Officer's Representative Training and Risk 

> Level Designations (ED-OIG/A&I 2001-03)

This memorandum provides the results of our review of Contracts and
Purchasing Operations' (CPO) training program for Contracting Officer's
Representatives (COR) and

the Department of Education's (the Department or ED) risk level
designations for CORs.[^1] We conducted our inspection to determine
whether:

-   CORs are receiving the necessary training, and

```{=html}
<!-- -->
```
-   CORs have the proper position risk level designation.

> We reviewed the Department's training courses and curriculum for COR
> certification using the Office of Federal Procurement Policy's *A
> Guide to Best Practices for Contract Administration,* October 1994
> (the Guide)*.* We also reviewed the Department's administration of the
> COR training program to determine if CORs were being trained in the
> timeframes specified by Department policy. We found the training
> courses meet or exceed most best practices contained in the Guide, but
> the data maintained by CPO is inaccurate and incomplete for purposes
> of properly administering the training program.

The risk-level designation review was conducted at our request by the
Department's Security Office using the CPO listing of COR
information.[^2] The Security Office found COR positions that should
have been designated as high-risk public trust positions due to the
high-dollar value of the contracts under their supervision.

We recommend that the CPO update its COR records and include the COR
appointment date in its training database so CPO can fulfill its
responsibility to schedule and conduct the COR training curriculum and
properly certify and recertify the Department's CORs in a timely manner.
We also recommend that principal offices conduct periodic reviews of the
position risk level designations of their CORs to determine if their
risk levels are correct in relation to the value and complexity of their
contracts.

The CPO is aware of our COR training findings and is taking action to
address these issues.

# COR TRAINING 

# Contracts and Purchasing Operations

CPO, within the Office of the Chief Financial Officer, is responsible
for: 1) appointing CORs for specific contracts; 2) determining the
training requirements for CORs;

3\) conducting COR training; 4) certifying CORs upon completion of
training; and

5\) maintaining accurate COR training records.

Once appointed, the COR acts as a liaison between the Department's
contractors and the CPO for a specific contract. The responsibilities of
the COR include, but are not limited to: 1) reviewing periodic progress
reports; 2) offering possible solutions to problems;

3\) maintaining records; and 4) monitoring invoices and schedule
deadlines.

**COR Certification**

The Federal Acquisition Regulations that govern government contracting
do not specify standards for COR training. The CPO Director, based on
his experience and benchmarking of other agencies, established the
Department's training requirements. The Department requires all CORs to
complete 80 hours of training to become certified. CORs are also
required to take an eight-hour recertification course, also called a
refresher course, every two years.

As of 1990, CPO policy states that COR training must be completed before
an individual may serve as a COR. The CPO Director said that due to a
shortage of certified CORs, however, contracting officers have assigned
non-certified CORs to contracts. The appointment letters for these CORs
state that they have one year from the date of their appointments to
complete the mandatory COR training program.

The COR appointment date is an essential data element that should be in
the CPO database to monitor COR progress in meeting the mandatory
training requirements. The CPO, however, does not maintain this data on
the 734 CORs in the CPO database. Further, the database does not reflect
which CORs are actively administering a contract. Without this
information, we could not determine from the CPO database whether CORs
completed the necessary training prior to or within one year of their
appointment dates. In the judgmental sample of 26 CORs we interviewed,
we obtained their appointment dates from them and found that 62%, or 16,
were appointed prior to certification. In addition, we found that 35%,
or 9, of our sample group did not complete their training within one
year of their appointments.

The CPO database does contain a record of the courses CORs have taken,
the dates CORs were certified as having completed training, and the
dates CORs were recertified and/or due for recertification. According to
the database, 50%, or 368, of the 734 CORs are certified. Of those
certified, we found 8%, or 31, had not taken all of the courses required
for certification. In addition, 73%, or 267, of the certified CORs are
overdue for recertification.

The CPO Director indicated that the current training database is to be
replaced by an Oracle database. The Director stated that many
deficiencies in the current database are to be addressed in the new
database, including adding the appointment dates and the active/inactive
status of CORs. In addition, all Department CORs are to receive training
on the new database.

**COR Training Curriculum**

CPO established two training tracks for COR certification. Both tracks
contain ten days (80 hours) of training, exceeding the suggested 40
hours presented in the Guide. One track includes a five-day course while
the second track provides similar course material in two separate
courses. The remaining 40 hours of training are the same for both
tracks. In addition to these courses, Student Financial Assistance (SFA)
developed its own five-day COR training course with an emphasis on
performance-based contracting.

We compared the Department's COR training with the training at 13
Federal agencies. While ED requires 10 days of training, we found that
other agencies require approximately 3.6 days of training for
certification. ED requires COR recertification every two years, while
the average time for COR recertification in other agencies requiring
recertification is three years. Some of the agencies surveyed do not
have recertification requirements.

We compared the number of classes offered by the other agencies and
found that ED requires more classes than most agencies. While ED
requires four or five classes (depending on the track selected), most
agencies require only one basic class.

A comparison of course curricula found that the Department's curriculum
is more comprehensive than those of all but two of the other agencies.
Most agencies cover basic contract administration, including the role of
a COR, the contract modification process, and contract closeout
responsibilities. ED is one of the few agencies to cover such topics as
the payment process, writing task orders, and evaluating the technical
aspects of contracts.

**Training Improvement Initiatives**

During our interviews some CORs and program managers suggested that
training could be improved by: 1) offering priority enrollment to CORs
who need specific courses to complete their certification; and 2)
providing in-class examples that relate specifically to ED contracting
work, such as examples involving intellectual property and research
projects.

Course announcements now state that preference will be given to CORs
needing the course for certification. Additionally, the Director of CPO
said the contract trainers are provided with examples of ED contracting
situations and problems to incorporate into their training. The Director
stated that improving the relevancy of training examples remains a
challenge, however, due to the diversity of the Department's contracts
and the backgrounds of the contractors conducting the training.

Some CORs said they had seen improvements in the relevancy of the
courses, which they attributed to the Director's class visits to solicit
ideas to improve training. One program manager also stated that her
office benefited by inviting CPO staff to give a brown bag presentation
on the contracting issues in her principal office.

**Best Practices**

As a result of our review we found that the CPO's training program
generally meets or exceeds the list of best practices set forth in the
Office of Federal Procurement Policy's *A Guide to Best Practices for
Contract Administration,* October 1994. There are a few best practices
the CPO could incorporate to improve the contract process in the future
(See Appendix B, Best Practices: A Comparison of ED to Selected Training
Procedures Contained in the Office of Federal Procurement Policy's
Guide). These best practices include:

-   Program managers and direct supervisors of CORs play an important
    role in the contracting process. It may be helpful to add a basic
    contracting class for program managers and direct supervisors so
    they have a better understanding of the contracting process.

-   Reviewing invoices and vouchers is an essential part of a COR's
    responsibility during the contracting process. Creating a checklist
    or voucher review form, which includes major cost categories, may be
    a useful tool to determine the reasonableness of contractor
    invoices. Also, maintaining an invoice/voucher payment log could
    help a COR track the contractor's claimed costs against the costs
    set forth in the contract.

**POSITION RISK LEVEL DESIGNATION**

**Position Description**

Proper Position Descriptions (PD) are the foundation of an effective and
consistent suitability program. The PD provides a description of the
duties used to determine what type of background investigation is
required and how closely an individual is screened for a position.
Additionally, as the level of authority and responsibility for a
position becomes greater, character and conduct become more significant
in deciding whether initial or continued employment would protect the
integrity and promote the efficiency of the Federal service.

The Office of Personnel Management (OPM) has provided draft guidance to
determine the appropriate public trust designation and background
investigation for positions held by government employees.[^3] The
designation of position risk level is the responsibility of principal
offices and is reviewed by the Department's Security Office.

The PD has been the primary source of information needed for a principal
office to make the appropriate risk designation. One factor in the
designation is the fiduciary responsibility associated with the
position. In recent years, the Department has created more generic PDs.
In our review of the PDs for the CORs we interviewed, we found some that
did not include COR responsibilities even though the COR participated in
large-dollar- value contracts. Principal offices must consider this
factor in setting the risk designation level of the position, even if it
is not in the PD, to make accurate determinations of risk.

**Security Issues**

The Security Office reviewed the dollar value of all the contracts the
Department's CORs monitor and identified 23 CORs in positions with
risk-level designations that are too low. All of these CORs were in
positions at a moderate risk level, even though the dollar values of
their contracts ranged from \$12 million to \$162 million.[^4] The
Security Office asked all of the affected principal offices to review
the risk-level designations of these positions.

As a result of the COR risk-level findings, we asked the Security Office
to review the risk level designations for the program managers
associated with the 26 contracts we reviewed. The Security Office
identified three program managers whose positions did not have the
appropriate risk-level designations. The Security Office has contacted
the appropriate principal offices and asked them to review these
risk-level designations.

**RECOMMENDATIONS**

1.  The CPO should update its COR records and include the COR
    appointment date in its training database so CPO can fulfill its
    responsibility to schedule and conduct the COR training curriculum
    and properly certify and recertify the Department's CORs in a timely
    manner.

2.  The principal offices should conduct periodic reviews of the
    position risk level designations of COR positions and program
    manager positions to determine if the risk level is correct in
    relation to the dollar value and complexity of applicable contracts.

**Department Comments**

The Office of the Deputy Secretary responded to our draft memorandum and
provided no comments. The Management Improvement Team (MIT) also
responded to our draft. The MIT's concerns were that:

1.  Our first recommendation did not sufficiently address the findings
    associated with training deficiencies.

2.  The sample methodology for selecting the CORs we interviewed was not
    identified.

3\. Some of the identified best practices should be offered as
recommendations.

The MIT's full response is included in Exhibit 1.

**OIG's Response**

In response to the MIT's first concern, we have modified our first
recommendation. We have made no changes in response to the second, as we
believe our sample methodology is appropriately described in the
Objectives, Scope and Methodology section of the memorandum, Appendix A.
We disagree with the third suggestion, believing that our
recommendations should focus on the critical steps needed to improve the
COR training process, while leaving the best practices as possible
enhancements for management to consider.

We appreciate the cooperation we received from the CPO staff, the CORs,
and the program managers interviewed for this review. If you have any
questions, please call me at 260-3556.

Attachments

> **Appendix A**

**Objectives, Scope and Methodology**

The objectives of our inspection were to determine whether: 1) CORs are
receiving the necessary training; and 2) CORs have the proper position
risk level designation.

The CPO provided a copy of its COR data files containing the names and
training data for 734 CORs. The data files were used to analyze the
accuracy and completeness of CPO's monitoring of COR training.

The CPO also provided us with a list of over 400 current contracts that
included the names of the delegated CORs. We selected a judgmental
sample of the contracts with the greatest dollar value. The sample
consisted of the sixteen largest dollar contracts in the Department and
the ten largest in SFA. We interviewed the CORs and the program managers
for those contracts with questionnaires developed using the General
Accounting Office's *Standards for Internal Control in the Federal
Government,* November 1999*.*

We compared ED's training program to the best practices contained in the
Office of Federal Procurement Policy's *A Guide to Best Practices for
Contract Administration,* October 1994. The Guide provides useful
examples of what constitutes an effective training program and has
designated them as best practices.

We also compared the Department's COR training with the training at 13
Federal agencies. We specifically looked at the number and availability
of COR training classes, the certification requirements, and the
refresher classes offered at each agency. The agencies and departments
surveyed were:

Department of Agriculture Department of the Interior

Department of Commerce Department of Justice

Department of Defense Department of Labor

Department of Energy National Aeronautics and Space Administration

Environmental Protection Agency Department of Transportation

General Services Administration Department of Treasury

Department of Health and Human Services

We provided the Security Office with the CPO list of all Department CORs
and their contracts, including the dollar value of the contracts. We
asked that the Security Office make a determination, using OPM's
*Suitability Processing Handbook* (*Draft)*, April 2001, if all of the
risk levels were appropriate. We also asked the Security Office to
evaluate the risk levels of the program managers for the contracts we
reviewed.

This review was performed in accordance with the President's Council on
Integrity and Efficiency (PCIE) *Quality Standards for Inspections*,
dated March 1993.

**Appendix B**

**Best Practices: A Comparison of ED to Selected Training Procedures
Contained in the Office of Federal Procurement Policy's Guide**

MEMORANDUM

TO: Mary Mitchelson

##  Assistant Inspector General

##  Analysis and Inspection Services

FROM: John P. Higgins, Jr., Team Leader

##  Management Improvement Team

DRAFT: Draft Inspection Memorandum

> Review of Contracting Officer's Representative (COR) Training and
>
> Risk Level Desugnations (A & I 2001-03)

I am writing to provide comments to the above mentioned draft report. I
offer these comments for your consideration prior to your release of the
final reports.

I would like to express one primary concern, in addition to two other
important points that I believe deserve your attention, as detailed
below.

-   The recommendation intended to improve CPO's COR training
    deficiencies -- requiring CPO to update its COR records to more
    accurately track training records to ensure that proper
    certification and recertification occurs -does rot appear to
    sufficiently address this finding. While capturing more relevant
    data would allow CPO to more effectively monitor COR certification,
    it does not address the basic question of how CPO intends to ensure
    that all CORs actually complete the mandatory training necessary to
    become certified and recertified. Has CPO, for instance, worked with
    TDC to develop a training plan to address their needs in this area?

-   On page 2 reference is made to "...sample of 26 CORs we interviewed,
    ..." but the uthors do not identify sample type. You may find
    guidance in the audit manual useful.

-   On page 4 two "Best Practices" are identified -- adding a basic
    contracting class for managers and supervisors and creating a
    checklist for contractor invoices -- and the authors suggest that
    the Department implement them because "it may be helpful" and "may
    be a useful tool. Your other analytical narrative supporting the two
    is stronger and appears well-reason. If your opinion is that the
    Department will benefit from implementing these practices, why not
    offer them as recommendations?

I hope that you find these comments helpful. If you have any questions
please do not hesitate to contact me at 205-1738

Cc: Brent Weston

[^1]: A position risk level designation is used to determine the level
    of security clearance required for Department employees. There are
    three levels of risk: low, moderate, and high. These levels are
    based upon the degree of public trust in a position, the fiduciary
    responsibility of the employee, the employee's importance to the
    program, the program authority level, and the level of supervision.
    Chapter II, Section A, Page 1, of the Office of Personnel Management
    (OPM) *Suitability Processing Handbook (Draft)*, April 2001.

[^2]: At the time of our review, the Security Office was a component of
    the Office of Inspector General (OIG). It now is a part of the
    Office of Management.

[^3]: OPM *Suitability Processing Handbook (Draft)*, April 2001.

[^4]: Job assignments involving disbursement of \$10 million or more per
    year are designated high risk. Chapter II, Appendix B, Page 10, of
    the OPM *Suitability Processing Handbook (Draft)*, April 2001.