It is our military, 

civilians, and 

contractor 

employees that 

most acutely feel 

the impact of 

contract waste, 

fraud, and abuse.

SPECIAL REPORT ON CONTRACTOR BUSINESS SYSTEMS

Defense agencies must improve 

their oversight of contractor 

business systems to reduce 

waste, fraud, and abuse

Executive Summary

Contractor business systems and internal controls are the first line of defense against waste, 

fraud, and abuse. Weak control systems—such as those for estimating, billing, purchasing, 

labor, and compensation, among other activities—increase the risk of unallowable and 

unreasonable costs on government contracts, especially in contingency environments 

like Iraq and Afghanistan. The potential increased cost attributable to weak systems is 

exacerbated by the government’s increased reliance on service-support contractors in the 

high-risk environment of contingency contracting and on an oversight process that has 

proven ineffective for the task.

On August 11, 2009, the Commission on Wartime Contracting in Iraq and Afghanistan 

conducted a hearing to obtain testimony from government officials and contractors on the 

adequacy of contractor business systems. The Commission learned that unreliable data from 

business systems produced billions of dollars in contingency-contract costs that government 

auditors often could not verify. The government’s ability to detect contract cost errors and 

material misstatements is seriously impeded by contractors’ inadequate internal controls 

over their business systems. Further, the two primary government agencies involved, the 

Defense Contract Management Agency (DCMA) and the Defense Contract Audit Agency 

(DCAA), are not effectively working together to protect government interests.

The Commission found five systemic problems with current oversight of contractor business 

systems and makes five recommendations to correct them: 

CWC Special Report 1 September 21, 2009

Findings Recommendations

1 DCMA’s and DCAA’s divergent and often 

contradictory behaviors send mixed messages 

to contractors.

Department of Defense (DoD) needs to ensure that 

government speaks with one voice to contractors. 

2 Separate government reporting lines of 

authority complicate issue resolution. 

DoD needs to improve government accountability by 

rapidly resolving agency conflicts on business systems.

3 Audit reports are not informative enough 

to help contracting officers make effective 

decisions.

DCAA needs to expand its audit reports to go beyond 

rendering a pass/fail opinion. 

4 DCMA is not aggressive in motivating 

contractors to improve business systems.

DCMA needs to develop an effective process that 

includes aggressive compliance enforcement.

5 Agencies are under-resourced to respond 

effectively to wartime needs.

DCAA and DCMA need to request additional 

resources and prioritize contingency-contractor 

oversight workload.

Commission on Wartime Contracting

 in I raq and A fghanistan
2

Effective oversight of contractor business systems and internal controls is important and needs 

immediate attention. Every dollar wasted is a dollar not available for training, equipment 

maintenance, life-support services, and ultimately for accomplishing the mission. The Congress 

and taxpayers have a large stake in this issue, but our military, civilians, and contractor 

employees on the front line are the ones who most acutely feel the impact of contract waste, 

fraud, and abuse. This fiscal hemorrhaging must stop.

Background

Contractor business systems and internal controls are the first line of defense against waste, 

fraud, and abuse. Weak control systems increase the risk of unallowable and unreasonable costs 

on government contracts. Financial risks are greatly heightened in a contingency environment 

where business operations include new and unfamiliar business markets, foreign practices 

which often sanction graft, and poor communications that complicate home-office oversight. 

The Defense Contract Management Agency is charged with managing the government oversight 

process with audit and financial advisory services provided by the Defense Contract Audit 

Agency. The Federal Acquisition Regulation (FAR) gives contracting officers wide latitude in 

exercising business judgment to make final decisions regarding the adequacy of contractor 

business systems. A key factor in applying this judgment is the DCAA input from its audits of the 

following 10 key business systems:

•	 Control Environment and Overall Accounting System Controls

•	 Purchasing (subcontracting) Controls

•	 Indirect and Other Direct Cost Controls

•	 Compensation System Controls

•	 Billing System Controls

•	 Budget and Planning System Controls

•	 Estimating System Controls

•	 Material Management and Accounting System Controls

•	 Labor System Controls

•	 IT General System Controls

Contracting officers must balance concerns for accomplishing the mission with the risk 

associated with poor or inadequate business systems. 

In addition to supporting the DCMA’s contracting-officer assessment of contractors’ 

internal-control compliance, auditing standards generally require that the auditor obtain an 

understanding of the contractors’ systems of internal controls in order to plan the nature, 

timing, and extent of auditing procedures—that is, substantive tests. In other words, the 

government auditor does not look at every financial transaction of every contract to determine 

the reasonableness and reliability of the charges. This would be highly inefficient. Rather the 

auditor relies on contractor internal controls to limit substantive testing and gives more attention 

to areas of greatest audit risk.

Theoretically, decisions by DCMA contracting officers 

are supported and strengthened by professionally sound 

DCAA business-system audits. When all the pieces in 

the process work, the government should be able to 

rely on contractor business systems to substantially 

reduce risk of waste, fraud, and abuse—especially when 

significant amounts of taxpayer dollars flow quickly to 

contingency contractors.
3

Findings

DCMA’s and DCAA’s divergent and often contradictory 

behaviors send mixed messages to contractors

A key difference between the roles of DCMA and DCAA must be emphasized: only 

DCMA contracting officials have the responsibility and authority to enforce contract 

terms and conditions. In contrast, DCAA’s role is advisory. DCMA, as the administrative 

contracting office, has authority to accept or reject DCAA’s advice regarding the 

adequacy of business systems. While DCAA acts only in an advisory role, its auditors 

are recognized experts on accounting matters, internal controls, and business systems. 

Contracting officers are not typically trained in these complex audit and accounting 

procedures and sometimes make questionable decisions, seemingly ignoring DCAA 

recommendations.1 If contracting officials consistently override reasoned audit opinions

without proper consideration and DCAA coordination, the result is likely to be continued 

system deficiencies and increased contract costs.2 This is a longstanding issue that 

remains unresolved.3

Through research and hearings, the Commission learned that many contractor business 

systems cannot be relied upon to ensure that proposed and incurred contract costs are 

reasonable. Many deficiencies identified by the DCAA have remained uncorrected for 

years because the government failed to insist that the contractor make the necessary 

corrections. DCAA conducts audits and offers recommendations, but the power to 

accept audit recommendations, compel action, and impose consequences rests with the 

DCMA. For example, the Commission reviewed records that show DCMA contracting 

officials generally contradicted DCAA’s negative audit findings of Kellogg Brown & 

Root International, Inc. (KBR) business systems. As reflected in the figure 1 below, in 

every case, DCMA found KBR’s systems adequate, overruling DCAA’s professional audit 

opinion. 

1. DoD Inspector General Oversight Review Report No. D-2009-6-004, Defense Contract Management 

Agency Actions on Audits of Cost Accounting Standards and Internal Control Systems at DoD Contractors 

Involved in Iraq Reconstruction Activities, April 8, 2009, 8-13. 

2. Testimony of April Stephenson, Director, Defense Contract Audit Agency, before the Commission on 

Wartime Contracting in Iraq and Afghanistan, “. . . [KBR] could not support . . . $1.5 billion [in LOGCAP 

III contract costs],” May 4, 2009, 5, http://www.wartimecontracting.gov/images/download/documents/

hearings/20090504/Stephenson_DCAA_testimony_5-4-09.pdf.

3. http://www.dodig.mil/Audit/reports/fyod/03-6-001.pdf.

Yellow or red bars 

indicate a negative DCAA 

audit finding; green bars 

indicate areas where 

DCMA determined 

otherwise.

Source: Data provided to the Commission by DCAA and DCMA in July 2009.

Figure 1. KBR Business Systems - DCAA findings and DCMA resolution
4

There seems to be a significant disparity between the importance DCAA and 

DCMA assign to business systems and internal-control deficiencies. This 

disparity is exemplified in KBR-related data in Figure 1; however, similar results 

occur to varying degrees with many of the contingency-contractor businesssystem audits the Commission examined for logistics support-service contracts 

in Iraq and Afghanistan. For example, DCAA and DCMA reviewed the same 

KBR purchase orders and subcontracts issued against the Army logistics civil 

augmentation program (LOGCAP III) contract from the period January 1 

through December 31, 2007, and identified the same deficiencies, but came to 

different conclusions on the adequacy of KBR’s purchasing system. Despite the 

DCAA inadequacy recommendation, DCMA approved the system. Consistent 

assessment and reliability of contractors’ purchasing systems are especially 

important because subcontractors provide more than 70 percent of the 

LOGCAP III services in theater.4

Contractors have noticed—and openly discussed—the disagreements and 

inconsistent approaches between DCAA and DCMA. These two agencies and 

the contractors have often spent years arguing over whether corrective actions 

must be accomplished or have been satisfactorily completed in specific cases 

under dispute. This creates an environment in which contractors can exploit the 

agencies’ mixed messages and game the system to their advantage.

Separate government reporting lines of authority 

complicate issue resolution

There is no common line of authority or arbiter to resolve significant 

differences between DCAA and DCMA, the primary participants in overseeing 

contingency-contracting business systems. The DCAA reports to the Under 

Secretary of Defense (Comptroller), while DCMA reports to Under Secretary 

of Defense (Acquisition, Technology, and Logistics). Their common point of 

resolution is the Office of the Secretary of Defense—a level too high in the 

organization structure to effectively resolve differences that continually occur. 

The Commission is not aware of any instance in which a dispute between the 

two agencies has risen to the Secretarial level—possibly a sign that disputes 

may go unresolved because parties are reluctant to push them up the chain of 

command. These separate lines of authority contribute to a lack of interagency 

cooperation and collaboration, and make it difficult for the oversight process to 

work as well as it should.

Audit reports are not informative enough to help 

contracting officers make effective decisions

In December 2008, DCAA changed its policy, eliminating “inadequate-in-part” 

opinions and “suggested management improvements.” Now, all deficiencies 

reported by DCAA will render the contractor’s system “inadequate,” resulting 

in many more adverse audit opinions. But this does not improve matters. 

Rather than giving system deficiencies more importance, it seems to have 

the opposite effect—undermining the significance of the audit findings and 

weakening their effectiveness. Use of a binary system involving a pass/fail rating 

does not adequately depict relative degrees of impact. Without any reasonable 

provision for more accurately describing systems that are less than perfect, 

contractors and contracting officers find the “adequate/inadequate” options 

4. Ibid., 27.

Consistent assessment 

and reliability of 

contractors’ purchasing 

systems are especially 

important because 

subcontractors provide 

more than 70 percent 

of the LOGCAP III

services in theater.
5

too restrictive. Moreover, since only significant deficiencies are now reported, 

there is no provision to report and track recommendations for other desirable 

improvements.

Contracting officers need audit opinions with clear and quantifiable risk 

information. They need DCAA’s expert opinion about the relative impact or 

dollar value (or even an estimated range of risk) of the deficiency in order to 

consider making a contract award or a contract-incentive determination in the 

face of an “inadequate” audit opinion. Further, cost-impact information provided 

by DCAA could help the contracting officer determine withhold amounts when 

necessary. Although DCAA has increased the number of its recommendations to 

withhold payment, it does not always estimate a cost impact for the deficiencies 

it has identified. This is of utmost importance to the contracting officer who 

must make a decision that balances the cost risk against the importance of the 

mission—that is, making a critical award in the face of an inadequate opinion.

When contracting officers making 

decisions about contract actions 

are presented with multiple and 

potentially differing opinions, 

their ability to make an overall 

assessment of system acceptability 

is severely limited. Apart from 

contractor systems specifically 

addressed in the FAR (e.g. the 

accounting system), there is no 

regulatory requirement for DCAA 

to render an overall opinion 

regarding the adequacy of many 

of the 10 business systems audited 

by DCAA. In fact, with respect to 

audit resolution procedures, DoD 

FAR Supplement (DFARS) 242.7502 instructs the contracting officer to consider 

significant deficiencies as opposed to an overall opinion regarding adequacy. 

DCMA is not aggressive in motivating contractors 

to improve business systems

When confronted with significant audit findings, contractors generally 

promise to improve their business systems by providing corrective-action 

plans to contracting officers. These plans, as opposed to completed corrective 

actions, are often accepted by contracting officers, thus effectively rendering 

a system adequate.5 Subsequently, there is no basis to pursue any suspension 

of percentage-of-progress payments, withhold reimbursement of costs, or use 

other incentives to ensure that contractors implement thorough and effective 

improvements. The Director of DCAA testified that contract withholds have a 

proven capacity to cause contractors to remedy inadequate business systems.6

For example, a “withhold” was placed on Titan Corporation’s in-theater linguist 

contract as a result of DCAA’s “inadequate” opinion on its labor system. As much 

5. Testimony of David Ricci, Executive Director, Contracts, Defense Contract Management Agency, 

before the Commission on Wartime Contracting in Iraq and Afghanistan, August 11, 2009, 25, http://

wartimecontracting.gov/images/download/documents/hearings/20090811/Transcript%20-%20

August%2011%202009%20Business%20Systems%20Hearing.pdf.

6. Testimony of April Stephenson, August 11, 2009, 36.

Federal regulations 

instruct the contracting 

officer to consider 

significant deficiencies as 

distinct from giving 

an overall opinion on 

adequacy.

DCMA has felt 

“a kind of almost 

direction to work 

with your industry 

counterparts,” 

an agency official 

testified.
6

as $40 million was withheld, with portions returned to the contractor as each 

system deficiency was corrected.7 This approach motivated the contractor to 

fix the deficiency as quickly as possible while mitigating the government’s 

risk during the process. Each of the contractors at the Commission’s August 11 

hearing agreed that contract withholds serve as a motivator to correct reported 

deficiencies.8 The CEO of DynCorp said it does not take a big withhold to 

catch a contractor’s attention.9

Nevertheless, the contract withhold remedy is rarely used even though the 

DFARS 242.7502 clearly instructs contracting officers to “consider whether 

it is appropriate” to suspend some payments until contractors submit a plan 

and correct deficiencies. Despite this regulatory coverage, DCMA’s Executive 

Director, Contracts, testified that he does not believe that DCMA has the 

authority to conduct withholds under cost-reimbursement or incentive-type 

contracts without an implementing clause or without showing a “logical 

nexus or causality between the specific system deficiency and the cost.”10

DCAA does not always provide this nexus, but DCMA has also been very 

conservative in its application of the available DFARS option. The DCMA’s 

Executive Director, Contracts, testified at the Commission’s August 11 hearing 

about “a kind of almost direction to work with your industry counterparts ... to 

the extent that DCMA perhaps has not taken the strongest action that maybe 

it could have.”11 This conservative approach results in 

little, if any, motivation for contractors to improve their 

business systems, and ultimately has a direct impact on 

the warfighting mission.

Agencies are under-resourced 

to respond effectively 

to wartime needs 

Poor alignment of personnel to meet wartime needs 

has resulted in a spiraling down of business-system 

oversight in contingency contracting. There have 

been too few experts to conduct reviews and too few 

personnel to validate that contractor correctiveaction 

was properly implemented. 

As a result of personnel shortfalls, DCAA system reviews 

and follow-ups are not always timely; therefore, the 

real-time status of contractor business systems cannot 

always be determined. As noted in our Interim Report 

to Congress, DCAA has not performed timely reviews of 

many contractor business systems. For example, the last 

full billing and estimating system reviews of KBR were 

completed in 2004; current reviews are scheduled for 

completion in late 2009 or early 2010.

7. Ibid., 17.

8. Testimony of Mssrs. Methot, Ballhaus, and Walters, representing Fluor, DynCorp, and KBR, 

August 11, 2009, 106.

9. Ibid.

10. Testimony by David Ricci, 26 and 36.

11. Ibid., 62.

Top: 8/11 CWC Panel 1, l-r:

Jeff Parsons, Army; April Stephenson, 

DCAA; David Ricci, DCMA.

Bottom: 8/11 CWC Panel 2, l-r:

David Methot, Fluor; William Ballhaus, 

DynCorp; William Walter, KBR.

The CEO of DynCorp 

said that it doesn’t take 

a big withhold to catch 

a contractor’s attention. 
7

Corrective actions taken by contractors sometimes remain unvalidated for 

extended periods of time. Consequently, contracting officers may not have 

current and accurate information to determine if the corrective actions that 

were implemented actually resolved system deficiencies. This may also give 

contractors the impression that the government does not consider business 

system reviews to be important. DCAA’s practice is to conduct follow-up 

assessments on contractors’ corrective actions within 6 to 12 months.12 In 

some cases, however, these assessments take more than a year to complete. 

For instance, DCAA’s April 2009 report on KBR’s purchasing system was the 

culmination of a review that started in January 2008.13

Another indication of personnel shortages is the small number of DCMA 

personnel devoted to contractor purchasing system reviews (CPSR). The number 

of personnel assigned to perform CPSR reviews has decreased from 102 in 

1994 to 70 in 2002, to 14 in 2009. Contract transactions, on the other hand, 

have increased by 328 percent since 

fiscal year 2000.14 This steep decline 

in personnel, combined with the 

exponential increase in contracting 

activity, demonstrates a diminishing 

level of DCMA critical analysis of 

contractor purchasing systems. 

The Commission believes that many 

of the untimely reviews are due to 

the failure of both DCAA and DCMA 

to prioritize their business-system 

workload in a wartime environment. 

DCAA does review outputs generated 

by contractor business systems, such 

as proposals that reflect contractors’ 

estimating systems. In fact, the DCAA 

Director testified that the agency 

found $6.1 billion in unsupported 

estimating costs in Iraq and 

Afghanistan.15 But DCAA is under-resourced for comprehensively reviewing all 

contingency contractors’ business systems on a timely basis.

The Commission recognizes that both DCAA and DCMA have recently 

requested additional resources to effectively accomplish their full missions.

Nevertheless, the wars in Iraq and Afghanistan have been going on for many 

years and the Commission is at a loss to understand why leadership has not 

aggressively pursued additional staffing until recently. In addition, it is the job of 

DCMA and DCAA leadership to reallocate existing, albeit limited resources in 

accordance with mission priorities. Timely oversight of contingency contractors’ 

business systems should be a priority for both agencies during wartime.

12. Testimony of April Stephenson, August 11, 2009, 50.

13. Information provided to the Commission by DCAA in July 2009.

14. Information provided to the Commission by DCMA on August 4, 2009.

15. Testimony by April Stephenson, May 4, 2009, 4.

The number of 

DCMA personnel 

assigned to review 

purchasing systems 

decreased from 102 

personnel in 1994 to 

70 in 2002, to 14 in 

2009.
8

Findings Summary

Opinions rendered and actions taken on contingency-contractor business systems 

have not received the attention necessary to monitor the billions of dollars of 

costs that flow through these systems. The five findings of this report indicate 

that the oversight process, as well as the communication between agencies must 

improve if we are to effectively mitigate the risk of waste, fraud, and abuse. 

These findings would be important in peacetime; in wartime they are critical. 

Because the United States relies on contractors as a primary source of in-theater 

support, it is imperative that the government correct the flaws in this process. The 

Commission offers the following recommendations for improvement.

Commissioners pose questions 

to witnesses at August 11, 2009, 

hearing on Capitol Hill.
9

RECOMMENDATIONs for Improvement

DoD needs to ensure that government speaks with one voice to contractors 

DCMA and DCAA must work closely together to protect the government’s interests. The Commission believes 

it is possible to achieve this while maintaining the auditing independence desired by DCAA and respecting the 

decision-making authority of the contracting officer. Audits and assessments that are conducted using a well-defined 

evaluation methodology will provide a consistent government position that is clear to the contractor. DCAA and 

DCMA must work together to develop agreed-upon standards and processes that communicate the same message 

to both the individual contractor and the contracting community and help contractors achieve “adequate” systems. 

Ideally, the process should be defined in the FAR (in a way similar to the material-management and accountingsystem standards called out in the DFARS 252.242.7004) so they are visible to all stakeholders. 

DoD needs to improve government accountability by rapidly resolving 

agency conflicts on business systems

The Department of Defense needs to re-establish control of the oversight process to the government by developing 

better internal-resolution processes. The DoD process should ensure that disagreements between DCAA and DCMA 

are rapidly resolved, with consideration for DCAA’s independent audit expertise as well as for the DCMA contracting 

officerís decision-making authority and the operational mission.

DCAA needs to expand its audit reports beyond rendering a pass/fail opinion

DCAA should revisit its policy with respect to its binary “adequate/inadequate” opinions for business-system 

reports and provide a mechanism for reporting any deficiency that warrants formal notification and tracking. Also, 

whenever possible, audit reports should include an assessment of audit risk and cost impact associated with reported 

deficiencies. Further, DCAA should re-examine the need to express opinions on the overall adequacy of business 

system audits beyond those explicitly required by the FAR.

DCMA needs to develop an effective process that includes 

aggressive compliance enforcement

DCMA, with DCAA advice, should develop a reliable and aggressive process for reaching consistent decisions on 

business systems and any corrective action needed. The process should recognize the contracting officer as the 

final authority but also acknowledge DCAA auditors as the business-system experts chartered to advise government 

contracting organizations, as noted in the DCAA mission statement.16 Disagreements with audit recommendations 

should be discussed at appropriate leadership levels within DCMA and DCAA and documented accordingly. As part 

of their decision process, DCMA contracting officers should also consider any risk analysis provided by DCAA and 

thoroughly address it in documenting their decisions. Finally, DCMA should ensure timely follow-up on contractor 

corrective-action plans and validate that the contractor actions actually correct the deficient business system. If not, 

the contracting officer should pursue such contractual remedies as withholds, and DCMA leadership should ensure 

that this occurs. If DCMA leaders believe there is ambiguity about their ability to impose withholds, they should seek 

clarification and resolution from the Undersecretary of Defense for Acquisition, Technology, and Logistics.

DCAA and DCMA need to request additional resources and prioritize 

contingency-contractor oversight workload 

The Commission believes that much of the delay in delivering audit opinions and enforcing corrective action is 

caused by the failure of both DCAA and DCMA to obtain enough resources and to effectively prioritize the wartime 

workload. These agencies need to give contractor business systems the appropriate priority and allocate resources 

accordingly. Both DCAA and DCMA have requested increases to their workforce in order to fulfill their assigned 

missions. The Commission strongly encourages each organization to aggressively pursue additional staff, but also 

to immediately prioritize its current workload to meet government oversight needs in the contingency-contracting 

arena. This is imperative to address the risks of waste, fraud, and abuse.

16. .See “The DCAA Organization,” http://www.dcaa.mil. 
10

conclusion

At the August 11, 2009 hearing, the Commissioners asked 

DCMA and DCAA to work together to improve the state of 

affairs outlined in this Special Report. A resolution is necessary 

sooner rather than later, and both agencies have been invited 

back to testify on their progress. The Commission hopes to learn 

that they have indeed made significant progress in developing an 

effective oversight program that capitalizes on the strengths of each 

organization. The Commission hopes to hear the agencies propose a plan 

that positively addresses each of the above findings and recommendations 

and we recommend that this plan subsequently be fully coordinated within the 

Department of Defense.

Both agency directors have made a commitment to implementing improvements. DCMA Director Charlie Williams sent a 

post-hearing letter for the record to the Commission committing to identify opportunities for improvement and to implement 

solutions. DCAA Director April Stephenson gave a similar commitment during her testimony. 

Making sure that contractor business systems are reliable will have far-reaching consequences for all contracts executed 

to support contingency operations. Government regulations need to ensure that audit follow-up and resolution is effective 

and timely for all government contracts. In the coming months, the Commission intends to expand its research to contractor 

business systems supporting Department of State and U.S. Agency for International Development contingency contracts. 

The Commission’s Final Report to Congress will reflect the results of all Commission work in this area. It will include lessons 

learned and recommendations for permanent improvement of oversight of wartime-contractor business systems.

Despite the difficulty of providing critical support for U.S. contingency operations in Iraq and Afghanistan, DCAA and 

DCMA military personnel, civilian employees, and private contractors have performed diligently and at the cost of great 

personal sacrifice. The Commission’s recognition of opportunities for improvement and suggestions for reform in no way 

diminish their contributions.

The Commission on Wartime Contracting is an independent, bipartisan legislative commission established in Section 841 of the 

National Defense Authorization Act for Fiscal Year 2008 (Public Law 110-181) to study federal agency contracting for reconstruction, 

logistical support, and security functions in Iraq and Afghanistan.

C ommissioners

Michael J. Thibault, Co-Chair; Christopher H. Shays, Co-Chair

Clark Kent Ervin, Grant S. Green, Linda J. Gustitus, Robert J. Henke, Charles Tiefer, Dov S. Zakheim

1401 Wilson Boulevard, Suite 300

Arlington, VA 22209

703-696-9362

www.wartimecontracting.gov