Audit of Management Controls Over 

Automated Commercial Environment (ACE) 

Contractor Billings

 

DEPARTMENT OF HOMELAND SECURITY 

Office of Inspector General 

Office of Audits 

 OIG-06-66 September 2006
Office of Inspector General 

U.S. Department of Homeland Security 

Washington, DC 20528

September 29, 2006 

Preface 

The Department of Homeland Security (DHS) Office of Inspector General (OIG) was established by 

the Homeland Security Act of 2002 (Public Law 107-296) by amendment to the Inspector General 

Act of 1978. This is one of a series of audit, inspection, and special reports prepared as part of our 

oversight responsibilities to promote economy, efficiency, and effectiveness within the department. 

This report assesses the internal controls related to the review and approval of contractor invoices for 

Bureau of Customs and Border Protection’s (CBP’s) Automated Commercial Environment contract. 

It is based on interviews with employees and officials of relevant agencies and institutions, direct 

observations, and a review of applicable documents. 

The recommendations herein have been developed to the best knowledge available to our office, and 

have been discussed in draft with those responsible for implementation. It is our hope that this 

report will result in more effective, efficient, and economical operations. We express our 

appreciation to all of those who contributed to the preparation of this report. 

 

Richard L. Skinner 

Inspector General 
Table of Contents/Abbreviations 

Executive Summary...............................................................................................................................1 

Background............................................................................................................................................1 

Results of Audit .....................................................................................................................................3 

 CBP Review of Invoices..................................................................................................................3 

 Conclusion .......................................................................................................................................9 

 Recommendations............................................................................................................................9 

 Management Comments and OIG Analysis ..................................................................................10 

 Award and Incentive Fees..............................................................................................................10 

Appendices 

 Appendix A: Purpose, Scope, and Methodology .......................................................................12 

 Appendix B: Management Comments.......................................................................................14 

 Appendix C: Invoice Procedure Steps .......................................................................................18 

 Appendix D: IBM System Diagram...........................................................................................19 

 Appendix E: Invoice Review Checklist.....................................................................................20 

 Appendix F: Award and Incentive ............................................................................................22 

 Appendix G: Major Contributors to This Report.......................................................................23 

 Appendix H: Report Distribution...............................................................................................24 

Abbreviations 

 ACE Automated Commercial Environment 

 CBP Bureau of Customs and Border Protection 

 DCAA Defense Contract Audit Agency 

 DHS Department of Homeland Security 

 eCP e-Customs Partnership 

 GAO Government Accountability Office 

 G&A General and Administrative 

 IBM International Business Machines 

 JTR Joint Travel Regulation 

 ODC Other Direct Costs 

 OIG Office of Inspector General 

 POP Period of Performance 

 WBSID Work Breakdown Structure Identification 
OIG 

Department of Homeland Security 

Office of Inspector General 

Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings 

Page 1 

Executive Summary

 

The Bureau of Customs and Border Protection (CBP) is developing the 

Automated Commercial Environment (ACE), a new cargo processing system 

that was initiated to modernize the targeting, inspection, enforcement, border 

security, revenue collection, and trade statistics processes for all cargo 

entering and leaving the United States. In August 2001, CBP awarded the 

ACE development contract to the e-Customs Partnership (eCP), a coalition of 

contractors headed by the prime contractor, International Business Machines 

Global Services (IBM). ACE is scheduled for completion in September 2011 

at an estimated cost of $3.0 billion. As of May 2005, CBP had paid eCP over 

$760 million. The CBP Cargo Systems Program Office (Program Office) 

manages the ACE development and shares responsibility with the Contracting 

Office for the review and approval of eCP’s invoices. 

The overall objective of the audit was to assess the internal controls related to 

the review and approval of ACE contractor invoices. The audit focused on 

two specific questions: (1) Were the procedures, processes, and internal 

controls adequate to verify the accuracy, reliability, and completeness of 

contractor invoices prior to payment? (2) Was the process for evaluating the 

quality of contractor performance and related award and incentive fee 

payments effective? 

CBP’s internal controls for the review and approval of invoices were not 

adequate. Specifically, (1) written guidance describing review procedures 

were not sufficiently detailed, (2) reviewers did not always document the 

review activities performed, and (3) CBP did not sufficiently research the 

causes for issues identified during reviews. Internal controls over the process 

for evaluating contractor performance and related award and incentive fee 

payments were adequate. We recommended CBP streamline and strengthen 

the internal controls over the invoice review process and request the Defense 

Contract Audit Agency (DCAA) to perform an incurred cost audit. CBP 

concurred with the recommendations. 

Background 

CBP receives one eCP invoice per active task order each month. The ACE 

contract is comprised of 21 individual task orders. As of May 5, 2005, 8 task 

orders were active. CBP contracted with Robbins-Gioia to assist in the dayto-day management of ACE contract operations. The Program Office has 

assigned an Acquisition Director to manage each task order. In addition, a 
Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 2

Business Manager from Robbins-Gioia works with each Acquisition Director. 

Together, the Acquisition Director and the Business Manager perform the 

technical review of an invoice. 

The Contracting Office entered into a time and materials contract with 

Stratecon LLC to provide contract administration support services for the 

workload associated with eCP. Stratecon LLC contract services include 

reviewing and evaluating monthly invoices by performing the financial review 

of an invoice for the Contract Officer. 

 

During the initial three days of an invoice review, the Contracting Office 

verifies the arithmetic totals and ensures that the invoice is in the correct 

format. If there is an arithmetic error or the format is incorrect, the 

Contracting Office will return the invoice to eCP. Otherwise, the Contracting 

Office and the Acquisition Directors will perform their respective reviews. 

The Contracting Office staff compiles problems found during the invoice 

reviews into an issues log and provides a copy of the issues log to eCP. After 

receiving eCP’s responses to the issues, the Contracting Office, the Program 

Office, and the Acquisition Director then make the final recommendation for 

approval, suspension, or rejection of payment to the Contracting Officer. 

Based on the recommendation, the Contracting Officer makes a determination 

to reject, accept, or partially pay the invoice. If approved, the Contracting 

Officer prepares an approval letter that is sent together with the invoice and 

supporting documentation to the Indianapolis Finance Center by the 26th day 

from the invoice receipt date. This allows the invoice to be paid within the 30 

days required by the Prompt Payment Act. See appendix C for a detailed 

diagram of the Invoice Procedure Steps. 

The Government Accountability Office (GAO) Standards for Internal Control 

in the Federal Government, dated November 1999, states that internal controls 

are comprised of the plans, methods, and procedures used to meet an 

organization’s mission, goals, and objectives. The procedures should provide 

reasonable assurance that the objectives of the program are accomplished. 

The standards require management to continually assess and evaluate internal 

controls to assure that the control activities being used are effective and 

updated when necessary. The standards also require that all transactions and 

other significant events of the internal control systems be clearly documented, 

and that the documentation be readily available for examination. 

Prior Audits 

DHS and DCAA have a memorandum of understanding that allows CBP to 

request audits from DCAA. However, DCAA audits major contractor systems 

for all federal contracts, not specifically the ACE contract. DCAA conducted 

an incurred cost audit for IBM’s FY 2002 incurred costs. In addition, DCAA 
Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 3

reviewed IBM’s internal controls in 2003 for its purchasing system, the 

budget and planning system, the billing system, and the labor system. All 

DCAA audits concluded that IBM’s internal controls were adequate. 

The Program Office Quality Assurance Team conducted an audit of the 

invoicing process in November 2004, which found issues similar to our audit 

results. Quality assurance audits aid program management in the monitoring 

of ACE processes. The purpose of the audit was to ensure that the invoicing 

process reflected current Program Office policy and that the processes were 

institutionalized and generating their intended value. The quality assurance 

report found that the documented processes had not been updated to reflect 

“how business is currently done.” The report also noted that the documented 

processes and procedures do not include the “low-level details covering the 

day-to-day activities” for the invoicing process. 

Results of Audit 

CBP Review of Invoices 

CBP’s internal controls for the review and approval of invoices were not 

adequate. Specifically, (1) written guidance describing review procedures 

was not sufficiently detailed, (2) reviewers did not always document the 

review activities performed, and (3) CBP did not sufficiently research the 

causes of issues identified during reviews. This occurred because CBP 

management did not adequately monitor invoice review operations. 

Consequently, CBP risks not detecting invoice errors or irregularities. 

CBP’s existing written standard operating procedures for the review and 

approval of contractor invoices were contained in two documents: Invoice 

Review and Approval Procedures and the Invoice Review and Approval 

Process. Together, these documents contained the specific steps for reviewing 

and approving invoices and described the activities, products and staff 

positions that implement the process. The Invoice Review and Approval 

Procedures include one checklist for the financial review and one checklist for 

the technical review. The Contracting Office staff is responsible for 

performing the financial review of invoices and the Program Office 

Acquisition Directors and Business Managers are responsible for performing 

the technical review of invoices. 

Written Guidance 

The standard operating procedures for the verification of five major cost 

elements did not provide reviewers with sufficiently detailed guidance to 

effectively and consistently verify the accuracy, reliability and completeness 
Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 4

of invoices. The five major cost elements reviewed included direct labor 

hours, inventory purchases, billable overhead, general and administrative 

expenses, and fixed contract fee. 

Direct Labor Hours

CBP’s written standard operating procedures for the verification of labor 

hours were incomplete and did not provide sufficient guidance to invoice 

reviewers. In addition, some written procedures were duplicative or could be 

strengthened to be more effective. 

Below are two examples of incomplete written procedures that did not 

adequately describe how to review invoices. 

• Reviewers verified labor hours on an invoice by comparing the 

Customs Labor and Ledger Report to the labor hour details in the 

invoice package. However, the procedures lacked specific instructions 

for how to use the Customs Labor and Ledger Report to verify the 

labor hours on an invoice. The written procedures did not describe the 

methodology, documents, or systems to verify the labor hours on an 

invoice. For example, the procedures did not explain which specific 

sections of the Customs Labor and Ledger Report the reviewer should 

compare to the invoice. 

• The written procedures for the financial and technical review of an 

invoice required the reviewers to verify that the labor charges for IBM 

and subcontractors were not previously billed. The procedures do not 

describe or explain how the reviewer could detect duplicate charges. 

The Contracting Office staff said they would detect duplicate charges 

only “by luck.” This is important since CBP frequently receives 

invoices from eCP that include labor charges for work performed by 

subcontractors six or more months before the invoice date. 

The procedures required both the financial and technical reviewers to 

perform identical steps related to the verification of labor charges. Duplicate 

procedures decrease the effectiveness and efficiency of invoice reviews. 

Examples of identical procedures performed by both the financial and 

technical reviewers include: 

• “Are all labor hour anomalies (i.e. >300 hours and/or prior period 

adjustments of >100 hours) sufficiently explained?” 

• “Is the period of performance unique to all other billings?” 
Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 5

• “Is the period of performance for all labor hours within the contract 

period of performance?” 

 

The procedures required the Contracting Office staff to perform certain 

invoice procedures that were not effective. For example, the procedures 

required the reviewer to verify the labor hours for at least one employee per 

vendor on an invoice. However, some invoices contain labor charges for 

more than 200 employees. In our opinion, verifying the labor hours for only 

one employee per vendor is not sufficient to deter or detect possible errors. 

Selecting larger employee samples would increase the likelihood of deterring 

or detecting errors or possible misuse, help management identify significant 

patterns or trends and make the review of labor hours more effective. 

Inventory Purchases

The Contracting Office staff performed two steps for reviewing inventory 

purchases that enhance accountability of property. These two steps were not 

included in the written guidance. 

• The Contracting Office staff verified the classification of inventory items 

to ensure that accountable property was correctly classified. 

• The Contracting Office staff verified that a copy of the accountable 

property inventory file accompanied all property classified as accountable 

property. 

Billable Overhead 

The Contracting Office staff performed some steps to verify billable overhead. 

However, the written guidance did not describe the procedures required to 

verify billable overhead. For example, the procedures do not - 

• require the verification of overhead calculations. 

• specify the number of IBM employees that the Contracting Office staff is 

required to spot check on an invoice. 

• prescribe a minimum allowable variance between the billable overhead 

cost on the invoice and the cost calculated by the Contracting Office staff 

before reporting the issue. 

• provide guidance or instruction for verifying retroactive adjustments made 

based on estimated and actual overhead rates, and DCAA audits. 

 
Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 6

General and Administrative (G&A) Expenses

CBP reviewers performed steps to verify G&A expenses that needed to be 

included in the procedures, and other steps needed to contain more detail 

guidance to reviewers. Below are examples. 

• CBP routinely verifies the mathematical accuracy of the G&A rate, 

however the procedures did not include this step. 

 

• The procedures did not inform the reviewer that the G&A rate was subject 

to annual revision once the actual G&A rate is determined by using the 

IBM G&A expenses. This would require the reviewer to subsequently 

review G&A costs to ensure that adjustments were made properly. 

• The procedures did not prescribe a minimum allowable variance between 

the Contracting Office staff calculation of G&A and the invoice amount. 

Fixed Contract Fees

The Invoice Review and Approval Procedures document does not contain any 

reference to, or guidance for, the review of fixed fees. Neither the financial 

nor the technical checklist addressed the verification of fixed fees. Fixed fee 

rates ranged from 3% to 7.5% of the total cost on the invoice (except for travel 

costs) in our sample of invoices. The fixed fee for one invoice in our sample 

was $83,548.24. The fixed fee rates are negotiated by task order and are 

described in the negotiation summary. At a minimum, the written procedures 

should: 

• Assign responsibility for the verification of fixed fees to either the 

Program Office or the Contracting Office. 

• Require the reviewer to verify the fixed fee rate on the invoice against the 

negotiation summary. 

• Require the reviewer to determine the applicable formula from the 

negotiation summary for the computation for the fixed fee. 

Documentation of Invoice Reviews 

 

CBP did not always maintain documentation of the work performed in an 

invoice review. Reviewers used the checklists as a guide to reviewing 

invoices but not all reviewers completed and documented the work performed 

on the checklists. Therefore, we could not verify the work performed by 

reviewers or determine whether the control procedures were effective or 
Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 7

consistently applied. The written procedures did not require reviewers to 

document and maintain the work they performed to verify an invoice. 

Completed checklists to document invoice reviews would provide 

management with information on trends and systemic problems. 

The written procedures include a financial review checklist and a technical 

review checklist (See Appendix E, Invoice Checklist). Review checklists 

provide spaces for the reviewer to enter the task order number, contract 

number, invoice number, and invoice date. However, reviewers did not 

complete the checklists and attach them to the invoice maintained in the 

Contracting Office files. Without a completed checklist or other 

documentation showing the work performed by the reviewer, we could not 

determine whether the reviewers effectively verified the accuracy, reliability, 

and completeness of contractor invoices before payment. 

If the reviewers did not identify issues for the issues log, CBP had no record 

of verification procedures that reviewers performed. For example, the 

procedures require the technical reviewers to spot check the purchase of major 

dollar equipment by comparing the item on the invoice to supporting detail 

contained with the invoice. Unless a problem, concern or issue related to the 

purchase of equipment was included in the issues log, no documentation 

existed to prove that the reviewers verified any equipment purchases. At a 

minimum, reviewers should document the specific major dollar equipment 

that was verified. Another example is the verification of labor hours. The 

financial review checklist requires the reviewer to spot check the labor hours 

for one employee per vendor against the labor report. However, there was no 

documentation that reviewers verified labor hours, unless a discrepancy 

between the labor hours on the invoice and the labor hours on the labor report 

was included on the issues log. At a minimum, CBP should have 

documentation of the name of the employee that the reviewer spot-checked 

and verified. 

Research of Issues 

 

CBP did not effectively research eCP’s responses to the issues log. As a 

result, issues found during the invoice reviews were not completely resolved 

and recurred on subsequent invoices. Additionally, CBP could have internally 

resolved some of the issues identified on the issues log without requiring 

eCP’s time and effort. 

Contracting Office staff recorded issues identified during the invoice review 

process on the issues log, which was then forwarded to eCP for explanation. 

Issues included concerns such as, discrepancies between labor hours on the 

invoice and labor hours in the Customs Labor and Ledger report, concerns 

regarding labor overhead rates, and incorrect work packages or computations. 
Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 8

The Contracting Office and the Program Office staff accepted the 

explanations from eCP and closed issues without further verification, 

investigation, or follow-up. The Contracting Office acknowledged that they 

have accepted eCP’s responses to the issues log without additional research 

because there was a "push" to be sure the invoices got processed and paid 

timely. The following three examples identify issues that needed further 

research. 

First, on two separate invoices, the Contracting Office could not verify the 

labor hours for employees using the Customs Labor and Ledger Report and 

included the names on the respective issue log. The eCP response stated that 

the labor hours on the invoice exactly matched the Customs Labor and Ledger 

Report and included an extract of the report as supporting documentation. 

The Contracting Office accepted the response without further verification. 

We asked the Contracting Office to verify eCP’s response for the two 

employees as part of our sample in the testing of the effectiveness of internal 

controls related to labor hours. The Contracting Office could not verify the 

labor hours when comparing the labor hours on the invoice to the Customs 

Labor and Ledger Report. To test the effectiveness of the labor hour 

verification process, we judgmentally selected five employees from 15 

invoices for a total of 75 employees and observed the Contracting Office 

verify their labor hours. The Contracting Office was only able to verify the 

exact number of labor hours for 13 of the 75 employees on the invoice by 

comparing the invoice to a section of the Customs Labor and Ledger Report.

If CBP had verified eCP responses that hours matched back to the Customs 

Labor and Ledger Report, CBP would have detected that they were not using 

the correct section of the report. However, they continued to identify 

differences with the labor hours and post them on the issues log. Research of 

labor hour issues would have detected that CBP procedures to verify labor 

hours were ineffective. 

Second, further research into the cause of the discrepancies in the labor hours 

might have alerted CBP management to an internal control design weakness. 

Specifically, IBM prepares both the invoice and the Customs Labor and 

Ledger Report from the same accounting system, essentially furnishing the 

same information in two different formats (See Appendix D for IBM Systems 

Diagram). The procedure performed by CBP only verifies the consistency 

between the report and the invoice; it does not actually verify that the labor 

hours were worked on this contract. Procedures that are unlikely to detect 

misstatements or errors could add unnecessary cost. 

Third, the Contracting Office staff questioned an overhead calculation for an 

employee on the issues log. The invoice showed that the employee worked 61 

hours during the period January 1 through February 1, 2005. eCP responded 

with a breakdown of how they calculated the overhead amounts. The 
Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 9

breakdown reflected 39 labor hours for 2004 overhead rates and 22 hours for 

2005 overhead rates. The breakdown of their computation supported the 

amount on the invoice, but the Contracting Office staff did not investigate or 

adequately resolve the following problems raised by eCP’s response. 

• If the employee worked 39 hours in 2004, then the period of performance 

on the invoice was incorrect. 

• If the employee worked 39 hours in 2004 and 22 hours in 2005, then the 

Customs Labor and Ledger Report would not support the invoice because 

it would not show 61 hours for the employee during the period January 1 

through February 1, 2005. Either the hours on the invoice were wrong or 

the hours on the Customs Labor and Ledger Report were wrong. 

• If the employee worked the hours in 2004, then the Contracting Office 

staff needed to ensure that they did not pay for those labor hours on a prior 

invoice. 

Conclusion 

The weaknesses in the internal controls over the invoice review process 

increase the risk of improper payments. To strengthen internal controls, CBP 

needs to improve written procedures, better monitor the process, document the 

review activities performed, and research the cause of discrepancies noted 

during the review. This will allow management to ensure that reviewers for 

all task orders effectively and consistently applied invoice review steps. In 

addition, the fact that CBP plans to spend over a billion dollars on ACE over 

the next four years represents an inherent risk for the invoice review process. 

While DCAA incurred cost audits aid in reducing the risk, the last audit 

conducted by DCAA reviewed costs from 2002. 

Recommendations 

 We recommend that: 

1. The Program Office Director streamline and strengthen the internal 

controls over the invoice review process by: 

• eliminating redundant invoice review steps performed during the 

technical and financial reviews, 

• ensuring consistency between reviews of task orders for each cost 

element, 

• adequately researching the causes of problems noted in the issues logs, 
Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 10

• periodically monitoring the invoice review process to assure policies 

and procedures are effectively followed, and 

• requiring that the activities performed in the review of invoices be 

documented and retained with the invoice. 

2. The Contracting Officer should request DCAA to conduct an incurred cost 

audit for the ACE contractor. 

Management Comments and OIG Analysis: 

CBP concurred with the recommendations. DCAA is currently reviewing 

IBM’s CY 2004 incurred costs. On July 20, 2006, CBP updated the Invoice 

Review and Approval Procedure, the Invoice Financial Review Checklist, and 

the Invoice Technical Review Checklist. Additionally: 

• CBP is monitoring invoice review activities to ensure consistency 

between reviews of task orders; 

• CBP is tracking the number and type of questions generated by the 

invoice review process to identify trends across task orders; 

• CBP has mandated that all associated invoice review documentation, 

including each checklist, be completed and retained in an invoice 

archive; and 

• CBP has appointed a government lead for ACE invoicing oversight, 

who meets with IBM’s invoicing team on a bi-weekly basis to resolve 

invoicing issues, including the causes of problems noted in the issues 

logs. 

The actions taken by CBP satisfy the intent of our recommendations. 

Therefore, the recommendations in this report are considered closed. 

Award and Incentive Fees 

CBP adequately followed existing procedures and policies for monitoring, 

evaluating and measuring contractor performance for payment of award fees 

and product quality for payment of incentive fees. Our audit focused on the 

application of the measurement criteria and did not include assessing CBP’s 

measurement criteria or validating CBP’s performance measurements. 

The chart below summarizes payments through March 2005. See Appendix F 

for details. 

Available (millions) Percent 

Amount Earned Forfeit Paid

Award Fee (Periods 1-5) $18.4 $4.0 $14.4 22 % 

Incentive Fee (30 incentives) 13.5 11.0 2.5 81 % 
Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 11

The Award fee amounts were paid based on performance ratings. The 

contractor’s performance evaluation reports for five-performance rating 

periods did contain adequate justifications to support the contractor’s ratings. 

The general performance ratings include program management, cost, and 

technical quality. CBP used a consultant to assist in managing the Award Fee 

process for evaluating contractor’s performance. The consultant gathered 

comments and tallied the rating results from Acquisition Directors, task order 

staff, program level personnel and CBP management. Using the results, the 

consultant develops the performance evaluation report for the Performance 

Evaluation Board and the Fee Determination Official. 

CBP properly tracked, monitored, and measured incentive fees in accordance 

with the negotiated terms and verifiable measurement results. Incentive fees 

may include, but are not limited to, specific system performance metrics, 

milestones, service level, and cost savings. CBP used incentive fees to reward 

the contractor for providing quality deliverables for specific task orders, that 

CBP determined needed to be accomplished or sustained in order to improve 

the program. 
Appendix A 

Purpose, Scope and Methodology

Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 12

The overall objective of the audit was to assess the internal controls related to 

the review and approval of ACE contractor invoices. The audit focused on 

two specific questions: (1) Were the procedures, processes, and internal 

controls adequate to verify the accuracy, reliability, and completeness of 

contractor invoices prior to payment? (2) Was the process for evaluating the 

quality of contractor performance and related award and incentive fee 

payments effective? 

This audit was performed at various DHS locations within the Washington, 

D.C. area. During our audit, we selected and reviewed 15 eCP invoices from 

December 2004 to April 2005 with a total value of $22.3 million and three (3) 

Robbins-Gioia invoices from March 2005 to May 2005 with a total value of 

$3.9 million. The audit included reviewing the Program Office policies, 

procedures, and controls, testing the controls by sampling 15 eCP invoices, 

and evaluating the documentation of the results of invoice reviews and 

approvals. 

We assessed CBP’s internal controls for the invoice review and approval 

process. The internal controls for the review of an invoice serve to protect the 

Government’s interest by ensuring that payment is commensurate with the 

work performed. We performed these steps to assess internal controls: 

• evaluated CBP’s policies and procedures used by reviewers for 

relevant internal controls, 

• observed invoice reviews performed by CBP for five major cost 

elements, 

• evaluated documentation supporting reviews to determine if 

transactions were properly documented, and 

• reviewed documentation provided by the contractor to support 

invoiced amounts 

Our examination specifically tested the invoice review and approval system's 

internal control procedures associated with the following control activities: 

• Management Reviews for Actual Performance 

• Policies and Procedures 

• Implementation of Policies and Procedures 

• Accurate and Timely Recording of Transactions and Events 

• Appropriate Documentation of Transactions and Internal Control 

We evaluated the Program Office invoice and approval system using the 

applicable requirements contained in the Federal Acquisition Regulation, and 

Standards for Internal Controls in the Federal Government. 
Appendix A 

Purpose, Scope and Methodology

Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 13

We reviewed the pertinent plans and documents related to the design, 

development, implementation, documentation and effectiveness of the ACE 

Invoice Review Process, including: 

• Invoice Review and Approval Process Version 1.0 

• Invoice Review and Approval Procedure Version 3.0 

• Funds Management Process Version 1.0 

• eCP Invoicing Process Version 1.2 

• Change Request Process 

• eCP ACE Contract 

• Stratecon Contract Requirements 

As of May 5, 2005, 21 task orders had been issued for ACE, of which eight 

were active. We judgmentally selected three of the eight task orders based on 

the following criteria: 

• One Task Order (TO 17) where a portion of the invoice was 

disallowed. 

• The highest total dollar amount on the most recent invoices (TO 19) 

• A task order related to the next ACE Release, Release 5 (TO 21) 

We gathered data on the invoice review processes and procedures through 

structured interviews, document analysis, and observation of operations. We 

selected the 5 most recently processed and paid invoices for each of the 3 task 

orders to test the effectiveness of controls for General and Administrative 

Fees, Overhead Rate and Fixed Fees. 

To test the effectiveness of the control procedure for the verification of labor 

hours, we judgmentally selected five (5) employees from each of the 15 

invoices for 75 employees. There were 32 IBM employees and 43 

subcontractor employees. 

Inventory purchases are processed through task order 19. To test the 

effectiveness of the control procedures for the verification of inventory 

purchases, we examined inventory items on the five invoices which contained 

inventory purchases. 

We conducted our audit between May 2005 and May 2006 under the authority 

of the Inspector General Act of 1978, as amended, and according to generally 

accepted government auditing standards. 
Appendix B 

Management Comments

Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 14

x 
Appendix B 

Management Comments

Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 15
Appendix B 

Management Comments

Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 16
Appendix B 

Management Comments

Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 17
Appendix C 

Invoice Procedure Steps 

Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 18
Appendix D 

IBM System Diagram

Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 19

The following diagram illustrates the two databases that feed labor hour 

information to the IBM accounting system and the two outputs. 

Each invoice from eCP includes documentation that provides details on the 

charges for IBM and subcontract labor. The detailed documentation consists 

of tables that identify the employee, the workpackage (assignment), period of 

performance, and number of hours worked during the period of performance. 

Additionally, the IBM accounting system produces a weekly labor report 

entitled the Customs Labor and Ledger Report and IBM posts the report on 

the CBP intranet. This labor report details the hours charged by week to the 

ACE program by employee name and workpackage (assignment). 

CBP reviewers perform spot checks of labor hours on an invoice by 

judgmentally selecting an IBM or subcontract employee from the detailed 

documentation in the invoice package and comparing the number of hours on 

the invoice to the number of labor hours in the Customs Labor and Ledger 

Report. 

IBM Labor 

Claiming 

Database

Subcontract 

Labor 

Claiming 

Database 

 ACCOUNTING 

SYSTEM 

Invoice 

Including IBM and 

Subcontractor labor 

backup 

Customs Labor and 

Ledger Report 

Outputs
Appendix E 

Invoice Review Checklist 

Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 20
Appendix E 

Invoice Review Checklist 

Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 21
Appendix F 

Award and Incentive

Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 22

*Includes rollover amounts from previous periods 

Completed Incentives

Task Percent Percent

Order Available Earned Not Paid Paid Not Paid

 

4 $ 484,488 $ 484,488 $ - 100.0% 0.0%

8 3,263,898 2,962,615 301,283 90.8% 9.2%

9 818,931 614,198 204,733 75.0% 25.0%

16 2,144,719 1,797,388 347,331 83.8% 16.2%

17 2,747,544 2,546,311 201,233 92.7% 7.3%

17.1 27,120 27,120 - 100.0% 0.0%

19 3,689,010 2,210,616 1,478,394 59.9% 40.1%

20 112,082 112,082 - 100.0% 0.0%

21 239,582 239,582 - 100.0% 0.0%

 

 $ 13,527,374 $ 10,994,400 $ 2,532,974 81.3% 18.7%

As of March 2005 

 AWARD FEE HISTORY 

Award Available 

Period Rating Pool * Awarded Forfeit

 

1 74% $1,000,000 $740,000 $260,000 

2 Failing 3,000,000 - 3,000,000 

2 and 3 56% 8,500,000 - 8,500,000 

4 64% 2,100,000 - 2,100,000 

5 87% 3,800,000 3,300,000 500,000 

 

Totals $18,400,000 $4,040,000 $14,360,000 

 22% 78% 
Appendix G 

Major Contributors to this Report 

Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 23

George Tabb, Director, Trade Operations and Security Division 

Gene Wendt, Audit Manager 

Carlos Berrios, Auditor In Charge 

David Porter, Auditor 

DeWayne Bailey, Auditor 

Michael Lugo, Auditor 
Appendix H 

Report Distribution 

Audit of Management Controls Over Automated Commercial Environment (ACE) Contractor Billings

Page 24

Department of Homeland Security

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chief of Staff 

Assistant Secretary for Policy 

Assistant Secretary for Public Affairs 

Assistant Secretary for Legislative and Intergovernmental Affairs 

General Counsel 

Executive Secretary 

Chief Privacy Officer 

Director, GAO/OIG Liaison 

Customs and Border Protection

Commissioner, Bureau of Customs and Border Protection 

CBP OIG Liaison 

Director, Cargo Systems Program Office 

ACE Contract Officer 

Office of Management and Budget

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress

Congressional Oversight and Appropriations Committees, as appropriate 

 
Appendix H 

Report Distribution 

DO NOT DISTRIBUTE WITHOUT OIG AUTHORIZATION

Draft Report 

Payments to ACE Contractor 

Page 25

 

 

Additional Information and Copies 

To obtain additional copies of this report, call the Office of Inspector General 

(OIG) at (202) 254-4100, fax your request to (202) 254-4285, or visit the OIG 

web site at www.dhs.gov/oig. 

OIG Hotline 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of 

criminal or noncriminal misconduct relative to department programs or 

operations, call the OIG Hotline at 1-800-323-8603; write to DHS Office of 

Inspector General/MAIL STOP 2600, Attention: Office of Investigations - 

Hotline, 245 Murray Drive, SW, Building 410, Washington, DC 20528, or email 

DHSOIGHOTLINE@dhs.gov. The OIG seeks to protect the identity of each 

writer and caller.