GAO 

United States Government Accountability Office

Report to the Committee on Homeland 

Security and Governmental Affairs, 

U.S. Senate 

DCAA AUDITS 

Widespread Problems 

with Audit Quality 

Require Significant 

Reform 

September 2009 

GAO-09-468 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

September 2009

DCAA AUDITS

Widespread Problems with Audit Quality Require 

Significant Reform 

Highlights of GAO-09-468, a report to the 

Committee on Homeland Security and 

Governmental Affairs, U.S. Senate 

The Defense Contract Audit 

Agency (DCAA) under the 

Department of Defense (DOD) 

Comptroller plays a critical role in 

contractor oversight by providing 

auditing, accounting, and financial 

advisory services in connection 

with DOD and other federal agency 

contracts and subcontracts. 

Last year, GAO found numerous 

problems with DCAA audit quality 

at three locations in California, 

including the failure to meet 

professional auditing standards. 

This report addresses audit quality 

issues at DCAA offices nationwide. 

GAO was asked to (1) conduct a 

broad assessment of DCAA’s 

management environment and 

audit quality assurance structure, 

(2) evaluate DCAA actions to date 

to correct previously identified 

problems, and (3) identify potential 

legislative and other actions for 

improving DCAA effectiveness and 

independence. To achieve these 

objectives, GAO analyzed DCAA’s 

mission, strategic plan, audit 

policies, and quality assurance 

program; conducted interviews; 

reviewed selected audits at DCAA 

offices; and analyzed legislative 

and other actions. 

What GAO Recommends

GAO makes 17 recommendations 

to DOD and the DOD Inspector 

General (IG) to improve DCAA’s 

management environment, audit 

quality, and oversight. GAO also 

discusses matters that Congress 

should consider to enhance the 

effectiveness and independence of 

DCAA contract audits. DOD and 

DOD IG generally agreed with 

GAO’s recommendations, 

concurring with all but two. 

GAO found audit quality problems at DCAA offices nationwide, including 

compromise of auditor independence, insufficient audit testing, and 

inadequate planning and supervision. GAO’s conclusions stem from a review 

of 69 audit assignments supporting contract award and administrative 

decisions; an assessment of DCAA’s audit quality assurance structure, which 

found similar audit quality problems but gave satisfactory ratings to deficient 

audits; and DCAA’s rescission of 80 problem audit reports. The rescinded 

audits supported decisions on pricing and contract awards and impacted the 

planning and reliability of hundreds of other DCAA audits, representing 

billions of dollars in DOD expenditures. GAO findings include the following. 

Selected Details of Audits GAO Reviewed 

Contractor Audit Significant case study issues

Research and 

development 

grantee 

Billing 

system 

• DCAA auditors spent 530 hours to support an audit of a 

nonexistent billing system and reported adequate system controls. 

• Instead, DCAA should have relied on the Single Audit Act report on 

the grantee’s cash management system. DCAA agrees. 

Combat 

systems 

Billing 

system 

• This was a new system and therefore high risk, but auditors 

deleted key audit steps related to contractor policies and internal 

controls over progress payments without explanation. 

• One auditor told GAO he did not perform detailed tests because 

“the contractor would not appreciate it.” 

• DCAA allowed the contractor 7 months to address 6 significant 

deficiencies, dropping 2 and downgrading the other 4.

• DCAA rescinded this audit report following GAO’s review. 

Iraq 

reconstruction

Accounting 

system 

• Contractor objected to draft report, which included 8 significant 

deficiencies in the accounting system. 

• Auditors dropped 5 significant deficiencies and downgraded 3 

others to suggestions to improve without performing new work. 

• Supervisory auditors directed audit staff to delete some audit 

documents, generate others, and in one case, copy the signature 

of a prior supervisor onto new documents making it appear that the 

prior supervisor had approved a revised risk assessment. 

• Supervisory auditor who approved altered documents was later 

promoted to western region quality assurance manager, where he 

served as quality control check over thousands of audits. 

Source: GAO. 

GAO found DCAA’s management environment and quality assurance structure 

were based on a production-oriented mission that put DCAA in the role of 

facilitating DOD contracting without also protecting the public interest. DCAA 

has taken several positive steps. However, DOD and DCAA have not yet 

addressed fundamental weaknesses in DCAA’s mission, strategic plan, 

metrics, audit approach, and human capital practices that had a detrimental 

effect on audit quality. 

To improve DCAA oversight, the DOD Comptroller requested Defense 

Business Board and “tiger team” reviews and established a DCAA Oversight 

Committee. In addition, in the short-term, Congress could provide DCAA with 

certain legislative protections and authorities similar to those available to IGs. 

In the longer term, Congress may wish to consider organizational changes to 

elevate DCAA to a component agency reporting to the Deputy Secretary or to 

establish an independent governmentwide contract audit agency. 

View GAO-09-468 or key components.

For more information, contact Gregory Kutz at 

(202) 512-6722 or kutzg@gao.gov. 
Page i GAO-09-468

Contents 

Letter 1

Background 5 

Nationwide Audit Quality Problems Are Rooted in DCAA’s Poor 

Management Environment 14 

DCAA Has Made Progress, but Correcting Fundamental Problems 

in Agency Culture That Have Impacted Audit Quality Will 

Require Sustained Leadership 42 

Legislative and Other Actions To Improve DCAA’s Effectiveness 

and Independence 61 

Conclusions 69 

Recommendations for Executive Action 70 

Matters for Congressional Consideration 72 

Agency Comments and Our Evaluation 73 

Appendix I Internal Control System Audits Did Not Meet 

Professional Standards 83 

Appendix II DCAA Does Not Perform Sufficient Work to Identify 

and Collect Contractor Overpayments 100 

Appendix III Objectives, Scope, and Methodology 105 

Appendix IV Comments from the Department of Defense 113 

 

Appendix V Comments from the Department of Defense Inspector 

General 143 

Tables 

Table 1: Examples of DCAA Audit and Nonaudit Services 10 

Table 2: Summary of Five Selected Internal Control Audits 20 

Table 3: Summary of Five Selected Cost-Related Assignments 28 

Table 4: Summary of Selected DCAA Audit Quality Review Results 34 

 DCAA Audit Environment 
Table 5: GAGAS Noncompliance on 37 Selected Audits of 

Contractor Controls 84 

Table 6: Case Studies of Problem DCAA Cost-Related Assignments 103 

Table 7: Summary of DCAA Audits Reviewed for GAGAS 

Compliance 107 

Table 8: Summary of DCAA Cost-Related Audits Reviewed 108 

Figures 

Figure 1: DCAA Opinions on Contractor Internal Control Systems 

Audits 18 

Figure 2: Comparison of DOD Contract Obligations and DCAA 

Workforce for Fiscal Years 2002 through 2008 53 

Figure 3: DCAA Questioned Costs and Amounts Sustained by 

Contracting Officers 102 

Abbreviations 

AICPA American Institute of Certified Public Accountants 

AT AICPA Statements on Attestation Standards 

AT&L Acquisition, Technology, and Logistics 

APO Audit Policy and Oversight (a Defense Inspector General 

 organization) 

AU AICPA Statements on Auditing Standards 

CAS Cost Accounting Standards 

CAM Contract Audit Manual, also referred to as the DCAA Contract 

Audit Manual, or DCAM 

CFO Chief Financial Officer 

COSO Committee on Sponsoring Organizations 

DBB Defense Business Board 

DCAA Defense Contract Audit Agency 

DCAM DCAA Contract Audit Manual 

DCMA Defense Contract Management Agency 

DFARS Defense Federal Acquisition Regulation Supplement 

DFAS Defense Finance and Accounting Service 

DFMR Defense Financial Management Regulation

DOD Department of Defense 

DPAP Director of Defense Procurement Policy 

FAO field audit office 

FAR Federal Acquisition Regulation 

Page ii GAO-09-468 DCAA Audit Environment
FLA Financial Liaison Advisor

FMR Financial Management Regulation, also referred to as the 

Defense Financial Management Regulation, or DFMR 

GAGAS generally accepted government auditing standards

GAS Government Auditing Standards 

GPRA Government Performance and Results Act 

GS General Schedule

IG Inspector General 

IGDH Inspector General, Defense Handbook 

OIG Office of Inspector General 

PCIE President’s Council on Integrity and Efficiency, renamed the 

Council of the Inspectors General on Integrity and Efficiency 

SAS AICPA Statements on Auditing Standards 

SES Senior Executive Service

SIGIR Special Inspector General for Iraq Reconstruction 

SSAE AICPA Statements on Standards for Attestation Engagements

USC United States Code 

USD Under Secretary of Defense 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately. 

Page iii GAO-09-468 DCAA Audit Environment
Page 1 GAO-09-468

 

United States Government Accountability Office

Washington, DC 20548 

 

September 23, 2009 

The Honorable Joseph I. Lieberman 

Chairman 

The Honorable Susan M. Collins 

Ranking Member 

Committee on Homeland Security and 

 Governmental Affairs 

United States Senate 

The Honorable Claire C. McCaskill 

Chairman 

Subcommittee on Contracting Oversight 

Committee on Homeland Security and 

 Governmental Affairs 

United States Senate 

This report addresses audit quality problems and independence issues at 

the Defense Contract Audit Agency (DCAA). In a September 2008 hearing 

before the Committee, we testified1

 that DCAA failed to meet professional 

audit standards at three locations in California. Specifically, we found that 

the audit documentation for 14 selected audits at two locations did not 

support reported opinions, that DCAA supervisors dropped findings and 

changed audit opinions without adequate audit evidence for their changes, 

and that sufficient audit work was not performed to support audit 

opinions and conclusions. Further, we found that contractor officials and 

the Department of Defense (DOD) contracting community improperly 

influenced the audit scope, conclusions, and opinions of several audits, 

including forward pricing audits at a third location—a serious 

independence issue. During our investigation, DCAA managers took 

actions against their staff at two locations that served to intimidate 

auditors and create an abusive work environment. For example, we 

learned of verbal admonishments, reassignments, and threats of 

disciplinary action against auditors who spoke with or contacted our 

investigators, DOD investigators, or DOD contracting officials. 

1

 GAO, DCAA Audits: Allegations That Certain Audits at Three Locations Did Not Meet 

Professional Standards Were Substantiated, GAO-08-993T (Washington, D.C.: Sept. 10, 

2008). 

 DCAA Audit Environment 
 

At the time of the September 2008 hearing, we were conducting a broad 

assessment of DCAA’s management environment and audit quality 

assurance structure at DCAA offices nationwide. Given the evidence 

presented at this hearing, you requested that we expand our ongoing 

assessment. This report therefore presents (1) an assessment of DCAA’s 

management environment and quality assurance structure; (2) an analysis 

of DCAA’s corrective actions in response to our July 2008 report,2

 the 

Under Secretary of Defense (Comptroller/Chief Financial Officer)3

 “tiger 

team” review,4

 and the Defense Business Board study;5 and (3) potential 

legislative and other actions that could improve DCAA’s effectiveness and 

independence. 

To assess DCAA’s overall management environment and quality assurance 

structure, we analyzed DCAA’s mission statement and strategic plan, 

performance metrics, policies and audit guidance, and system of quality 

control. We also reviewed audit documentation for selected audits at 

certain field audit offices (FAO) in each of DCAA’s five regions for 

compliance with generally accepted government auditing standards 

(GAGAS)6

 and other applicable standards. We selected 37 audits of 

contractor internal control systems performed by seven geographically 

disperse DCAA field offices within the five DCAA regions during fiscal 

years 2004 through 2006.7

 These were the most recently completed fiscal 

years at the time we initiated our audit. Our approach focused on DCAA 

offices that reported predominately adequate, or “clean,” opinions on 

audits of contractor internal controls over cost accounting, billing, and 

 

2

 GAO, DCAA Audits: Allegations That Certain Audits at Three Locations Did Not Meet 

Professional Standards Were Substantiated, GAO-08-857 (Washington, D.C.: July 22, 2008). 

3

 Hereafter referred to as the DOD Comptroller/CFO. 

4

 Under Secretary of Defense—Comptroller, Memorandum for Director Defense Contract 

Audit Agency, Subject: Implementation of Corrective Actions, (Washington, D.C.: Aug. 20, 

2008). 

5

 Defense Business Board, Report to the Secretary of Defense: Independent Review Panel 

Report on the Defense Contract Audit Agency, October 2008. 

6

 GAO, Generally Accepted Government Auditing Standards, GAO-03-673G (Washington, 

D.C.: June 2003) and GAO-07-731G (Washington, D.C.: July 2007). 

7

 In the case of follow-up audits, we also reviewed the documentation for the previous audit 

to gain an understanding of the scope of work and deficiencies identified in the prior audit. 

Page 2 GAO-09-468 DCAA Audit Environment
 

cost estimating systems issued in fiscal years 2005 and 2006.8 We selected 

DCAA offices that report predominately adequate opinions on contractor 

systems and related internal controls because contracting officers rely on 

these opinions for three or more years to make decisions on pricing and 

contract awards, and payment. For example, audits of estimating system 

controls support negotiation of fair and reasonable prices.9

 Also, the FAR 

requires contractors to have an adequate accounting system prior to award 

of a cost-reimbursable or other flexibly priced contract.10 Billing system 

internal control audit results support decisions to authorize contractors to 

submit invoices directly to DOD and other federal agency disbursing 

offices for payment without government review.11 In addition, DCAA uses 

the results of internal control audits to assess risk and plan the nature, 

extent, and timing of tests for other contractor audits and other 

assignments. When a contractor has received an adequate opinion on its 

systems and related controls, DCAA would assess the risk for subsequent 

internal control and cost-related audits as low and would perform less 

testing on these audits. Although our selection of the seven offices and 37 

internal control audits was not statistical, it represented about 9 percent of 

the total 76 DCAA offices that issued audit reports on contractor internal 

controls and nearly 18 percent of the 40 offices that issued 8 or more 

reports on contractor internal controls during fiscal year 2006. Of the 37 

internal control audits we reviewed, 32 reports were issued with adequate 

opinions and 5 reports were issued with inadequate-in-part opinions. 

At the same seven DCAA field offices, we selected an additional 32 paid 

voucher, overpayment, request for equitable adjustment, and incurred cost 

assignments that were completed during fiscal years 2004 through 2006 for 

review of supporting documentation to determine whether DCAA auditors 

were identifying and reporting contractor overpayments and billing 

 

8

 In selecting the seven DCAA offices, we considered a 2-year history of internal control 

audit results. The seven DCAA offices we selected reported adequate opinions on 89 

percent or more of the internal control reports they issued during fiscal year 2006. During 

fiscal year 2005, 4 of the 7 offices reported adequate opinions in 85 percent or more of the 

internal control reports they issued, and the other 3 offices issued adequate opinions in 50 

to 69 percent of the internal control audit reports they issued. 

9

 DCAA, Contract Audit Manual (CAM) 5-1202.1a and Defense Federal Acquisition 

Regulation Supplement (DFARS) 215.407-5. 

10 FAR §§ 16.104(h) and 16.301-3(a)(1). 

11 FAR § 42.101 and DFARS § 242.803. 

Page 3 GAO-09-468 DCAA Audit Environment
 

errors.12 In total, we reviewed 69 DCAA audits and cost-related 

assignments.13 To address our second objective, we assessed the status 

and analyzed several key actions that DCAA initiated as a result of our 

earlier investigation, including changes in performance metrics and policy 

and procedural guidance, as well as DCAA efforts in response to DOD 

Comptroller/CFO and Defense Business Board14 recommendations. To 

achieve our third objective to identify potential legislative and other 

actions that could improve DCAA’s effectiveness and independence, we 

considered DCAA’s current role and responsibilities; the framework of 

statutory authority for auditor independence in the Inspector General Act 

of 1978, as amended;15 best practices of leading organizations that have 

made cultural and organizational transformations; our past work on DCAA 

organizational alternatives; GAGAS criteria for auditor integrity, 

objectivity, and independence; and GAO’s Standards for Internal Control 

In the Federal Government16 on managerial leadership and oversight. 

Throughout our audit, we met with the DCAA Director and DCAA 

headquarters policy, quality assurance, and operations officials and DCAA 

region and FAO managers, supervisors, and auditors. We also met with 

DOD Office of Inspector General (OIG) auditors responsible for DCAA 

audit oversight and DOD OIG hotline office staff. We conducted this 

performance audit from August 2006 through December 2007, at which 

time we suspended this work to complete our investigation of hotline 

complaints regarding audits performed at three DCAA field offices. We 

resumed our work on this audit in October 2008 and performed additional 

 

12 Contractor overpayments can occur as a result of errors made by paying offices, such as 

duplicate payments and payments in excess of amounts billed, and contractor billing 

errors, such as using the wrong overhead rate, failing to withhold designated amounts on 

progress payments, duplicate billings, or billing for unallowable cost. Recoveries of 

overpayments can be accomplished through refunds, subsequent billing offsets, or other 

adjustments to correct billing errors. 

13 Although we selected 73 assignments for review, two internal control assignments were 

assist audits and two cost related assignments were not completed assignments. As a 

result, we did not consider these four assignments in our analysis, and we discuss the 

results of our analysis of the 69 completed assignments that we reviewed. 

14 On August 19, 2008, at the request of the DOD Defense, Comptroller, the Deputy 

Secretary of Defense established an independent review panel under the Defense Business 

Board (DBB) to review DCAA operations and make recommendations for improvements. 

15 Codified in an appendix to Title 5 of the United States Code (hereafter 5 U.S.C. App.). 

16 GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 

(Washington, D.C.: November 1999). 

Page 4 GAO-09-468 DCAA Audit Environment
 

work through mid-September 2009 to evaluate DCAA’s quality assurance 

program during fiscal years 2007 and 2008, assess DCAA corrective actions 

on identified audit quality weaknesses, and consider legislative and 

organizational placement options. During our assessment of DCAA 

corrective actions and analysis of legislative and organizational placement 

options for DCAA, we met with the former DOD Comptroller/CFO to 

discuss plans for Office of Comptroller/CFO and Defense Business Board 

reviews, and we continued to meet with and obtain information from the 

new DOD Comptroller/CFO and his staff. We also met with Comptroller’s 

new DCAA Oversight Committee, which includes the Auditors General of 

the Army, the Navy, and the Air Force; the DOD Director of Defense 

Procurement and Acquisition Policy; and the DOD Deputy General 

Counsel for Acquisition. We obtained DOD and DOD OIG comments on a 

draft of this report. DOD and DOD IG comments are summarized in the 

Agency Comments and Our Evaluation section of this report. DOD 

comments are reprinted in appendix IV and DOD OIG comments are 

reprinted in appendix V. We conducted our audit in accordance with 

generally accepted government auditing standards. Those standards 

require that we plan and perform the audit to obtain sufficient, appropriate 

evidence to provide a reasonable basis for our findings and conclusions 

based on our audit objectives. We believe that the evidence obtained 

provides a reasonable basis for findings and conclusions based on our 

audit objectives. We performed our investigative procedures in 

accordance with quality standards set forth by the Council of the 

Inspectors General on Integrity and Efficiency (formerly the President’s 

Council on Integrity and Efficiency). A detailed discussion of our 

objectives, scope, and methodology is included in appendix III. 

DOD contract management continues to be a high-risk area for the 

government.17 With hundreds of billions of taxpayer dollars at stake, 

strong controls are needed to provide reasonable assurance that contract 

funds are not lost to fraud, waste, abuse, and mismanagement. Downsizi

of contract administration personnel during the 1990s coupled wit

increased contract spending since 2000 have exacerbated the risks 

associated with DOD contract management. Our work continues to 

Background 

ng 

h 

 

17 GAO, High-Risk Series: An Update, GAO-09-271 (Washington, D.C.: January 2009). 

Page 5 GAO-09-468 DCAA Audit Environment
 

identify significant problems with federal agency contract payments18 and 

contract management.19

DCAA is charged with a critical role in DOD contractor oversight by 

providing auditing, accounting, and financial advisory services in 

connection with the negotiation, administration, and settlement of 

contracts and subcontracts. DCAA also performs contract audit services 

and payment reviews for other federal agencies, as requested, on a fee-forservice basis. DCAA contract audit services are intended to be a key 

control to help assure that prices paid by the government for needed 

goods and services are fair and reasonable and that contractors are 

charging the government in accordance with applicable laws, regulations 

(e.g., Federal Acquisition Regulation (FAR) and Defense Federal 

Acquisition Supplement (DFARS), standards (e.g., Cost Accounting 

Standards (CAS)), and contract terms. 

DCAA is headed by a director who reports to the Under Secretary of 

Defense (Comptroller/CFO). DCAA’s placement provides the DOD 

Comptroller/CFO with access to financial information on defense 

contracts and allows the Comptroller/CFO to make this information 

available to the Secretary and Deputy Secretary of Defense. In addition, it 

permits the Comptroller/CFO to elevate policy issues concerning the 

scope of DCAA’s authority and level of resources. The DCAA Director is 

 

18 GAO, Global War on Terrorism: DOD Needs to More Accurately Capture and Report the 

Costs of Operation Iraqi Freedom and Operation Enduring Freedom, GAO-09-302 

(Washington, D.C.: Mar. 17, 2009); Centers for Medicare and Medicaid Services: Internal 

Control Deficiencies Resulted in Millions of Dollars of Questionable Contract Payments, 

GAO-08-54 (Washington, D.C.: Nov. 15, 2007); Defense Contract Management: DOD’s Lack 

of Adherence to Key Contracting Principles on Iraq Oil Contract Put Government 

Interests at Risk, GAO-07-839 (Washington, D.C.: July 31, 2007); Hanford Waste Treatment 

Plant: Department of Energy Needs to Strengthen Controls over Contractor Payments 

and Project Assets, GAO-07-888 (Washington, D.C.: July 20,2007); Iraq Contract Costs: 

DOD Consideration of Defense Contract Audit Agency’s Findings, GAO 06-1132 

(Washington, D.C. Sept. 25, 2006); Department of Energy, Office of Worker Advocacy: 

Deficient Controls Led to Millions of Dollars in Improper and Questionable Payments to 

Contractors, GAO-06-547 (Washington, D.C.: May 31, 2006); and Federal Bureau of 

Investigation: Weak Controls over Trilogy Project Led to Payment of Questionable 

Contractor Costs and Missing Assets, GAO-06-306 (Washington, D.C.: Feb. 28, 2006). 

19 GAO, Defense Acquisitions: Assessments of Selected Weapon Programs, GAO-09-326SP 

(Washington, D.C.: Mar. 30, 2009); Defense Management: Actions Needed to Overcome 

Long-standing Challenges with Weapon Systems Acquisition and Service Contract 

Management, GAO-09-362T (Washington, D.C.: Feb. 11, 2009); and Defense Acquisitions: 

DOD’s Increased Reliance on Service Contractors Exacerbates Long-standing Challenges, 

GAO-08-621T (Washington, D.C.: Jan. 23, 2008). 

Page 6 GAO-09-468 DCAA Audit Environment
 

responsible for day-to-day management of DCAA, development of strategic 

plans, audit guidance and procedures, and the quality of DCAA’s audit 

services. DCAA’s Contract Audit Manual (CAM)20 prescribes the 

standards, policies, and techniques to be followed by DCAA personnel in 

conducting contract audits. DCAA emphasizes and supplements CAM 

guidance through policy memorandums and other written notices, as well 

as through training and oral communications. 

The IG Act gives the DOD IG broad responsibilities to provide policy 

direction for and to conduct, supervise, and coordinate audits and 

investigations in DOD and in contractor operations, if warranted. DOD IG 

duties pertaining to DCAA include (1) providing policy direction for all 

DOD audits; (2) investigating fraud, waste, and abuse uncovered as a 

result of audits; (3) monitoring and evaluating adherence by all DOD 

auditors to audit policies, procedures, and standards; and (4) requesting 

assistance as needed from other auditors in DOD. As part of its audit 

policy and oversight responsibilities, the DOD IG reviews DCAA’s system 

of audit quality control on a 3-year basis that is intended to meet the 

requirements under GAGAS for a peer review. 

DCAA History and 

Organizational Structure 

Audits of military contracts can be traced back to at least the World War I 

era. Initially, the various branches of the military had their own contract 

audit function and associated instructions and accounting rulings. 

Contractors and government personnel recognized the need for 

consistency in both contract administration and audit. The Navy and the 

Army Air Corps made the first attempt to perform joint audits in 1939. By 

December 1942, the Navy, the Army Air Corps, and the Ordnance 

Department had established audit coordination committees for selected 

areas where plants were producing different items under contracts for 

more than one service. On June 18, 1952, the three military services jointly 

issued a contract audit manual that later became the DCAA CAM. 

In May 1962, Secretary of Defense Robert S. McNamara instituted “Project 

60” to examine the feasibility of centrally managing the field activities 

 

20 DCAA, Contract Audit Manual (CAM), DCAAM 7640.1. 

Page 7 GAO-09-468 DCAA Audit Environment
 

concerned with contract administration and audit.21 An outcome of this 

study was the decision to establish a single contract audit capability within 

DOD and DCAA was established on June 8, 1965.22 At that time, DCAA’s 

mission to perform all necessary contract audits for DOD and provide 

accounting and financial advisory services regarding contracts and 

subcontracts to all DOD components responsible for procurement and 

contract administration was established. The former Deputy Comptroller 

of the Air Force was selected as the DCAA Director and the former 

Director of Contract Audit for the Navy, was selected as the Deputy 

Director. DCAA was placed under management control of the Under 

Secretary of Defense (Comptroller), where it remains today. 

DCAA consists of a headquarters office at Fort Belvoir, Virginia, and six 

major organizational components—a field detachment office, which 

handles audits of classified contracting activity, and five regional offices 

within the United States. The regional offices manage field audit offices 

(FAO), which are identified as branch offices, resident offices, or 

suboffices. Resident offices are located at larger contractor facilities in 

order to facilitate DCAA audit work. In addition, regional office directors 

can establish suboffices as extensions of FAOs to provide contract audit 

services more economically. A suboffice depends on its parent FAO for 

release of audit reports and other administrative support. In total, there 

are more than 300 FAOs and suboffices throughout the United States and 

overseas. During fiscal year 2008, DCAA employed about 3,600 auditors at 

more than 300 FAOs throughout the United States, Europe, the Middle 

East, and in the Pacific to perform audits and provide nonaudit services in 

support of contract negotiations related to approximately 10,000 

contractors. 

DCAA Audit and Nonaudit 

Services 

DCAA’s mission encompasses both audit and nonaudit services in support 

of DOD contracting and contract payment functions. FAR subpart 42.1, 

“Contract Audit Services,” and DOD Directive 5105.36, Defense Contract 

 

21 Project 60 also resulted in consolidation of the military services’ contract management 

activities under the Defense Contract Management Agency (DCMA), formerly the Defense 

Contract Management Command (DCMC) within the Defense Logistics Agency. On March 

27, 2000, DCMC was established as DCMA under the authority of the Under Secretary of 

Defense (Acquisition, Technology, and Logistics). 

22 DOD, General Plan: Consolidation of Department of Defense Contract Audit Activities 

into the Defense Contract Audit Agency (Feb. 17, 1965). 

Page 8 GAO-09-468 DCAA Audit Environment
 

Audit Agency (DCAA), establish DCAA as the department’s contract audit 

agency23 and set forth DCAA’s responsibilities. 

FAR 42.101 prescribes contract audit responsibilities as submitting 

information and advice to the requesting activity, based on the analysis of 

contractor financial and accounting records or other related data as to the 

acceptability of the contractors’ incurred and estimated costs; reviewing 

the financial and accounting aspects of contractor cost control systems; 

and, performing other analyses and reviews that require access to 

contractor financial and accounting records supporting proposed and 

incurred costs. DOD Directive 5150.36 lists several responsibilities and 

functions that shall be performed by the DCAA Director,24 including: 

• “Assist in achieving the objective of prudent contracting by providing 

DOD officials responsible for procurement and contract 

administration25 with financial information and advice on proposed or 

existing contracts and contractors, as appropriate.” 

• “Audit, examine, and/or review contractors’ and subcontractors’ 

accounts, records, documents, and other evidence; systems of internal 

control; [and] accounting, costing, and general business practices and 

procedures; to the extent and in whatever manner is considered 

necessary to permit proper performance of other functions ....” These 

other functions cover contract audit and nonaudit services. In addition, 

the Directive states that the DCAA Director shall perform such other 

functions as may be assigned by the Secretary and Deputy Secretary of 

Defense or the Under Secretary of Defense (Comptroller/CFO). 

• “Approve, suspend, or disapprove costs on reimbursement vouchers 

received directly from contractors, under cost-type contracts, 

transmitting the vouchers to the cognizant Disbursing Officer.” 

DCAA uses the term audit to refer to a variety of evaluations of various 

types of data.26 In fiscal year 2008, DCAA reported that over 97 percent of 

its service work hours were spent on audits, meaning that DCAA has opted 

to provide nearly all of its services to the contracting and finance 

 

23 DODD 5105.36, paragraph 4.2, reissued on February 28, 2002. 

24 DODD 5105.36, paragraphs 5.1 through 5.14. 

25 Contract administration responsibilities are set forth in FAR Subparts 42.2 and 42.3. 

26 CAM 2-001. 

Page 9 GAO-09-468 DCAA Audit Environment
 

communities under applicable auditing standards, as discussed below. 

Table 1 lists several audit and nonaudit services provided by DCAA during 

the three phases of the contracting process—pre-award, contract 

administration, and close-out—and cites the statutory and regulatory 

provisions that authorize or establish the need to have DCAA perform the 

service. DCAA audits also support the contract payment process both 

directly and indirectly. For example, audits of contractor incurred cost 

claims and voucher reviews directly support the contract payment process 

by providing the information necessary to certify payment of claimed 

costs. 27 Other audits of contractor systems, including audits of contractor 

internal controls, CAS compliance, and defective pricing, indirectly 

support the payment process by providing assurance about contractor 

controls over cost accounting, cost estimating, purchases, and billings that 

the agency may rely upon when making contract decisions, such as 

determinations of reasonable and fair prices on negotiated contracts. For 

example, an accounting system deemed to be adequate by a DCAA audit 

permits progress payments based on costs to be made without further 

audit.28

Table 1: Examples of DCAA Audit and Nonaudit Services 

Payment support 

Contract phase and 

assignment Audit and Nonaudit services 

Contracting 

support Direct Indirect 

Pre-award phase: 

Accounting systema Audit: DCAA determines adequacy of the contractor’s accounting 

system prior to award of a cost-reimbursable or other flexibly 

priced contract. FAR § 16.301-3(a)(1). 

X X 

Contractor accounting 

disclosure statements 

Audit: DCAA reviews the contractor’s Disclosure Statement for 

adequacy and CAS compliance and determines whether the 

contractor’s Disclosure Statement is current, accurate, and 

complete. DCAA also reviews Disclosure Statements during the 

post award phase if contractors revise them. FAR §§ 30.202-6(c), 

30.202-7 and 30.601(c). 

X X 

Estimating system aAudit: DCAA determines adequacy of contractor estimating 

systems. FAR § 15.407-5 and DFARS § 252.215-7002(d), (e). 

X X 

 

27 Disbursing officers are authorized to make payments on the authority of a voucher 

certified by an authorized certifying officer, who is responsible for the legality, accuracy, 

and propriety of the payment. 31 U.S.C. §§ 3325, 3521(a), and 3528(a). 

28 FAR § 32.503-4. 

Page 10 GAO-09-468 DCAA Audit Environment
 

 Payment support 

Contract phase and 

assignment Audit and Nonaudit services 

Contracting 

support Direct Indirect 

Contract price 

proposals and forward 

pricing proposalsb

 

Audit: DCAA examines contractor records to ensure that cost or 

pricing data is accurate, current, and complete and supports the 

determination of fair and reasonable prices. 10 U.S.C. §§ 2306a 

and 2313 (DOD) and 41 U.S.C. § 254d (other agencies); FAR 

Subpart 15.4 (esp. FAR § 15.404-2(c)) and § 52.215-2(c); and 

DFARS § 215.404-1. 

X X 

Financial liaison 

advisory servicesb

Nonaudit: DCAA Director establishes and maintains liaison 

auditors and financial advisors, as appropriate, at major procuring 

and contract administration offices. These services are also 

provided during the post-award phase, as needed. DODD 

5105.36, paras. 7.1.1 and 5.9. 

X X 

Post award/administration phase: 

Internal control system 

audits (generally) 

Audit: DCAA reviews the financial and accounting aspects of the 

contractor’s cost control systems, including the contractor’s 

internal control systems. FAR § 42.101(a)(3) and DFARS § 

242.7501. 

X X 

Billing system auditsaAudit: DCAA determines adequacy of contractors’ billing system 

controls and reviews accuracy of paid vouchers. DCAA uses audit 

results to support approval of contractors to participate in the 

direct-bill program. FAR § 42.101 and DFARS § 42.803 (b)(i)(C). 

X X 

Purchasing system 

review b 

Audit: DCAA determines adequacy of a contractor’s or 

subcontractor’s purchasing system. FAR Subpart 44.3. 

X X 

Progress paymentsb Audit: DCAA verifies amount claimed, determines allowability of 

contractor requests for cost-based progress payments, and 

determines if the payment will result in undue financial risk to the 

government. FAR §§ 32.503-3, 32.503-4, and 52.232-16. 

X X 

Incurred cost claimsaAudit: DCAA determines acceptability of the contractors’ claimed 

costs incurred and submitted by contractors for reimbursement 

under cost-reimbursable, fixed-price incentive, and other types of 

flexibly priced contracts and compliance with contract terms, FAR, 

and CAS, if applicable. FAR §§ 42.101, 42.803(b), and DFARS § 

242.803. 

X X 

Billing rates and final 

indirect cost ratesa 

Audit: DCAA establishes billing rates for interim indirect costs and 

final indirect cost rates. FAR §§ 42.704, 42.705 and 42.705-2 and 

DFARS § 42.705-2. 

X X 

Defective pricingbAudit: DCAA determines the amount of cost adjustments related 

to defective pricing. See above authorities to audit contractor cost 

and pricing data and FAR § 15.407-1. 

X X 

CAS compliancebAudit: DCAA determines contractor and subcontractor compliance 

with CAS set forth in 48 CFR § 9903.201 and determines cost 

impacts of noncompliance. FAR §§ 1.602-2, 30.202-7, and 

30.601(C). 

X X 

Other specially 

requested services 

Audit and nonaudit services: DCAA conducts performance audits 

and other audits based on requests from DOD components and 

requests from other federal agencies. DOD Directive 5105.36, 

Sec. 5. 

X X 

Page 11 GAO-09-468 DCAA Audit Environment
 

 Payment support 

Contract phase and 

assignment Audit and Nonaudit services 

Contracting 

support Direct Indirect 

Paid voucher reviewsa

Nonaudit services: DCAA reviews vouchers after payment to 

support continued contractor participation in the direct bill 

program. CAM 6-1007.6; FAR § 42.803; DFARS § 242.803; 

DODD 5105.36, paras. 5.4 and 5.5; and DOD Financial 

Management Regulation (FMR), vol. 10, ch. 10, para. 100202. 

X X 

Approval of vouchers 

prior to paymenta

Nonaudit: DCAA reviews and approves contractor interim 

vouchers for payment and suspends payment of questionable 

costs. FAR § 42.803; DFARS § 242.803(b)(i)(B); DOD Directive 

5105.36, paras. 5.4 and 5.5; and DOD FMR vol. 10, ch. 10, para. 

100202. 

X X 

Overpayment reviewsaNon audit services: At the request of the contracting officer, DCAA 

reviews contractor data to identify potential contract 

overpayments. FAR §§ 2.605, 52.216-7(g), (h)2. 

X X 

Close-out/termination phase: 

Contract close-out 

procedures and 

auditsa

Audit: DCAA reviews final completion vouchers and the 

cumulative allowable cost worksheet and may review contract 

closing statements. DFARS § 242.803(b)(i)(D). 

X X 

Source: GAO analysis. 

a

Indicates DCAA audit and nonaudit services covered in this audit. 

b

Indicates types of audits covered in our prior investigation (GAO-08-857). We reviewed progress 

payment and contract close-out audits that related to audits in our earlier investigation or this audit 

where the auditors considered the evidence in those audits. 

Importance of Audits in 

Accordance with GAGAS 

DCAA policy states29 that it follows GAGAS30 when conducting audits. 

These standards provide a framework for conducting high quality 

government audits and attestation engagements. These standards also 

provide guidelines to help government auditors maintain competence, 

integrity, objectivity, and independence in their work and require that they 

obtain sufficient evidence to support audit conclusions and opinions. 

When auditors are required to follow GAGAS or are representing to others 

that they followed GAGAS, they should follow all applicable GAGAS 

requirements and should refer to compliance with GAGAS in the auditor’s 

report.31 Most DCAA audits are performed as attestation audits under 

GAGAS. For attestation audits, GAGAS incorporates the American 

 

29 CAM, 2-101. Except where stated otherwise in this report, various types of evaluations 

entailing different levels of assurance that DCAA refers to as audits—such as examinations, 

attestations, and reviews—were subject to GAGAS. 

30GAO-03-673G, §1.01, and GAO-07-731G, §1.03. 

31 GAO-07-731G, § 1.11. 

Page 12 GAO-09-468 DCAA Audit Environment
 

Institute of Certified Public Accountants (AICPA) general standard on 

criteria, and the field work and reporting standards and the related 

Statements on Standards for Attestation Engagements (SSAE), unless 

specifically excluded or modified by GAGAS.32 DCAA also conducts 

performance audits upon request. This report addresses DCAA attestation 

audits and related supporting assignments. 

GAGAS state that the public expects auditors to observe the principles of 

serving the public interest and maintaining the highest degree of integrity, 

objectivity, and independence in discharging their professional 

responsibilities. Serving the public interest and honoring the public trust 

are critical when performing government audits. Auditors increase public 

confidence when they conduct their work with an attitude that is 

objective, fact-based, nonpartisan, and non-ideological with regard to 

audited entities and users of the auditors’ reports. Auditors also should be 

intellectually honest and free of conflicts of interest in discharging their 

professional responsibilities.33 Management of the audit organization sets 

the tone for ethical behavior throughout the organization by maintaining 

an ethical culture, clearly communicating acceptable behavior and 

expectations to each employee and creating an environment that 

reinforces and encourages ethical behavior throughout all levels of the 

organization. 34 The credibility of auditing in the government sector is 

based on auditors’ objectivity and integrity in discharging their 

professional responsibilities.35

 

32 GAO-03-673G, § 6.01, and GAO-07-731G, § 6.01. 

33 GAO-07-731G, §§ 2.06 through 2.10. 

34 GAO-07-731G, § 2.01. 

35 GAO-07-731G, § 2.10. 

Page 13 GAO-09-468 DCAA Audit Environment
 

We found audit quality problems at DCAA offices nationwide, as 

demonstrated by serious quality problems in the 69 audits and cost-related 

assignments we reviewed, DCAA’s ineffective audit quality assurance 

program, and DCAA’s rescission of 80 audit reports in response to our 

work. 36 Of the 69 audits and cost-related assignments we reviewed for this 

report, 65 exhibited serious GAGAS or other deficiencies similar to those 

found in our prior investigation, including compromise of auditor 

independence, insufficient audit testing, and inadequate planning and 

supervision. Although not as serious, the remaining four audits also had 

GAGAS compliance problems. The 69 audits and cost-related assignments 

we reviewed included 43 audits that DCAA reported were performed in 

accordance with GAGAS and 26 non-GAGAS cost-related assignments, 

including 10 overpayment and 16 paid voucher assignments. According to 

DCAA officials, DCAA rescinded the 80 audit reports because the audit 

evidence was outdated, insufficient, or inconsistent with reported 

conclusions and opinions and reliance on the reports for contracting 

decisions could pose a problem. Nearly one third (24) of the 80 rescinded 

reports relate to unsupported opinions on contractor internal controls, 

which were used as the basis for risk-assessments and planning on 

subsequent internal control and cost-related audits. Other rescinded 

reports relate to CAS compliance and contract pricing decisions. Because 

the conclusions and opinions in the rescinded reports were used to assess 

risk in planning subsequent audits, they impact the reliability of hundreds 

of other audits and contracting decisions covering billions of dollars in 

DOD expenditures. We found that DCAA’s focus on a production-oriented 

mission led DCAA management to establish policies, procedures, and 

training that emphasized performing a large quantity of audits to support 

contracting decisions over audit quality. An ineffective quality assurance 

structure compounded this problem. 

Nationwide Audit 

Quality Problems Are 

Rooted in DCAA’s 

Poor Management 

Environment 

Audit Quality Problems 

Found in All Audits GAO 

Reviewed 

We found audit quality problems, including GAGAS compliance problems, 

with all 37 audits of contractor internal controls and the 4 incurred cost 

and the 2 request for equitable adjustment audits we reviewed at 7 FAOs 

across the 5 DCAA regions covered in this audit. In addition, none of the 

26 cost-related assignments we reviewed from these same FAOs included 

sufficient testing to identify contractor overpayments and billing errors. 

 

36 According to documentation provided by DCAA as of the end of July 2009, the 80 

rescinded reports include 62 reports related to findings in our July 2008 investigative report 

and 18 reports related to this audit. 

Page 14 GAO-09-468 DCAA Audit Environment
 

For additional details on our analysis of these DCAA audits and 

assignments, including narrative case-studies, see appendixes I and II. 

DCAA performs attestation audits of contractors’ systems for cost 

accounting, estimating, and billing to gather evidence to express an 

opinion on the adequacy of the contractor’s systems and related internal 

controls for compliance with applicable laws and regulations and contract 

terms. A contractor must have an adequate accounting system to be 

awarded a government cost-reimbursement contract, an adequate billing 

system to submit invoices for payment without government review, and an 

acceptable estimating system to support a contracting officer’s approval of 

pricing proposals. A secondary objective of DCAA’s audits of contractor 

systems and controls is to determine the degree of reliance that can be 

placed on the contractor’s internal controls as a basis for planning the 

scope of other related audits. For example, if a contractor receives an 

adequate opinion on various systems control audits, auditors assess risk as 

low and reduce the level of testing on subsequent internal control and 

cost-related audits, including audits of contractors’ annual incurred cost 

claims. Although the reports for all 37 audits of contractor internal 

controls that we reviewed stated that the audits were performed in 

accordance with GAGAS, we found GAGAS compliance issues with all of 

these audits. Examples of GAGAS compliance issues we found included: 

Internal Control Audits 

Independence issues. For 7 audits we reviewed, DCAA independence 

was compromised because auditors provided material nonaudit services 

to a contractor they later audited; experienced access to records problems 

that were not fully resolved; or significantly delayed report issuance in 

order to allow the contractors to resolve cited deficiencies. GAGAS state 

that auditors should be free from influences that restrict access to records 

or improperly modify audit scope.37

Insufficient evidence. We found that 33 of the 37 internal control audits 

did not include sufficient testing of internal controls to support auditor 

conclusions and opinions. GAGAS for examination-level attestation 

engagements require that sufficient evidence be obtained to provide a 

reasonable basis for the conclusion that is expressed in the report.38

However, our review of audit documentation often found that only two, 

three, or sometimes five transactions were tested to support audit 

 

37 See GAO-03-673G, § 3.19, and GAO-07-731G, § 3.10. 

38 GAO-03-673G, § 6.04b. 

Page 15 GAO-09-468 DCAA Audit Environment
 

conclusions, and the audit documentation did not contain a justification 

for the small sample sizes selected for testing. For internal control audits, 

which are relied on for 2 to 4 years and sometimes longer, the auditors 

would be expected to test a representative selection of transactions across 

the year and not transactions for just one day, one month, or a couple of 

months.39 For many controls, the procedures performed consisted of 

documenting the auditors’ understanding of controls, and the auditors did 

not test the effectiveness of the implementation and operation of controls. 

Generally, the basis for an auditor’s determination of sufficient testing 

should include (1) an adequate risk assessment, taking into consideration 

any auditor alerts arising from related audits, past findings, and corrective 

actions; (2) the contractor’s overall control environment; and (3) the 

nature and volume of transactions and associated materiality and risk of 

error. For example, decisions on sufficient testing of contractor internal 

controls would include consideration of the number and types of contracts 

or proposals; the nature, dollar amount, and volume of transactions; and 

key control attributes or special characteristics of the transactions. 

Further, a representative selection would include a representative number 

of transactions from a population of transactions representing a 

reasonable period of time, in order for test results to support conclusions 

and opinions on the overall adequacy of the contractor’s systems and 

effectiveness of the related controls. For example, under the GAO/PCIE 

Financial Audit Manual,

40 the minimum sample size for an attribute 

sample of a control would be 45 items. 

Reporting problems. According to GAGAS, audit reports should, among 

other matters, identify the subject matter being reported and the criteria 

used to evaluate the subject matter. Criteria identify the required or 

desired state or expectation with respect to the program or operation and 

provide a context for evaluating evidence and understanding the findings.41

None of the 37 internal control audit reports we reviewed cited specific 

criteria used in individual audits. Instead, the reports uniformly used 

boilerplate language to state that DCAA audited for compliance with the 

“FAR, CAS, DFARS, and contract terms.” As a result the user of the report 

 

39 AICPA Statements on Auditing Standards, AU 350, and Audit and Accounting Guide: 

Audit Sampling, §§ 3.14, 3.29-3.34, 3.58, and 3.61. 

40 GAO/PCIE, Financial Audit Manual, GAO-08-585G (Washington, D.C.: July 2008). 

41 GAO-07-731G, § 4.15. 

Page 16 GAO-09-468 DCAA Audit Environment
 

does not know the specific Federal Acquisition Regulation (FAR), Cost 

Accounting Standards (CAS), or contract terms used as criteria to test 

contractor controls. This makes it difficult for users of the reports to 

determine whether a particular report provides the level of assurance 

needed to make contracting decisions. 

The lack of sufficient support for the audit opinions on 33 of the 37 

internal control audits we reviewed rendered them unreliable for decision 

making on contract awards, direct billing privileges, the reliability of cost 

estimates, and reported direct cost and indirect cost rates. For example, 

the FAR requires42 government contracting officers to determine the 

adequacy of a contractor’s accounting system before awarding a costreimbursement contract. Of the 9 audits of contractor accounting system 

internal controls that we reviewed, only two of the audits included 

sufficient testing to support DCAA’s audit opinion that internal controls 

over the contractors’ accounting systems were adequate. In addition, none 

of the 20 audits of contractor billing system internal controls we reviewed 

contained sufficient testing of controls to support the reported opinions. 

Adequate opinions on billing system audits are the basis for DCAA 

decisions to approve contractors for the direct bill program, whereby 

contractors submit invoices directly to a government disbursing office 

without prior review.43 Four of the 6 audits of contractor estimating 

system controls that we reviewed did not include sufficient testing to 

support the reported opinions. DOD requires44 that large contractors have 

acceptable estimating systems. Opinions on contractor estimating system

support DCAA decisions on the extent of testing performed on contract 

proposals. Neither of the two internal control audits of contractor indirect 

and other direct costs we reviewed included sufficient testing to support

reported opinions. As shown in figure 1, at the time these audits were 

performed, DCAA policy guidance provided for three categories of 

opinions on internal control audits. This policy provided for different 

opinions and criteria for judging them based on the severity of the 

problems identified. Professional standards have long recognized differe

levels of severity with regard to reporting deficiencies and material 

weakness

s 

nt 

es in internal controls. 

 

42 FAR §§ 16.104(h) and 16.301-3(a)(1). 

43 FAR § 42.101 and DFARS § 242.803(b)(i)(C). 

44 DFARS § 215.407-5-70; see FAR § 15.407-5. 

Page 17 GAO-09-468 DCAA Audit Environment
 

Figure 1: DCAA Opinions on Contractor Internal Control Systems Audits 

Source: GAO analysis of DCAA policy.

Risk

Adequate

Inadequate

In

No significant

deficiencies were

identified in the audit

Auditors identified one

or more significant

deficiencies that render

the entire contractor

system unreliable

Auditors identified one

or more significant

deficiencies that affect

parts of the contractor’s

system

Scope of future audits will be decreased based on assurance provided by

 adequate controls. 

Contractor is required to make improvements and DCAA is to perform follow-up

 testing within 6 months.

Inadequate opinion requires expanded audit scopes on other audits because

 controls do not provide reasonable assurance that data generated by the

 contractor’s system are reliable.

Contractor is required to make improvements, and DCAA is to perform follow-up

 testing within 6 months.

Inadequate in part opinion also requires expanded audit scopes on future and

 concurrent audits until the contractor’s corrective actions are confirmed by

 the auditors.

adequate in part

noinipo AACD retirC ai eR sultant actions

Low

High

Supervisors of the DCAA internal control audits we reviewed dropped 

auditor findings of significant deficiencies from the audit reports or 

treated them as suggestions for improvement without adequate support, 

including instances of FAR noncompliance that should have been reported 

as material weaknesses. In some cases, auditors reported “inadequate-in 

part” opinions when the severity of the deficiencies or material 

weaknesses identified would have called for “inadequate” opinions. 

On December 19, 2008, DCAA revised its policy to eliminate the 

“inadequate-in-part” opinion and the requirement to report suggestions for 

improvement.45 The new DCAA policy defines “significant 

deficiency/material weakness” as an internal control deficiency that 

(1) adversely affects the contractor’s ability to initiate, authorize, record, 

process or report government contract costs in accordance with 

applicable government contract laws and regulations; (2) results in a 

reasonable possibility that unallowable costs will be charged to the 

government; and (3) the potential unallowable cost is not clearly 

immaterial. The new DCAA policy also establishes new guidance on 

 

45DCAA, “Audit Guidance on Significant Deficiencies/Material Weaknesses and Audit 

Opinions on Internal Control Systems,” 08-PAS-043R (Dec. 19, 2008). 

Page 18 GAO-09-468 DCAA Audit Environment
 

reporting audit opinions on contractors’ internal control systems. For 

example, the new DCAA policy states that audit reports that identify any 

significant deficiencies/material weaknesses in contractors’ internal 

control systems will include opinions that the systems are “inadequate.” 

The policy notes that the contractor’s failure to accomplish any control 

objective tested in DCAA’s internal control audits will or could ultimately 

result in unallowable costs being charged to government contracts, even 

when the control objective does not have a direct relationship to charging 

costs to government contracts. As an example, the policy notes the control 

objective related to ethics and integrity is not directly related to charging 

costs to government contracts, but that the contractor’s failure to 

accomplish the control objective creates an environment that could 

ultimately result in mischarging to government contracts. 

By eliminating the “inadequate-in-part” opinion, the new policy does not 

recognize different levels of severity and could unfairly penalize 

contractors whose systems have less severe deficiencies by giving them 

the same opinion—”inadequate”—as contractors having material 

weaknesses or serious deficiencies that in combination would constitute a 

material weakness. 

At the time we finalized our draft report for DOD comment, DCAA had 

rescinded 18 of the 33 audits of contractor internal controls that we 

determined did not contain sufficient testing to meet GAGAS.46 Unreliable 

audit opinions on contractor internal controls pose a significant risk 

because DCAA generally performs these audits on a 2- to 4-year cycle and 

the audit results are relied on for several years to make decisions on 

testing in various audits of contractor internal controls and cost-related 

assignments. In response to our earlier investigation in November 2008, 

DOD added DCAA audits not meeting professional standards to its list of 

material weaknesses.47 Table 2 provides details on five case studies that 

are typical of the flawed internal control audits that we reviewed during 

the course of our work. For more detail on the internal control audits we 

reviewed, see appendix I. 

 

46 Under its decentralized management environment, DCAA headquarters obtains field 

office agreement to rescind audit reports that do not meet GAGAS. 

47 DOD, Fiscal Year 2008 Agency Financial Report, Department of Defense (Washington, 

D.C.: Nov. 17, 2008). 

Page 19 GAO-09-468 DCAA Audit Environment
 

Table 2: Summary of Five Selected Internal Control Audits 

Case Region Audit type Case details 

1 Western Billing system (2004) • DCAA auditors inappropriately planned and performed a billing system audit of a 

federally funded research and development center (grantee) with $1.5 billion in annual 

funding. The grantee does not have a “billing system.” 

• The grantee is funded by a line of credit, which provides for cash draws and 

transaction reporting by the grantee’s accounting system. 

• DCAA auditors spent 530 hours revising Single Audit Act cash management audit 

documentation to address procedures required in DCAA’s standard audit program for 

billing system internal controls and developed a billing system audit report, when the 

auditors could have simply forwarded the results of work on the grantee’s cash 

management system performed under the Single Audit Act to the federal agency’s 

buying command. 

• As a result of our review, DCAA reassessed the need to perform a billing system audit 

for the grantee and determined that it would rely on the Single Audit reports in the 

future. 

2 Western Accounting system 

(2004) 

• This audit involving accounting controls for one of the five largest DOD contractors 

working in Iraq was initiated in November 2003. 

• In September 2005, after nearly 2 years of audit work, DCAA provided draft findings 

and recommendations to the contractor that included 8 significant deficiencies in the 

contractor’s accounting design and operation. 

• The contractor objected to the findings, stating that the auditors did not fully 

understand its new policies and procedures, which were just being developed for the 

fast track effort in Iraq. 

• Following the contractor’s objections, various supervisory auditors directed the 

auditors to revise and delete some workpapers, generate new workpapers, and in one 

case, copy the signature of a prior supervisor onto new workpapers making it appear 

that the prior supervisor had approved a revised risk assessment. 

• On August 31, 2006, after dropping 5 significant deficiencies and downgrading 3 

significant deficiencies to suggestions for improvement, DCAA reported an “adequate” 

opinion on the contractor’s accounting system without adequate audit evidence for the 

changes. 

• The interim audit supervisor, who instructed the lead auditor to copy and paste the 

prior supervisor’s name onto key risk assessment workpapers, was subsequently 

promoted to be the Western Region’s quality assurance manager where he served as 

quality control check over thousands of audits, including those GAO reported on last 

year. 

• In April 2007, the Special IG for Iraq Reconstruction (SIGIR) reported that despite 

being paid $3 million to complete the renovation of a building in Iraq, the contractor’s 

work led to plumbing failures and electrical fires in a building occupied by the Iraqi 

Civil Defense Directorate. 

• DCAA rescinded the audit report on December 2, 2008. 

Page 20 GAO-09-468 DCAA Audit Environment
 

Case Region Audit type Case details 

3 Eastern Billing system (2005) • In May 2005, DCAA reported an inadequate-in-part opinion on the billing system 

internal controls of a second of the five largest DOD contractors. 

• After issuing the report, DCAA auditors helped the contractor develop policies and 

procedures related to accounts receivable, overpayments, and system monitoring 

before performing a required follow-up audit—a serious impairment to auditor 

independence. 

• In June 2006, DCAA reported an adequate opinion on the contractor’s billing system 

internal controls, including the policies and procedures DCAA helped the contractor 

develop. 

• As a result of GAO’s review, DCAA rescinded the follow-up audit report on March 6, 

2009. 

4 Central Billing system 

(2005) 

• This audit, which was initiated in July 2005, covered a new billing system at a 

business segment of another of the five largest DOD contractors. Although DCAA 

considers new systems to be high-risk and requires increased testing, auditors 

deleted key audit steps related to contractor policies and internal controls over 

progress payments from the standard audit program without explanation and 

performed little or no testing of the contractor’s billing controls. 

• The contractor objected to requests for documentation to test whether billing clerks 

had received necessary training. 

• One auditor told GAO he did not perform other tests because “the contractor would 

not appreciate it.” 

• The auditors provided draft findings and recommendations to the contractor in 

February 2006 that included six suggestions to improve the system related to the 

need for internal audits, oversight of subcontractor accounting systems, and 

improvements in policies and procedures and desk instructions. 

• Instead of issuing the report, when audit work was completed and noting the status of 

any contractor actions to address identified control weaknesses, the auditors 

monitored contractor corrective actions for 7 months, dropping the two suggestions for 

improvement related to internal audits and monitoring subcontractor accounting 

systems. The failure to monitor subcontractor accounting systems should have been 

considered a significant deficiency. 

• On September 15, 2006, DCAA reported an “adequate” opinion on the contractor’s 

billing system. 

• Following GAO’s review of this audit, DCAA rescinded the audit report on February 

10, 2009. 

Page 21 GAO-09-468 DCAA Audit Environment
 

Case Region Audit type Case details 

5 Central Billing system (2006) • A fraud investigation by the Army’s Criminal Investigative Division was under way at 

the time DCAA performed this contractor’s billing system audit. The FAO was aware 

of the substance of the Army’s investigation. 

• The auditor requested increases in budgeted audit hours to perform increased testing 

because of fraud risk and the contractor’s use of temporary accounts for charging 

costs that had not yet been authorized by the contracting officer. 

• The auditor drafted an “inadequate” opinion on the contractor’s billing system, which 

was overturned by the supervisor and FAO manager. 

• Despite a reported $2.8 million in fraud for this contractor, DCAA reported an 

“inadequate-in-part” opinion related to 3 significant deficiencies in the contractor’s 

billing system on August 31, 2005, and an “adequate” opinion on September 11, 

2006, related to a follow-up audit. 

• The auditor, whose performance appraisal was lowered for performing too much 

testing and exceeding budgeted audit hours, was assigned to and then removed from 

the follow-up audit. The auditor left DCAA in March 2007. 

• Following GAO’s review, DCAA rescinded both audit reports on November 20, 2008. 

Source: GAO analysis of DCAA audit documentation and auditor interviews. 

The 32 cost-related assignments we reviewed did not contain sufficient 

testing to provide reasonable assurance that overpayments and billing 

errors that might have occurred were identified. As a result, there is little 

assurance that any such errors, if they occurred, were corrected and that 

related improper contract payments, if any, were refunded or credited to 

the government. Contractors are responsible for ensuring that their 

billings reflect fair and reasonable prices and contain only allowable costs, 

and taxpayers expect DCAA to review these billings to provide reasonable 

assurance that the government is not paying more than it should for goods 

and services. Further, we found that DCAA does not consider some costrelated assignments to be GAGAS audits, even though these assignments 

are used to provide assurance of the reasonableness of contractor billings, 

for example: 

Cost-Related Assignments 

Paid voucher reviews. DCAA performs annual testing of paid vouchers 

(invoices) to determine if contractor voucher preparation procedures are 

adequate for continued contractor participation in the direct-bill 

program.48 Under the direct-bill program, contractors may submit their 

invoices directly to the DOD disbursing officer for payment without 

further review. Although DCAA does not consider its reviews of contractor 

 

48 DCAA does not perform paid voucher reviews during the year that it performs an audit of 

the contractor’s billing system internal controls. 

Page 22 GAO-09-468 DCAA Audit Environment
 

paid vouchers to be GAGAS engagements; it has not determined what 

standards, if any, apply to these assignments. In addition, for the 16 paid 

voucher assignments we reviewed, we found that DCAA auditors failed to 

comply with CAM guidance.49 Rather than documenting the population of 

vouchers, preparing sampling plans, and testing a random (statistical) 

sample, auditors generally did not identify the population of vouchers, did 

not create sampling plans, and made a small, nonrepresentative selection 

of as few as one or two invoices for testing to support conclusions on their 

work. Even when DCAA auditors tested 20 or 30 invoices, they did not test 

billing controls or review supporting documentation for goods and 

services purchased. Instead, the auditors performed limited procedures 

such as determining whether the vouchers were mathematically correct 

and included current and cumulative billed amounts. Based on this limited 

work, the auditors concluded that controls over invoice preparation were 

sufficient to support approval of the contractors’ direct billing privileges. 

However, the limited work performed does not provide assurance that 

contractor billings are accurate and comply with applicable laws, the FAR, 

CAS, and contract terms. This is of particular concern because we 

determined that Defense Finance and Accounting Service (DFAS) 

certifying officers rely on DCAA voucher reviews, and they do not repeat 

review procedures they believe to be performed by DCAA. 

Professional literature contains guidance to help auditors determine the 

level of testing that should be performed to obtain sufficient, appropriate 

evidence to support a conclusion that internal controls are effectively 

designed, implemented, and operating effectively. Inquiry alone does not 

provide sufficient, appropriate evidence to support a conclusion about the 

effectiveness of a control. Some of the factors that affect the risk 

associated with a control include 

• the nature and materiality of misstatements that the control is intended 

to prevent, 

• the inherent risk associated with the related account(s) and 

assertion(s), 

• whether there have been changes in the volume or nature of 

transactions that might adversely affect control design or operating 

effectiveness, 

 

49 CAM 6-1007. 

Page 23 GAO-09-468 DCAA Audit Environment
 

• the degree to which the control relies on the effectiveness of other 

controls (i.e., information technology controls), 

• the competence of personnel who perform the control or monitor its 

performance, and whether there have been changes in key personnel 

who perform the control or monitor performance, and 

• whether the control relies on performance by an individual or is 

automated (an automated control would generally be expected to be 

lower risk if relevant IT general controls are effective).50

Professional standards51 state that the auditor should focus more attention 

on the areas of highest risk. As the risk associated with the control being 

tested increases, the evidence that the auditor should obtain increases. In 

addition, the GAO/PCIE Financial Audit Manual provides guidance on 

sampling control tests that would be relevant to DCAA testing of 

contractor invoices.52 The auditor should assess risk in determining the 

control attributes to be tested and select a sample that the auditor expects 

to be representative of the population. Attribute sampling requires random 

or systematic, if appropriate, selection of sample items without 

considering the transactions’ dollar amount or other special 

characteristics. To determine the sample size, the auditor uses 

professional judgment to determine three factors—confidence level,53

tolerable rate (maximum rate of deviations from the prescribed control 

that the auditor is willing to accept without altering the preliminary 

control risk), and expected population deviation rate (expected error 

rate).54

 

50 AU § 350.19 and SSAE §§15.64 and 15.69. 

51 AU §§ 350.07 through 350.14. 

52 GAO-08-585G, § 450. 

53 Confidence interval is the probability associated with the precision, that is, the 

probability that the true misstatement is within the confidence interval. 

54 For example, for a confidence level of 90 percent and a tolerable rate of 5 percent, a 

sample size of 45 transactions would have an acceptable number of deviations of zero and 

a sample size of 78 transactions would have an acceptable number of deviations of one. For 

the same confidence level of 90 percent and a tolerable rate of 10 percent, a sample size of 

45 would have an acceptable number of deviations of one and a sample size of 78 would 

have an acceptable number of deviations of four. 

Page 24 GAO-09-468 DCAA Audit Environment
 

Finally, the American Institute of Certified Public Accountants (AICPA) 

Audit and Accounting Guide: Audit Sampling55 (Audit Guide) contains 

attestation guidance on the application of SSAEs in specific 

circumstances, including engagements for entities in specialized 

industries. The Audit Guide states that an auditor using nonstatistical 

sampling is not required to compute the sample size using statistical 

theory. However, sample sizes of statistical and nonstatistical samples 

ordinarily would be comparable when the same sampling parameters are 

used.56

Overpayment assignments. DCAA intends these audits to verify that 

contractors have billing procedures and internal controls in place to 

identify and resolve contractor overpayments in a timely manner. DCAA 

guidance states that these engagements should be conducted in 

accordance with GAGAS to the extent applicable under the 

circumstances.57 However, none of the 10 overpayment assignments we 

reviewed were performed or reported as GAGAS engagements. We found 

that auditor judgments about the population and selection of transactions 

for these assignments did not provide a representative basis for testing 

and concluding on contractor controls over billings and payments 

received. For example, for the 10 assignments we reviewed, the auditors 

selectively reviewed an accounts receivable aging report to identify 

overpayments and determine if they had been resolved. The auditors did 

not attempt to identify the population of transactions subject to 

overpayments and over billings during the year, and they did not 

document their rationale for selecting a particular dollar threshold, 

number of transactions, or time period for testing contractor invoices. Our 

assessment of these assignments includes the same concerns regarding 

insufficient evidence to support the auditors’ conclusions as discussed 

above for annual testing of paid vouchers. As a result, this work does not 

provide reasonable assurance that contractors have adequate controls in 

place to identify and correct overpayments and billing errors and make 

appropriate, timely refunds and adjustments. 

 

55 The AICPA Audit Guide is an interpretive publication pursuant to AT section 50, SSAE 

Hierarchy (AICPA, Professional Standards, vol. 1). 

56 AICPA Audit Guide § I-17, and AU § 350.23. Statements on Auditing Standards (SAS) 39 

is referred to as AU 350. 

57 DCAA, “Audit Program: Audit of Contractor Overpayments,” (Activity Code 17310), April 

2004, September 2007, and May 2008. 

Page 25 GAO-09-468 DCAA Audit Environment
 

Incurred cost audits. The purpose of incurred cost audits is to examine 

contractors’ cost representations and opine on whether the costs are 

allowable, allocable to government contracts, and reasonable in 

accordance with the contract and applicable government acquisition 

regulations. 58 DCAA performs these audits as GAGAS attestation 

engagements. For the four incurred cost audits we reviewed, we found 

that the auditors did not adequately document their judgments about 

control risk or the sampling and test methodologies used. In addition, we 

found that the auditors traced claimed pool and base costs (indirect costs) 

to the contractor’s accounting books and records to determine their 

accuracy and allowability. However, the auditors did not perform 

sufficient, detailed testing of support for claimed indirect and direct costs. 

The scope of work performed was not sufficient to identify claimed costs, 

if any, that were not adequately supported or unallowable costs, if any, 

that should have been questioned. 

In addition to the testing failures we identified on the 32 cost-related 

assignments, several additional issues came to our attention during our 

review: 

Exempting from professional standards certain assignments that 

were used as support for internal control system audits. We noted 

that paid voucher reviews and overpayment assignments, which were used 

to support direct-bill decisions and billing system audits, were not 

performed under GAGAS, even though some of them used the same 

terminology as GAGAS engagements to describe the work performed, 

including “comprehensive examination” and “audit.” According to DCAA’s 

CAM and DCAA officials, paid voucher reviews and most overpayment 

assignments are not intended to meet GAGAS standards. However, paid 

voucher reviews are intended to serve as audits of contractor payments, 

and DCAA’s standard audit program for overpayment assignments states 

that the assignments are to be performed in accordance with GAGAS, 

unless there are specific exceptions. When these types of assignments are 

not conducted under professional standards, it is important for the report 

to clearly state the procedures performed and the intended uses of the 

report, such as verifying compliance with certain FAR requirements, in 

order to provide context for understanding the stated conclusions of the 

work and avoid misleading users of the report. 

 

58 CAM 6-102. 

Page 26 GAO-09-468 DCAA Audit Environment
 

Auditor objectivity issues. We also determined that DCAA’s role with 

regard to making decisions to approve contractors for participation in the 

direct-bill program59 presented an impairment to auditor objectivity—

which includes being independent in fact and appearance when providing 

audit and attestation engagements.60 The objectivity impairment relates to 

DCAA’s audit role in authorizing contractors to participate in the directbill program, which places it in the position of making decisions that 

impact its nonaudit workload related to the review of contractor invoices 

prior to payment. For example, when contractors do not have direct billing 

privileges, DCAA acts as the authorized representative of the DOD 

contracting officer in reviewing contractor invoices prior to submission 

for payment. However, if DCAA auditors determine that a contractor has 

an adequate billing system, DCAA may authorize a contractor to 

participate in the direct-bill program, thereby eliminating workload related 

to review of the contractor’s invoices prior to payment. In addition, the 20 

billing system audits and follow-up audits we reviewed lacked sufficient 

testing to support reported opinions, or the opinions reported were 

inconsistent with the audit evidence. DCAA had approved all but 2 of the 

16 contractors involved in these audits for the direct bill program. 

At the end of our audit, DCAA had not rescinded any of the memorandums 

or reports on the results of the cost-related assignments we reviewed. 

Table 3 provides details on five selected case studies of flawed costrelated assignments that we reviewed during the course of our work. 

 

59 FAR 42.101, DFARS 242.803(b)(1)(c), and CAM 6-1007. 

60 GAO-03-673G, §§ 3.03 through 3.18. 

Page 27 GAO-09-468 DCAA Audit Environment
 

Table 3: Summary of Five Selected Cost-Related Assignments 

Case Region 

Type of 

assignment Case details 

1 Eastern Paid voucher review 

(2004) 

Non-GAGAS 

• This contractor generates $1.1 billion in annual billings to the government. 

• The auditor assessed risk as low for this assignment without documenting the basis 

for the decision. The auditor then judgmentally selected 3 vouchers totaling $88,000 

for testing out of a total of 222 vouchers submitted to the government for payment 

from March 2003 through February 2004. 

• The auditor tested the first voucher selected and performed limited testing on the 

remaining 2 vouchers. The workpapers do not include any evidence to show that the 

auditor performed most of the audit steps required in the standard audit program. 

• Despite limited testing, on March 31, 2004, DCAA prepared a Memorandum for the 

Record, stating “continued reliance can be placed on the contractor’s procedures for 

the preparation of interim vouchers...” and “the contractor has met the criteria for 

continued participation in the direct billing program.” 

2 Mid-Atlantic Paid voucher review 

(2004) 

Non-GAGAS 

• In 2004, DCAA reviewed interim vouchers submitted by a contractor with $40 million 

in annual sales. 

• The auditor chose a nonrepresentative selection of 3 vouchers totaling $621,000 

from a 3-month period. The auditor should have used a population covering a 12-

month period because this assignment was designed to cover a 1-year period. 

• The auditor did not document the sample selection methodology as required by 

DCAA’s CAM. Although testing of 3 vouchers is not sufficient to support a 

conclusion on the effectiveness of the contractor’s controls over preparation of 

interim vouchers, the auditor removed one of the 3 vouchers from testing and did not 

document a reason. 

• The auditor did not identify any errors in testing the two remaining vouchers. 

• On August 31, 2004, DCAA reported “continued reliance can be placed on the 

contractor’s procedures for the preparation of interim vouchers” and “the contractor 

had met the criteria for continued participation in the direct billing program.” 

3 Western Paid voucher 

review (2005) 

Non-GAGAS 

• This DOD contractor with over $1 billion in annual billings to the government was 

one of several contractors that performed work to support the FBI’s Trilogy 

investigative systems upgrade project. 

• The auditor tested less than 20 vouchers of 5,530 vouchers issued in a 12-month 

period. 

• On April 14, 2005, DCAA issued a Memorandum for the Record, stating “continued 

reliance can be placed on the contractor’s procedures for the preparation of interim 

vouchers” and “the contractor has met the criteria for continued participation in the 

direct-bill program. 

• One year later, a GAO audit report revealed that during the time of this DCAA 

assignment, the contractor had over billed the FBI by over $400,000 in labor and 

improper first-class travel costs. 

Page 28 GAO-09-468 DCAA Audit Environment
 

Case Region 

Type of 

assignment Case details 

4 Central Overpayment 

assignment (2005) 

Non-GAGAS 

• This DCAA assignment covered one of the five largest DOD contractors. 

• The auditor tested 4 transactions from a listing of potential underpayments and 

overpayments prepared by the contractor. The auditor did not independently verify 

the accuracy or completeness of the contractor’s listing. 

• The audit program required the auditor to determine whether the contractor monitors 

the billings submitted by its top 3 to 5 subcontractors. However, the auditor 

performed this procedure for only 1 subcontractor based on “auditor judgment” and 

did not document the basis for this judgment in the audit documentation. 

• The auditor also relied on the unverified contractor-provided listing to identify 

refunds to the government. The auditor then “judgmentally selected” 2 refunds for 

testing from the contractor’s listing. 

• The auditors’ conclusions that the contractor’s controls are sufficient to detect and 

correct billing errors and overpayments were not supported by sufficient testing or 

other independent evidence. 

5 Western Incurred cost 

audit (2004) 

GAGAS 

• This audit covered a $516 million incurred cost claim submitted by a contactor 

performing reconstruction work in Iraq. 

• The auditors reported about $6 million in questioned costs and about $83 million in 

unsupported costs based on assist audits (portions of the audit performed by other 

FAOs) that had not been received by the report issue date. 

• Although the auditors charged 2,292 hours to this assignment, GAO determined that 

the auditors did not perform sufficient work to support the audit opinion. For 

example, the auditors traced claimed pool and base costs to the contractor’s 

accounting books and records using a threshold of $5 million for cost-type contracts 

and $2 million for time and materials contracts, but did not perform detailed testing 

of support for transactions. Tracing amounts to the general ledger is not sufficient 

work to support an examination-level opinion and the auditors did not document the 

basis for the judgment used to determine the multimillion dollar thresholds. 

• Further, the auditors relied on testing performed in a related accounting system 

audit, which DCAA rescinded on December 2, 2008, in response to GAO concerns. 

• As a result, the auditor’s risk assessment used to plan the incurred cost audit is no 

longer supported. 

Source: GAO analysis of DCAA audit documentation and auditor interviews. 

We did not attempt to re-perform these assignments to find out whether 

actual overpayments or billing errors existed. For additional details on the 

cost-related assignments we reviewed, see appendix II. 

Poor Management 

Environment and Quality 

Assurance Structure at 

DCAA Impacted Audit 

Quality 

We found that a management environment and agency culture that 

focused on facilitating the award of contracts and an ineffective audit 

quality assurance structure are at the root of the agencywide audit failures 

we identified. DCAA’s mission and management goals focus on producing 

a large quantity of audits to support procurement and contract 

administration rather than assuring proper contract costs that help save 

Page 29 GAO-09-468 DCAA Audit Environment
 

taxpayer dollars. In addition, an ineffective audit quality control system 

and a “clean” peer review opinion compounded the problem, hindering 

DCAA management from identifying and correcting agencywide audit 

quality problems. 

DCAA’s current mission statement does not address protecting the public 

interest in the manner in which it carries out audits to help assure that 

contractors charge fair and reasonable prices that comply with applicable 

laws and regulations, cost accounting standards, and contract terms. 

Instead, DCAA’s mission statement calls for it to perform all necessary 

contract audits for DOD and provide accounting and financial advisory 

services regarding contracts and subcontracts to all DOD components 

responsible for procurement and contract administration. Similarly, 

DCAA’s 2006 strategic plan focused on various processes and outputs. 

DCAA’s strategic plan contains the following five strategic goals with 

targeted completion dates from 2006 through 2008: 

DCAA’s Mission Statement and 

Strategic Plan Do Not Focus on 

the Public Interest 

1. fostering a quality work-life environment that promotes trust, 

teamwork, mutual respect, superior job performance and high morale; 

2. assuring customer satisfaction by providing timely and responsible 

audits and financial services that meet or exceed customer 

requirements and expectations; 

3. attaining the highest level of professional competence through 

continuous improvement in the management and performance of 

audits and services; 

4. providing best value audit and financial services through continuous 

evaluation and improvement of audit and administrative processes; 

and 

5. providing an integrated information technology structure that 

promotes effectiveness and efficiency in providing services for internal 

and external customers. 

DCAA objectives under each strategic goal focus on process 

improvements and do not contain a clear plan for achieving the respective 

goal or adequate quantitative and qualitative measures for determining 

success, for example: 

• One DCAA quality of work-life objective is to assess whether the 

participative work team concept is the best model for facilitating 

continuous process improvement. The underlying activities include 

internal meetings and brainstorming sessions, literature reviews, and 

developing recommendations for executive committee review. None of 

Page 30 GAO-09-468 DCAA Audit Environment
 

the activities included refer to identifying best practices or working 

with outside experts. 

• Another objective is to hold or lower attrition in high turnover areas. 

DCAA activities in this area include analyzing causes of attrition, and 

conducting surveys of new hires and departing employees. None of the 

related activities include surveys of like organizations, consideration of 

best practices, or identifying and addressing causes of high attrition. 

Moreover, in response to our requests for attrition data, DCAA 

provided high-level summaries without any analysis. 

• DCAA’s strategic goal for customer satisfaction, included the objective 

of increasing by 20 percent annually the number of incurred cost audit 

reports issued with contractor cumulative allowable cost worksheets, 

completing 100 percent of identified incurred cost audits necessary to 

accomplish Defense Contract Management Agency (DCMA) 

performance goals for contract close-out and canceling funds.61

DCAA’s strategic plan contains no explanation of the importance o

these objectives or how they link to DCAA’s mis

f 

sion. 

 

• A key goal related to best value audit services is for DCAA to manage 

its cost per direct audit hour at a level sufficient to maintain DCAA’s 

competitive advantage over the comparable national public firm 

composite rate. One of the ways DCAA has achieved a low cost per 

audit hour is to maintain a pay structure that caps journey-level 

auditors at the GS-12 level. In addition, our work identified numerous 

instances where entry-level auditors with little or no experience often 

perform audit assignments by themselves. However, lower grade levels 

and limited experience can place auditors at a disadvantage when 

dealing with contractor officials. 

The Government Performance and Results Act of 1993 (GPRA)62 directed 

federal agencies to shift their focus from traditional concerns of staffing 

and activity levels to a broad focus on outcomes or results by (1) defining 

a clear mission and desired outcomes instead of outputs, (2) measuring 

performance to gauge progress, and (3) using performance information as 

a basis for decision making. The act required agencies to meet with 

Congress and key stakeholders to clearly define their mission and develop 

61 Canceling funds refers to the point in time at which the availability of a fixed-year 

appropriation cancels and is no longer available for recording, adjusting, and liquidating 

obligations properly chargeable to the appropriation. (31 U.S.C. §§ 1552(a) and 1553(b)). 

62 Pub. L. No. 103-62, 107 Stat. 285 (Aug. 3, 1993). 

Page 31 GAO-09-468 DCAA Audit Environment
 

long-term strategic goals as well as annual goals that were linked to them. 

Although these legislated requirements were directed at federal agencies, 

including DOD, DCAA’s mission statement and strategic plan were not 

revised to conform to GPRA requirements. 

GPRA also requires that once federal agencies establish their strategic 

goals they are to develop results-oriented measures for assessing 

performance in meeting those goals and publicly report on how well they 

are doing. However, most of DCAA’s performance metrics continued to 

focus on output. Several DCAA managers noted that fear of outsourcing 

the contract audit function led DCAA to emphasize performance metrics 

that demonstrated high productivity and low cost. In fiscal year 2008, 

DCAA reported some results-oriented performance measures, such as 

return on investment and net savings related to questioned cost. However, 

most of DCAA’s metrics focused on production and audit cost, including 

cost per direct audit hour, 30-day cycle time on forward pricing audits, and 

dollars audited per hour. In addition, DCAA’s focus on completing over 

30,000 assignments annually with about 3,600 auditors continued to 

emphasize production of audits instead of performing quality audits that 

assured taxpayers that the government was paying fair and reasonable 

prices for contracted goods and services. 

Performance Metrics Were 

Designed To Measure Output 

DCAA’s audit quality assurance program was not properly implemented, 

resulting in an ineffective quality control process that accepted audits with 

significant deficiencies and noncompliance with GAGAS and DCAA policy. 

Moreover, even when DCAA’s quality assurance documentation showed 

evidence of serious deficiencies within individual offices, those offices 

were given satisfactory ratings. GAGAS require that each audit 

organization performing audits and attestation engagements in accordance 

with GAGAS should have a system of quality control that is designed to 

provide the audit organization with reasonable assurance that the 

organization and its personnel comply with professional standards and 

applicable legal and regulatory requirements, and have an external peer 

review at least once every 3 years.63

DCAA’s Audit Quality 

Assurance Program Was 

Ineffective 

Our analysis of DCAA audit quality review documentation for 14 of 48 

offices covered in audit quality reviews during fiscal years 2004 through 

2006—the period covered in the last DOD OIG peer review—found that 

although DCAA gave satisfactory ratings to 13 of the 14 FAOs, DCAA 

 

63GAO-07-731G, §§ 3.50-3.52. 

Page 32 GAO-09-468 DCAA Audit Environment
 

reviewers reported that 10 of these offices had 2 or more instances of 

serious GAGAS noncompliance, including inadequate planning, lack of 

proper supervision, and insufficient support for reported conclusions and 

opinions. However, DCAA gave only 1 of the 14 FAOs reviewed an 

unsatisfactory rating. The failed FAO had 5 of 9 assignments reviewed with 

at least two significant instances of noncompliance with GAGAS or DCAA 

policy. Further, although DCAA headquarters performed a follow-up 

review to confirm that problems identified at the failed office were 

corrected, DCAA headquarters officials told us they did not perform 

follow-up reviews to assure that the problems identified at other offices 

were corrected. 

In response to a DOD IG finding that DCAA quality assurance reviews did 

not cover a sufficient number of internal control system audits, DCAA 

increased the number of audits covered to date in its fiscal year 2007 and 

2008 quality assurance reviews. However, DCAA continued to 

inappropriately conclude that audits “demonstrated professional 

judgment,” allowing reviewers to disregard serious deficiencies with 

GAGAS in concluding on overall audit quality.64 DCAA failed only 1 of the 

40 FAOs as a result of its fiscal year 2007 and 2008 audit quality reviews. 

Our analysis of DCAA’s audit quality results showed that 19 of the 40 

FAO’s had two or more audits with at least 2 instances of significant 

noncompliance with GAGAS or DCAA policy. However, 18 of these FAOs 

received a satisfactory rating. DCAA headquarters has not yet followed up 

with offices that had deficient audits. 

The examples in table 4 show the disparity between DCAA quality 

assurance reports of a “satisfactory level of compliance” and actual results 

documented by quality assurance reviewers. The examples below also 

illustrate the long-term nature of this problem. 

 

64 In using professional judgment, GAGAS (GAO-07-731G, §§ 3.32 and 3.35) require auditors 

to act diligently in accordance with applicable professional standards and ethical principles 

in all aspects of carrying out their professional responsibilities. 

Page 33 GAO-09-468 DCAA Audit Environment
 

Table 4: Summary of Selected DCAA Audit Quality Review Results 

Region 

Number and type 

of audits DCAA audit quality review conclusions and findings 

Eastern 5 incurred cost 

audits 

On October 28, 2008, DCAA reported a satisfactory level of compliance for the FAO reviewed. 

Supporting documentation showed that reviewers found that 2 of 5 audits reviewed had at least 

2 instances of significant noncompliance with GAGAS and DCAA policy, including insufficient 

supervisory involvement and inadequate workpaper documentation to support significant auditor 

judgments and conclusions. 

North-eastern 8 forward pricing 

audits 

On September 27, 2007, DCAA reported satisfactory compliance by the FAO reviewed. 

Supporting documentation showed that reviewers found that 4 of 8 audits had at least 2 

significant instances of noncompliance with GAGAS or DCAA policy and 2 of the 4 audits had 3 

instances of noncompliance, including inadequate planning and supervision and failure to 

exercise reasonable professional judgment. 

Central 8 other (various) 

assignments 

On April 4, 2006, reviewers gave the FAO reviewed a satisfactory rating. However, supporting 

documentation showed that audit quality reviewers found that 2 of 8 assignments had at least 

two significant deficiencies related to noncompliance with GAGAS and DCAA policy, including 

inadequate planning on 3 assignments and inadequate supervision on 2 assignments. 

Reviewers also determined that the auditor on one other assignment had not met the annual 

requirement for continuing professional education. 

Western 5 incurred cost 

audits 

On April 26, 2005, reviewers gave the FAO a satisfactory rating. Although the audit quality 

review documentation identified only 1 audit that had at least 2 instances of significant 

deficiencies, the documentation noted limited testing and stated that statistical sampling was not 

used, as required. The reviewers also found that audit working papers did not support the 

conclusions in the audit report. The reviewers noted that insufficient supervisory involvement 

was responsible in part for the deficiencies found in the audit. 

Mid-Atlantic 6 incurred cost 

audits 

On September 29, 2005, reviewers reported a satisfactory level of compliance for this FAO. 

However, supporting documentation showed that 4 of the 6 audits had at least 2 significant 

deficiencies related to noncompliance with GAGAS and DCAA policy. For example, audit quality 

reviewers noted that the risk assessment for one assignment inappropriately stated the 

contractor’s accounting system was adequate. In addition, reviewers stated that conclusions and 

opinions in reports for three audits were not based on sufficient evidence. Reviewers also noted 

that three audits had significant deficiencies, including insufficient testing, inadequate 

procedures to identify illegal acts and noncompliance with laws and regulations, and reporting 

problems. Reviewers also found inaccuracies in reporting on three audits and stated that reports 

on 2 of the audits should not have been issued and a reported qualification in the report for the 

third audit was worded incorrectly and implied that work had been performed when the related 

assist audits had not been completed. 

Eastern 6 internal control 

audits 

On June 8, 2004, DCAA reported satisfactory compliance by the FAO reviewed. However, 

supporting documentation showed that 2 of 6 audits reviewed had at least 2 instances of 

significant noncompliance with GAGAS and DCAA policy, including inadequate supervision, 

missing workpapers on the contractor’s control environment, and insufficient and incomplete 

workpaper evidence to support conclusions in the audit reports. 

North-eastern 8 forward pricing 

audits 

On June 26, 2003, DCAA reviewers reported satisfactory level of compliance by the FAO 

reviewed. Audit quality review documentation showed that reviewers found that 6 of the 8 audits 

had at least 2 instances of significant GAGAS or DCAA policy noncompliance. For example, 2 

audits were not adequately planned and 4 audits had inadequate supervisory involvement. In 

addition, supervisory review was performed 10 days after the report was issued on one audit, 

and audit work did not support the reported opinion on a second audit. 

Source: GAO analysis of DCAA documentation. 

Page 34 GAO-09-468 DCAA Audit Environment
 

In March 2009, DCAA officials advised us that going forward, DCAA plans 

to report all audit quality review findings along with recommendations for 

corrective action and follow-up to assure that FAOs have taken 

appropriate corrective action. 

The DOD IG reported an adequate (“clean”) opinion on DCAA’s most 

recent peer review results although the reported evidence indicated that 

numerous audits had serious deficiencies in audit quality.65 In conducting 

DOD’s audit oversight review of DCAA audits for fiscal year 2006, DOD IG 

audit oversight reviewers considered the same results of DCAA’s internal 

audit quality assurance reviews that we analyzed and reviewed numerous 

additional audits, which also identified significant GAGAS noncompliance 

as evidenced by DOD IG peer review findings and recommendations. 

Although the DOD IG report contained evidence of significant, systemic 

noncompliance with professional standards throughout DCAA audits that 

OIG staff reviewed, and the IG report included numerous findings and 

recommendations related to those issues, the DOD IG gave DCAA a 

“clean” peer review opinion,66 concluding that: 

DOD IG Peer Review Opinion 

on DCAA’s Audit Quality 

Control System Is Inconsistent 

with the Underlying 

Deficiencies Reported 

“In our opinion, the DCAA system of quality control for audits and 

attestation engagements performed during the FY ended September 30, 

2006, was designed in accordance with quality standards established by 

Government Auditing Standards (GAS). Further, the internal quality 

control system was operating effectively to provide reasonable 

assurance that DCAA personnel were following established policies, 

procedures, and applicable auditing standards. Accordingly, we have 

determined that the DCAA system of quality control used on audits and 

attestation engagements for the review period ended September 30, 

2006, is adequate.” 

The overall report conclusion in the DOD IG report is not consistent with 

the detailed observations in the report, which indicate numerous 

significant deficiencies in DCAA’s system of quality control. Furthermore, 

based on DCAA’s actions to rescind dozens of audit reports67 related to our 

 

65 All 10 categories of recommendations in the DOD IG’s report related to GAGAS 

compliance problems. 

66 DOD Inspector General, Oversight Review: Review of the Defense Contract Audit 

Agency Quality Control System, Report No. D-2007-6-006 (Arlington, VA: May 1, 2007). 

67 Of the 80 rescinded audit reports, 39 reports were issued in fiscal year 2006—the period 

covered in the DOD IG peer review report on DCAA. 

Page 35 GAO-09-468 DCAA Audit Environment
 

prior investigation and this audit and our analysis of DCAA’s internal audit 

quality review procedures and documentation—all of which relate to the 

period covered by the DOD IG peer review—we concluded that DCAA’s 

quality control system for the period covered by the last DOD IG peer 

review was not effectively designed and implemented to provide 

assurance that DCAA and its personnel comply with professional 

standards. The DCAA audits performed during fiscal years 2007 and 2008 

were performed under the same policy guidance and production-related 

performance metrics as the earlier audits and had the same types of 

GAGAS noncompliance, as indicated by DCAA’s internal audit quality 

review findings for audit reports issued in fiscal years 2007 and 2008. 

In the absence of a risk-based audit planning approach, DCAA has 

historically performed 30,000 to 40,000 audits annually to support 

contracting community decisions on contract awards, administration, and 

close-out using 3,000 to 4,000 auditors—an average of about 10 audit 

reports per year for each auditor. The large number of assignments has 

contributed to the production-oriented environment and widespread 

problems we have identified with audit quality. The failure to perform 

quality audits leaves government contracting officers and disbursing 

officers with inadequate information, ultimately putting taxpayers at risk 

of improper contract payments and fraud, waste, abuse, and 

mismanagement. GAO’s Standards for Internal Control in the Federal 

Government68 require federal agency managers to identify and assess 

relevant risks the agency faces from external and internal sources 

associated with achieving agency objectives, such as those defined in 

strategic and annual performance plans developed under the GPRA. To do 

this, management needs to consider all significant interactions between 

the entity and other parties as well as internal factors at the agency and 

activity levels. The specific risk analysis methodology used can vary by 

agency because of differences in agency missions and the difficulty in 

qualitatively and quantitatively assigning risk levels. For example, DCAA 

would need to consider requirements in law and federal regulation to audit 

contractor cost, price, schedule, systems, and compliance with laws, 

regulations, cost accounting standards, and contract terms. DCAA also 

would need to consider risks associated with contractor activity and the 

materiality of contractor costs. Once risks have been identified, sound 

management controls require that they should be analyzed for their 

DCAA Lacks a Risk-Based 

Audit Planning Approach 

 

68 GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1

(Washington, D.C.: November 1999). 

Page 36 GAO-09-468 DCAA Audit Environment
 

possible effect, and management should decide how to manage the risk 

and what actions should be taken. 

A risk-based audit approach would help identify and prioritize which 

audits are the most important or have the highest return on investment 

and determine what constitutes appropriate testing for various audit and 

nonaudit services. Basing future audit plans on historical DCAA audit hour 

data is problematic because DCAA has not yet determined the time and 

effort that would be needed to perform quality audits. For example, 

historical audit hour data do not accurately reflect either the time needed 

to complete a quality audit or the hours actually worked on various audits 

because many auditors performed limited procedures or they performed 

audit procedures on their own time to meet budgeted audit hour metrics. 

In addition, some audits may not be necessary. For example, we 

concluded that 3 of the 37 internal control audits that we reviewed were 

not necessary. For one of the three audits, DCAA could have relied on the 

audit of a grantee that was performed under the Single Audit Act.69 DCAA 

agreed with our conclusion. Two other unnecessary audits involved 

estimating systems of contractors that only have one contract with the 

government. Because contract proposals, which would be tested as part of 

the estimating system audit for these contractors, are separately audited 

when they are submitted, we questioned the need for separate estimating 

system audits for these contractors. DCAA officials told us they would 

reconsider the need for separate estimating system audits in such cases. 

Developing a risk-based audit approach that considers the risk of 

improper contract payments and available resources would also be a first 

step in determining the level of audit resources and training needed to 

accomplish effective contract audits. In addition, determining appropriate 

roles and responsibilities for nonaudit assignments would further clarify 

DCAA audit resource needs as well as needed job skills and funding for 

buying commands and DCMA. 

The most pervasive audit deficiency we identified was insufficient testing 

to support DCAA’s reported conclusions and opinions. Limited audit 

testing was directly related to DCAA’s goal of performing 30,000 or more 

 

69 Codified, as amended, at 31 U.S.C. ch. 75. The Single Audit Act requires that a state, local 

government or non-profit organization that expends more than $500,000 in a fiscal year 

undergo a single audit, which includes an audit of the entity’s financial statements and 

Schedule of Expenditures of Federal Awards, as well as testing of and reporting on certain 

internal controls. 

Page 37 GAO-09-468 DCAA Audit Environment
 

audit assignments annually. Achieving a goal of performing quality audits 

will depend, in part, on appropriate guidance on testing coupled with 

adequate training and supervision. Quality audits will also be dependent 

upon contracting community support of a risk-based audit approach and 

an appropriate delegation of nonaudit contract administration activities 

and audit responsibilities among DCMA, buying commands, and DCAA. As 

noted above, DCAA provides nearly all of its services to the contracting 

and finance communities as GAGAS audits. However, a risk-based audit 

approach may require these communities to re-evaluate whether all such 

services should be provided as audits and whether DCAA, as an 

independent audit organization would perform any nonaudit services. 

DCAA’s deficiencies in audit quality are directly related to its human 

capital management. Effective, efficient contract audits and oversight are 

dependent on a workforce that has the required skills to meet 

organizational goals and perform quality audits that serve the public 

interest, especially the taxpayer. Both GAGAS and GAO’s Internal Control 

Standards70 require that personnel possess and maintain a level of 

competence that allows them to accomplish their assigned duties. GAGAS 

specifically requires that the staff assigned to conduct audit or attestation 

engagements under GAGAS must collectively possess the technical 

knowledge, skills, and experience necessary to be competent for the type 

of work being performed before beginning that assignment.71 GAGAS also 

requires attestation engagements to be properly supervised.72 Accordingly, 

agency management has a responsibility to identify appropriate 

knowledge and skills needed for various jobs and provide needed training, 

as well as candid and constructive counseling, and performance 

appraisals. DCAA’s human capital management practices of hiring auditors 

at the entry-level and assigning them to complex audits with little 

classroom training or on-the-job experience and minimal supervision have 

contributed to the audit problems we identified. 

DCAA Lacks Effective Human 

Capital Management 

Inadequate training and supervision. DCAA headquarters officials 

acknowledged that the agency could improve developmental training and 

that it does not have continuing training for DCAA auditors throughout 

their career, referred to by DCAA as life-cycle training. Given the 

 

70 GAO-07-731G §§ 3.40 through 3.49, and GAO/AIMD-00-21.3.1. 

71 GAO-07-731G, § 3.43. 

72 GAO-03-673G, § 60.04a, and GAO-07-731G, § 6.04a. 

Page 38 GAO-09-468 DCAA Audit Environment
 

complexity of contract audits and identified DCAA audit quality problems, 

timely and effective training and appropriate supervision are critical to 

achieving effective audits. Auditors also should understand the 

professional standards they are required to follow. 

In addition, we found that on-the-job-training and supervision, which are 

key components of developmental training, were not consistently provided 

to new auditors. On-the-job training for new auditors varied by supervisor 

and by DCAA field office. For example, we previously reported73 that one 

of the offices in our hotline investigation had addressed this training need 

by assigning one supervisor to oversee trainee auditors and assigning 

trainee auditors to senior auditors who provided them on-the-job training 

during a particular audit. However, we identified 13 CAS compliance 

audits at this same office to which trainee auditors were assigned with 

little or no training or supervision. In addition, documentation for one of 

the team performance awards that we recently obtained from this office 

contained evidence that some trainee auditors were immediately given an 

audit assignment to carry out on their own. The performance award 

documentation stated as an achievement that “new hires were purposely 

assigned their own assignments as early as deemed appropriate in order to 

instill in them early the concept that they are responsible for the planning 

and conduct of their assigned audits. The supervisory and senior 

auditor...made a conscious decision to do this to avoid dependency issues 

with the new auditors.” 

Our discussions with auditors in DCAA’s 5 regions provide anecdotal 

examples of the training problems we found. For example, one auditor 

told us that entry level training is a “one-size-fits-all” approach that does 

not provide the right training at the right time, while four auditors told us 

they were not given enough time to develop their skills. One consistent 

comment from auditors was that on-the-job training was key to auditor 

effectiveness, but DCAA provided little or no opportunity for new auditors 

to obtain this developmental experience. Several auditors told us that 

trainees in their offices are given assignments to do on their own and that 

while trainees may work with a senior level auditor, sometimes these 

senior auditors do not take a leadership role that would provide a learning 

experience for trainees. In addition, several auditors described DCAA’s 

internal training courses as “good,” but noted that the courses covered 

high-level conceptual and technical information and did not provide the 

 

73 GAO-08-857. 

Page 39 GAO-09-468 DCAA Audit Environment
 

detailed knowledge on how to apply this information when performing a 

particular contractor audit. Some FAO managers share this concern. 

Supervisors responsible for deficient audits identified in GAO’s 

prior investigation were promoted. At the September 2008 hearing, 

Committee Members expressed concerns about DCAA promotions of 

supervisors who were responsible for improperly dropped audit findings, 

unsubstantiated changes in audit opinions, and abusive management 

actions against whistleblowers at locations covered in our investigation. 

Best practices of leading organizations making organizational and cultural 

changes include top leadership who set the direction, pace, and tone and 

provides a clear, consistent rationale that unites staff together behind a 

single mission. Agency management plays a key role by setting and 

maintaining the organization’s ethical tone, providing guidance for proper 

behavior, removing temptations for unethical behavior, and providing 

discipline, when appropriate. Our review of GAO hotline allegations 

received since our investigation showed that meeting metrics related to 

producing reports within budgeted hours and planned time frames 

resulted in performance awards for auditors who performed deficient 

audits with little or no testing and lower performance ratings and 

personnel actions that resulted in downgrades and termination of auditors 

who did not meet these metrics. Further, our analysis of performance 

appraisals and performance award information for auditors and 

supervisors at the location in our investigation where supervisors had 

been promoted74 showed that the supervisory auditors responsible for 

deficient audits at this location were rewarded with high performance 

appraisals, cash awards, and promotions. 

We obtained performance evaluations and performance award 

documentation for auditors and supervisors involved with 12 audits that 

had serious deficiencies at the first location we investigated in our prior 

work. The DCAA Director told us that there are legal issues associated 

with holding employees, such as the supervisory auditors, accountable for 

actions that were identified after-the-fact. However, the two supervisory 

auditors responsible for the deficient audits were approved for promotion 

even though Western Region managers who made promotion decisions 

were aware of the GAGAS compliance problems. DCAA’s Western Region 

management had received the DOD IG’s January 24, 2007, memorandum of 

investigation covering 10 audits performed at this location that did not 

 

74 GAO-08-857. 

Page 40 GAO-09-468 DCAA Audit Environment
 

meet GAGAS. Further, during the summer of 2007, Region management 

was responding to issues identified in our hotline investigation, which 

mirrored the IG’s concerns and raised concerns about GAGAS compliance 

with four additional audits. Despite these findings, we found no evidence 

that supervisors and auditors who did not follow GAGAS and DCAA policy 

were disciplined, counseled, or required to take additional training. 

Instead, our review of performance appraisal and awards documentation 

showed that the supervisors and auditors responsible for the deficient 

audits received performance appraisals ranging from “exceeds fully 

successful” to “outstanding” along with numerous cash awards. One of the 

two supervisors responsible for inappropriate decisions to drop audit 

findings and change opinions without supporting evidence was promoted 

on October 14, 2007, and the second supervisor was selected for 

promotion on July 25, 2008—3 days after our investigative report was 

issued. DCAA placed a hold on the second supervisor’s promotion pending 

further investigation. In addition, a senior auditor who dropped audit 

findings without support at the direction of the second supervisor was 

promoted to a supervisory auditor position on January 6, 2008. In contrast, 

the performance appraisal of the senior auditor witness from that office 

who testified at the Committee’s September 2008 hearing was lowered two 

levels from “outstanding” to “fully successful” following the submission of 

her hotline complaint, and she received no cash awards. DCAA has 

rescinded all 12 audit reports and re-performed the 12 audits associated 

with our investigation at this field location. 

Allegations about abusive management actions have continued. We 

found that DCAA’s current organization is highly decentralized, fostering a 

culture of region autonomy. Within this culture, DCAA’s Western Region 

appears to have continuing problems with unresolved allegations of 

abusive management actions. For example, 21 of the 34 DCAA hotline 

allegations we received since our July 2008 report,75 include examples of 

abusive management actions, such as auditors being penalized for 

attempting to perform what they believe was sufficient testing to support 

audit opinions and auditors not completing work within established 

timeframes. Nine of these 21 allegations relate to DCAA’s Western 

Region—the subject region in our prior hotline investigations. Seven of the 

9 allegations relate to current problems in the Western Region. Our review 

 

75 We spoke to the auditors and reviewed documentation they provided. To the extent that 

the auditors also submitted complaints to DCAA’s anonymous Web site, we reviewed 

DCAA’s handling of their complaints. 

Page 41 GAO-09-468 DCAA Audit Environment
 

of DCAA anonymous Web site contacts as of the end of May 2007 showed 

that over 40 percent (65 of 152) of the DCAA contacts also relate to the 

Western Region, including several that pertain to abusive management 

actions.76 Although DCAA headquarters officials have followed up on some 

of the complaints about management abuse that they received, decisions 

on disciplinary or corrective action typically have been delegated to region 

management. DCAA headquarters officials explained that in several cases, 

Western Region management has not agreed to take disciplinary or other 

available corrective actions. The officials told us that DCAA hotline staff 

have no recourse in these situations. 

Although DCAA has taken several positive steps, much more needs to be 

done to address widespread audit quality problems. DCAA’s productionoriented culture is deeply imbedded and likely will take several years to 

change. Under the decentralized management environment, there has been 

little headquarters oversight of DCAA regions, as demonstrated by 

nationwide audit quality problems. Further, DCAA’s culture has focused 

on hiring and promoting from within the agency and most training has 

been conducted by agency staff. This has led to a very insular culture 

where there are limited perspectives on how to make effective 

organizational changes. In response to our July 2008 investigative report,77

DOD’s former Comptroller/CFO and Defense Business Board (DBB) 

conducted reviews78 of DCAA operations and made recommendations for 

corrective actions. The recommendations of the DBB are consistent with 

many of the recommendations discussed later in this report. DCAA has 

taken actions to revise performance metrics, change certain policy 

guidance, and obtain an independent organizational assessment (staff 

survey); however, DCAA has not yet addressed the fundamental 

weaknesses in its mission, strategic plan, audit approach, and human 

capital practices. Moreover, DCAA actions to date have focused on 

DCAA Has Made 

Progress, but 

Correcting 

Fundamental 

Problems in Agency 

Culture That Have 

Impacted Audit 

Quality Will Require 

Sustained Leadership 

 

76 After we provided our report to DOD for comment, we received updated information on 

DCAA anonymous Web site complaints. As of the end of July 2009, DCAA had established 

209 cases. Eight of those cases were immediately referred to the DOD IG for investigation. 

Of the 209 cases, 82 were for the Western Region. 

77 GAO-08-857. 

78 Based on audit quality problems identified in our July 2008 report, in August 2008, the 

DOD Comptroller/CFO conducted a tiger team review in August 2008 and also asked the 

Secretary of Defense for support in conducting a study of DCAA. With the Secretary’s 

approval, the DOD Advisory Panel determined that the Defense Business Board would 

perform this study. 

Page 42 GAO-09-468 DCAA Audit Environment
 

process and have not addressed the agency’s decentralized organizational 

structure that has fostered a culture of DCAA region autonomy. On 

October 23, 2008, the DBB discussed its preliminary findings and 

recommendations at a public meeting, and on January 22, 2009, the DBB 

released its DCAA study report, which concluded that: 

• DCAA’s mission focused primarily on supporting the procurement 

community with no mention of protecting taxpayer interest. The 

current mission statement also provided for advisory services that 

raised serious questions about DCAA’s independence and objectivity 

under GAGAS. 

• DCAA’s strategic plan did not address essential elements required by 

GPRA, and it did not address emerging issues that could affect mission 

accomplishment or contain a human capital strategic plan despite 

spending 80 percent of its budget on personnel. 

• None of DCAA’s 24 performance measures addressed audit quality, 

such as conformance to GAGAS, and only 8 could be tied to DCAA’s 

strategic plan. 

• DCAA’s decentralized organizational culture dilutes effectiveness of 

managerial oversight and affects GAGAS compliance and audit quality. 

• DCAA has not established a human capital strategic plan as a key tool 

to facilitate human capital management and workforce development in 

support of DCAA’s mission and implementation of its strategic plan. 

The following discussion summarizes the status of DCAA corrective 

actions on identified weaknesses, including actions on key DBB and DOD 

Comptroller/CFO recommendations. 

DCAA’s Mission Statement 

and Strategic Plan Have 

Not Yet Been Revised 

The DBB report, released in January 2009, pointed out that DCAA had five 

versions of a mission statement, noting that each version focused 

primarily on supporting the procurement community. The Board 

concluded that DCAA’s mission should be refocused to protect the 

taxpayer’s interests, writing: “The mission fostered the culture of 

supporting contracting officials, and the value system was one of quantity 

(number, cost, and timeliness of audits) over quality...which was further 

reinforced by the performance metrics that drove the organization.” In 

addition, the Board reported that instead of complying with GPRA 

strategic planning requirements for long-term goals and objectives for 

Page 43 GAO-09-468 DCAA Audit Environment
 

major operations and functions, DCAA’s plan resembled a short-term 

process improvement checklist and did not address enterprise risk, 

external factors, or emerging issues that could affect mission 

accomplishment. In addition, the Board noted that DCAA’s strategic plan 

did not include an adequate human capital strategy to facilitate workforce 

development, recruiting, retention, and succession planning. 

The DBB report recommended that the Secretary of Defense revise 

DCAA’s mission to focus on protecting the interest of taxpayers, with the 

taxpayer as the primary customer, and that DCAA establish a core value of 

performing high quality, independent, and objective contract audits that 

adhere to GAGAS and ensure that taxpayer dollars are spent on fair and 

reasonable contract prices. The DBB did not address any amendments that 

might need to be made to the FAR, DFARS, and DOD Directives and policy 

documents that reflect DCAA’s primary role as an advisor to government 

contracting officers and disbursing officers.79

The Secretary of Defense Has 

Not Yet Developed a DCAA 

Mission Statement That 

Focuses on Protecting the 

Public Interest 

Leading organizations that have undergone cultural and organizational 

transformation have identified top leadership involvement in developing a 

mission statement and strategic plan as a best practice. These 

organizations consider top leadership commitment in setting the direction, 

pace, and tone for the transformation as essential to provide a clear, 

consistent rationale that unites agency components behind the mission to 

guide the transformation. In meetings with DCAA officials, we expressed 

our concern that the Secretary of Defense had not taken action to revise 

DCAA’s mission statement. On March 12, 2009, following a discussion on 

the preliminary results of our audit, the DCAA Director submitted a 

proposed revision to DCAA’s mission statement to the Comptroller/CFO 

for review. The proposed revision inserted phrases that refer to “...serving 

the public interest” and “...ensure taxpayer dollars are spent on fair and 

reasonable contract prices.” Although the revised mission statement had 

not been approved by the Secretary of Defense as of the end of July 2009, 

these changes would be positive. 

The DBB also recommended that DCAA develop a strategic plan that 

cascades from the revised mission statement and concurrently develop (1) 

an annual performance operating plan and a balanced scorecard tied to 

the strategic plan and (2) a human capital strategic plan. In addition, the 

DCAA Has Not Yet Developed a 

Strategic Plan To Provide a 

Framework for Organizational 

and Cultural Reform 

 

79 On most contracting matters with DCAA involvement, the cognizant agency contracting 

officer makes final decisions based on DCAA’s findings and recommendations. 

Page 44 GAO-09-468 DCAA Audit Environment
 

DBB recommended that DCAA obtain an independent assessment of 

resource needs and engage an external professional organization to assist 

in a cultural transformation. 

DCAA officials told us they are having difficulty identifying an 

independent external professional organization to assist the agency in 

developing a strategic plan because DCAA audits most of the organizations 

that should be able to provide this type of assistance. In her February 27, 

2009, response to the DBB report, the DCAA Director stated that DCAA 

expects to complete action on this recommendation by September 2009. 

With regard to the recommendation to develop a balanced score card, the 

DCAA Director reported that based on agreements with prior DOD 

Comptroller/CFOs, DCAA plans to use a monthly status report of agency 

performance measures rather than developing a balanced score card. 

Together with the change in performance measures for fiscal year 2009, 

DCAA implemented the monthly performance report in October 2008. The 

DCAA Director stated that DCAA will refine the annual performance plan 

in accordance with development of a revised strategic plan. 

The DCAA Director also stated that DCAA initiated a process to 

reengineer its human capital strategic plan in November 2008. The 

Director stated that DCAA obtained example plans from other 

organizations and attended training on human capital plan preparation and 

maintenance. DCAA is also seeking assistance from external organizations 

in reengineering its human capital plan. 

DCAA’s Director Took 

Immediate Action To 

Eliminate Production 

Metrics, but Concerns 

about Audit Quality 

Measures Remain 

The Committee’s September 2008 DCAA oversight hearing raised concerns 

that DCAA’s performance metrics focused on producing reports rather 

than performing quality audits and that auditors who attempted to perform 

quality audits were penalized for not meeting production goals. The DCAA 

Director acknowledged problems with the agency’s metrics and stated that 

she had initiated a project to assess the agency’s use of performance 

measures that would be completed by September 30, 2008. Performance 

metrics provide the basis for measuring achievement of agency mission 

and strategic goals. Accordingly, performance measures should be 

consistent with agency strategic goals. Although DCAA’s mission 

statement and strategic plan have not yet been revised to provide new 

goals, the DCAA Director took action in September 2008 to eliminate 

production-oriented performance measures. On September 30, 2008, the 

Director issued a policy memorandum that eliminated 18 performance 

measures, identified 9 performance measures with goals for use in fiscal 

year 2009, and clarified the use and level of reporting on the revised 

Page 45 GAO-09-468 DCAA Audit Environment
 

measures. Some of the new performance metrics focus on outcomes, 

while others continue to focus on producing low cost audits in fixed time 

frames. 

The DOD Comptroller/CFO required DCAA to develop standard metrics to 

measure and re-enforce compliance with GAGAS and CAM across DCAA 

by February 28, 2009. The DCAA Director reported that the new metrics 

established on September 30, 2008, met this requirement. DCAA identified 

the following six new performance metrics as focusing on the intended 

outcome-related goal of achieving quality audits that comply with 

GAGAS.80

New Performance Metrics 

Intended To Focus on 

Achieving Quality Audits 

1. Obtaining an unqualified DOD IG peer review opinion. 

2. DCAA’s internal quality assurance program results show that 100 

percent of the audits reviewed reflected professional judgment. 

3. Checklist confirmation that issued reports did not include serious 

deficiencies. 

4. A goal that 45 percent of audit reports will have findings as an 

indication of the tangible value of the audit work performed. 

5. A goal that 15 percent of the audits will use quantitative methods to 

measure the extent to which advanced level audit techniques are used. 

6. A goal that auditors will meet 100 percent of their continuing 

professional education requirements on time. 

Only metrics number 1, 3, and 6 have a direct relationship to audit quality. 

Although metric number 2 could improve audit quality if properly 

implemented, DCAA gave passing scores to deficient audits. Given the 

problems with DCAA’s ineffective quality assurance program and DOD IG 

peer review results, for these three metrics to achieve the intended audit 

quality goal, significant changes will be needed in policy guidance and 

training on audit standards, appropriate procedures, and audit 

documentation in order to comply with GAGAS. The fourth goal that 45 

percent of DCAA audit reports will have findings is approximately the 

same as the actual percentage of 41 percent of the reports in 2008. 

Because findings would support recommendations for corrective action, 

this metric could contribute to improvements in accountability over 

contractor cost and billings. Regardless of the goal, findings should be 

reported as appropriate based on the completion of quality audits. Further, 

the use of quantitative methods of analysis in audit reports needs to be 

 

80 DCAA also established contracting officer sustention rates related to questioned cost and 

net savings as an informational goal to show return to the taxpayer. 

Page 46 GAO-09-468 DCAA Audit Environment
 

supported by training on the appropriate methods for sampling and testing 

contract costs, controls, and compliance to help auditors perform 

sufficient testing to support audit conclusions and opinions. 

Although three of DCAA’s fiscal year 2009 metrics are important in that 

they address responsiveness to contracting officer requests for audits, if 

not properly managed, they could impact the effectiveness of DCAA’s new 

audit quality metrics. In the past, DCAA’s efforts to meet contracting 

officer requests for audits within specified time frames caused auditors to 

sacrifice audit quality. The following three performance metrics continue 

to address issuing reports within specified times to support contract 

awards and closeouts. 

Performance Metrics That 

Continue To Measure Output 

• A forward-pricing audit timeliness goal of 95 percent based on 

agreement with requesters. 

• Incurred cost audit timeliness goals of 90 percent of corporate audits 

completed within 12 months, 90 percent of major contractor audits 

completed in 15 months, and 95 percent of non-major contractor audits 

completed in 24 months. 

• An efficiency goal of cost per direct audit hour of less than $113.45 to 

be monitored at the agency level only. 

It is critical that agreements with the contracting community on timeliness 

goals for forward-pricing and incurred cost audits allow performance of 

sufficient audit procedures to help contracting officers ensure that prices 

paid by the government are fair and reasonable, and that contract costs 

comply with applicable laws, regulations, cost accounting standards, and 

contract terms. In addition, keeping cost per direct audit hour in line with 

past practices indicates that DCAA likely would continue to use trainee or 

junior auditors on assignments without senior auditor or supervisory 

auditor involvement. GAGAS requires that staff assigned to perform the 

audit or attestation engagement must collectively possess adequate 

professional competence for the tasks required.81 Moreover, DCAA has not 

agreed to develop a risk-based audit approach to address how it will 

perform required audits with available audit resources, reassess the need 

to perform 30,000 or more audits annually, and establish priorities for 

performing quality audits that meet GAGAS within available resources. 

 

81 GAO-07-731G, § 3.40. 

Page 47 GAO-09-468 DCAA Audit Environment
 

On October 30, 2008, DCAA required regional audit managers to provide 

training on changes in performance metrics to all FAOs by December 31, 

2008, as part of the effort to get the word out that DCAA’s mission should 

be to protect taxpayer interest and that auditors should perform quality 

audits that meet GAGAS. The DCAA Director stressed to us that budgeted 

audit hours would be captured for planning purposes, but they were never 

intended and should not have been used to evaluate auditor performance. 

The DCAA Director also told us that DCAA auditor performance 

appraisals should not have considered exceeding budgeted audit hours as 

a performance failure. In addition, DCAA implemented an anonymous Web 

site for capturing feedback on inappropriate use of the new performance 

measures and abusive management actions. 

During random telephone calls made to 17 auditors across 15 FAOs in the 

five DCAA regions, we found mixed results on FAO implementation of 

DCAA’s new performance metrics. DCAA’s Assistant Director of 

Operations told us she also had become aware of some problems with 

regional audit managers meeting the requirement to provide training to 

FAOs on implementation of the new DCAA performance metrics. The 

Operations Assistant Director told us that she planned to follow-up with 

all FAOs in this regard. In response to our telephone calls, for example: 

Inconsistent Implementation 

and Training on New Metrics 

• Auditors at 13 of the FAOs told us that metrics related to meeting 

budget hours for completing audits have been relaxed. Although most 

of these auditors were not aware of audit completion dates in fiscal 

year 2009 program plans for their offices, two auditors told us that 

audit completion dates had been pushed back to allow more time for 

performing individual audits. An auditor at a Northeast Region FAO 

told us the use of budget hours was flexible before the metrics 

changes, so there was no noticeable difference. An auditor at a 

Western Region FAO said that although budget hours are no longer a 

metric for individual auditor performance, there is still a lot of pressure 

on auditors to meet budgeted hours. 

• Auditors at 5 of the 15 FAOs told us they had received the mandatory 

training on changes in performance metrics prior to December 31, 

2008. However, auditors at 4 FAOs told us they received the mandatory 

training after December 31, 2008, including two auditors at one Eastern 

Region FAO who told us they did not receive the required training until 

February 13, 2009. Auditors at the other 6 FAOs told us they received 

the metrics training, but they could not remember the dates of the 

training. 

Page 48 GAO-09-468 DCAA Audit Environment
 

• Auditors at 5 FAOs told us they were permitted to charge from 1 to 2 

hours of administrative time per pay period for reading e-mails on 

DCAA policy changes and new policy memorandums. Auditors at 2 

FAOs said they were not given an administrative code for this purpose. 

One of these auditors told us they read the policies on their own time. 

Auditors at the remaining 8 FAOs did not mention a time limit for 

reading DCAA policy memoranda. DCAA headquarters officials told us 

that auditors should be permitted to charge administrative codes for 

this purpose and that they are working to resolve this issue across 

DCAA. 

The DCAA Director advised DCAA employees that the new performance 

metrics would be revisited after 6 months to determine if changes are 

needed. On February 11, 2009, DCAA revised its fiscal year 2009 job 

objectives/performance plans to reflect the new performance measures, 

and DCAA’s Deputy Assistant Director of Operations advised us that 

DCAA initiated an assessment of the new performance metrics in April 

2009. 

DCAA Has Centralized, but 

Has Not Yet Restructured 

Its Audit Quality 

Assurance Program 

DCAA has taken some actions to improve its quality assurance program. 

However, staffing difficulties and other issues have left the outcome of this 

important initiative uncertain. As previously discussed, GAGAS require 

that each audit organization performing audits and attestation 

engagements in accordance with GAGAS should have a system of quality 

control that is designed to provide the audit organization with reasonable 

assurance that the organization and its personnel comply with 

professional standards and applicable legal and regulatory requirements, 

and have an external peer review at least once every 3 years.82 In addition, 

considering the large number of DCAA audit reports issued annually and 

the reliance the contracting and finance communities have placed on 

DCAA audit conclusions and opinions, an effective quality assurance 

program is key to protecting the public interest. Such a program would 

report review findings along with recommendations for any needed 

corrective actions; provide training and additional policy guidance, as 

appropriate; and perform follow-up reviews to assure that corrective 

actions were taken. When we briefed DCAA on our preliminary findings in 

March 2009, DCAA had not yet taken action to correct serious deficiencies 

in its quality assurance program, including problems with DCAA’s 

application of the professional judgment standard, whereby quality 

 

82 GAO-07-731G, §§ 3.49-3.52. 

Page 49 GAO-09-468 DCAA Audit Environment
 

assurance program officials gave satisfactory ratings when significant 

noncompliance with GAGAS had been identified by reviewers. 

In response to our previous report, on August 20, 2008, the DOD 

Comptroller/CFO required that DCAA take certain actions to improve 

audit quality, which included a restructuring of DCAA’s quality assurance 

function. Accordingly, on August 22, 2008, DCAA established a new 

headquarters Directorate for Quality Assurance and Integrity, which 

centralized the quality assurance function at DCAA headquarters. The 

DOD Comptroller/CFO directed that the new Quality Assurance 

Directorate be headed by a Senior Executive Service (SES) Deputy 

Director. Because DOD did not grant DCAA an additional SES position for 

this purpose, the DCAA Director assigned responsibility for leading 

DCAA’s quality assurance function to a level GS-15, Assistant Director for 

Integrity and Quality Assurance. Under DCAA’s management environment 

and culture, which continue to foster autonomous regions headed by SESlevel directors, the grade level and experience of the GS-15 equivalent 

Assistant Director for Integrity and Quality Assurance pose a challenge 

when dealing with SES-level regional directors, deputy directors, and 

regional audit managers. For example, when presented with our findings 

and conclusions that various audits did not comply with GAGAS, DCAA 

headquarters policy and quality assurance managers allowed regions and 

FAO’s to decide whether to rescind the subject audit reports. In March 

2009, DCAA officials advised us that the GS-15, Assistant Director for 

Integrity and Quality Assurance position is an intended SES position and 

that two GS-15 Assistant Directors will perform as Chief of Integrity and 

Chief of Quality Assurance. 

In centralizing the quality assurance program, DCAA’s new quality 

assurance organization provides for five GS-14 senior quality assurance 

auditors at DCAA headquarters and up to 27 GS-13 quality assurance 

auditors in the field assigned across the 5 DCAA regions. However, a 

headquarters requirement that all senior quality assurance staff relocate to 

DCAA headquarters at Fort Belvoir, Virginia, resulted in all but one of the 

five senior staff accepting other positions within DCAA because they did 

not wish to relocate. It took several months to recruit DCAA staff for the 

senior quality assurance positions at DCAA headquarters. On July 10, 2009, 

a DCAA headquarters official advised us that DCAA had selected staff to 

fill the two remaining vacancies, and these staff would be reporting for 

duty in the next few weeks. 

In response to our concerns that DCAA’s quality assurance program has 

not resulted in audits that comply with GAGAS, DCAA officials advised us 

Page 50 GAO-09-468 DCAA Audit Environment
 

that going forward, DCAA will no longer rate an FAO’s overall compliance 

with GAGAS and DOD policy. The officials told us that instead, DCAA 

headquarters plans to (1) report the detailed results of the audit quality 

reviews, (2) make recommendations to FAOs for any needed corrective 

actions, (3) conduct follow-up reviews for all FAOs with identified audit 

deficiencies to ensure that corrective actions are taken, and (4) provide 

training and policy guidance, as appropriate. If properly implemented, 

these procedures would help to assure an effective audit quality assurance 

program. 

DCAA Disagrees with the 

DBB Recommendation for 

a Risk-Based Audit 

Planning Process 

The DBB recommended that DCAA establish a risk-based planning 

process that expands DCAA self-initiated audits and increases the 

potential for identifying fraud, waste, and abuse, and higher rates of return 

to the taxpayer by April 2009. The DBB intended for DCAA to audit any 

and all contracts awarded by the department. On February 27, 2009, in 

responding to the DBB recommendation, the DCAA Director stated that 

(1) DCAA’s practice of auditing only certain contracts was due to 

regulation or statute and (2) absent the DCAA access-to-records clause in 

certain types of contracts, DCAA has no legal basis to obtain cost data 

from a contractor. The DCAA Director suggested that the DBB 

recommendation should be directed to the Under Secretary for 

Acquisition, Technology and Logistics, who oversees DCMA, and not 

DCAA. The DCAA Director told us that she believes that DCMA should 

address this recommendation because DCMA decides what audits DCAA 

should perform to support contracting decisions and DCMA would need to 

initiate action to change audit-related FAR requirements. 

Generally, DCAA, as the agent of the Secretary of Defense, has authority83

to examine records of (1) a contractor performing any costreimbursement, incentive, time-and-materials, labor-hour, or price redeterminable contracts and subcontractors performing such contracts of 

the contractor and (2) to evaluate the accuracy, completeness, and 

currency of certified cost or pricing data required to be submitted 

pursuant to law, all records of the contractor or subcontractor related to 

the proposal, and discussions conducted on the proposal, pricing of the 

contract or subcontract or performance of the contract or subcontract. 

This authority is implemented by insertion of the Audit of Records clause 

in solicitations for negotiated contracts.84 In addition, the Director of 

 

83 10 U.S.C. § 2313 and § 2306a. 

84 FAR §§ 52.214-26, 52.215-2. 

Page 51 GAO-09-468 DCAA Audit Environment
 

DCAA may require by subpoena the production of any records of a 

contractor that the Secretary of Defense is authorized to audit or examine. 

While DCAA does not have access to the records of all DOD contractors or 

statutory rights of access to contractor officials, we believe it has 

sufficient authority to undertake a risk-based audit approach consistent 

with its existing authority. Therefore, we believe the DBB 

recommendation for DCAA to develop a risk-based audit planning 

approach is appropriate. DOD acquisition officials we met with agree. 

Further, as previously discussed, a risk-based audit approach would 

provide a basis for determining audit resource requirements. 

DCAA has selected the Army Force Management Support Agency85 to 

perform its staffing study. However, DCAA is conducting a staffing study 

as a stand-alone effort rather than performing the study in concert with an 

effort to establish a risk-based planning process. To provide useful 

information for decision making, it is important that the staffing study and 

risk-based audit planning approach are conducted as integrated efforts. It 

is also important for the DOD contracting and finance communities to be 

involved in the staffing study analysis and planning process because, as 

discussed earlier, a risk-based audit approach may require these 

communities to re-evaulate whether all DCAA services should be provided 

as audits and whether DCAA, as an independent audit organization, should 

perform any nonaudit services. 

To address immediate staffing needs, DCAA requested funds for additional 

audit staff and training from the Defense Acquisition Workforce 

Development Fund,86 including 300 positions for fiscal year 2009 and 

another 200 positions in 2010. DCAA received approval of this request in 

December 2008. In May 2009, as part of DOD’s request for an additional 

9,000 positions for contract management and oversight, the DCAA request 

was increased from 500 to 700 new positions that are to be phased in from 

 

85 The Army Force Management Support Agency’s mission includes providing requirements 

studies and staffing analysis as well as determining whether organizations have the 

appropriate staff to carry out their mission. The Army Force Management Support Agency 

also provides services to DOD components. 

86 Pub. L. No. 110-181, §1705, 122 Stat. 3 (Jan. 28, 2008), the National Defense Authorization 

Act for Fiscal Year 2008, authorized the Secretary to establish the Department of Defense 

Acquisition Workforce Fund, in addition to other funds that may be available, for the 

recruitment, training, and retention of department acquisition personnel. The fund is 

managed by the Under Secretary of Defense for Acquisition, Technology, and Logistics. 

Page 52 GAO-09-468 DCAA Audit Environment
 

fiscal year 2009 through 2011.87 As previously discussed, without 

developing a risk-based audit approach, it is difficult to determine the level 

of resources needed to perform effective, quality contract audits. 

However, federal acquisition and contract audit resources have not kept 

pace with the growth on federal procurements. As shown in figure 2, 

although procurement obligations related to greater reliance on 

contractor-provided services and support of the Global War on Terrorism 

have more than doubled since fiscal year 2002, DCAA audit resources have 

remained about the same. In addition, contractor and subcontractor 

relationships have become more complex, increasing the complexity of 

contract audits. These changes underscore the need for a risk-based audit 

plan and assessment of auditor resource and training needs. 

ine the level 

of resources needed to perform effective, quality contract audits. 

However, federal acquisition and contract audit resources have not kept 

pace with the growth on federal procurements. As shown in figure 2, 

although procurement obligations related to greater reliance on 

contractor-provided services and support of the Global War on Terrorism 

have more than doubled since fiscal year 2002, DCAA audit resources have 

remained about the same. In addition, contractor and subcontractor 

relationships have become more complex, increasing the complexity of 

contract audits. These changes underscore the need for a risk-based audit 

plan and assessment of auditor resource and training needs. 

Figure 2: Comparison of DOD Contract Obligations and DCAA Workforce for Fiscal 

Years 2002 through 2008 

0

50

100

150

200

250

300

350

400

2002 2003 2004 2005 2006 2007 2008

Dollars in billions

Source: GAO analysis of unaudited obligations data from the Federal Procurement Data System and acquisition workforce data from

the Office of Personnel Management.

DOD contract obligations

DCAA audit workforce

0

2

4

6

8

10

Audit workforce in thousands

$171

$195

$231

$270

$299

$331

$383

3.5 3.5 3.5 3.5 3.5 3.6 3.6

Fiscal year

 

87 According to a DOD Comptroller official, DCAA will receive an additional 300 positions 

in fiscal year 2009 and additional 200 positions in each of fiscal years 2010 and 2011. 

Page 53 GAO-09-468 DCAA Audit Environment
 

Although DCAA has undertaken certain initiatives to improve the 

effectiveness of audits of contractor billings and internal control systems, 

these efforts are not targeted for completion until September 2010 and 

September 2012, respectively, and they are not part of a comprehensive 

audit strategy or framework. Once decisions are made on changes in 

various audit procedures for these audits, related audit guidance and 

training would be needed to help ensure the new procedures are 

effectively implemented. 

DCAA Issued Revised 

Policy Guidance To 

Address Auditor 

Independence, Assure 

Management Involvement 

in Key Decisions, and 

Address Audit Quality 

Issues 

Our investigation and audit identified problems and concerns related to 

auditor independence, the need for management involvement in key 

decisions, and audit quality. In response to our work, the DBB and DOD 

Comptroller/CFO made several recommendations for DCAA actions to 

address these concerns. Specific DCAA actions and our assessment 

include the following. 

Auditor independence. The DBB recommended that DCAA address 

advisory-type (nonaudit) services by (1) discontinuing participation on 

Integrated Product Teams and Source Selection Evaluation Boards, both 

of which impair auditor independence in fact and appearance under 

GAGAS; (2) reevaluating the role and number of Financial Liaison 

Advisors (FLA) to ensure independence and objectivity in both fact and 

appearance; and (3) working with the DOD acquisition leadership to 

explore alternatives for providing technical advice and support to the 

contract management community while adhering to the auditor 

independence standards in GAGAS. 

The DCAA Director responded that DCAA discontinued participation in 

Integrated Product Teams on August 4, 2008, and Source Selection 

Evaluation Boards on September 12, 2008. On November 23, 2008, DCAA 

realigned all FLAs to report directly to DCAA headquarters and completed 

an assessment of the number of advisors. DCAA is continuing to assess the 

functions performed by FLAs to assure their independence. The DCAA 

Director stated that if there is a significant change in the advisory 

functions, DCAA will initiate discussions with DOD acquisition leadership. 

We support efforts to reevaluate DCAA’s nonaudit advisory services given 

the problems identified in our investigation. Although our review of 

DCAA’s CAM guidance found that DCAA had established appropriate 

guidelines to avoid independence issues, we found that the auditors had 

not followed DCAA policy. According to the DCAA Director, the DBB’s 

primary concern is that DCAA participation in these advisory services 

created the appearance of a lack of independence. 

Page 54 GAO-09-468 DCAA Audit Environment
 

Requirement for DCAA management involvement in key decisions.

DCAA issued policy memorandums requiring that (1) FAO managers sign 

all audit reports issued by the FAO; (2) auditors elevate memorandums on 

disagreements with supervisors and FAO managers on draft audit opinions 

to the highest level necessary, including the DCAA Director, for resolution; 

and (3) auditors elevate problems in accessing contractor records to FAO 

managers, contracting officers, and regional offices for appropriate 

handling. 

DCAA action to require FAO managers to sign all audit reports issued by 

the FAO addresses concerns identified in our investigation that 

supervisors could inappropriately issue reports with adequate (“clean”) 

opinions without review by FAO managers. Similarly, the policy to elevate 

disagreements on changes to audit opinions responds to findings in our 

investigation that supervisors ignored auditors’ objections to dropped 

findings and changed opinions, and the auditors had no opportunity to 

elevate their disagreement beyond the supervisors. The access-to-records 

policy clarified actions required when auditors are denied access to 

records and required FAO managers to brief their staff on the revised 

guidance. The revised policy guidance emphasized that auditors (1) should 

follow procedures for addressing denial of access to records, which 

include notifying the FAO manager, contracting officer, and DCAA region; 

(2) take appropriate actions to effect a suspension or withholding of any 

unsupported costs billed to the government until the data are received and 

a determination is made regarding the allowability of the costs; and (3) 

question the unsupported costs in the audit report if the supporting 

documentation is not received prior to the completion of fieldwork. 

Although our work identified some access-to-records problems, in these 

cases, there was no evidence that DCAA supervisors elevated the issue to 

management or to procurement officials to initiate enforcement action, as 

set out in existing DCAA policy. 

Guidance to improve audit quality. On August 6, 2008, the DCAA 

Director requested that each FAO hold a stand-down day (where staff 

were relieved of assigned duties to take mandatory training) to discuss 

audit quality and the requirement to comply with GAGAS requirements for 

competence, integrity, objectivity, and independence in performing 

contract audits. In addition, DCAA issued policy guidance on adequate 

audit documentation and testing, including the following guidance that 

applied to assignments we reviewed for this report: 

• “Workpaper Documentation of Judgmental Selections”—requires a 

description of the universe (population) from which items are selected 

Page 55 GAO-09-468 DCAA Audit Environment
 

for testing, identification of items and attributes to be tested, and an 

explanation to support that the judgmental selection will result in 

adequate audit coverage. 

Emphasizing the requirement that audit documentation include a 

description of the population used for sampling and identification of 

items and attributes to be tested is appropriate. However, the 

requirement for an explanation in the audit documentation that the 

judgmental selection will result in adequate audit coverage needs to be 

sufficiently justified. GAGAS and AICPA standards require that 

auditors document significant decisions affecting the audit objectives, 

scope and methodology, findings, conclusions, and recommendations 

resulting from professional judgment.88

• “Audit Guidance for Annual Testing of Contractor Eligibility for Direct 

Bill,” which is intended to determine whether continued reliance can 

be placed on the contractor’s procedures for preparation of interim 

vouchers. This policy change clarified and consolidated audit steps 

related to the contractor’s compliance with contract provisions, added 

audit steps for reviewing vouchers under time-and-material and laborhour contracts, and removed the requirement to verify that the 

contractor’s Central Contractor Registration is current. The policy 

memorandum states that this scope of work performed does not 

constitute an audit or attestation engagement under GAGAS. 

It is within DCAA’s purview to determine whether these procedures 

constitute an audit. However, because direct-bill decisions present a 

risk of undetected improper contract payments, prudent decisions to 

continue a contractor’s direct-bill authorization would necessarily be 

based on testing a statistical sample of invoices89 and include a review 

 

88 GAO-07-731G, § 3.38 and AU § 339.12. 

89 Disbursing officers are authorized to make payments on the authority of a voucher 

certified by an authorized certifying officer, who is responsible for the legality, accuracy, 

and propriety of the payment. 31 U.S.C. §§ 3325, 3527(c). DOD 7000.14-R, Department of 

Defense Financial Management Regulation (DFMR), Vol. 5, Ch. 11 (March 2009), paras. 

110102, 110203. In general, certifying officers designated in writing by the agency are 

financially liable for any improper, illegal, or incorrect payment made, and each payment 

made must be audited (or “examined”). 31 U.S.C. §§ 3521(a), 3528(a). DFMR, Vol. 5, Ch. 33 

(April 2005), para. 330303. However, 31 U.S.C. § 3521(b) authorizes heads of agencies to 

carry out a statistical sampling procedure, within certain parameters, to audit vouchers 

when the head of the agency determines that economies will result. Further, 31 U.S.C. § 

3521(c) provides that certifying and disbursing officials are not liable for payments that are 

not audited if they were made in good faith under a statistical sampling procedure. See 68 

Comp. Gen. 618 (1989); also see generally, GAO, Policy and Procedures Manual for 

Guidance of Federal Agencies, title 7, §§ 6.5, 7.4, and 7.5 (Washington, D.C.: May 18, 1993). 

Page 56 GAO-09-468 DCAA Audit Environment
 

of supporting documentation, including documentation to confirm the 

government received goods and services noted on the billing invoice. 

We confirmed that Defense Finance and Accounting Service certifying 

officers rely on DCAA reviews, and they do not repeat review 

procedures they believe to be performed by DCAA. 

Human Capital 

Management and Cultural 

Transformation 

The DBB made two recommendations to improve DCAA human capital 

management and agency culture, namely that DCAA (1) develop a human 

capital strategic plan as a key tool to facilitate human capital management 

and workforce development and (2) engage an external professional 

organization to assist in a cultural transformation that includes 

emphasizing core values such as quality, independence, ethics, and 

objectivity rather than a mindset focused on quantity and productivity. 

DCAA has not yet developed a human capital strategic plan as a key tool 

to facilitate human capital management and workforce development. In 

May 2009, DCAA finalized an agreement with the Naval Post Graduate 

School, Center for Defense Reform, for assistance on cultural reform. 

According to GAO’s Internal Control Standards,

90 operational success is 

possible only when the right personnel for the job are on board and are 

provided the right training, tools, structure, incentives, and 

responsibilities. Accordingly, management should ensure that skill needs 

are continually assessed and that the organization is able to obtain a 

workforce that has the required skills that match those necessary to 

achieve organizational goals. In addition, training should be aimed at 

developing and retaining employee skill levels to meet challenging 

organizational needs; qualified and continuous supervision should be 

provided to ensure that internal control objectives are achieved; and 

performance evaluation and feedback, supplemented by an effective 

reward system, should relate employee performance to the organization’s 

success. 

Lack of a human capital strategic plan. The lack of a human capital 

management strategic plan has limited the effectiveness of DCAA’s hiring, 

training, and staff development efforts. DCAA officials told us they view 

contract auditing as a highly specialized profession that requires 

knowledge of acquisition law and regulations and government 

procurement and contract management processes. As a result, DCAA 

officials believe that auditors must be hired at the entry level and trained 

 

90 GAO/AIMD-00-21.3.1. 

Page 57 GAO-09-468 DCAA Audit Environment
 

to perform contract audits. The officials also believe that because DCAA is 

the only contract audit agency in the federal government and it operates 

the only federal contract audit training institute, DCAA is in the best 

position to train contract auditors. However, DCAA is not the only agency 

that performs contract audits. Many IG offices, including the DOD IG, the 

military service audit agencies, several executive agency IGs, and GAO all 

perform contract audits. Further, DCAA has not provided training that is 

designed to develop contract audit skills at successively higher levels, and 

it has not provided adequate or continuous supervision of audit staff. 

Moreover, our work has shown that performance evaluations and 

feedback have not always related performance to the agency’s success, as 

was the case when supervisors who were responsible for improperly 

dropping audit findings and changing draft audit opinions received high 

performance evaluations and cash awards. 

At the September 2008 hearing, the DCAA Director acknowledged the 

need to develop revised training to address audit quality issues. However, 

it will take considerable time to develop a revised training program to 

address the range of changes in audit policies, processes, and procedures 

for performing quality audits in accordance with GAGAS. However, on 

April 8, 2009, DCAA revised its Supervisory Development Training 

Curriculum to emphasize leadership skills and better reflect the day-to-day 

activities performed by supervisors. This revision was based on feedback 

received through DCAA’s suggestion program, anonymous Web site 

contacts, and focus groups and is not based on a study or expertise of an 

outside professional organization. In addition, DCAA has begun a 

reassessment of the 2-week technical indoctrination class for new hires. 

Although it is appropriate to consider staff input in developing training 

courses, the development of in-house training by agency personnel may 

not result in a design that encourages participants to develop more critical 

analysis of the underlying principles or ways to bring about organizational 

change. Outside expertise helps ensure that an organization benefits from 

outside subject matter experts as well as education and training 

professionals who have a broad perspective on innovative approaches to 

best practices or best learning design. 

DCAA has difficulty identifying an independent professional 

organization to assist in cultural transformation. According to the 

DCAA Director, DCAA faces challenges in engaging a professional 

organization to assist with cultural change because (1) many external 

organizations that provide this service are audited by DCAA and to 

preserve the appearance of independence under the auditing standards, 

Page 58 GAO-09-468 DCAA Audit Environment
 

DCAA cannot engage organizations that it audits and (2) based on initial 

discussions with various organizations, DCAA believes this effort could 

cost from $1 to $2 million or perhaps more and DCAA would need 

additional funding to pay for this assistance. However, based on an 

assumption that DCAA would receive funding for this effort, the Director 

established a completion date of January 2010 with training of the 

workforce potentially extending into fiscal years 2011 and 2012. In the face 

of these challenges, the DCAA Director took action on three other 

initiatives related to cultural change. The DCAA Director stated that 

shortly after issuance of our July 2008 report, DCAA initiated a 1- to 2-year 

project to accomplish an organizational assessment using the Baldrige 

National Quality Program91 criteria with assistance from Baldrige experts 

within the Army. In addition, as required by the DOD Comptroller/CFO in 

September 2008, the Director asked the Office of Personnel Management 

to conduct an independent organizational survey of DCAA. As previously 

discussed, to help ensure that DCAA’s new performance metrics resulted 

in appropriate cultural change with regard to the new emphasis on audit 

quality, DCAA established an anonymous Web site for obtaining feedback 

on the inappropriate use of the performance measures. 

In May 2009, DCAA asked the Naval Postgraduate School, Center for 

Defense Reform to assist DCAA with cultural transformation as 

recommended by the DBB. The Center began work in June 2009 to help 

DCAA identify issues facing the organization and develop an action plan. 

Delay in reporting results of DCAA’s organizational survey. DCAA’s 

independent organizational survey was completed during the fall of 2008, 

and DCAA officials said the assessment results would be finalized in 

March 2009, but then amended the date for completing the assessment of 

the survey results to late July 2009. Therefore, the survey results were not 

available to us for review. 

DCAA’s anonymous Web site contacts underscore the need for a 

separate hotline office. DCAA’s anonymous Web site was established as 

a mechanism for monitoring compliance with DCAA’s new performance 

metrics; however, it has become an internal hotline, with many auditors 

 

91 The Baldrige National Quality Program is named for Malcolm Baldrige, a former 

Secretary of Commerce, who was a proponent of quality management as a key to national 

prosperity and long-term strength. The seven Baldrige performance excellence criteria are: 

leadership; strategic planning; customer and market focus; measurement, analysis, and 

knowledge management; workforce focus; process management; and results. 

Page 59 GAO-09-468 DCAA Audit Environment
 

reporting the same issues as those presented in hotline complaints 

received by GAO. The DBB report stated that DCAA would benefit from 

the establishment of a Chief of Internal Review to perform critical 

inspector general functions, such as performing periodic reviews and 

evaluations, serving as an ombudsman between staff and DCAA 

management, and addressing hotline complaints. Instead of establishing a 

separate Internal Review function, in March of 2009, the DCAA Director 

divided responsibilities of its Operations Directorate between the 

Operations Assistant Director and Deputy Assistant Director to provide 

dedicated staff to handle auditor concerns reported to the internal DCAA 

anonymous Web site. DCAA’s Assistant Director of Operations along with 

a Division Chief and three program managers were made responsible for 

the DCAA hotline function, and the Deputy Assistant Director of 

Operations was given responsibility for day-to-day operations. 

Our review of DCAA headquarters handling of DCAA auditor concerns and 

hotline allegations sent to DCAA’s anonymous Web site determined that 

internally reported DCAA auditor concerns represent problems across all 

five DCAA regions. As with GAO hotline complaints, the largest number of 

problems reported to DCAA’s anonymous Web site related to DCAA’s 

Western Region. Our review of DCAA documentation and discussions with 

auditors and DCAA officials indicate that current handling of internally 

reported DCAA auditor concerns and allegations appears to be timely, 

objective, and fact-based. The Assistant Director of Operations has made 

good progress in establishing credibility and trust in the DCAA hotline 

function. It will be important for any future inspector general or 

ombudsman to carry forward in this role. The DCAA Director’s response 

to the DBB report did not address the recommendation to establish a 

Chief of Internal Review. We agree with the DBB recommendation. It is 

important for DCAA to have a hotline function that is separate from 

management and operations. Currently, the Operations Assistant Director 

has been reassigned to handle this function on a temporary basis. 

However, given the size of the DCAA organization, the extensive number 

of internal DCAA hotline complaints—which totaled about 150 at the end 

of May 2009—and the likelihood of continuing hotline contacts that would 

need to be addressed as DCAA undergoes its cultural transformation, a 

permanent internal review or inspector general function is warranted. 

Page 60 GAO-09-468 DCAA Audit Environment
 

In addition to correcting the fundamental weaknesses in mission and the 

overall management environment discussed above, certain legislative and 

other actions, such as changes in organizational placement, could enhance 

DCAA’s effectiveness and independence. Successful management 

initiatives for cultural and organizational change in large private and 

public sector organizations can often take several years to accomplish. 

Changing DCAA’s organizational placement without first correcting 

fundamental weaknesses in mission and the overall management 

environment would not assure effective audits. Given this time frame and 

pursuant to your request, we identified legislative and other actions that 

decision makers can consider to improve DCAA’s effectiveness. In the 

short term, Congress could enhance DCAA’s effectiveness and 

independence by granting DCAA certain authorities and protections 

similar to those offered to presidentially appointed inspectors general 

under the Inspector General Act of 1978, as amended92 (IG Act). The IG 

Act contains provisions that enhance the independence of presidentia

appointed IGs, including protections from removal without congressional 

notification, access to independent legal counsel, public reporting of audit 

results, rights to take statements from contractor and other personnel, and 

budget visibility. These provisions would enhance the important DCAA 

initiatives currently under way. Continued monitoring and oversight will 

be essential to assuring the successful implementation of DCAA’s 

management initiatives. In the longer term, Congress could consider 

changes in organizational placement after current reform efforts have 

been effectively implemented. However, moving DCAA as an organization 

would require careful analysis and planning before implementation. 

Legislative and Other 

Actions To Improve 

DCAA’s Effectiveness 

and Independence 

lly 

 

Short-Term Legislative 

Actions 

In addition to DCAA management reforms already under way and our 

additional recommendations, we identified certain legislative protections 

and authorities under the IG Act that could enhance DCAA’s effectiveness. 

Legislation would be needed in order to grant DCAA such protections and 

authorities. 

Leadership. The IG Act provides for the President to appoint the IG, with 

Senate confirmation, at many federal agencies.93 Under the act, Congress 

must be notified in advance of removing the IG, and only Congress can 

92 Codified in an appendix to Title 5 of the United States Code (hereafter 5 U.S.C. App.). 

93 The IG Act also requires the heads of many “designated federal entities” to appoint an 

inspector general for each entity. 5 U.S.C. App. 8G. 

Page 61 GAO-09-468 DCAA Audit Environment
 

eliminate the office of an IG. Currently, the head of DCAA is appointed and 

can be removed by the Secretary of Defense. Further, DCAA was created 

and can be reorganized or reassigned by departmental order without 

notice. IG Act protections Congress could grant to DCAA would therefore 

include (1) Senate confirmation of a presidentially appointed DCAA 

Director94 and (2) removal of the DCAA Director conditioned on 

congressional notification. 95 Specifically, the act provides that an 

inspector general may be removed from office by the President and any 

removal is to be reported to both Houses of Congress 30 days prior to the 

removal. In addition to these IG Act protections, Congress could build 

additional provisions into legislation, to include the following: 

• Requirements that the DCAA Director possess the appropriate 

professional qualifications. For example, provisions for appointment of 

the DCAA Director could require selection from among individuals 

who possess demonstrated ability in managing and leading 

organizations, specific accounting or auditing background, general 

knowledge of contract management, and knowledge of and extensive 

practical experience in financial management practices in large 

governmental or business entities. 

• A mandate permitting the DCAA Director to hold a renewable term 

appointment for between 5 to 7 years. Legislation should provide that 

the DCAA Director can be removed only for cause or other stated 

reasons. These protections would allow the head of DCAA to provide 

stability and continuity of leadership that span presidential 

administrations and prevent removal except for cause or other 

disclosed reasons. 

• Conflict of interest provisions for the DCAA Director and other key 

staff in addition to those provisions currently in law. This would be 

intended to ensure that selection of the audit agency head would not 

involve a “revolving door” situation between contractors and the 

contract audit agency. 

Access to independent legal counsel. The IG Act provides for 

independent legal advice for IGs rather than requiring the use of agency 

 

94 5 U.S.C. App. § 3(a). 

95 5 U.S.C. App. § 3(b). 

Page 62 GAO-09-468 DCAA Audit Environment
 

legal counsel.96 Currently, DCAA relies upon DOD legal counsel. DCAA 

officials told us that the DCAA Director has not always been apprised of 

legal decisions by DOD counsel that have impacted DCAA operations. 

Further, according to the DCAA Director, the lack of independent counsel 

led to a situation where DOD attorneys provided questionable legal 

counsel to a DCAA field office supervisor without the DCAA Director’s 

knowledge. Obtaining independent legal counsel would avoid conflicts of 

interest between DOD and DCAA, thereby helping to improve DCAA’s 

effectiveness. 

Budget. The IG Act requires separate budgets for Offices of Inspector 

General (OIG) within agency budgets, allowing Congress to review IG 

budget requests separately. DCAA currently does not have this protection. 

IGs that are appointed by the President with Senate confirmation receive a 

separate appropriation, preventing agencies from reprogramming IG funds 

to other programs and activities. However, there is currently little visibility 

of DCAA’s budget because it is funded under the Operations and 

Maintenance, Defense-wide appropriation, which includes numerous DOD 

agencies, such as the Defense Contract Management Agency (DCMA), the 

Defense Logistics Agency, the Defense Finance and Accounting Service, 

and some buying command activities. Therefore, DCAA’s share of annual 

appropriations is subject to reprogramming, sometimes without 

congressional notification. According to the DCAA Director and 

documentation provided by the Director and Office of Comptroller/CFO, 

in the past, DOD has reprogrammed funding between DCAA and other 

DOD activities on numerous occasions. Because these reprogrammings 

were below the $15 million threshold for congressional notification, 

Congress did not have notice of these funding decreases at the time they 

occurred. For fiscal year 2009, DOD reprogramming increased DCAA’s 

funding by $3.5 million. Legislation similar to the IG Act could grant DCAA 

a separate budget97 to provide visibility and protections from 

reprogramming of funds to other agency priorities. 

Increased authority and independence. Legislation could strengthen 

DCAA’s audit authority by providing the same level of access to records 

and personnel available to IGs.98 Currently, DCAA has statutory rights of 

 

96 5 U.S.C. App. § 8F(4)(A). 

97 5 U.S.C. App. § 6(f)(1). 

98 5 U.S.C. App. § 6(a)(1), (4), and (5). 

Page 63 GAO-09-468 DCAA Audit Environment
 

access to certain records related to cost-type contracts or those that 

contain cost and pricing data, but not to contractor personnel. As a result, 

DCAA’s subpoena power is limited to certain records and does not cover 

contractor personnel. While we recognize that DCAA auditors have 

ongoing discussions with contractor personnel, they do not have statutory 

authority to compel contractor officials to meet with them and submit to 

interviews. IGs have authority, including subpoena power, to access all 

records, reports, audits, reviews, documents, papers, recommendations, or 

other material available that relate to programs and operations for which 

the IG has responsibilities. Further, IG subpoena authority extends beyond 

access to records and documents in that IG auditors can administer or 

take an oath in order to obtain information. Our discussions with DCAA 

auditors and reviews of audit documentation identified numerous 

instances where requests for contractor records were not met.99 Obtaining 

increased access to contracting companies, especially their staff and 

documentation, would be an important provision to improve the 

effectiveness of DCAA audit staff. 

Reporting and oversight of audit results. The IG Act provides for 

semi-annual reports to the agency head and appropriate committees of 

Congress summarizing results of significant audits and investigations.100

DCAA currently has no external reporting requirement, reducing 

opportunities for oversight and transparency. Congress could mandate 

some form of external DCAA reporting in legislation similar to the IG Act. 

Moreover, DCAA does not currently provide copies of its audit reports to 

other federal agencies that use the same contractors that DOD uses. 

According to the DCAA Director, DCAA’s appropriations are specific to 

DOD contractor audits, and unless federal agencies request and reimburse 

DCAA for audit services, DCAA cannot provide them with copies of its 

audit reports even though its DOD audits of systems and related internal 

controls, cost accounting system compliance, etc. may cover their 

contractors. Legislation could also expressly allow DCAA to provide audit 

results to other agencies, a step that would improve its visibility and 

effectiveness for the government as a whole. 

 

99 As noted previously, in these cases, there was no evidence that DCAA supervisors 

elevated the issue to management or to procurement officials to initiate enforcement 

action, as set out in DCAA policy. 

100 5 U.S.C. App. § 5(a). 

Page 64 GAO-09-468 DCAA Audit Environment
 

Legislation to grant DCAA similar protections and authorities as those 

provided in the IG Act could enhance reform efforts that are already under 

way. Although we found that a lack of DOD Comptroller/CFO and IG 

oversight has impaired DCAA’s effectiveness, DOD has begun work to 

provide improved oversight of DCAA’s operations. In August 2008, the 

DOD Comptroller/CFO conducted a “tiger team” review of DCAA’s audit 

quality assurance program, and DOD approved a more comprehensive 

Defense Business Board (DBB) study. The new DOD Comptroller/CFO 

recognized the need for DCAA oversight and on March 16, 2009, approved 

the charter for a DCAA Oversight Committee. Committee members include 

the Auditors General of the Army, the Navy, and the Air Force; the DOD 

Director of Defense Procurement and Acquisition Policy; and the DOD 

Deputy General Counsel for Acquisition and Technology. The Committee 

held its first meeting in early April 2009. During May 2009, the DCAA 

oversight committee members reviewed selected DCAA audits and visited 

a DCAA field office. In addition, the committee members have indicated 

that they plan to review this report, our earlier investigative report, the 

DOD Comptroller/CFO “tiger team” report, the DBB report, and the 

upcoming DOD IG report that follows up on issues from our July 2008 

report. The committee plans to assess DCAA actions on recommendations 

in these reports and identify any gaps for further action. We note that 

DCAA has already taken numerous actions to respond to our initial 

investigative report as well as DOD Comptroller/CFO and DBB 

recommendations. 

Long-Term Legislative 

Actions To Move DCAA 

Most of the impairments to DCAA effectiveness that we identified can be 

addressed within DCAA’s current organizational placement. However, to 

address the Committee’s interest in how changes in DCAA’s organizational 

placement could improve DCAA effectiveness and independence, we 

considered potential approaches to moving DCAA. During the 1980s, there 

were numerous proposals to reorganize DCAA’s organizational structure, 

including legislative proposals that would have placed DCAA in the Office 

of the Under Secretary of Defense (Acquisition), or in the DOD Office of 

Inspector General (OIG), or placed only DCAA’s post-contract audits in 

the OIG. We analyzed these proposals in an April 1991 report101 and 

concluded that they were not workable because they posed conflict of 

interest or duplication of effort issues. 

 

101 GAO, Defense Contract Audits: Current Organizational Relationships and 

Responsibilities, GAO/AFMD-91-14 (Washington, D.C.: Apr. 3, 1991). 

Page 65 GAO-09-468 DCAA Audit Environment
 

We believe that it is prudent to consider changes in organizational 

placement after DCAA has had sufficient opportunity to effectively 

implement current reform efforts necessary to address fundamental 

operational issues. Legislation to move DCAA as an organization would 

require careful analysis and planning before implementation. Moving 

DCAA at this time would be a bold step with possible unintended 

consequences, and decision makers would need to carefully weigh the 

costs and benefits of moving DCAA before the fundamental operational 

issues are addressed. As discussed below, regardless of its ultimate 

placement in the government, DCAA still needs to address the 

fundamental weaknesses in its mission, strategic plan, metrics, audit 

approach, and human capital management. 

Elevating DCAA within DOD as a separate component reporting to the 

Deputy Secretary of Defense could give more authority to the DCAA 

Director and increase visibility of the organization both within and outside 

of DOD.102 Because DOD positions reporting to the Secretary level are 

established by law, moving DCAA to the department level would require 

new legislation. To avoid any ambiguities or questions about whether the 

Secretary of Defense currently possesses the statutory authority to 

transfer the supervision of DCAA to the Deputy Secretary, we believe 

additional legislation that sets out appropriate relationships would be the 

best approach.103 In addition, this option would require some level of 

administrative change. For example, management and oversight of the 

contract audit function would become the responsibility of Deputy 

Secretary, a separate appropriation would need to be established, and 

some form of periodic external reporting to Congress would be 

appropriate. We note that authorizing legislation to move DCAA could also 

include similar protections and authorities as those under the IG Act if 

these provisions have not already been enacted. 

Elevating DCAA within DOD 

 

102 The Deputy Secretary of Defense is appointed by the President after confirmation by the 

Senate. 10 U.S.C. § 132(a). Among other duties as assigned by the Secretary of Defense and 

in statute, the Deputy Secretary serves as the Chief Management Officer of the department 

with primary responsibility for “effectively and efficiently organiz[ing] the business 

operations of the Department of Defense.” Pub. L. No. 110-181, div A, title IX, § 904(a)(2) 

(Jan. 28, 2008). In that capacity, the Deputy Secretary is to be assisted by a Deputy Chief 

Management Officer, who also is appointed by the President after confirmation by the 

Senate, and who supervises the Defense Business Transformation Agency. 10 U.S.C. §§ 

132(c), 192(e). 

103 Current provisions of law relevant to the Secretary of Defense establishing and assigning 

defense agencies and defense field activities within the Office of the Secretary of Defense 

include 10 U.S.C. §§ 125(a), 131(b), 191(b), 192(a), and 194. 

Page 66 GAO-09-468 DCAA Audit Environment
 

Although this option could enhance DCAA auditor objectivity and 

independence, under this organizational placement, DCAA would still 

need to resolve the management environment and cultural problems that 

have had a negative impact on audit quality, including pressure by 

contractors and contracting officers on audit scope and findings, 

conclusions, and recommendations. DCAA also would need DOD 

commitment to strengthening DCAA’s contract audit function through 

continued monitoring and oversight. Leadership from the Deputy 

Secretary of Defense would be critical to help DCAA address these 

matters. A key factor will be whether the Deputy Secretary has the 

necessary time to focus on DCAA. The amount of time needed should be 

less once the fundamental improvements are accomplished. 

Numerous governmentwide acquisition management reform efforts are 

currently under way that could impact the contract audit function. These 

efforts include congressional oversight and reform legislation and 

Presidential direction on developing governmentwide guidance for 

reviews of existing contracts to identify contracts that are wasteful, 

inefficient, or otherwise unlikely to meet agencies’ needs, and to formulate 

corrective action in a timely manner, as well as interest group studies. For 

example, in the National Defense Authorization Act for Fiscal Year 2008, 

Congress created the Commission on Wartime Contracting to study 

federal agency contracting for the reconstruction, logistical support of 

coalition forces, and the performance of security functions in Iraq and 

Afghanistan. The Senate Committee on Homeland Security and 

Governmental Affairs also recently created a new Subcommittee on 

Contracting Oversight. Several Members of the House Oversight and 

Government Reform Committee created the Clean Contracting Coalition 

to take a similar governmentwide approach. The House Oversight and 

Government Reform Committee also has been very active in this area. In 

addition, the House Armed Services Committee established an acquisition 

panel to evaluate DOD’s current acquisition system, analyze the root 

causes of project or program failures, and the administrative and cultural 

pressures that acquisition and program personnel face. The House and 

Senate Armed Services Committees also led the effort to enact the 

Weapon Systems Acquisition Reform Act of 2009,104 which requires 

oversight of cost estimation, systems engineering, and performance 

assessment; promotes competition; and limits organizational conflicts of 

interest. 

Establishing an Independent, 

Governmentwide Contract 

Audit Agency 

 

104 Pub. Law No. 111-23, 123 Stat. 1704, May 22, 2009. 

Page 67 GAO-09-468 DCAA Audit Environment
 

On March 4, 2009, the President issued a memorandum directing executive 

agencies to (1) increase the use of fixed-price contracts, (2) enhance the 

capacity of the acquisition workforce, (3) maximize competition, and 

(4) rationalize the choice of government or contractor resources to 

perform required services. In addition, the Federal Acquisition Innovation 

and Reform Institute—a nonpartisan, nonprofit organization led by leaders 

in acquisition and supply management—has called for acquisition 

workforce reforms, including a single acquisition job series that 

encompasses at a minimum, three functions—program management, 

contracting, and a new function called requirements management—and is 

considered a professional “super COTR” (contracting officer’s technical 

representative) position. Over the next several years, these reform 

initiatives likely will have a significant impact on government contracting, 

including the roles and relationships of contract auditors and the 

contracting, program, and finance communities. 

Depending on the outcome of the various contract reform initiatives and 

the successful implementation of DCAA management reforms, Congress 

may also want to consider increasing the efficacy of these reforms by 

establishing an independent governmentwide contract audit agency. The 

creation of a statutory governmentwide contract audit agency could 

enhance contract auditor effectiveness and independence by placing the 

audit agency outside DOD and other federal agencies that make 

procurement and contract management decisions. Centralizing the 

contract audit function and mandating its use by all federal agencies also 

could provide for consistent audit coverage and bring efficiencies and 

economies of scale to the contract audit process across the government. 

However, this would likely entail significant costs and operational and 

accountability considerations and would be an extremely costly option 

involving significant infrastructure and reorganization and would require 

substantial planning and analysis before deciding whether to proceed and 

how to implement any changes. Some of the issues that would need 

further study and analysis include the following: 

Governance. Governance is the framework of rules and practices by 

which a governing body, such as a board of directors, ensures 

accountability, fairness, and transparency in the entity’s relationship with 

all of its stakeholders, including management, employees, and 

government. In order to improve governance and accountability at federal 

agencies, a variety of laws covering a range of management and 

administrative practices and processes have been enacted. Consideration 

of such provisions for a governmentwide contract audit agency should 

include application of general laws related to funds control, performance 

Page 68 GAO-09-468 DCAA Audit Environment
 

and financial reporting, accounting and internal control systems, human 

resources management, and recordkeeping and access to information, 

among others. Further, governance issues unique to a contract audit 

agency, such as its relationships to agency contracting officers and the 

Congress, should be assessed. 

Scope of Work. Scope of work considerations would include roles, 

responsibilities, and relationships of the governmentwide contract audit 

agency and IGs with regard to contract audits. Another consideration 

would be whether the new agency would be available for consultation as 

an outside expert on federal agency pre-award issues. In addition, a 

determination would need to be made on the handling of fraud referrals. 

For example, the central new agency could have an investigative division 

or it could refer potential contract fraud to federal agency IGs for further 

investigation. 

Funding. Congress would need to determine how to fund the new 

contract audit agency. For example, funding could be provided through 

appropriations or from reimbursement by federal agencies. This decision 

would likely be tied to decisions on the governmentwide contract audit 

agency’s mandate and scope of work and any realignment of contract 

audit resources. 

Further study and analysis of this option would involve input from the 

federal agency IGs and agency contracting and finance communities as 

well as government contractors and public interest groups. Numerous 

additional issues would potentially be identified and require substantial 

time and cost for effective consideration and resolution. 

Successful accomplishment of DCAA reforms will require focused and 

committed leadership at the highest levels of DOD and DCAA as well as 

fundamental changes in DCAA’s culture and possible congressional action. 

Without leadership commitment to a strong contract audit function and 

substantial changes to DCAA’s mission, strategic plan, and management 

environment and culture, DCAA will continue to be challenged in its 

ability to perform quality audits that protect the public interest. Many 

needed changes are planned or under way and can be completed in the 

short-term, including revising DCAA’s mission statement, strategic plan, 

and monitoring, and adjusting performance metrics. Fundamental 

structural and cultural changes related to developing and implementing a 

comprehensive, risk-based approach for contract audits that comply with 

professional auditing standards and identifying staffing, training, and 

Conclusions 

Page 69 GAO-09-468 DCAA Audit Environment
 

resource needs will take several years to accomplish and implement. 

However, unless the overall problems with DCAA’s culture and 

management environment that resulted in pervasive contract audit failures 

are resolved, billions of taxpayer dollars will continue to be at risk for 

fraud, waste, abuse, and mismanagement. 

We are making 15 recommendations to the Secretary of Defense to 

improve the quality of the agency’s audits and strengthen auditor integrity, 

objectivity, and independence, including recommendations for actions on 

findings in this report that are aligned with certain Defense Business 

Board (DBB) findings and recommendations. 

Recommendations for 

Executive Action 

First, we recommend that the Secretary of Defense revise DCAA’s mission 

statement to reflect the need for quality contract audits and related 

nonaudit services that take into account serving the public interest. 

We also recommend that the Secretary of Defense require the Under 

Secretary of Defense (Comptroller/CFO) to establish milestones for 

completing DCAA corrective actions and monitor and regularly report on 

DCAA progress to assure timely completion of critical actions. 

In addition, we recommend that the Secretary of Defense direct the Under 

Secretary of Defense (Comptroller/CFO) to require the Director of the 

Defense Contract Audit Agency (DCAA) to take the following 13 actions. 

The following five recommendations cover actions to address our findings 

that are similar to DOD Comptroller/CFO and DBB findings. 

• In concert with the revised mission statement, develop a strategic plan 

with short-term and long-term outcome-related goals. 

• To measure progress in achieving strategic goals, ensure that metrics 

are tied to the revised mission statement and strategic plan and 

support the agency’s annual work plan. 

• Consult with DOD stakeholders and engage outside experts to develop 

a risk-based contract audit approach that identifies resource 

requirements and focuses on performing quality audits that meet 

generally accepted government auditing standards (GAGAS). 

Page 70 GAO-09-468 DCAA Audit Environment
 

• Establish an SES-level position with responsibility for audit quality 

assurance that requires demonstrated knowledge and experience in 

applying professional audit standards. 

• Consistent with DBB report observations, establish a separate DCAA 

internal review organization to conduct critical internal inspector 

general functions, including performing periodic internal evaluations 

and reviews and addressing DCAA hotline complaints. 

The following eight recommendations relate to specific GAO findings in 

this report. 

• In consultation with DOD stakeholders, review DCAA’s current 

portfolio of audit and nonaudit services to determine if any should be 

transferred or reassigned to another DOD agency or terminated in 

order for DCAA to comply with GAGAS integrity, objectivity, and 

independence requirements. 

• Based on the risk-based audit approach, develop a staffing plan that 

identifies auditor resource requirements as well as auditor skill levels 

and training needs. 

• Establish a position for an expert on auditing standards or consult with 

an outside expert on auditing standards to assist in revising contract 

audit policy, providing guidance on sampling and testing, and 

developing training on professional auditing standards. 

• Revise DCAA audit policy to provide appropriate guidance on what 

constitutes sufficient testing to comply with GAGAS. Update DCAA’s 

Contract Audit Manual, as appropriate. 

• Develop agencywide training on government audit standards. This 

training should emphasize the level of assurance intended by the 

various types of engagements and provide detailed guidance on auditor 

independence, planning, fraud risk, level of testing, supervision, 

auditor judgment, audit documentation, and reporting. 

• Conduct a comprehensive, independent review of DCAA’s revised audit 

quality assurance function. This review should focus on the consistent 

application of criteria used for assessing audit quality and assuring 

timely, consistent, and appropriate reporting of review results. 

• Make appropriate recommendations to address annual quality 

assurance review findings of serious deficiencies and GAGAS 

Page 71 GAO-09-468 DCAA Audit Environment
 

noncompliance, provide training, and follow-up to assure that 

appropriate corrective actions have been taken. 

• Establish policies and procedures to ensure that auditors who make 

direct bill decisions are independent of DCAA employees who perform 

a DOD management function by reviewing vouchers of contractors not 

eligible for the direct billing program, thereby reducing situations 

where DCAA auditors are encouraged to reduce their office workload 

by approving contractors for the direct-bill program. 

Further, we recommend that the Department of Defense Inspector General 

take the following two actions. 

• Reconsider its overall conclusions in the May 2007 DOD IG report on 

the audit of DCAA’s quality control system in which it reported an 

adequate (“clean”) opinion on DCAA system of quality control in light 

of the serious deficiencies and findings included in that report and the 

additional evidence identified in our audit. 

• Based on the above, determine whether the report should be rescinded 

or modified. 

In addition to our recommendations to DOD for improving DCAA audit 

quality and auditor objectivity, integrity, and independence, Congress may 

wish to consider the following legislative actions for enhancing DCAA’s 

effectiveness and independence. In considering these options, the 

Congress would need to weigh DCAA’s ability to accomplish significant 

reforms within its current environment and the cost and administrative 

effort involved with the alternative options along with the potential 

benefits. Timing would also need to be considered, given significant 

reforms that DCAA is already undertaking and the additional burden that a 

change in organizational placement would add at this time. 

Matters for 

Congressional 

Consideration 

• In the short term, as DCAA makes progress in correcting fundamental 

weaknesses that have impacted audit quality, Congress could consider 

enhancing DCAA reform efforts by enacting legislation to grant it 

protections and authorities similar to those embodied in the Inspector 

General Act, as amended. 

• In the medium term, Congress could consider elevating the contract 

audit function within DOD by moving DCAA from under the DOD 

Comptroller/CFO and placing it under the Deputy Secretary of 

Defense. 

Page 72 GAO-09-468 DCAA Audit Environment
 

• In the longer term, depending on the outcome of acquisition 

management reform initiatives under way and the success of DCAA 

management reforms, Congress could consider creating an 

independent, governmentwide contract audit agency. Legislation to 

move DCAA should incorporate the protections and authorities similar 

to those embodied in the Inspector General Act, if these have not 

already been granted to DCAA. 

We made a total of 17 recommendations, including 15 recommendations to 

DOD to improve DCAA’s management environment, audit quality, and 

oversight; and we made 2 recommendations to the DOD IG regarding 

DCAA’s last peer review. We received written comments from the 

Department of Defense (DOD) on September 8, 2009, and we received 

written comments from the DOD Inspector General (IG) on September 3, 

2009. DOD stated that the department concurs with all but one of our 15 

recommendations. DOD also stated that the Department and DCAA are 

committed to taking the necessary corrective actions to address our 

findings and that the department will continue to monitor DCAA to ensure 

timely completion of critical actions to address our recommendations. 

DOD also provided comments on our matters for congressional 

consideration. Although DOD disagreed with the matters we discussed, we 

continue to believe these are valid matters for congressional 

consideration. The DOD IG concurred with our recommendation to 

reconsider the conclusions in its May 2007 peer review report on DCAA; 

the IG did not concur with our recommendation to determine whether to 

rescind or modify its peer review report. DOD’s written comments are 

reprinted in appendix IV, and the DOD IG’s written comments are 

reprinted in appendix V. We summarize and evaluate the DOD and DOD IG 

comments and responses to our recommendations below. We made 

technical corrections and clarifications suggested by DOD in the body of 

our report, where appropriate. 

Agency Comments 

and Our Evaluation 

DOD Comments and Our 

Response 

DOD’s written comments include (1) comments on our 15 

recommendations, (2) comments on matters we presented for 

congressional consideration, (3) a list of DCAA corrective actions, 

(4) DCAA clarifications, and (5) comments from the Director, Defense 

Procurement and Acquisition Policy. DOD officials fully concurred with 13 

of our 15 recommendations for improving DCAA audits, partially 

concurred on one recommendation, and did not concur with one 

recommendation. We view DOD comments as being generally responsive 

to the intent of our recommendations. Our discussion of DOD’s response 

Page 73 GAO-09-468 DCAA Audit Environment
 

to our matters discussion and our findings and recommendations follow. 

We provide additional comments on specific sections of the DOD response 

letter in appendix IV. 

With regard to the matters we presented for congressional consideration, 

DOD stated that it generally opposes providing DCAA with authorities 

similar to those contained in the Inspector General Act. DOD stated that it 

specifically opposes certain recommendations based on the IG model if 

DCAA remains within DOD, including (1) a Presidentially-appointed and

Senate-confirmed DCAA Director, unless DCAA is independent of DOD, 

(2) fixed terms for the DCAA Director, (3) an independent budget, and (4) 

mandatory public reporting. DOD also stated that it plans to take steps to 

strengthen DCAA’s independence by establishing an appeals process that 

permits DCAA to seek resolution when there are differences of opinion as 

to the resolution of its audit findings. Finally, DOD opposes moving DCAA 

from under the DOD Comptroller/CFO and placing it under the Deputy 

Secretary. DOD pointed out that the Deputy Secretary is the Chief 

Management Officer of one of the world’s largest organizations and backs 

up the Secretary in the wartime chain of command, and he does not have 

the time to provide oversight and support to individual defense agencies. 

Although DOD did not agree with these matters, we believe they provide 

important information for Congress to consider. For example, the 

Inspector General Act provides many important authorities and 

protections for IG’s that could enhance DCAA’s independence and 

effectiveness. DOD disagreed with the Presidential appointment and 

Senate confirmation provision because it believes this would inject a 

political element into DCAA that is not appropriate and could create 

lengthy periods where there is no Director. DOD also opposes fixed terms 

for the DCAA Director because it believes the Secretary of Defense must 

have the ability to choose an appropriate Director. Our position with 

regard to appointments of IGs has been that Presidential appointments 

with Senate confirmation enhance their independence from the entities 

they audit and investigate. We recognize that DCAA serves a different role 

than IGs. We looked to the IG Act model to identify provisions that 

enhance the independence of auditors. A political appointment would 

elevate the status of the Director among DCAA’s stakeholders and, as a 

consequence, give DCAA more authority to respond to actions taken by its 

stakeholders to influence its independent audit work. A fixed term would 

provide stability, especially during a time of organizational change. DOD 

also questioned the wisdom of an independent budget because it would 

limit its ability to move money into DCAA, as is occurring now based on 

funding from the Defense Acquisition Workforce Development Fund. 

Page 74 GAO-09-468 DCAA Audit Environment
 

Separate appropriations are a key independence provision for IGs. The 

ability to reprogram funds within the Defense-wide Operations and 

Maintenance appropriation can involve both increases and decreases. Our 

analysis of DCAA reprogrammings over the last three years showed that 

funds were also moved from DCAA to other DOD organizations within the 

Defense-wide operations and maintenance appropriation. In DCAA’s case, 

the reprogrammings to reduce funding generally related to large 

unobligated balances—showing that DCAA under executed its budget. We 

believe this is important information that Congress would want to know. 

Further, we do not see a reason why DOD could not receive approval to 

transfer funds to DCAA from another fund if it had a separate budget. For 

example, providing DCAA with funds from the Defense Acquisition 

Workforce Development Fund constitutes a transfer (not a 

reprogramming), the authority for which is provided in the legislation 

governing the Fund, 10 U.S.C. § 1705(e). DOD also opposed mandatory 

public reporting by DCAA. We believe that periodic reporting to Congress 

and the public on the results of DCAA’s work will enhance accountability 

over DCAA. As discussed in our report, DCAA needs time to address the 

fundamental weaknesses in mission and the overall management 

environment. However, if DCAA is not successful in resolving these 

problems under its current organizational placement, it will be necessary 

to consider additional actions. In this regard, it may be worthwhile to 

consider elevating DCAA as a component agency reporting to the Deputy 

Secretary because this could enhance DCAA's independence by providing 

it more authority within DOD and increase DCAA's visibility both within 

and outside of DOD. 

DOD partially concurred with our recommendation that DCAA consult 

with DOD stakeholders and engage outside experts to develop a riskbased contract audit approach that identifies resource requirements and 

focuses on performing quality audits that meet GAGAS. DOD stated that 

DCAA already has a risk-based contract audit approach in identifying 

resource requirements and considers audit risk in planning various 

assignments. DOD stated that DCAA will coordinate with the Under 

Secretary of Defense for Acquisition, Technology, and Logistics (USD 

(AT&L)) to assess DCAA audit requirements.105 DOD also noted that one of 

DCAA’s cultural transformation projects is identifying and resolving 

 

105 The USD(AT&L) is responsible under 10 U.S.C. § 133 for establishing DOD policies 

related to the negotiation, award, and administration of contracts, such as those related to 

the use of contract audit services, and for coordinating contract audit activities within 

DOD. 

Page 75 GAO-09-468 DCAA Audit Environment
 

differing stakeholder expectations while ensuring DCAA performs quality 

audits that meet GAGAS. DOD expects to complete its assessment of 

stakeholder needs based on regulatory and statutory requirements by 

December 2010. We appreciate these steps; however, we remain 

concerned that DCAA’s current approach of performing 30,000 to 35,000 

audits and issuing over 22,000 audit reports with 3,600 auditors 

substantially contributed to the widespread audit quality problems we 

identified. Generating that many reports and doing that many audits with 

3,600 auditors leaves very little time to perform in-depth, complex audits 

of contractors. While the Director of Defense Procurement and Acquisition 

Policy commented that contract audits need to be completed “in time to be 

useful,” to assure timely, quality audits, DCAA will need a risk-based 

approach to determine the appropriate level of audit and nonaudit effort 

and staffing. 

DOD did not concur on our recommendation to develop policies and 

procedures related to direct-billing decisions, stating that (1) the 

department believes that a review of the contractor’s interim public 

vouchers is an integral function of DCAA’s continual assessment of a 

contractor’s billing system (2) DCAA is in the best position to review and 

approve contract interim billings based on its thorough understanding of 

the contractor’s system, (3) DOD believes that our concerns are mitigated 

based on the comprehensive supervisory and audit manager reviews, and 

(4) DCAA does not believe that the approval of interim vouchers along 

with the approval for contractors to be on direct billing results in a lack of 

auditor objectivity. 

We continue to believe that DCAA’s management (nonaudit) responsibility 

to perform prepayment reviews of contractor vouchers for DOD and the 

auditor’s decision making role of approving contractors for direct billing 

privileges based on its audit conclusions about the strength of the 

contractor’s system of internal controls, create audit objectivity issues. We 

revised our findings discussion and our recommendation to clarify this 

point. Under normal circumstances, DCAA must review contractor 

vouchers prior to payment—a management support function for DOD 

generally performed by DCAA field office administrative staff. By 

obtaining direct billing privileges, contractors can receive payment for 

goods and services without a voucher review by DCAA prior to payment. 

Because we found that this situation provides an incentive for DCAA to 

reduce its administrative workload by recommending that contractors are 

placed on direct billing, we recommended that DCAA develop new policies 

and procedures to ensure a separation between staff reviewing vouchers 

and staff making direct-bill decisions. In addition, DCAA has not explained 

Page 76 GAO-09-468 DCAA Audit Environment
 

the basis for its belief that administrative staff have a thorough 

understanding of the contractors’ systems. Further, we disagree with 

DOD’s statement that our concerns are mitigated based on the 

comprehensive supervisory and audit manager reviews because this is not 

supported by our findings. The fact that DCAA approvals of contractor 

direct-bill privileges were not based on sufficient audit procedures as 

demonstrated by our work and DCAA’s removal of over 200 contractors 

from the direct-bill program since our July 2008 report106 support our 

concern that the existence of such an incentive presents an objectivity 

impairment. 

DOD provided additional comments on findings in its transmittal letter. 

DOD stated that it disagrees with the suggestion in our report that the 

department has not yet begun to address the weaknesses we identified. 

Our report neither states nor implies that DOD has not yet begun to take 

action. In fact, one of our objectives was to analyze steps DOD has taken 

so far, and our report describes in detail the progress made. Our report 

acknowledges that several positive steps have been taken by DCAA, but 

much more needs to be done to address the fundamental problems. Thus, 

solutions to the problems documented in this report will take time to first 

implement and then will have to be independently assessed to make sure 

they are effective. Our report also notes that fundamental changes have 

not taken place. For example, to date DOD has not revised DCAA’s 

mission statement to reflect the need to consider the public interest as a 

key component of its work. In addition, DCAA has yet to assess the 

feasibility of 3,600 auditors issuing over 20,000 reports in one year (22,349 

in fiscal year 2008) and the appropriateness and need for the current 

combination of audit and non-audit services that drives this workload. 

Until these and other key steps are further along, it will be too early to 

assess whether DCAA has fundamentally changed or whether past 

practices continue. 

The DOD comments noted that one of our major findings is the lack of 

sufficient testing to support conclusions when giving an opinion on 

contractor internal control systems. The comments incorrectly refer to the 

requirement for sufficient testing as a GAO requirement and state that 

planned staffing increases may not be enough to accomplish audits 

required by regulation in light of additional testing stipulated by GAO. 

Professional audit standards have always required auditors to obtain 

 

106 GAO-08-857. 

Page 77 GAO-09-468 DCAA Audit Environment
 

sufficient evidence to provide a reasonable basis for the conclusion 

expressed in the report. As stated in our report, testing methodologies are 

a matter of professional judgment and can involve many factors. However, 

our findings reflect more than a difference of opinion with DCAA auditors 

on their exercise of professional judgment as reflected, in part, by the 

number of audit reports DCAA rescinded for insufficient testing. For 

example, we found insufficient documentation to support the 

methodology chosen and insufficient reasons for minimal testing, such as 

being told by a DCAA auditor that a “file size was too large” to test more 

than two recent vouchers. Again, DOD must address the feasibility of 3,600 

auditors issuing over 22,000 reports annually, most of which were 

reportedly performed under auditing standards. This may entail not only a 

risk-based audit approach but also exploring changes to the regulations 

that DOD represents require tens of thousands of these audits. 

DOD also disagreed with our position on the status of actions to 

strengthen DCAA’s quality assurance program. DOD stated that DCAA has 

been proactive in standing up its new Integrity and Quality Assurance 

Directorate. DOD also stated that it believes the extensive overhaul of the 

quality assurance function accomplished in fiscal year 2009 will mitigate 

the prior shortcomings in audit quality that we cited. Although DOD’s 

comments imply that DCAA has resolved its quality assurance problems, 

DCAA has acknowledged that it is not ready to undergo another peer 

review at this time. On September 1, 2009, we received a letter from the 

DCAA Director, stating that although improvements were put in place in 

fiscal year 2009, several significant improvements will be accomplished in 

fiscal year 2010. To allow sufficient time for DCAA to fully implement the 

necessary corrective actions, DCAA contacted us for guidance on (1) 

deferring its external quality control review for 2 years and (2) requesting 

that the next external peer review to cover assignments to be completed in 

fiscal year 2011. We agree with DCAA that it is not cost-effective to 

undergo an external peer review until an adequate system of quality 

control is in place. Expending substantial DOD IG resources when DCAA 

acknowledges that several years are necessary for improvements to be 

fully implemented is, in our view, an inefficient use of resources. DCAA 

has already begun to appropriately disclose in its reports that its audits do 

not comply with GAGAS external peer review requirements. 

The Director of Defense Procurement and Acquisition Policy (DPAP) 

provided additional comments. The Director stated that our report 

impugns DCAA’s audits and that we adopt the position that because DCAA 

is serving the interests of contracting officers, DCAA is therefore not 

auditing in the interest of the public. The Director further asserts that 

Page 78 GAO-09-468 DCAA Audit Environment
 

DCAA serves the public interest by providing useful and timely 

information to contacting officers, and that it is erroneous to imply that 

contracting officers do not seek to protect the public interest. Also, the 

Director states that GAO agrees with the Defense Business Board’s 

recommendation to revise DCAA’s mission to reflect a focus on the 

taxpayer as the primary customer. Finally, the Director suggests that our 

criticism of DCAA’s “production-oriented auditing” sets up a dichotomy 

between quality and timely audits. We disagree with these 

characterizations of our report. 

DPAP’s statements that our report impugns DCAA’s audits and that we 

take the position that when DCAA is serving the interests of contracting 

officers, it is not auditing in the interest of the public relate to our 

summarization of the Defense Business Board (DBB) report and not our 

findings. Our report does not endorse the specific recommendations of the 

DBB to focus on the taxpayer as the primary customer. As our report 

points out, this recommendation does not take into account the regulatory 

and policy requirements that establish DCAA’s primary role as an advisor 

to government contracting officers and disbursing officers. However, we 

agree with the DBB that DCAA should consider the public interest when 

carrying out GAGAS engagements. For audits and attestation engagements 

conducted under GAGAS, the auditor is expected to objectively and 

independently acquire and evaluate sufficient, appropriate evidence, and 

report on the results, consistent with the guidance in GAGAS.107 GAGAS 

states the principle that “observing integrity, objectivity, and 

independence in discharging [auditors’] professional responsibilities 

assists auditors in meeting the principle of serving the public interest and 

honoring the public trust.”108

DPAP also stated that the contracting officer is bound by regulation to 

meet the public interest in the broadest sense, for the entire matter 

surrounding a contract and that this includes factors other than DCAA 

audit findings and recommendations. As reflected in the extensive 

background discussion and elsewhere throughout our report, we 

recognize that contracting officers make final contracting decisions, and 

DCAA engagements support contracting officers in that process. Because 

we did not review the standards that contracting officers must follow, we 

did not include references to the requirements for contracting officers to 

 

107 See GAO-07-731G, § 1.03. 

108 GAO-07-731G, § 2.06. 

Page 79 GAO-09-468 DCAA Audit Environment
 

protect the public interest in their actions. Our report also states that 

DCAA contract audit services are intended to be a key control to help 

assure that prices paid by the government for needed goods and services 

are fair and reasonable and that contractors are charging the government 

in accordance with applicable laws, regulations (e.g., Federal Acquisition 

Regulation (FAR) and Defense Federal Acquisition Supplement (DFARS), 

standards (e.g., Cost Accounting Standards (CAS)), and contract terms. In 

providing this assurance, DCAA audits would necessarily take into 

account serving the public interest. However, when DCAA audits do not 

meet GAGAS, they do not provide this assurance and thus are not serving 

the public interest. We found that DCAA auditors lacked objectivity and 

independence when performing GAGAS audits and engagements. In many 

cases, this was a result of auditors’ focus on expediency to support client 

needs and, as the Director also observes, human capital shortages and 

poor management decisions. We do not question the need for contracting 

officers to use the services of advocates and assistants in carrying out 

their duties. However, when contract auditors represent that they are 

performing engagements under GAGAS, their primary focus should be on 

the integrity, objectivity, and independence of their work, which serves 

both contracting officers and the public interest. Further, the quality of 

DCAA audits impacts the quality of information available for contracting 

officer decisions. Whether DCAA can adhere to GAGAS on contract audits 

that provide minimal time to perform the work is a factor that USD 

(AT&L) should consider when establishing requirements for contract audit 

services. As we recommended, DOD should reconsider the mix of audit 

and non-audit services that it needs. 

DOD IG Comments and 

Our Response 

The DOD IG concurred with our recommendation to reconsider its overall 

conclusions in the May 2007 report on the audit of DCAA’s quality control 

system in which it reported an adequate (“clean”) opinion on DCAA’s 

system of quality control in light of the serious deficiencies and findings 

included in that report and the additional evidence identified in our audit. 

The IG also stated that it did not concur with our recommendation to 

rescind the report and, because of that statement, we believe the IG 

misconstrued our recommendation as expressly calling for a rescission or 

modification of its peer review report. Our recommendation was for the IG 

to determine, based on the results of our recommended reconsideration of 

the IG’s conclusions, whether it should rescind or modify the peer review 

report. 

The DOD IG also states that it took alternative action that conformed to 

the intent of our recommendation. The DOD IG comments state that it 

Page 80 GAO-09-468 DCAA Audit Environment
 

notified DCAA on August 24, 2009, that the May 2007 “adequate” opinion 

on DCAA’s system of quality control would expire on August 26, 2009. In 

addition, the IG stated, “We have determined that it is not prudent to allow 

the adequate opinion from our May 2007 report to carry forward.” 

However, peer review opinions neither “expire” nor “carry forward” 

beyond the period covered by the peer review. Peer review opinions cover 

the period to which the opinion applied—in DCAA’s case, as of the end of 

fiscal year 2006—and the peer reviewed audit organization need not 

undergo another peer review during the next 2 years.109 Because it has 

been more than 3 years since DCAA’s last peer review, DCAA is no longer 

in compliance with the GAGAS requirement for an external peer review, 

and DCAA has taken appropriate action to disclose this noncompliance in 

its reports. 

As stated in our report, the overall conclusion in the DOD IG report is 

inconsistent with the detailed observations in its report, which indicate 

numerous significant deficiencies in DCAA’s system of quality control. 

Further, based on DCAA’s actions to rescind 80 audit reports, 39 of which 

were issued in fiscal year 2006—the period on which the IG conclusions 

are based—and the findings in our audit, we concluded that DCAA’s 

quality control system for the period covered by the DOD IG peer review 

was not effectively designed and implemented to provide assurance that 

DCAA and its personnel comply with professional standards. 

As agreed with your office, unless you publicly announce the contents of 

this report, we plan no further distribution for 30 days from the report 

date. At that time, we will send copies of this report to the Secretary of 

Defense; the Under Secretary of Defense (Comptroller/CFO); the Under 

Secretary of Defense for Acquisition, Technology, and Logistics; the DOD 

Director for Defense Procurement and Acquisition Policy; the Deputy 

General Counsel for Acquisition; the Secretary of the Army; the Secretary 

of the Navy; the Secretary of the Air Force; the Director of DCAA, the 

Director of DCMA; the DOD Inspector General; and the Director of the 

Office of Management and Budget. In addition, this report will be available 

at no charge on the GAO Web site at http://www.gao.gov. Contact points 

for our Offices of Congressional Relations and Public Affairs may be found 

on the last page of this report. 

 

109 GAO-07-731G, § 3.55. 

Page 81 GAO-09-468 DCAA Audit Environment
 

If you or your staff have any questions concerning this report, please 

contact me at (202) 512-7922 or kutzg@gao.gov or Gayle Fischer, Assistant 

Director, Financial Management and Assurance at (202) 512-9577 or 

fischerg@gao.gov. 

regory D. Kutz 

Managing Director 

nd Special Investigations 

G

Forensic Audits a

Page 82 GAO-09-468 DCAA Audit Environment
Appendix I: Internal Control System Audits Appendix I: Internal Control System Audits Did Not Meet Professional Standards 

Did Not Meet Professional Standards 

In performing its audits, the Defense Contract Audit Agency (DCAA) states 

that it follows generally accepted government auditing standards 

(GAGAS).1

 As part of our assessment of DCAA’s overall management 

environment and quality assurance structure, we reviewed documentation 

for selected DCAA audits of contractor systems controls for compliance 

with GAGAS. We focused on internal control audits because contracting 

officers rely on DCAA audit opinions on contractor system controls for 3 

or more years to make decisions on pricing and contract awards and 

DCAA uses the audit opinions to assess risk when planning subsequent 

audits. We selected seven DCAA field audit offices (FAO) across the five 

DCAA regions that reported predominately adequate (“clean”) opinions on 

contractor controls. For the seven FAOs, we reviewed 372

 selected audits 

of contractor internal control systems, including accounting, estimating, 

billing, and indirect and other direct cost systems. As shown in table 5, we 

assessed these audits for compliance with eight key areas of GAGAS 

requirements: (1) auditor independence;3

 (2) adequate planning; (3) 

auditor understanding of controls; (4) design of procedures to detect risk 

of fraud, abuse, mismanagement, and contract terms; (5) documentation 

of sampling and testing; (6) audit evidence supports conclusions and 

opinion; (7) proper supervision; and (8) timely reporting and disclosures.4

We also considered GAGAS requirements for protecting the public interest 

when using auditor judgment.5

 As discussed in the body of this report, the 

37 audits we reviewed did not comply with GAGAS in one or more of these 

areas. However, we determined that 4 of the 37 audits included sufficient 

testing to support reported conclusions and opinions. Because the 

conclusions and opinions in the deficient audits were used to make risk 

assessments and determine the level of testing in other DCAA audits, such 

as annual audits of contract or incurred cost claims, audits of contract 

proposals and contractor forward pricing proposals, progress pay audits, 

and contract close-out audits, the audit quality issues related to the 

 

1

 CAM 2-101(a) and 2-103c(1). 

2

 We originally selected 39 internal control audits for our review. Because two audit 

assignments were performed as assist audits to an internal control audit in our selection, 

we considered these three assignments as one audit, and therefore, we reviewed a total of 

37 audits of contractor system internal control audits. 

3 GAO-03-673G, Chapter 3, especially §§ 3.03, 3.04, and 3.13-3.17. 

4

 GAGAS for attestations audits related to requirements 2 through 8 are covered in 

GAO-03-673G, §§ 6.04a; 6.13-6.14; 6.24a & c; 6.15a, and 6.16-6.20; 6.02a, 6.04b, 6.22 and 6.24; 

and 6.28-6.54. 

5 GAO-03-673G, § 3.33-3.38. 

Page 83 GAO-09-468 DCAA Audit Environment 
Appendix I: Internal Control System Audits 

Did Not Meet Professional Standards 

GAGAS noncompliance we identified potentially impacts hundreds of 

other audits and contracting decisions covering billions of dollars in DOD 

expenditures. 

Table 5: GAGAS Noncompliance on 37 Selected Audits of Contractor Controls 

DCAA regions 

Reasons for GAGAS noncompliance 

Northeast

(FAO #1)

Mid-Atlantic

(FAO #2)

Eastern

(FAO #3)

Central 

(FAO #4 & 5) 

Western 

(FAOs #6 & 7)

All 

regions

Independence impairments 0 0 1 2 4 7

Inadequate planning 0 4 1 5 7 17

Inadequate auditor understanding of controls 1 4 0 2 5 12

Lack of fraud risk detection procedures 4 5 6 11 9 35

Insufficient documentation on sampling 

methodology 

3 5 6 9 4 27

Insufficient evidence to support conclusions and 

opinion 

3 5 6 11 8 33

Improper Supervision 0 0 2 5 6 13

Reporting problems 4 5 6 12 10 37

Total GAGAS noncompliance issues 15 28 28 57 53 181

Number of audits 4 5 6 12 10 37

Rescinded reports 1 3 3 7 4 18

Source: GAO analysis of selected DCAA audits. 

Note: Because of the large size of the Central and Western regions, we tested audits at more than 

one field audit office in these regions. 

The following discussion includes examples of GAGAS noncompliance 

from specific audits we reviewed. 

Independence 

Impairments 

GAGAS state that the audit organization and the individual auditor should 

be free, both in fact and appearance, from personal, external, and 

organizational impairments to independence.6

 Our review of 37 audits of 

contractor internal controls found evidence in documentation for 7 audits 

that DCAA independence was compromised because auditors provided 

material nonaudit services to a contractor they later audited; experienced 

access-to-records problems that were not resolved; delayed report 

issuance, which allowed the contractor to resolve cited deficiencies, 

 

6 GAO-03-673G, § 3.03, and GAO-07-731G, § 3.02. 

Page 84 GAO-09-468 DCAA Audit Environment
Appendix I: Internal Control System Audits 

Did Not Meet Professional Standards 

without proper reporting; and performed test work on billings the 

contractor selected for testing. GAGAS state that auditors should be free 

from influences that restrict access to records or improperly modify audit 

scope.7

 GAGAS also state that audit organizations should not audit their 

own work or provide nonaudit services if the services are significant or 

material to the subject matter of the audit.8

 The following examples 

describe a situation where auditors assisted a Department of Defense 

(DOD) contractor in developing billing system policies and procedures 

after identifying five significant deficiencies and then reviewed their own 

work during a follow-up audit. 

DCAA Auditors Issued an Adequate Opinion on Controls They Helped Design 

DCAA auditors impaired their independence by performing nonaudit services for one of 

the top five DOD contractors in terms of dollars when they helped the contractor develop 

policies and procedures that were material to the billing system they were auditing. 

On May 12, 2005, DCAA reported an inadequate-in-part opinion on the contractor’s 

billing system internal controls. The report included five significant deficiencies, including 

a failure to maintain current, adequate billing system policies and procedures. After 

issuing the report, DCAA auditors helped the contractor develop adequate policies and 

procedures related to accounts receivable, overpayments, and monitoring of the billing 

system before performing the required follow-up audit—an impairment to auditor 

independence. A year later, after performing the follow-up audit, DCAA auditors 

concluded that the contractor had performed adequate actions to correct all of the billing 

system deficiencies previously reported. On June 28, 2006, DCAA reported an adequate 

opinion on the contractor’s billing system internal controls. 

Following GAO’s review of these audits, on March 6, 2009, DCAA rescinded the billing 

system audit follow-up report. 

We also noted instances of denials and limitations on access to records by 

contractors that were not handled properly. For example, during a billing 

system audit of one of the top five DOD contractors, an e-mail message 

documented in the audit workpapers showed that the auditors were 

challenged by a contractor official when they requested documentation to 

test whether billing clerks had received required training. The contractor’s 

e-mail stated, “Here’s a question for you. Can you tell me who and what 

requirement is making this part of the [audit]. This is a question that [is] 

being asked by [the Cash Manager].” The auditors eventually obtained 

limited training documentation from the contractor. Audit documentation 

and our interviews with the auditors revealed that the auditors also limited 

 

7

 See GAO-03-673G, § 3.19 and GAO-07-731G, § 3.10. 

8 GAO-03-673G, § 3.16. 

Page 85 GAO-09-468 DCAA Audit Environment
Appendix I: Internal Control System Audits 

Did Not Meet Professional Standards 

testing in several other areas “because the contractor would not 

appreciate it.” Access to records problems and strong external influence to 

limit testing are both impairments to independence according to GAGAS.9

Inadequate Planning GAGAS for attestation engagements state that the work shall be 

adequately planned.10 Auditors should communicate information regarding 

the nature, timing, and extent of planned testing and reporting to officials 

of the audited entity and to the individuals contracting for or requesting 

the attestation engagement. Auditors should also plan work to follow up 

on actions to address significant findings and recommendations in 

previous audits and assess areas of risk in planning the engagement. 

However, our review of the audit documentation determined that 17 of the 

37 internal control audits we reviewed were not adequately planned. 

• In five audits, auditors failed to consider risk associated with new 

systems that had not yet been audited or systems that had not been 

audited in more than 4 years. These audits should have been ascribed a 

higher risk level according to DCAA CAM guidance and testing should 

have been increased.11 DCAA has rescinded three of the five audits and 

is planning new audits, as appropriate. 

• Without documenting the basis for their decisions, auditors deleted 

audit steps from standard audit programs or did not perform all audit 

steps for three of seven audits we reviewed at one FAO. When we 

asked the auditors why they omitted key audit procedures in their 

work, the auditors told us they used “auditor judgment.” However, the 

auditors would not explain the basis for their judgments to us or their 

rationale for omitting key procedures, such as assessing the 

contractor’s control environment and testing the implementation of a 

contractor’s policies and procedures. Because we did not find any 

justification for omitting key audit procedures in these three audits, we 

determined that they were inadequately planned. 

The following case discussion illustrates deficiencies in audit planning as 

well as a lack of auditor understanding of contractor processes and 

controls. 

 

9

 See GAO-03-673G, § 3.19, and GAO-07-731G, § 3.10. 

10 GAO-03-673G, §§ 6.04a, 6.06, and 6.11. 

11 CAM 5-103. 

Page 86 GAO-09-468 DCAA Audit Environment
Appendix I: Internal Control System Audits 

Did Not Meet Professional Standards 

DCAA Erroneously Performed an Audit over a Billing System That Did Not Exist 

In 2004, a Western Region FAO planned a billing system audit of a federally funded 

research and development center (grantee) that receives $1.5 billion annually for 

research services. However, the planning for this billing system audit did not take into 

account the fact that grantees are funded through letters of credit and do not actually 

bill the government. This financial relationship is very different—and much less 

complicated—than a situation where a contractor bills the government for contract costs 

in accordance with Cost Accounting Standards and the Federal Acquisition Regulation. 

For example, under a letter of credit financing arrangement, grantees draw funds as 

disbursements are made and are required to prepare reports of transactions on their 

use of the funds and submit them to the funding agency. Despite this obvious mistake, 

on May 6, 2005, DCAA auditors issued a report stating that the grantee had an 

“adequate billing system.” 

Another report issued by the same DCAA office on June 25, 2004, reviewed the 

grantee’s cash management practices under the Single Audit Act for another federal 

agency. The auditors could have simply forwarded this report to the DOD contracting 

officer—a task that would take an hour at the most to complete. Instead, DCAA auditors 

charged over 530 staff hours to generate documentation to meet DCAA’s billing system 

audit requirements, even though there was no related “billing system.” As a result of our 

review, DCAA reassessed the need to perform a billing system audit for the grantee 

and determined that it would rely on the Single Audit Act reports in the future. DCAA 

has not rescinded the audit report even though it expresses an opinion on a nonexistent 

system. 

Auditors Did Not Properly 

Document Understanding 

of Controls for Several 

Audits 

GAGAS require that in planning examination-level attestation 

engagements, auditors should obtain a sufficient understanding of internal 

control that is material to the subject matter and design procedures to 

achieve the objectives of the audit.12 The subject matter or assertion the 

auditor is testing may relate to the effectiveness and efficiency of 

operations, including the use of an entity’s resources; the reliability of 

financial reporting, including reports on budget execution and other 

reports for internal and external use; compliance with applicable laws and 

regulations, provisions of contract, or grant agreements; and safeguarding 

of assets.13 Although most of the 37 internal control audits we reviewed 

met this standard, 12 audits did not. The following case study shows an 

example of insufficient understanding of controls. 

• On five audits, auditors overstated the strength of the contractor’s 

control environment in the audit documentation and used this 

information to justify performing little or no testing of controls for 

 

12 GAO-03-673G, §§6.13-6.14. 

13 GAO-03-673G, §§6.13 and 6.14. 

Page 87 GAO-09-468 DCAA Audit Environment
Appendix I: Internal Control System Audits 

Did Not Meet Professional Standards 

accounting and billing system control audits. On two of the five audits, 

a Mid-Atlantic Region auditor admitted that he included inaccurate 

statements in the audit documentation. These statements indicated 

that the contractor performed internal audits and had a formal 

management-level monitoring process over accounting and billing 

functions. When we requested copies of the internal audits and 

management reviews, the auditor admitted that these statements were 

not true and that he had made “mistakes.” He entered the factually 

incorrect information in the audit documentation to justify performing 

little or no testing. The auditor was a GS-13 technical specialist who 

reviewed the work of other auditors and provided them audit guidance. 

DCAA has rescinded four of the five audits and is planning or initiating 

new audits. 

• On another audit involving a business segment of a third contractor of 

the top 5 DOD contractors, auditors did not consider the contractor’s 

control environment in planning an audit of a new accounting 

system—a significant factor that resulted in insufficient testing. 

Further, after identifying significant accounting system deficiencies, 

including that certain contract costs are manually processed, are not 

processed timely, or are not adequately reconciled to actual incurred 

costs, the auditors delayed issuance of the audit report for about 16 

months, waiting to see if the contractor would take corrective actions 

on the identified deficiencies. Although test procedures were applied 

from February 25, 2004, to September 15, 2004, DCAA reported an 

“inadequate-in-part” opinion on the contractor’s accounting system on 

March 14, 2006—nearly 1-1/2 years later, without performing any 

additional testing. Following discussions with GAO, DCAA rescinded 

this audit report on November 20, 2008. 

In the audit described below, the auditor relied on the contractor to 

document the auditor’s understanding of controls. 

Page 88 GAO-09-468 DCAA Audit Environment
Appendix I: Internal Control System Audits 

Did Not Meet Professional Standards 

DCAA Auditors Relied on the Contractor to Document Internal Controls without 

Testing the Accuracy of the Documentation 

This case involves a billing system audit DCAA conducted in 2006. The last time DCAA 

had tested the billing system for this contractor was in 2000—a clear indication that new 

tests should be performed. At that time, DCAA’s CAM required that contractor internal 

control systems be audited every 2 to 4 years. However, rather than re-testing the 

billing system, DCAA auditors provided the contractor’s Information Systems Manager 

with 6-year-old documentation obtained during a DCAA auditor’s walkthrough of the 

billing process in the prior audit. The DCAA auditors asked the Information Systems 

Manager to update the documentation by making edits where necessary. According to 

the audit workpapers, the 6-year-old documentation was “edited by the contractor” and 

provided back to the DCAA auditor. Based on the contractor’s documentation of the 

billing system internal controls, the auditor concluded “we can limit our testing of 

management reviews, policies and procedures, and implementation of policies and 

procedures.” The auditor then traced one paid voucher through the billing process. This 

procedure relates to determining whether the auditor’s understanding of the process is 

correct and is not substantive testing (i.e., detailed tests of transactions and balances 

and analytical review procedures.) 

The auditor told GAO that she used this “low-risk approach” because she felt that the 

contractor’s system was “strong” and did not warrant a higher risk approach. However, 

according to the documentation GAO reviewed, the billing system was a software 

package that downloads accounting system data to spreadsheets. Manual calculations 

were then used to develop invoice amounts—a process that is prone to errors and does 

not provide assurance of consistent systematic processing of invoices. Further, since 

DCAA’s earlier walkthrough in 2000, the contractor had experienced significant 

downsizing and restructuring. 

The auditor performed no testing of the contractor’s billing system controls in order to 

determine whether the system was operating effectively at the time of the audit. The 

audit report that was issued on June 21, 2006, with an adequate opinion was not based 

on sufficient audit procedures to provide assurance over approximately $76 million in 

sales to the government. After GAO raised concerns about this audit, DCAA rescinded 

the audit report on March 3, 2009. 

Failure to Design and 

Perform Procedures to 

Detect Fraud Risk 

For DCAA examination-level attestation audits of contractor controls that 

we reviewed, GAGAS requires auditors to design and perform audit steps 

to obtain reasonable assurance of detecting fraud, illegal acts, or 

violations of provisions of contracts that could have a material effect on 

the subject matter of the engagement or internal control.14 DCAA 

management asserts that its examination-level audits are designed to 

provide this assurance, and DCAA internal guidance requires auditors to 

consider a list of fraud indicators included in DCAA’s CAM15 or the DOD 

 

14 GAO-03-673G, §6.15a. 

15 CAM, Figure 4-7-3. 

Page 89 GAO-09-468 DCAA Audit Environment
Appendix I: Internal Control System Audits 

Did Not Meet Professional Standards 

Inspector General’s Handbook on Fraud Indicators16 in planning and 

performing their work. However, for 35 of the 37 internal control audits 

we reviewed there was no evidence that DCAA auditors designed specific 

procedures to identify risk of fraud, illegal acts, violations of contract 

terms, or other improprieties. Further, our analysis of audit workpapers 

showed that DCAA auditors lacked an understanding of fraud indicators 

associated with weak internal controls. For example, although segregation 

of duties is a key fraud-prevention control, in the seven audits where 

workpapers identified segregation of duties issues, the auditors did not 

consider a lack of segregation of duties to be a fraud risk in 6 of the audits. 

The auditors did not look for a compensating control or perform 

additional procedures to determine whether the lack of segregation of 

duties had allowed fraud to occur. Occurrences of duplicate invoices also 

would increase the risk of fraud. However, DCAA’s audit program for 

testing contractor billing system controls does not include specific 

procedures to test for duplicate contractor invoices. We found evidence of 

testing related to duplicate invoices in only 2 of the 37 internal control 

audits we reviewed. Moreover, in the audit described below, DCAA FAO 

managers ordered an auditor to ignore significant fraud risks during an 

audit. 

DCAA FAO and Region Management Prevented an Auditor from Pursuing 

Significant Fraud Risks during a Billing System Audit 

During a fiscal year 2003 incurred cost audit of a major defense contractor, a DCAA 

Central Region auditor learned of a fraud investigation initiated by the Army’s Criminal 

Investigative Division (CID) in response to allegations of contractor fraud reported in 

August 2002. In July 2004, during a billing system audit of the same contractor, the 

auditor contacted the Army CID investigator to discuss the ongoing fraud investigation 

and learned that the fraud related to improper billings. As a result of this elevated fraud 

risk, the auditor requested several nominal increases in budget hours to perform 

additional testing to determine the extent of the fraud. The auditor had prior DOD 

contract administration experience and intended to use this experience in applying her 

audit testing procedures. After approving increases in budgeted hours for this 

assignment, the regional audit manager told the auditor that her concerns were not 

valid and to remove her “contracting hat.” 

Eight months later, on April 28, 2005, the auditor submitted a draft audit report to her 

supervisor. She concluded that the contractor’s billing system was inadequate—a 

finding that would have resulted in the contractor losing its direct-billing privileges. The 

auditor noted several deficiencies and concerns, including (1) the lack of billing policies 

and procedures, (2) a lack of training for contractor employees responsible for 

preparing invoices, (3) indications that the contractor may have billed the government 

for unapproved and unfunded work, and (4) evidence of an ongoing criminal 

 

16 DOD Inspector General, Handbook on Fraud Indicators for Contract Auditors, Section 

II.4 (IGDH 7600.3 APO, March 31, 1993). 

Page 90 GAO-09-468 DCAA Audit Environment
Appendix I: Internal Control System Audits 

Did Not Meet Professional Standards 

investigation by the Army CID. After reviewing the report, the supervisor and FAO 

manager directed the auditor to change the opinion from inadequate to inadequate-inpart because the auditor had not identified any excess or unallowable costs. The audit 

report, issued on August 31, 2005, reported an inadequate-in-part opinion and 

combined the first two deficiencies, reporting a total of three significant deficiencies. 

However, DCAA did not remove the contractor from the direct-bill program, whereby 

contractors are authorized to submit invoices directly to a government paying office 

without prior review. 

The auditor assigned to the original audit was also assigned to the billing system followup audit, but she was subsequently removed from the follow-up audit because, 

according to her supervisor, she was documenting her audit in too much detail. In 

January 2006, during the follow-up audit, Army CID concluded its fraud investigation. 

The contracting officer’s technical representative (COTR) and several contractor 

employees were convicted of fraudulently billing the government using the billing 

system that DCAA later deemed adequate. The investigation found that the COTR and 

the contractor employees were charging the government for travel to contract-related 

conferences and arranging the trips so they could attend a NASCAR race at 

government expense. They took government cars on the trips and various contractor 

employees each charged the government for use of their personal cars, with the COTR 

approving the travel vouchers. In addition, the COTR had contractor employees cut 

scrap lumber on government land and stack it at his home for use as firewood. The 

government was billed for the contractor employees’ time on behalf of the COTR. In the 

January 2006 settlement, which totaled over $2.8 million, the COTR and contractor 

employees paid fines and restitution, and the COTR also served jail time. 

The Army CID Special Agent in charge of the fraud investigation told us that he had 

tried on numerous occasions to get the DCAA FAO manager to stop issuing incurred 

cost audit reports with “clean” opinions because the opinions would be contradicted by 

the findings in the ongoing fraud investigation. The FAO issued the 2002 incurred cost 

audit report on January 5, 2005, stating its opinion that except for the qualification that 

the ongoing fraud investigation had developed information which may impact the costs 

and transactions in this report, the claimed direct costs are acceptable and are 

provisionally approved, pending final acceptance. DCAA did not include a cautionary 

note or similar qualification in the billing system audit report. In September 2006, DCAA 

reported an adequate (“clean”) opinion in the follow-up audit report on the contractor’s 

billing system controls without performing work to confirm that the contractor’s billing 

system policies and procedures were effectively implemented. 

Following GAO’s review of these audits, on November 20, 2008, DCAA rescinded both 

reports because the audit documentation did not support the reported opinions and 

initiated a new audit of the contractor’s billing system controls. 

Insufficient 

Documentation of 

Sampling and Testing 

Methodology 

Testing is a critical auditing procedure that allows auditors to determine 

whether controls are operating effectively. Although some testing can 

involve statistical samples, such samples are not required under GAGAS. 

Instead, GAGAS require that auditors prepare attest documentation in 

sufficient detail to enable an experienced auditor, having no previous 

connection to the audit, to ascertain from the attest documentation that 

the evidence supports the auditors’ significant judgments and conclusions. 

Under GAGAS, attest documentation should contain the objectives, scope, 

and methodology of the attestation engagement, including any sampling 

Page 91 GAO-09-468 DCAA Audit Environment
Appendix I: Internal Control System Audits 

Did Not Meet Professional Standards 

and other selection criteria used.17 Of the 37 internal control audits we 

reviewed, 27 audits did not contain workpaper documentation to 

demonstrate that the auditors’ nonstatistical samples met these 

requirements. for example: 

• On one billing system audit, the auditor performed testing on two 

vouchers. The auditor did not document how he selected the two 

vouchers, and he did not document the population of contractor 

vouchers in the workpapers or the basis for his judgment on selecting 

the two vouchers for testing. When we asked the auditor why he 

selected two most recent vouchers for testing and did not document 

the voucher population, the auditor told us it was because “the file size 

was too large,” and he saves the population files on his desktop 

computer. 

• On a billing system audit of one of the five largest DOD contractors we 

asked the auditor why he tested only one voucher to assess the 

contractor’s controls for subcontractor accounting and billing. The 

auditor said this was reasonable because DCAA “had tested so many 

vouchers before.” Other workpaper documentation noted testing was 

not performed on the direct-bill section of the audit program. When we 

asked the auditor why these procedures were not performed, the 

auditor told us that testing was performed by another FAO when the 

contractor implemented a new system 2 months earlier, and he decided 

not to do testing again because “the contractor would not appreciate 

it”—an indication of an auditor independence problem. Moreover, tests 

of new billing systems focus on data processing controls and would not 

take the place of tests of invoices for compliance with CAS, FAR, and 

contract terms. 

Although the CAM includes guidance on sufficient testing,18 auditors 

appeared to follow general guidance throughout the manual that advises 

auditors to use their judgment “to ‘test check’ a procedure, to make 

verifications ‘on a selective basis,’ or to review a ‘representative number’ 

of transactions or items.” Several auditors, field office managers, and 

DCAA headquarters officials told us that they believed “spot checks” were 

sufficient testing to conclude on controls overall and they did not believe 

they were required to document their sampling plans. 

 

17 GAO-03-673G, §§ 6.04b, 6.22, and 6.24a. 

18 CAM 4-600 and Appendix B. 

Page 92 GAO-09-468 DCAA Audit Environment
Appendix I: Internal Control System Audits 

Did Not Meet Professional Standards 

DCAA Relied on Faulty Auditor Judgment to Approve Contractor Controls 

An Eastern Region auditor performed minimal testing in an audit of controls over 

indirect and other direct cost for a business segment of one of the top five DOD 

contractors that billed the government for about $1 billion during 2006. The auditor did 

not use statistical sampling or test a representative selection of accounts payable 

transactions. Instead, without documenting the reasons for his judgments, the auditor 

tested 6 of 16,000 accounts payable transactions ($86 of $50 million), 3 of 4,500 travel 

transactions ($2,700 of $15 million), and 3 of 1,600 interdivisional transactions ($5,000 

of $16 million). On September 27, 2006, DCAA reported an adequate opinion on the 

contractor’s controls over direct and indirect costs. However our review of the audit 

workpapers revealed 

• no explanation of why so few transactions were tested, 

• no rationale for why transactions selected for testing covered the months of May 

through July 2005, when transactions occurred throughout the year, or 

• how the auditor concluded that the system was adequate based on testing 12 out 

of about 22,000 transactions. 

When we asked the auditors to explain the basis for their selection of transactions used 

for testing, FAO management said the selection was based on auditor judgment; 

implying auditors could use their professional judgment without the need to meet any 

specific criteria in doing so. GAGAS section 3.34 (GAO-03-673G) states that auditors 

should consider the need to protect the public interest when making professional 

judgments. GAGAS section 6.02a requires auditors to perform sufficient testing to 

support audit conclusions and opinions on controls. Determining what is sufficient 

testing requires auditors to determine an appropriate sample size considering risks, 

expectation of misstatements or deviations, and materiality, and select a representative 

sample from the population, meaning that all transactions have a known chance of 

being selected. GAGAS section 6.24 a. and c. require auditors to document the 

sampling plan and auditor judgments made in sampling and testing. This audit did not 

meet these GAGAS requirements. 

Insufficient Evidence to 

Support Audit Conclusions 

and Opinions 

We found that audit procedures for most of the 37 internal control audits 

we reviewed documented the design of controls but did not test the 

implementation of controls. As a result, the audits lacked sufficient 

evidence to support audit opinions that covered both the design and 

implementation of controls. GAGAS for examination-level attestation 

engagements require that sufficient evidence be obtained to provide a 

reasonable basis for the conclusion that is expressed in the report.19

GAGAS state that attest documentation serves to (1) provide the principal 

support for the auditor’s report, (2) aid auditors in conducting and 

supervising the attestation engagement, and (3) allow for the review of the 

quality of the attestation engagement. The preparation of attest 

documentation should be appropriately detailed to provide a clear 

 

19 GAO-03-673G, §6.04b. 

Page 93 GAO-09-468 DCAA Audit Environment
Appendix I: Internal Control System Audits 

Did Not Meet Professional Standards 

understanding of its purpose and source and the conclusions the auditors 

reached, and it should be appropriately organized to provide a clear link to 

the findings, conclusions, and recommendations contained in the auditors’ 

report.20

Overall, we found that 33 of the 37 internal control audits did not include 

sufficient testing of internal controls to support auditor conclusions and 

opinions. Our review of audit workpapers often found that only two, three, 

or sometimes five transactions were tested to support audit conclusions, 

for example: 

• On several audits, DCAA concluded that a contractor had adequate 

controls for removing system access for terminated or transferred 

employees. However, the auditors did not document the employee 

population from which individual employees were selected for testing 

system access, or the methodology used to select them. On none of 

these audits did we see evidence that DCAA auditors checked 

alphabetical listings of individuals having system access to lists of 

current personnel to confirm that access was removed when 

employees transferred or left the company. Without documentation of 

sampling and testing methodologies, there is no way to ascertain how 

the auditors came to their conclusions that controls were adequate or 

that sufficient testing was done to support audit conclusions. 

• For many controls, DCAA did not perform any testing at all. For 

example, at least 6 of the 9 accounting audits we reviewed did not 

include procedures for testing contractor segregation of allowable and 

unallowable cost; 20 of 22 billing system audits we reviewed did not 

include tests to identify duplicate invoices, and 10 of the 22 billing 

system audits of contractors that relied on manual procedures to 

prepare invoices from accounting system data queries did not check 

for compensating controls. For one audit, DCAA issued an adequate 

opinion on the accounting system for a major DOD contractor after 

performing a walkthrough of the accounting process and interviewing 

two employees. 

 

20 GAO-03-673G, §6.24. 

Page 94 GAO-09-468 DCAA Audit Environment
Appendix I: Internal Control System Audits 

Did Not Meet Professional Standards 

Adequate Opinion on Contractor Billing System Was Based on Spot Checks of 4 

Vouchers Generated on the Same Day 

A Mid-Atlantic Region auditor used interviews with contractor staff and limited testing as 

evidence that billing system controls were adequate for a DOD contractor with about 

$40 million in annual government sales. Workpapers documenting audit procedures on 

key internal controls referred to “discussions with the contractor” rather than 

independent auditor verification, including (1) verification of periodic reviews of 

contractor policies and procedures, (2) implementation and effectiveness of policies 

and procedures, (3) frequency and sufficiency of the contractor’s management reviews, 

(4) timely processing of offsets, and (5) exclusion of non-billable items from government 

billings. Although the audit was performed from November 2004 through July 2005, 

according to the workpapers, the auditor tested a nonstatistical selection of four 

vouchers (invoices) totaling $2.3 million that were all processed on the same day—

February 28, 2005. The workpapers contained no documentation on the population of 

invoices or the basis for selecting four vouchers for testing that were all processed on 

the same day out of the 8-month period covered by the audit. GAO also determined 

that the auditors performed no testing of the contractor’s billing system information 

technology (electronic data processing) controls. As a result, this audit can not be relied 

on for assurance that the contractor’s billing system and related internal control policies 

and procedures were adequate as of June 16, 2005. 

Audit Supervision 

Problems 

GAGAS require that assistants (audit staff) be properly supervised and that 

audit documentation contain evidence of supervisory reviews of the work 

performed that supports findings, conclusions, and recommendations 

contained in the report before the report on the attestation engagement is 

issued.21 Although workpaper documentation for the majority of the 37 

audits of contractor internal control systems we reviewed evidenced 

supervisory review, we found: 

• A lack of proper documentation of supervisory review in 13 audits. For 

example, for an Eastern Region accounting system audit, the 

supervisory auditor who signed the audit report did not review key 

workpapers related to accounting system transaction processing and 

transaction testing and cost allocations until 1 to 2 days after the audit 

report was issued. This was similar to a situation we found in our prior 

investigation, when supervisors at one DCAA field office frequently 

reviewed the workpapers for forward pricing reports after the reports 

were issued. The auditors also performed insufficient testing on this 

audit. 

• Audit steps were deleted from the standard audit program in an 

accounting system audit and a billing system audit after the supervisors 

approved the audit programs. The supervisors did not ensure that the 

deleted steps were addressed or that documentation was added to the 

 

21 GAO-03-673G, §§ 6.04a and 6.24e. 

Page 95 GAO-09-468 DCAA Audit Environment
Appendix I: Internal Control System Audits 

Did Not Meet Professional Standards 

workpapers to explain the reasons why the related audit procedures 

were not performed. 

• For six other audits, audit documentation shows that the supervisors 

and FAO managers extended the audit time frames while contractors 

took actions to correct significant deficiencies. The audit reports were 

issued 1 to 2 years later with adequate (“clean”) opinions on controls. 

Although this raises serious auditor independence and reporting issues 

because identified deficiencies were not reported, we are highlighting 

these cases under our discussion of poor supervision to also 

demonstrate the importance of “tone at the top.” 

DCAA Extended Audit and “Scrubbed” Audit Documentation after Contractor 

Objected to Findings 

A DCAA Western Region FAO failed to provide proper supervision of auditors throughout 

an accounting system audit of one of DOD’s five largest contractors working in Iraq. For 

contractor fiscal year ended December 31, 2004, the contractor reported over $900 

million in sales of which 98 percent related to government contracts, including $250 

million for work in Iraq. The 2004 audit, which was initiated in November 2003, was 

transferred among several auditors and at least three supervisors before its completion 

and August 2006 publication. In September 2005, the contractor objected to draft 

findings and recommendations that included eight significant deficiencies in the design 

and operation of the contractor’s accounting system, including inadequate system 

access controls, lack of policies and procedures for segregation of duties, lack of 

periodic reconciliations of cost accounts to the general ledger, and insufficient cost 

ledger information on total base costs by contract and cost elements for applying indirect 

rates. The contractor stated that the auditors did not fully understand the new policies 

and procedures that were just being developed for the fast track effort in Iraq. 

Following the contractor’s objections, the auditors revised and deleted some workpapers 

and created new workpapers. GAO’s review of the audit documentation identified several 

workpapers that were indexed to supporting documentation that no longer existed. 

Further, the auditors told GAO that because they had difficulty finding support for Iraq 

vouchers, they relied on voucher reviews performed under other DCAA audits. GAO also 

found evidence in the audit documentation that the final supervisor instructed the final 

lead auditor to insert the signature of a prior supervisor on an electronic workpaper after 

it had been revised, thereby making it appear that the prior supervisor had approved the 

workpaper revisions. 

On August 31, 2006, after “scrubbing” the audit documentation at the supervisor’s 

request, dropping five significant deficiencies and downgrading three significant 

deficiencies to suggestions for improvement, DCAA reported an adequate (“clean”) 

opinion on the contractor’s accounting system. Waiting to review audits with significant 

deficiencies until the end of the job after the work has been completed, raises questions 

about proper and timely supervision. The audit supervisor, who authorized the electronic 

recording of the prior supervisor’s name on the audit documentation and supervised the 

issuance of the audit report, was subsequently promoted to be the Western Region 

Quality Assurance Manager, where he went on to act as a quality control check over 

thousands of audits—including several of the audits investigated in GAO’s prior work. 

Following GAO’s review, DCAA rescinded the audit report on December 2, 2008. 

Page 96 GAO-09-468 DCAA Audit Environment
Appendix I: Internal Control System Audits 

Did Not Meet Professional Standards 

Audit reports are DCAA’s principal work product. According to GAGAS, 

audit reports should, among other criteria, (1) identify the subject matter 

being reported, the criteria used to evaluate the subject matter, the 

conclusion or opinion, and state that the opinion was as of a certain date; 

(2) include a statement of the nature and scope of the work performed and 

state that the audit was performed in accordance with GAGAS; (3) 

disclose any reservations about the engagement, including any scope 

limitations; (4) state the intended use of the report, if limited; and (5) state 

the time frame22 covered by the audit. Our review of audit documentation 

and DCAA final audit reports determined that none of the 37 DCAA 

reports on contractor systems internal controls met these reporting 

standards, for example: 

Reporting Problems 

• The reports did not cite the specific criteria used in individual audits. 

Criteria represent the laws, regulations, contracts, grant agreements, 

standards, measures, expected performance, defined business 

practices, and benchmarks against which performance is compared 

and evaluated. Criteria identify the required or desired state or 

expectation with respect to the program or operation and provide a 

context for evaluating evidence and understanding the findings.23

Instead, the DCAA reports uniformly used boilerplate language to state 

that DCAA audited for compliance with the “FAR, CAS, DFARS, and 

contract terms.” As a result the user of the report does not know the 

specific Federal Acquisition Regulation (FAR), Cost Accounting 

Standards (CAS), or contract terms used as criteria to test contractor 

controls. This makes it very difficult for users of the reports to 

determine whether the report provides the level of assurance needed 

to make contract management decisions. In addition, audit 

documentation for many of the audits we reviewed did not identify the 

audit work performed to provide assurance that contractors complied 

with specific requirements in CAS, FAR, DFARS, or contract terms. 

• Six of the 37 audit reports were not issued at the time24 the work was 

completed. These reports were issued from 8 months to over 2 years 

after the audits were completed. Frequently, we found that the delays 

were the result of serious findings, which led DCAA to withhold 

 

22 AICPA, Standards for Attestation Engagements, AT §101.63 incorporated by reference 

in GAO-03-673G, § 6.01, and GAO-07-731G, § 6.01. 

23 GAO-07-731G, § 7.37. 

24 GAO-03-673G, §§ 6.50 and 6.24, and GAO-07-731G, § 6.24. 

Page 97 GAO-09-468 DCAA Audit Environment
Appendix I: Internal Control System Audits 

Did Not Meet Professional Standards 

issuance of the report while the contractor addressed the problems. 

Because testing was not updated or was not sufficiently updated, the 

reported audit opinions, which related to controls at the time the 

reports were issued, were not adequately supported and may have 

been inaccurate. 

• The audit reports stated the period during which the audit was 

performed but did not disclose the scope and timing for tests of 

vouchers, transactions, or control attributes. Some tests covered a few 

days in only one month or a 3-month period and did not test controls 

across the year audited. As a result, testing did not support the 

reported audit opinions as of the report dates. 

• Contractors imposed restrictions on the scope of four audits by 

denying DCAA access to certain records. The access-to-records issues 

were not fully resolved or disclosed by the auditors. 

• The scope of 33 audits was limited by DCAA imposed, or implied, 

restrictions, including inadequate audit resources, unclear audit 

guidance on nature and extent of testing, and time constraints that 

prevented auditors from performing sufficient work to support 

reported opinions on contractor internal controls. DCAA officials told 

us that DCAA does not have sufficient resources to perform full-scope 

audits of contractor internal controls. 

Failure to issue reports when sufficient evidence has been obtained to 

support an auditor’s conclusion puts decision makers at risk of relying on 

out-dated or inaccurate information. Also, when DCAA auditors do not 

perform the scope of work necessary to support the reported audit 

opinions, the audit reports provide a false level of assurance. Following 

our discussion of these audits with DCAA headquarters officials, DCAA 

rescinded 4 of the 6 audit reports that did not accurately relate the period 

of testing to the audit opinion, and it rescinded 18 audit reports where the 

scope of work did not support the audit opinions. The discussion below 

describes a particularly egregious example of this problem. 

Page 98 GAO-09-468 DCAA Audit Environment
Appendix I: Internal Control System Audits 

Did Not Meet Professional Standards 

Two Years after Testing Controls, DCAA Reported the Results of an Audit of a 

Multibillion Dollar Contractor’s Billing System 

In July 2003, DCAA initiated a billing system audit of a contractor doing business in Iraq 

with sales of $6.3 billion at the two divisions under audit. More than 2 years after 

performing test procedures and after spending 1,025 hours on the audit, the FAO 

issued an opinion that the contractor’s billing system controls were adequate as of 

August 31, 2005, without updating the testing. 

In 2003, DCAA auditors tested 38 vouchers submitted for payment within a 12-day 

period. DCAA auditors identified numerous billing errors, including two instances where 

billings did not comply with the Federal Acquisition Regulation (FAR). On August 12, 

2004, DCAA auditors prepared a draft report with an adequate opinion and three 

suggestions for improvement. DCAA auditors did not perform testing in 2004 or in 2005 

despite the number of errors found as a result of limited test procedures performed in 

2003. As a result, the evidence does not support the opinion that the contractor’s billing 

system controls are adequate as of August 31, 2005. Additionally, there is no evidence 

in the workpapers that the contractor resolved the errors DCAA identified and the 

underlying system deficiencies that caused those errors. This is of special concern 

because billing errors and system deficiencies at this contractor put multiple agencies 

at risk. For example, this contractor does work not only for DOD but also for the 

Departments of Agriculture, Commerce, Interior, and NASA, and several other 

agencies. 

The lead auditor told us that this audit was delayed because numerous auditors were 

assigned over the course of this audit, and the contractor’s work in Iraq took 

precedence over this audit. However, we found no evidence supporting a decision not 

to issue this report when the testing was completed in 2003. Following GAO’s review, 

DCAA rescinded the audit report on April 7, 2009. 

Page 99 GAO-09-468 DCAA Audit Environment
Appendix II: DCAA Does Not Perform 

Sufficient Work to Identify and Collect Appendix II: DCAA Does Not Perform Contractor Overpayments 

Sufficient Work to Identify and Collect 

Contractor Overpayments 

DCAA performs assignments that are designed to test various contractor 

costs as allowable, reasonable under the related contracts, the Federal 

Acquisition Regulation (FAR), and Cost Accounting Standards (CAS). 

Although DCAA uses the term “audit” generically, some of these 

assignments are audits and other assignments relate to financial and 

advisory services. We reviewed 32 cost-related assignments1

 performed by 

seven geographically disperse field audit offices (FAO) across the five 

DCAA regions (the same offices as in appendix I) to assess whether (1) the 

tests of contractor costs, billings, and payments were effective in 

identifying overpayments, billing errors, and unallowable cost2

 and 

(2) DCAA identified and reported unallowable and unsupported costs, 

overpayments, and billing errors so that the government was in a position 

to collect or recover improper costs and billings through refunds, contract 

adjustments, or offsets. The 32 DCAA cost-related assignments we 

reviewed included 16 paid voucher reviews, 10 overpayment assignments, 

4 incurred cost audits, and 2 request for equitable adjustment (REA) 

audits.3

 Although DCAA performs incurred cost and REA audits as 

engagements in accordance with generally accepted auditing standards 

(GAGAS), DCAA does not consider paid voucher reviews or overpayment 

audits to be GAGAS assignments. DCAA performed the paid voucher 

reviews to assess the accuracy of contractor billings to support decisions 

to approve contractors for participation in the direct-bill program,4

whereby the contractor submits invoices directly to a federal agency 

paying office without government review of the invoices prior to payment. 

Overpayment assignments review contractor controls for identifying and 

 

1

 We initially selected 34 cost-related audit assignments for review. After reviewing the 

audit documentation, we determined that one assignment only covered part of an audit and 

the other assignment was terminated and the procedures were incorporated into a related 

billing system audit. Therefore, we reviewed a total of 32 completed cost-related 

assignments. 

2

 Contractor overpayments can occur as a result of errors made by paying offices, such as 

duplicate payments and payments in excess of amounts billed, and contractor billing 

errors, such as using the wrong overhead rate, failing to withhold designated amounts on 

progress payments, duplicate billings, or billings for unallowable cost. Recoveries of 

overpayments can be accomplished through refunds, subsequent billing offsets, or other 

adjustments to correct billing errors. Unallowable costs include lobbying cost, certain legal 

expenses, executive and management bonuses, luxury items, and certain overhead costs. 

3

 REA relates to contractor requests to adjust contract terms for rates and payments 

resulting from contract modifications. In the case of the two REA audits, contract 

modifications related to requests for increased hours of service and related labor and 

materials. 

4

 FAR § 42.101 and DFARS § 242.803. 

Page 100 GAO-09-468 DCAA Audit Environment 
Appendix II: DCAA Does Not Perform 

Sufficient Work to Identify and Collect 

Contractor Overpayments 

refunding, offsetting, or adjusting contract overpayments and billing 

errors. 

Similarly, DCAA performs overpayment assignments at the request of 

contracting officers to determine (1) whether contractor controls are 

effective in identifying overpayments made by disbursing officers or over 

billings and billing errors made by contractors and (2) if contactors are 

making timely refunds, offsets, or adjustments. 

At the time the 32 cost-related assignments were performed, FAR § 52.232-

25(d) imposed a requirement on contractors to immediately notify the 

contracting officer and request instructions for disposition of any 

overpayment when the contractor becomes aware of a duplicate or 

overpaid contract financing or invoice payment.5

 Also, FAR 32.604(b)(4) 

provides that contractors shall repay debts under a demand letter within 

30 days, except for certain debts covered by specific terms of the 

contract.6

 This time period is incorporated into most contracts under FAR 

Clause 52.232-17(a). We found that DCAA auditors are not consistent 

when assessing the timeliness of refunds and offsets. Specifically, 

although DCAA’s overpayment work program cites 30 to 60 days after the 

overpayment occurred as timely,7

 some DCAA auditors considered 90 days 

as timely which effectively minimized the impact on the contractors’ cash 

flow. 

We also found limited testing in the four incurred cost audits we reviewed. 

DCAA considers incurred cost audits to be GAGAS attestation 

engagements. Incurred cost audits examine contractors’ annual claims for 

payment of cost incurred. DOD contracting officers rely on DCAA incurred 

cost audits to approve contractor claims for payment.8

 DCAA incurred 

cost audits and proposal audits are the source of most DCAA questioned 

costs and dollar recoveries. Dollar recoveries are based on contracting 

 

5

 FAR 52.232-25(d) was amended in October 2008 to require contractors to monitor for and 

make adjustments to correct overpayments they may receive, but it still does not specify a 

timeframe for making any needed adjustments. 

6

 FAR 32.606(a). 

7

 DCAA, Audit of Contract Overpayments Audit Program, version 2.1, October 2006. 

8

 Although the government pays contractor invoices on a provisional basis when they are 

submitted for payment, DCAA incurred cost audits provide the basis for final approval of 

contractor incurred costs claims. 

Page 101 GAO-09-468 DCAA Audit Environment
Appendix II: DCAA Does Not Perform 

Sufficient Work to Identify and Collect 

Contractor Overpayments 

officer agreement with DCAA questioned costs.9 DOD contracting office

are responsible for enforcing DCAA recommendations to disallow 

questioned cost. Figure 3 provides a comparison of costs questioned

DCAA auditors and questioned costs sustained (recovered) by DOD 

contractin

cting officers 

 by 

g officers. 

Figure 3: DCAA Questioned Costs and Amounts Sustained by Contracting Officers 

Questioned costs

Questioned costs sustained

0

2

4

6

8

2000 2001 2002 2003 2004 2005 2006 2007 2008

Dollars (in billions)

Source: GAO analysis of DCAA data.

3.4

4.6

3.0 2.8

3.5

3.2 3.4

3.1

4.2

5.0

6.8

4.0 4.2

4.7

5.5 5.3

4.9

6.7

Fiscal year

For one of the four incurred cost audits we reviewed, DCAA rescinded the 

related accounting system audit report in response to concerns we 

identified with that report. For a second incurred cost audit we reviewed, 

DCAA rescinded the related billing system report. Risk assessments for 

determining the nature, extent, and timing of testing for incurred cost 

audits are based in part on the results of accounting and billing system 

audits. Therefore, a rescission of an accounting or billing system audit 

 

9

 Questioned costs include costs questioned by DCAA auditors as unallowable or 

unsupported. 

Page 102 GAO-09-468 DCAA Audit Environment
Appendix II: DCAA Does Not Perform 

Sufficient Work to Identify and Collect 

Contractor Overpayments 

would call into question the risk assessment performed for the related 

incurred cost audits. 

The case study examples in table 6 illustrate significant problems we 

identified with the DCAA cost-related assignments we reviewed. As 

previously discussed, the level of testing in these assignments was not 

sufficient to identify all potential contractor billing errors and 

overpayments. 

Table 6: Case Studies of Problem DCAA Cost-Related Assignments 

Region Type of assignment Details of review 

Central Paid voucher review (2006) 

Non-GAGAS 

• For this review of paid contractor invoices, the auditor relied on the results of DCAA’s 

2005 billing system audit and did not test any invoices. The workpapers stated that the 

auditor also relied on the results of the 2005 paid voucher assignment. However, that 

assignment did not test any 2006 invoices. 

• Further, as a result of GAO’s work, DCAA had rescinded the 2005 billing system audit 

report on February 10, 2009. 

• As a result, there is no audit support for DCAA’s approval for this contractor to directly 

bill the government. 

Central Paid voucher 

review (2005) 

Non-GAGAS 

• In planning this work, the auditor improperly assessed risk as low and deleted several 

steps from the standard “audit” program. 

• The auditor did not identify the population of vouchers (invoices) and selected two 

invoices for testing, but only tested one of them. 

• The auditor tested one invoice to see if the payment received by the contractor 

matched the amount billed. 

• On January 23, 2006, DCAA issued a Memorandum for the Record, stating “reliance 

can be placed on the contractor’s procedures for preparation of interim vouchers. 

Accordingly, the contractor has met the criteria for continued participation in the direct 

billing program.” 

Western Paid voucher 

review (2005) 

Non-GAGAS 

• Without documenting the population of vouchers or the total dollars billed during the 

contractor’s fiscal year, the auditor tested 8 of 734 vouchers issued from April 16, 2004, 

through March 25, 2005. 

• The supervisor incorrectly directed the auditor to test a final voucher. Paid voucher 

assignments focus on interim vouchers as a basis for making direct-bill decisions. Final 

vouchers are submitted to close out a contract. 

• The auditor did not identify any errors in the vouchers tested. 

• On September 30, 2005, the auditor prepared a Memorandum for the Record, stating 

that “continued reliance can be placed on the contractor’s procedures for preparation of 

interim vouchers. Accordingly, the contractor has met the criteria for continued 

participation in the direct billing program.” 

Page 103 GAO-09-468 DCAA Audit Environment
Appendix II: DCAA Does Not Perform 

Sufficient Work to Identify and Collect 

Contractor Overpayments 

Region Type of assignment Details of review 

Eastern Paid voucher review (2004) 

Non-GAGAS 

• Although the contractor generated $1.1 billion in annual billings to the government, the 

auditor assessed risk as low for this assignment. Without documenting the basis for the 

risk assessment, the auditor judgmentally selected 3 vouchers totaling $88,000 for 

testing out of a total of 222 vouchers submitted to the government for payment from 

March 2003 through February 2004. 

• The auditor tested the first voucher selected and performed limited testing on the 

remaining 2 vouchers. 

• The workpapers do not include any evidence to show that the auditor performed most 

of the audit steps required in the standard audit program. 

• Despite limited testing, on March 31, 2004, DCAA prepared a memorandum for the 

record, stating “continued reliance can be placed on the contractor’s procedures for the 

preparation of interim vouchers” and “the contractor has met the criteria for continued 

participation in the direct billing program.” 

Source: GAO analysis of DCAA audit documentation. 

Page 104 GAO-09-468 DCAA Audit Environment
Appendix III: Objectives, Scope, and 

Methodology 

Page 105 GAO-09-468

Appendix III: Objectives, Scope, and 

Methodology 

Pursuant to a request from the Chairman and Ranking Member of the 

Senate Committee on Homeland Security and Governmental Affairs, we 

conducted an agencywide performance audit to assess the effectiveness of 

Defense Contract Audit Agency (DCAA) audits for helping to assure that 

prices paid by the government for needed goods and services are fair and 

reasonable and that contractors are charging the government in 

accordance with applicable laws, regulations, cost accounting standards, 

and contract terms. The overall objectives of our work were to (1) conduct 

a broad assessment of DCAA’s management environment and quality 

assurance structure, (2) evaluate DCAA corrective actions in response to 

our prior investigation1

 and DOD Comptroller/CFO “tiger team” and 

Defense Business Board (DBB) studies, and (3) identify potential 

legislation and other actions that could improve DCAA’s effectiveness and 

independence. 

To address our first objective, we evaluated DCAA’s contract audit 

guidance and policies and its quality assurance program and assessed the 

quality of a nationwide selection of DCAA audits. We evaluated the results 

of internal DCAA audit quality assurance reviews on audits issued from 

fiscal year 2003 through 2008. We also reviewed a total of 69 DCAA audits 

and cost-related assignments.2

 In reviewing DCAA audits, we used 

generally accepted government auditing standards as our criteria.3

 The 69 

DCAA audits and cost-related assignments we reviewed included 37 audits 

of contractor internal controls and 32 cost-related audits and assignments. 

We did not assess a statistical sample of DCAA audits. Rather, we focused 

on DCAA offices that reported predominately adequate, or “clean,” 

opinions on audits of contractor internal controls over cost accounting, 

billing, and cost estimating systems issued in fiscal years 2005 and 2006.4

We selected DCAA offices that reported predominately adequate (“clean”) 

 

1 GAO-08-857. 

2

 As stated in DCAA’s Contract Audit Manual, CAM 2-100, DCAA uses the term audit to 

refer to a variety of audits, evaluations, reviews, assessments, and analyses. 

3

 GAO, Government Auditing Standards: 2003 Revision, GAO-03-673G (Washington, D.C: 

June 2003) and Government Auditing Standards: 2007 Revision, GAO-07-731G 

(Washington, D.C: July 2007). 

4

 In selecting the seven DCAA offices, we considered a 2-year history of internal control 

audit results. The seven DCAA offices we selected reported adequate opinions on 89 

percent or more of the internal control reports they issued during fiscal year 2006. During 

fiscal year 2005, four of the seven offices reported adequate opinions in 85 percent or more 

of the internal control reports they issued, and the other 3 offices issued adequate opinions 

in 50 to 69 percent of the internal control audit reports they issued. 

 DCAA Audit Environment 
Appendix III: Objectives, Scope, and 

Methodology 

opinions on contractor systems and related internal controls because 

contracting officers rely on these opinions for three or more years to make 

decisions on pricing and contract awards, and payment. For example, 

audits of estimating system controls support negotiation of fair and 

reasonable prices.5

 Also, the Federal Acquisition Regulation (FAR) 

requires contractors to have an adequate accounting system prior to award 

of a cost-reimbursable or other flexibly-priced contract.6

 Billing system 

internal control audit results support decisions to authorize contractors to 

submit invoices directly to DOD and other federal agency disbursing 

offices for payment without government review.7

 In addition, DCAA uses 

the results of internal control audits to assess risk and plan the nature, 

extent, and timing of tests for other contractor audits. When a contractor 

has received an adequate opinion on its systems and related controls, 

DCAA would assess the risk for subsequent internal control and costrelated audits as low and would perform less testing on these audits. 

Using this approach, we identified seven geographically disperse DCAA 

field offices within the 5 DCAA regions and targeted 39 audits of 

contractor cost accounting, billing, and estimating system controls issued 

during fiscal years 2004 through 2006 for review.8

 These were the most 

recent completed fiscal years at the time we initiated our audit. Two of the 

39 internal control audits we identified were performed as assist audits to 

a billing system audit and we considered them as part of the billing system 

audit we reviewed. Therefore, we reviewed a total of 37 audits of 

contractor internal controls for compliance with GAGAS and DCAA 

policy. We also considered whether DCAA adequately applied internal 

control standards in its audits that are applicable to the private sector.9

 We 

 

5

 DCAA Contract Audit Manual (CAM) 5-1202.1a and Defense Federal Acquisition 

Regulation Supplement (DFARS) § 215.407-5. 

6

 FAR § 16.301-3(a)(1). 

7

 FAR § 42.101, and DFARS § 242.803. 

8

 In the case of follow-up audits, we also reviewed the documentation for the previous audit 

to gain an understanding of the scope of work and deficiencies previously identified. 

9

 The Internal Control Integrated Framework developed by the Committee on Sponsoring 

Organizations (COSO) of the Treadway Commission, September 1993, are applicable to 

private sector entities. We considered whether DCAA audits addressed contractor controls 

related to the five key control activities: (1) contractor control environment; (2) contractor 

risk assessment; (3) control activities, including policies and procedures and segregation of 

duties; (4) information and communication (i.e., information system processing controls); 

and (5) monitoring. 

Page 106 GAO-09-468 DCAA Audit Environment
Appendix III: Objectives, Scope, and 

Methodology 

did not review classified audits performed by DCAA’s field detachment 

office. Although our selection of the seven offices and 37 internal control 

audits was not statistical, it represented about 9 percent of the total 76 

DCAA offices that issued audit reports on contractor internal controls and 

nearly 18 percent of the 40 offices that issued 8 or more reports on 

contractor internal controls during fiscal year 2006. Of the 37 internal 

control audits we reviewed, 32 reports were issued with adequate opinions 

and 5 reports were issued with inadequate-in-part opinions. Table 7 

summarizes the number and types of contractor internal control audits we 

reviewed for seven FAOs across the 5 DCAA regions. 

Table 7: Summary of DCAA Audits Reviewed for GAGAS Compliance 

Type of internal control audit 

Region/FAO Accounting system 

Indirect & other 

direct cost Billing system

Estimating 

system 

Total internal 

control audits 

Northeast 

FAO #1 — — 3 1 4

Mid-Atlantic 

FAO #2 2 — 3 — 5

Eastern 

FAO #3 1 1 3 1 6

Central 

FAO #4 2 — 2 1 5

FAO #5 2 — 5 — 7

Western 

FAO #6 — 1 3 1 5

FAO #7 2 — 1 2 5

Total 9 2 20 6 37

Source: GAO analysis of DCAA management information system data. 

At the same seven DCAA field offices, we selected 34 cost-related 

assignments performed during the same period as the internal control 

audits we reviewed and analyzed supporting documentation to determine 

whether the assignments included sufficient testing to assess whether 

(1) the tests of contractor costs, billings, payments were effective in 

Page 107 GAO-09-468 DCAA Audit Environment
Appendix III: Objectives, Scope, and 

Methodology 

identifying overpayments, billing errors, and unallowable cost10 and 

(2) DCAA reported overpayments, billing errors, and unallowable and 

unsupported costs, so that the government was in a position to recover 

improper payments through refunds, contract adjustments, or offsets and 

avoid payment of unsupported and unallowable costs. Upon reviewing 

documentation for the 34 cost-related audits, we determined that one of 

these assignments covered the risk assessment portion of an incurred cost 

audit and was not a complete audit. Documentation for a second 

assignment to test for overpayments was terminated and the audit 

procedures were rolled into a billing system audit. Consequently, as shown 

in table 8, we reviewed a total of 32 cost-related DCAA assignments. These 

assignments included paid voucher reviews and overpayment control 

assignments and audits of requests for equitable adjustment (REA)11 and 

contractor incurred cost claims. 

Table 8: Summary of DCAA Cost-Related Assignments Reviewed 

Type of Assignment 

Region/FAO Paid Voucher review 

Over payment 

assignment REA audit Incurred Cost audit Total assignments

Northeast 

FAO #1 — 1 2 2 5

Mid-Atlantic 

FAO #2 4 1 — 1 6

Eastern 

FAO #3 3 3 — — 6

Central 

FAO #4 1 1 — — 2

FAO #5 5 2 — — 7

 

10 Contractor overpayments can occur as a result of errors made by paying offices, such as 

duplicate payments and payments in excess of amounts billed, and contractor billing 

errors, such as using the wrong overhead rate, failing to withhold designated amounts on 

progress payments, duplicate billings, or billing for unallowable cost. Recoveries of 

overpayments can be accomplished through refunds, subsequent billing offsets, or other 

adjustments to correct billing errors. Unallowable cost include lobbying cost, certain legal 

expenses, executive and management bonuses, luxury items, and certain overhead costs. 

11 REA audits relate to reviewing contractor requests for adjustments in billing rates 

pursuant to contract modifications. For example, if a contractor is asked to provide 

additional services or expand hours of service, contract costs would need to be 

recalculated and adjusted rates verified. REA audits relate to audits of contractor 

estimating system controls. 

Page 108 GAO-09-468 DCAA Audit Environment
Appendix III: Objectives, Scope, and 

Methodology 

Type of Assignment 

Region/FAO Paid Voucher review 

Over payment 

assignment REA audit Incurred Cost audit Total assignments

Western 

FAO #6 3 1 — — 4

FAO #7 — 1 — 1 2

Total 16 10 2 4 32

Source: GAO analysis of DCAA management information system data. 

The details of our assessments of DCAA audits of contractor internal 

control systems and cost-related audits and assignments are included in 

appendixes I and II, respectively. Examples of our findings are included in 

the body of this report to help illustrate the effect of our findings related to 

DCAA’s management environment. 

To assess DCAA’s management environment and quality control system, 

we reviewed DCAA’s mission statement, strategic plan, performance 

metrics, quality assurance program, audit planning and policy guidance, 

and human capital management. We evaluated the results of internal 

DCAA audit quality assurance reviews on audits issued from fiscal year 

2004 through 2008. We used requirements in the Government Performance 

and Results Act,12 GAGAS,13 and GAO’s Standards for Internal Control in 

the Federal Government14 as our criteria. 

We analyzed the findings, conclusions, and recommendations in the DOD 

Inspector General’s (IG) 2007 report on its oversight review of DCAA,15

which serves the purpose of a peer review. We did not review DOD IG 

documentation for the oversight review. In assessing the DOD IG peer 

review conclusions and opinion, we considered the inconsistencies 

between the findings and recommendations in the IG report. In addition, 

we considered the results of our analysis of DCAA audits in our prior 

investigation; our review of the 69 DCAA audits and related assignments 

 

12 Pub. L. No. 103-62, 107 Stat. 285 (Aug. 3, 1993). 

13 GAO-03-673G, and GAO-07-731G. 

14 GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-21.32.1 

(Washington, D.C.: November 1999). 

15 DOD Inspector General, Oversight Review: Review of the Defense Contract Audit 

Agency Quality Control System, Report No. D-2007-6-006 (Arlington, VA: May 1, 2007). 

Page 109 GAO-09-468 DCAA Audit Environment
Appendix III: Objectives, Scope, and 

Methodology 

covered in this report; the results of DCAA’s internal quality assurance 

reviews; and DCAA’s actions to rescind 80 audit reports. 

To achieve our second objective, we reviewed the status of several key 

actions that DCAA initiated as a result of our earlier investigation, 

including efforts to 

• revise DCAA’s mission statement and strategic plan to focus on 

protecting the public interest; 

• change performance metrics to focus on audit quality instead of 

performing large quantities audits; 

• end DCAA involvement with integrated product teams, which we 

identified as an impairment to DCAA’s independence; 

• improve audit quality by revising audit policy guidance and realigning 

DCAA’s audit quality assurance structure; and 

• update training courses to reflect changes in DCAA’s mission, metrics, 

and audit policy. 

Although the October 2008 Defense Business Board report recommended 

that the Secretary of Defense revise DCAA’s mission statement to focus on 

protecting the public interest, at the time we completed our work in July 

2009, DCAA’s mission statement had not yet been revised. To assess 

changes in performance metrics, we analyzed DCAA’s new metrics and 

determined whether changes made in September 2008 were effective in 

shifting DCAA focus from report production to performing quality audits 

and if the new metrics had been integrated into DCAA’s performance 

plans, auditor expectations, and performance appraisal standards. In 

addition, we made selected calls to one or more auditors in 15 selected 

DCAA offices that were separate from the offices we visited to review 

audit documentation and interviewed auditors about their experience with 

changes in DCAA policies and performance metrics. We also considered 

34 additional hotline allegations we received from auditors across the 5 

DCAA regions after our investigative report was issued. We used GAGAS 

criteria16 to assess the effectiveness of DCAA policy changes and DCAA’s 

centralization of the audit quality function aimed at improving auditor 

independence and audit quality. We used GAO’s Internal Control 

 

16 GAO-03-673G, and GAO-07-731G. 

Page 110 GAO-09-468 DCAA Audit Environment
Appendix III: Objectives, Scope, and 

Methodology 

Standards as our criteria for assessing DCAA’s management environment, 

culture, need for a risk-based audit approach, and human capital practices. 

To achieve our third objective to identify potential legislative and other 

actions to improve DCAA’s effectiveness, we considered DCAA’s current 

role and responsibilities; the framework of statutory authority for auditor 

independence in the Inspector General Act of 1978, as amended;17 best 

practices of leading organizations that have made cultural and 

organizational transformations; our past work on DCAA organizational 

alternatives;18 GAGAS criteria for auditor integrity, objectivity, and 

independence; and GAO’s Standards for Internal Control19 on managerial 

leadership and oversight. We identified potential short-term and longer 

term legislative actions and organizational changes that could enhance 

DCAA’s effectiveness and independence. 

Throughout our audit we met with the DCAA Director and DCAA 

headquarters policy, quality assurance, and operations officials and DCAA 

Region and FAO managers, supervisors, and auditors. We also met with 

DOD Office of Inspector General (OIG) auditors responsible for DCAA 

audit oversight and DOD IG hotline office staff. We assessed the reliability 

DCAA data used in our work by reviewing DCAA procedures for assuring 

the reliability of reported performance data, discussing the compilation 

and use of these data with DCAA operations personnel, and performing 

analytical procedures to determine the reliability of specific data used in 

our analysis. For example, we determined that DCAA assignments 

initiated in one year and completed in the second year were double 

counted. We eliminated duplicate records from data used for our analysis. 

We also met with the former DOD Comptroller/CFO to discuss plans for 

the Office of Comptroller/CFO and Defense Business Board reviews, and 

we continued to meet with and obtain information from the new DOD 

Comptroller/CFO and his staff. We also met with the Comptroller’s new 

DCAA Oversight Committee, which includes the Auditors General of the 

Army, the Navy, and the Air Force; the DOD Director of Defense 

Procurement and Acquisition Policy; and the DOD Deputy General 

Counsel for Acquisition. 

 

17 5 U.S.C., App. 

18 GAO, Defense Contract Audits: Current Organizational Relationships and 

Responsibilities, GAO/AFMD-91-14 (Washington, D.C.: Apr. 3, 1991). 

19 GAO/AIMD-00-21.3.1. 

Page 111 GAO-09-468 DCAA Audit Environment
Appendix III: Objectives, Scope, and 

Methodology 

We conducted this performance audit from August 2006 through 

December 2007, at which time we suspended this work to complete our 

investigation of hotline complaints regarding audits performed at three 

DCAA field offices. We resumed our work on this audit in October 2008 

and performed additional work through July 2009 to evaluate DCAA’s 

quality assurance program during fiscal years 2007 and 2008, assess DCAA 

corrective actions, and consider organizational placement options. We 

conducted our audit in accordance with generally accepted government 

auditing standards. Those standards require that we plan and perform the 

audit to obtain sufficient, appropriate evidence to provide a reasonable 

basis for our findings and conclusions based on our audit objectives. We 

believe that the evidence obtained provides a reasonable basis for findings 

and conclusions based on our audit objectives. We performed our 

investigative procedures in accordance with quality standards set forth by 

the Council of the Inspectors General on Integrity and Efficiency (formerly 

the President’s Council on Integrity and Efficiency). 

Page 112 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department Appendix IV: Comments from the of Defense 

Department of Defense 

Note: GAO comments 

supplementing those in 

the report text appear at 

the end of this appendix. 

Page 113 GAO-09-468 DCAA Audit Environment 
Appendix IV: Comments from the Department 

of Defense 

Page 114 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

Page 115 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

Page 116 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

Page 117 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

Page 118 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

Page 119 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

Page 120 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

Page 121 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

Page 122 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

Page 123 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

Page 124 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

Page 125 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

Page 126 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

Page 127 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

Page 128 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

See comment 1. 

Page 129 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

See comment 2. 

See comment 3. 

See comment 4. 

Page 130 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

See page 76. 

Page 131 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

See page 78. 

See page 75. 

Page 132 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

See comment 5. 

See comment 6. 

See comment 3. 

Page 133 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

See page 78. 

Page 134 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

See comment 7. 

Page 135 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

See comment 8. 

Page 136 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

See comment 9. 

See page 74. 

See page 75. 

Page 137 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

See page 76. 

Page 138 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

Page 139 GAO-09-468

The following are GAO’s comments on the U.S. Department of Defense 

letter dated September 4, 2009. 

1. Rescinded reports. DOD stated that we were incorrect in stating that 

about half of the rescinded reports relate to unsupported internal control 

reports. DOD is correct. Of the 80 rescinded audit reports, 24 (31 percent) 

relate to unsupported opinions on contractor internal controls, 47 (61 

percent) relate to forward pricing reports, and 6 (8 percent) relate to 

defective pricing, compliance with cost accounting standards, and a labor 

floor check. We have corrected this information in the body of our report. 

GAO Comments 

2. Central Region billing system audit. DOD stated that the DCAA field 

audit office does not believe that it intentionally delayed issuance of the 

report to allow the contractor to correct the system. Audit documentation 

clearly shows that the auditors monitored the contractor’s actions for 7 

months and issued the audit report 9 months after the exit conference, 

once the contractor had prepared “written desk procedures to ensure 

liquidation progress billings would be handled correctly.” Opinions should 

be based on the findings at the end of the audit, and reports should be 

issued when the audit is completed. 

3. Central Region billing system audit during fraud investigation.

DOD stated that our report appears to imply that DCAA was not aggressive 

in pursuing the potential fraud at this contractor and noted that the DCAA 

Investigative Support Team was instrumental in assisting in the fraud 

investigation that recovered over $2.8 million in a civil case settlement. 

The audit documentation shows that the Regional Audit Manager, in the 

presence of the field office manager and the supervisory auditor, directed 

the auditor not to pursue contractor charges of costs to future-year, 

unfunded contract lines and to forget what she learned in her previous 

DOD contract administration job where she had been responsible for 

reviewing similar types of contracts. In addition, after reassignment of the 

first supervisor, the second supervisory auditor instructed the auditor to 

stop “over documenting” her audit, to complete the assignment, and issue 

the report. Moreover, the DCAA auditors who investigated the fraud 

worked with the Army Criminal Investigative Division special agent and 

Department of Justice Attorneys, not the DCAA field audit office. Finally, 

we did, in fact, discuss additional documentation we received from the 

investigative auditors with DCAA headquarters officials and provided 

them a summary of the key audit-related issues that we obtained from the 

investigators. 

 DCAA Audit Environment 
Appendix IV: Comments from the Department 

of Defense 

4. Insufficient testing in cost-related assignments. DOD stated that it 

appears that GAO is holding DCAA to the GAGAS requirements for these 

assignments even though the majority of these audits are not GAGAS-type 

audits. As discussed in our report, DCAA does not consider its paid 

voucher reviews and overpayment assignments to be GAGAS assignments. 

However, this is important work intended to assure the reliability of 

contract payments. Specifically, DCAA paid voucher reviews are relied on 

for making billions of dollars in continuing contract payments without 

prior review by the government. The Defense Finance and Accounting 

Service (DFAS) relies on DCAA voucher reviews, and DFAS certifying 

officers do not repeat review procedures they believe were performed by 

DCAA. Because paid voucher reviews constitute a payment audit, they 

require sufficient testing to support reported DCAA conclusions that the 

government can rely on contractor controls over preparation of interim 

vouchers to continue to make contract payments without prior review. In 

addition, DCAA’s overpayment audits are intended to determine whether 

the contractor has adequate controls in place to detect and correct causes 

of overpayments and billing errors and make timely refunds and 

adjustments. The limited testing we observed in our work does not 

provide the intended assurance. 

5. Increase authority and independence. DOD stated that it did not 

agree with our statement that DCAA does not have access to contractor 

personnel. The discussion in our report is based on DCAA’s authority in 10 

U.S.C. 2313(a)(B)(2), which gives DCAA legal access to certain contractor 

records but not access to contractor personnel. Further, DCAA subpoena 

authority in 10 U.S.C. 2313(b) is specific to the production of contractor 

records that DCAA is authorized to audit or examine and does not cover 

contractor personnel. We agree that in practice, DCAA auditors have 

numerous ongoing discussions with contractor personnel. However, if a 

contractor official refuses to talk to an auditor, DCAA does not have legal 

authority to compel contractor officials to meet with or talk to DCAA 

auditors. Our point is that under authority similar to the IG Act, DCAA’s 

authority to interview contractor officials would be enhanced. 

6. Independence impairments. DOD stated that DCAA routinely 

encounters “push back” from contractors and that the DCAA field office 

subsequently received training records from the contractor. We recognize 

that the field office received some training records from the contractor. 

However, we saw a pattern throughout this audit where the auditor limited 

requests for contractor documentation and also performed little or no 

testing in various areas because “the contractor would not appreciate it” if 

he did more testing. The audit documentation shows that the auditor 

Page 140 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

performed limited testing of selected billing clerk training. Additionally, 

documentation on testing of the contractor’s review of subcontractor 

costs shows that although the auditor should have tested cost data for 

three of the top five subcontractors, the auditor asked the contractor to 

“provide a list of the top 3-5 subcontracts, including subcontract values.... 

Three subcontractors would be fine.” This indicates that the auditor not 

only accepted data the contractor was willing to provide for testing, but he 

also let the contractor select the data to be used for testing. The auditor 

then tested costs of only one subcontractor. The pattern of backing off on 

requests for documentation and limiting the extent of testing based on 

concerns about the contractor’s reaction indicates that the auditor was 

influenced by the contractor and limited his audit procedures as a result—

a clear independence impairment. DCAA rescinded the audit report on 

February 10, 2009. 

7. Production auditing. USD AT&L comments suggest that there is a 

trade-off between audit timeliness and audit quality. We view both quality 

and timeliness as critical to effective contracting officer decision making. 

However, timely audits that do not meet professional standards are not 

quality audits and could be misleading or impair important contract 

decisions. For example, our audit identified three contractor internal 

control audits—an accounting system audit and two billing system 

audits—that were completed in 9, 13, and 15 days, respectively—all with 

adequate opinions on the contractor’s internal controls. Apparently, the 

contracting officers involved thought these audits were timely and met 

their needs because there was no audit documentation to the contrary. 

However, in response to our work, DCAA has rescinded all three of these 

audits. USD AT&L comments also stated, “A good audit in time is better 

than an extraordinary audit that is late and never used.” Our report did not 

call for extraordinary audits. DOD has determined that certain DCAA 

audits should comply with professional standards. When audit 

organizations state that their audits comply with professional standards, 

they must follow these standards. Further, until DCAA and AT&L address 

the need for DCAA to perform 30,000 assignments and issue over 20,000 

reports annually, DCAA will continue to face audit quality and timeliness 

problems. 

8. Contract audits in conformance with GAGAS. USD AT&L states 

that it believes that for some reviews and financial advice provided by 

DCAA, it is possible that it may not be necessary to perform GAGAS work 

to support certain contracting officer functions. We agree. As discussed in 

our report, a risk-based audit approach may require an appropriate 

delegation of nonaudit contract administration activities and audit 

Page 141 GAO-09-468 DCAA Audit Environment
Appendix IV: Comments from the Department 

of Defense 

responsibilities among DCMA, buying commands, finance community, and 

DCAA. An effective risk-based approach would include an effort by these 

communities to re-evaluate whether all such services should be provided 

as audits and whether DCAA, as an independent audit organization, would 

perform any nonaudit services. 

USD AT&L also stated that DCAA may be able to support contracting 

officer functions through an attestation review rather than a financial 

audit. However, DCAA does not perform financial audits. Instead, DCAA 

performs examination-level attestation audits and reports conclusions and 

opinions on subject matter as a whole. Examinations provide the highest 

level of assurance, and they must be based on sufficient evidence, often 

referred to as positive assurance work. For an attestation review, GAGAS 

require auditors to perform sufficient testing to form a conclusion based 

on the work performed. It is important to note that GAGAS prohibit 

auditors from performing review-level attestation work for reporting on 

internal control or compliance with laws and regulations. 

9. DCAA staffing. USD AT&L stated that “the [DCAA] workforce build-up 

will require years of effort to hire and train the staff required to do the 

work envisioned by the GAO audit.” We did not call for a build-up of the 

DCAA workforce. Instead, we noted that DCAA production metrics had a 

direct impact on audit quality. Therefore, it will be important to perform a 

risk-based analysis of FAR requirements and determine the mix of audit 

and nonaudit services that will best meet these requirements with 

consideration of appropriate roles and responsibilities of the contracting 

and finance communities. 

Page 142 GAO-09-468 DCAA Audit Environment
Appendix V: Comments from the Department Appendix V: Comments from the Department of Defense Inspector General 

of Defense Inspector General 

Page 143 GAO-09-468 DCAA Audit Environment 
Appendix V: Comments from the Department 

of Defense Inspector General 

Page 144 GAO-09-468 DCAA Audit Environment
Appendix V: Comments from the Department 

of Defense Inspector General 

Page 145 GAO-09-468 DCAA Audit Environment
Appendix V: Comments from the Department 

of Defense Inspector General 

Page 146 GAO-09-468 DCAA Audit Environment
Appendix V: Comments from the Department 

of Defense Inspector General 

(195099) Page 147 GAO-09-468 DCAA Audit Environment
GAO’s Mission The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday afternoon, GAO 

posts on its Web site newly released reports, testimony, and 

correspondence. To have GAO e-mail you a list of newly posted products, 

go to www.gao.gov and select “E-mail Updates.” 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s Web site, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information. 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, DC 20548 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548 

Public Affairs 

Please Print on Recycled Paper