Contract Audits: Role in Helping Ensure Effective Oversight and Reducing Improper Payments
Published: 2011-02-01T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Agencies across the government are increasingly reliant on contractors to execute their missions. With hundreds of billions of taxpayer dollars at stake, the government needs strong controls to provide reasonable assurance that these contract funds are not being lost to improper payments (fraud and errors), waste, and mismanagement. Effective contract oversight, which includes effective internal controls throughout the contracting process, is essential to protecting government and taxpayer interests. Standards for Internal Control in the Federal Government provides the overall framework for internal control, which includes the control environment, risk assessment, control activities, information and communication, and monitoring. Contract auditing is a control mechanism intended to provide those responsible for government procurement with financial information and advice relating to contractual matters and the effectiveness, efficiency, and economy of contractors' operations. Today's testimony describes the (1) contracting cycle and related internal controls, (2) Defense Contract Audit Agency (DCAA) and its role in performing contract audits for the Department of Defense (DOD) and other federal agencies, and (3) risks associated with ineffective contract controls and auditing. GAO's testimony is based on prior reports and testimonies, as listed at the end of this statement.
section_title: What GAO Found
paragraphs: The contracting cycle consists of activities throughout the acquisition process, including preaward and award, contract administration and management, and ultimately the contract closeout. Strong internal controls contain a balance of preventive and detective controls appropriate for the agency's operation and help ensure an effective contract oversight process. Preventive controls--such as invoice review prior to payment--are controls designed to prevent improper payments, waste, and mismanagement, while detective controls--such as incurred cost audits--are designed to identify improper payments after the payment is made. While detective controls identify funds that may have been inappropriately paid and should be returned to the government, preventive controls help to reduce the risk of improper payments or waste before they occur. DOD accounts for the largest share of federal contract spending. DCAA was established in 1965 in response to studies which identified the need for consistency in contract audits at DOD. DCAA serves a critical role in DOD and other federal agency contractor oversight by providing auditing, accounting, and financial advisory services in connection with the negotiation, administration, and closeout of contracts and subcontracts. The majority of DCAA audits focus on cost-reimbursable and other nonfixed-price contracts, which pose the highest risk to the government. Reported federal contract obligations--which have increased by $100 billion in real terms since fiscal year 2005, from $435 billion to $535 billion in fiscal year 2010--poses significant risk if effective contract oversight is not in place. GAO's work has identified contract management weaknesses, significant problems with federal agency controls over contract payments, and internal control deficiencies throughout the contracting process, including contract auditing. GAO also found audit quality problems at DCAA offices nationwide, including compromise of auditor independence, insufficient audit testing, and inadequate planning and supervision. DCAA and the other federal agencies mentioned in GAO's testimony have completed some actions and have actions under way to address GAO's recommendations. GAO made17 recommendations to DOD and the DOD Inspector General (IG) to address the weaknesses it identified at DCAA. DOD and DCAA have taken a number of actions on these recommendations, including revising DCAA's mission statement, appointing a new DCAA Director and a Western Region Director, establishing an internal review office to perform periodic internal evaluations and address hotline complaints, initiating outside hiring, strengthening its audit quality review function, and providing training on auditing standards. DCAA has actions under way on other recommendations. DOD IG has expanded its oversight of DCAA's audit quality control process. In addition, the Centers for Medicare and Medicaid Services (CMS) have completed actions on two recommendations and expect to complete actions on all but one of the remaining 16 recommendations by March 31, 2011. Department of Energy official's stated that actions have been complete on all 11 GAO recommendations. GAO is following up to confirm.

section_title: Letter
paragraphs: Thank you for the opportunity to be here today to discuss the role that  contract audits can serve in contract oversight processes and helping to  reduce the risk of improper payments. The purpose of contract auditing is  to assist in achieving prudent contracting by providing those responsible  for government procurement with financial information and advice  relating to contractual matters and the effectiveness, efficiency, and  economy of contractors’ operations. With reported federal contract  spending topping the $500 billion mark annually, effective contract  oversight, which includes effective internal control throughout the  contracting process, is essential to protecting the government and  taxpayer interests. The Standards for Internal Control in the Federal  Government provide the overall framework for establishing and  maintaining internal control and for identifying and addressing areas at  greatest risk of fraud, waste, abuse, and mismanagement.
Today, I will describe the (1) contracting cycle and the general nature of  internal controls that should be in place, (2) Defense Contract Audit  Agency (DCAA) and its role in performing contract audits, and (3) risks  associated with ineffective contract controls and auditing. I will conclude  by outlining some potential actions that could improve the effectiveness of  DCAA and its role in performing contract audits for the Department of  Defense (DOD) and other federal agencies.
In preparing this testimony, we relied on the work we performed during  our DCAA engagements, as well as our extensive body of work on federal  agency contract management. More detail on our scope and methodology  is included in each issued product. Our audit work was conducted in  accordance with generally accepted government auditing standards  (GAGAS). Those standards require that we plan and perform our audits to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: The Contracting Cycle and Internal Controls
paragraphs: The contracting cycle consists of activities throughout the acquisition  process, including preaward and award, contract administration and  management, and ultimately the contract closeout. Generally, prior to  contract award, an agency identifies a need; develops a requirements  package; determines the method of acquisition; solicits and evaluates bids  or proposals; determines the adequacy of the contractor’s accounting  system for billing purposes; and ultimately negotiates a price and contract  terms, resulting in the contract awards. After contract award, the agency  performs activities related to contract administration and management.  Contract administration and management involves monitoring the  contractor’s performance as well as reviewing and approving (or  disapproving) the contractor’s requests for payments. As discussed in  more detail later in this statement, there are various types of contract  audit activities that can occur in the preaward and award, and  administration and management phases of a contract. The contract  closeout process involves verifying that the goods or services were  provided and that administrative matters are completed, including a  contract audit of costs billed to the government and adjusting for any over-  or underpayments based on the final invoice. Effective contract oversight  includes effective internal control throughout the contracting process.
subsections: section_title: Internal Control
paragraphs: Generally, the government manages its risk, in part, through establishing  effective internal controls, which includes performing oversight activities.  Standards for Internal Control provides that to be effective, an entity’s  management should establish both a supportive overall control  environment and specific control activities directed at carrying out its  objectives. As such, an entity’s management should establish and  maintain an environment that sets a positive and supportive attitude  towards control and conscientious management. A positive control  environment provides discipline and structure as well as a climate  supportive of quality internal control, and includes an assessment of the  risks the agency faces from both external and internal sources. Control  activities are the policies, procedures, techniques, and mechanisms th enforce management’s directives and help ensure that actions are taken address risks. The standards further provide that information should  be  recorded and communicated to management and oversight officials in a  form and within a time frame that enables them to carry out their  responsibilities. Finally, an entity should have internal control monitori activities in place to assess the quality of performance over time and  ensure that the findings of audits and other review s are promptly resolved.
Control activities include both preventive and detective controls.  Preventive controls—such as invoice review prior to payment—are  controls designed to prevent improper payments (errors and fraud),  waste, and mismanagement, while detective controls—such as incurred  cost audits—are designed to identify errors or improper payments after  the payment is made. A sound system of internal control contains a  balance of both preventive and detective controls that is appropriate for  the agency’s operations. While detective controls are beneficial in that  they identify funds that may have been inappropriately paid and should be  returned to the government, preventive controls such as accounting  system reviews and invoice reviews help to reduce the risk of improper  payments or waste before they occur. A key concept in the standards is  that the cost of control activities should not outweigh the benefit.  Generally, it is more effective and efficient to prevent improper payments.  A control activity can be preventive, detective, or both, based on when the  control occurs in the contract life cycle.
section_title: Contract Types and Related Risks
paragraphs: Agencies may choose among different contract types to acquire goods and  services. This choice is the principal means that agencies have for  allocating risk between the government and the contractor. The choice of  a contract type will also impact the types of internal control and contract  auditing activities needed to help protect the government’s interests and  reduce the risk of improper payments. Contract types can be grouped into  two broad categories: fixed-price contracts and nonfixed-price contracts,  such as cost-reimbursable contracts and time and materials (T&M)  contracts. Although the Federal Acquisition Regulation (FAR) places  limitations on the use of cost-reimbursement and T&M contract types,  these contract types may be used to provide the flexibility needed by the  government to acquire the large variety and volume of supplies and  services it needs. The three types of contracts place different levels of risk  on the government and the contractor. For example,    For fixed-price contracts, the government agrees to pay a set price for  goods or services regardless of the actual cost to the contractor. A  fixed-price contract is ordinarily in the government’s interest when the  risks involving the project and the project’s price are minimal or can  be predicted with an acceptable degree of certainty and a sound basis  for pricing exists, as the contractor assumes the risk for cost overruns.
Under cost-reimbursement contracts, the government agrees to pay  those costs of the contractor that are allowable, reasonable, and  allocable to the extent prescribed by the contract. Consequently, the  government assumes most of the cost risk. The contractor is required  to provide its best effort to meet contract objectives within the  estimated cost. If this cannot be done, the government can provide  additional funds to complete the effort, decide not to provide  additional funds, or terminate the contract. Cost-reimbursement  contracts may be used only when the contractor’s accounting system  is adequate for determining costs applicable to the contract and  appropriate government surveillance during contract performance will  provide reasonable assurance that efficient methods and effective cost  controls are used. In order to determine if the contractor has efficient  methods and effective cost controls, contracting officers and other  contracting oversight personnel may perform reviews of various  contractor systems, as well as a comprehensive review of contractor  invoices to determine if the contractor is billing costs in accordance  with the contract terms and applicable government regulations. In  addition, the establishment of provisional and final indirect cost rates  helps to ensure that the government makes payments for costs that are  allowable, reasonable, and allocable to the extent prescribed by the  contract.
For T&M contracts, the government agrees to pay fixed, per-hour labor  rates and to reimburse other costs directly related to the contract,  such as materials, equipment, or travel, based on cost. Like cost- reimbursement contracts, the government assumes the cost risk  because the contractor is only required to make a good faith effort to  meet the government’s needs within a ceiling price. A T&M contract  may be used only if the contracting officer prepares a determination  and findings that no other contract type is suitable and if the contract  includes a ceiling price that the contractor exceeds at its own risk. In  addition, since these contracts provide no positive profit incentive for  the contractor to control costs or use labor efficiently, the government  must conduct appropriate surveillance of contractor performance to  ensure efficient methods and effective cost controls are being used.
As discussed in more detail later in this statement, most contract audit  activity is focused on cost-reimbursable and other nonfixed-price  contracts, due to the higher risks to the federal government.
section_title: DCAA’s Origin and Contract Audit Role
paragraphs: Audits of military contracts can be traced back to at least the World War I  era. Initially, the various branches of the military had their own contract  audit function and associated instructions and accounting rulings.  Contractors and government personnel recognized the need for  consistency in both contract administration and audit. The Navy and the  Army Air Corps made the first attempt to perform joint audits in 1939. By  December 1942, the Navy, the Army Air Corps, and the Ordnance  Department had established audit coordination committees for selected  areas where plants were producing different items under contracts for  more than one service. On June 18, 1952, the three military services jointly  issued a contract audit manual that later became the DCAA Contract  Audit Manual (CAM). The CAM has been regularly updated over the  years and is still in use today.
In May 1962, Secretary of Defense Robert S. McNamara instituted “Project  60” to examine the feasibility of centrally managing the field activities  concerned with contract administration and audit. An outcome of this  study was the decision to establish a single contract audit capability within  DOD and DCAA was established on June 8, 1965. At that time, DCAA’s  mission was to perform all necessary contract audits for DOD and provide  accounting and financial advisory services regarding contracts and  subcontracts to all DOD components responsible for procurement and  contract administration. DCAA was placed under management control of  the Under Secretary of Defense (Comptroller), where it remains today.  Other audit organizations, including the DOD and other federal agency  Inspectors General (IG), the Special IGs for Iraq and Afghanistan, and the  military service audit agencies also have a role in the oversight of federal  contracts.
DCAA consists of a headquarters office at Fort Belvoir, Virginia, and six  major organizational components—a field detachment office, which  handles audits of classified contracting activity, and five regional offices  within the United States. The regional offices manage field audit offices  (FAO), which are identified as branch offices, resident offices, or  suboffices. Resident offices are located at larger contractor facilities in  order to facilitate DCAA audit work. In addition, regional office directors  can establish suboffices as extensions of FAOs to provide contract audit  services more economically. A suboffice depends on its parent FAO for  release of audit reports and other administrative support. In total, there  are currently 382 DCAA offices, including 114 FAOs, throughout the  United States and overseas. At the end of fiscal year 2010, DCAA employed  about 4,700 staff, of which 85 percent are auditors, at DCAA’s various  offices throughout the United States, Europe, the Middle East, and in the  Pacific to perform audits and provide nonaudit services in support of  contract negotiations related to approximately 9,000 contractors.
DCAA contract audits are intended to be a key control to help ensure that  prices paid by the government for needed goods and services are fair and  reasonable and that contractors are charging the government in  accordance with applicable laws, the Federal Acquisition Regulation  (FAR), Cost Accounting Standards (CAS), and contract terms. DCAA’s  mission encompasses both audit and nonaudit services in support of DOD  and other federal agencies’ contracting and contract payment functions.  FAR subpart 42.1, “Contract Audit Services,” and DOD Directive 5105.36,  Defense Contract Audit Agency (DCAA), establish DCAA as the  department’s contract audit agency and set forth DCAA’s responsibilities.
FAR 42.101 prescribes contract audit responsibilities as submitting  information and advice to the requesting activity, based on the analysis of  contractor financial and accounting records or other related data as to the  acceptability of the contractors’ incurred and estimated costs; reviewing  the financial and accounting aspects of contractor cost control systems;  and performing other analyses and reviews that require access to  contractor financial and accounting records supporting proposed and  incurred costs.
DOD’s acquisition life cycle includes many contract and administrative  activities. As illustrated in figure 1, these activities fall into three contract  phases—preaward and award, administration and management, and  closeout—that involve several activities and numerous types of audits.  DCAA and other federal agencies are not consistent in their definitions of  contract audits and reviews and other federal agencies generally do not  perform the full range of audits that DCAA performs. While the majority of  DCAA’s audit effort supports the DOD contract community, in fiscal year  2010, based on DCAA records, about 12 percent of DCAA’s audit hours  were used to respond to other federal agency requests for contractor  audits. DCAA performs audit services for other federal agencies on a fee- for-service basis. Appendix I contains information on DCAA audits and  nonaudit services provided by DCAA in support of contracting and  contract payment.
The majority of DCAA audits focus on cost-reimbursable and other  nonfixed-price contracts, including progress payments on major weapon  systems and time-and-materials contracts. These contract types pose the  highest risk to the government because the government is generally not  promised a completed deliverable or service at a set price. DCAA audits of  contractor business systems and related internal controls support  decisions on pricing, contract awards, and billing. For example, the FAR  requires government contracting officers to determine the adequacy of a  contractor’s accounting system before awarding a cost-reimbursement or  other nonfixed-price contract. Audits of estimating system controls  support negotiation of fair and reasonable prices. Also, billing system  audits support decisions to authorize contractors to submit invoices  directly to DOD payment offices for payment without government  review. Internal control audits also impact the planning and reliability of  other DCAA audits, such as audits of contractors’ pricing proposals and  annual incurred cost claims, because DCAA uses the results of its internal  control audits to assess risk and plan the nature, extent, and timing of  tests for these audits.
section_title: Risks of Ineffective Contract Controls and Auditing
paragraphs: Agencies across the government are increasingly reliant on contractors to  execute their missions. In fiscal year 2010, federal agencies reported  obligating approximately $535 billion on goods and services—more than  double the amount obligated at the start of the last decade in real terms.  Our analysis of Federal Procurement Data System–Next Generation  (FPDS-NG) contract obligations determined that although federal  contract spending increases have slowed and decreased slightly in recent  years, over the past 5 years federal contract spending has increased by  $100 billion. As illustrated in figure 2, the sheer size of federal contract  spending poses significant risk if effective processes, controls, and  oversight are not in place. DOD accounts for approximately 70 percent of  the federal government’s FPDS-NG reported annual contract spending— $367 billion in fiscal year 2010—and other federal agencies accounted for  $168 billion in contract spending. With hundreds of billions in taxpayer  dollars spent on government contracts, strong contract oversight is  essential.
GAO’s work has shown that agencies confront several interrelated  challenges, including separating wants from needs; executing acquisition  programs within available funding and established time frames; using  sound contracting arrangements with appropriate incentives and effective  oversight; assuring that contractors are used only in appropriate  circumstances and play proper roles; and sustaining a capable and  accountable acquisition workforce. In addition, since 1997, we have  reported that the nonacquisition workforce, such as contracting officer  representatives and unit leaders, also have a role in contract management  and must be trained.
These challenges have contributed to GAO’s designating contract  management as a high-risk area at DOD, the Department of Energy, and  the National Aeronautical and Space Administration. Weapon system  acquisition is also designated as a high-risk area at DOD. Governmentwide,  GAO also designated the management and use of interagency contracting  as high risk. Other agencies face many of the same challenges.  Collectively, these challenges expose hundreds of billions of dollars to potential risks of improper payments, waste, and  mismanagement.
subsections: section_title: Contracting Control Weaknesses GAO Work
paragraphs: Our work has identified significant contract management weaknesses,  problems with federal agency controls over contract payments , as we weaknesses in contract auditing. We have identified internal control  deficiencies that have occurred throughout the contracting process and  phases. These weaknesses and deficiencies increase the risk of improper  payments, and fraud, waste, abuse, and mismanagement. For example, we  found:  Department of Energy (DOE). DOE’s internal controls over payments  to its Waste Treatment Plant (WTP) contractor did not provide reasonab assurance against the risk of improper payments, particularly given the  WTP project’s substantial inherent risks. Several factors combine to pose an inherent risk to the government of improper payments on th including the size and complexity of this one-of-a-kind nuclear  construction project, the multibillion-dollar cost and schedule overr the project had already experienced, and the substantial volume of  transactions billed by the contractor to DOE on each invoice. Despite these risks, in fiscal years 2005 and 2006, DOE performed little or no  review of the contractor’s invoices or supporting documents for $40  million to $60 million billed by the contractor to DOE each month. The  need for close, ongoing review of invoiced transactions and support is  particularly compelling given that the contractor’s invoices prov detail as to the items purchased, contrary to FAR and contract  requirements. However, DOE officials chose instead to rely primarily on  ncial  DCAA’s review and approval of the contractor’s corporatewide fina systems, which DOE officials believed allowed them to rely on the  contractor’s systems with little or no DOE oversight. In addition, DOE  relied primarily on the contractor to review and validate subcontractor  charges without having a process in place to assess whether the  contractor was properly carrying out its subcontractor oversight  ided little  responsibility. DOE’s heavy reliance on DCAA and the contractor, with  little oversight of its own, exposed the hundreds of millions of dolla spent annually on the WTP project to an unnecessarily high risk of  improper payments. Our July 2007 report made 11 recommendations to improve DOE’s oversight of and accountability for WTP expenditures.  DOE officials advised us that they have completed action on all 11  recommendations. We are currently following up to confirm DOE’s  actions.
Centers for Medicare and Medicaid Services (CMS). We evaluated  CMS’s Medicare Modernization Act (MMA) program contracting acti vity  and found that CMS did not fulfill critical contractor oversight  responsibilities, such as reviewing contractors’ indirect cost rate  information and assessing the adequacy of the contractors’ accounting  systems, thereby increasing risks of fraud, waste, and abuse not only to    CMS but to other federal agencies that may use the same contractors. Specifically, we identified numerous questionable payments totaling  nearly $90 million that represented potentially improper, unsubstantiated,  or wasteful payments. For example, we found payments for costs that did  not comply with the terms of the contract or applicable regulation, such a costs for unapproved labor categories, costs exceeding contract indire rate ceiling amounts, and travel costs in excess of allowable limits. In  other cases, we were unable to obtain adequate documentation, such as vendor invoices or time sheets, to support costs billed. In addition, w identified payments for which risks in CMS’s contracting practic resulted in potential waste. In some cases, due to the facts and  circumstances involved, we were unable to determine whether or to what  extent the costs were allowable, reasonable, and allocable. Our November 2007 report made nine recommendations to the Administrator of CMS to  improve internal control and accountability in the contracting proces related payments to contractors. CMS completed actions to develop  agency-specific policies and procedures for the review of contractor  invoices and create a centralized tracking mechanism that records the  training taken by personnel assigned to contract oversight activities. I addition, CMS officials advised that CMS has recovered $2.8 million,  deemed $7.5 million in questioned payments to be proper, and anticipa the remaining questioned cost will be found to have been proper after  te  indirect rate audits are complete. We are continuing to follow up on CMS’s  progress in addressing the remaining seven open recommendations.
As a result of the contracting weaknesses we found in the MMA program,  GAO was asked to evaluate CMS’s internal controls over its contracting  activities. Based on our audit, we found pervasive deficiencies in CMS’s  internal controls over contracting and payments to contractors. The  internal control deficiencies occurred throughout the contracting process  phases. These deficiencies were due in part to a lack of agency-specific  policies and procedures to ensure that FAR requirements and other  control objectives were met. CMS also did not take appropriate steps to  ensure that existing policies were properly implemented nor maintained  adequate documentation in its contract files. As a result of our work, we  estimated that at least 84.3 percent of FAR-based contract actions made by  CMS in fiscal year 2008 contained at least one instance in which a key  control was not adequately implemented. We also estimated that at least  37.2 percent of FAR-based contract actions made in fiscal year 2008 had  three or more instances in which a key control was not adequately  implemented. The high percentage of deficiencies indicated a serious  failure of control procedures over FAR-based acquisitions, thereby  creating a heightened risk of making improper payments or waste. Our  October 2009 report made nine additional recommendations to the CMS  Administrator to develop and implement policies and procedures to  ensure that FAR requirements and other control objectives are met. We  have obtained documentation on CMS’s actions and are in the process of  validating this information. CMS officials told us they expect to complete  actions on all but one of our recommendations by March 31, 2011.
section_title: Ineffective Contract Auditing
paragraphs: In 2009, we reported on audit quality problems at DCAA offices  nationwide, including compromise of auditor independence, insufficient  audit testing, and inadequate planning and supervision. In addition,  DCAA’s management environment and quality assurance structure were  based on a production-oriented mission that put DCAA in the role of  facilitating DOD contracting without also protecting the public interest.  We found serious quality problems in the 69 audits and cost-related  assignments we reviewed. For example, 65 of these assignments  exhibited serious noncompliance with generally accepted government  auditing standards (GAGAS) or other deficiencies similar to those found in  our investigation, including compromise of auditor independence,  insufficient audit testing, and inadequate planning and supervision. DCAA  has taken action on many of our recommendations but continues to  experience significant audit quality problems across offices in all DCAA  regions.
As a result of our work, DCAA rescinded over 80 audit reports because its  underlying audit evidence was outdated, insufficient, or inconsistent with  reported conclusions and opinions. Those rescinded audits had been  issued to support decisions on contract pricing and awards and impacted  the planning and reliability of hundreds of other DCAA audits,  representing billions of dollars in DOD expenditures. About one-third of  the rescinded reports relate to unsupported opinions on contractor  internal controls and were used as the basis for risk assessments and  planning on subsequent internal control and cost-related audits. Other  rescinded reports relate to Cost Accounting Standards (CAS) compliance  and contract pricing decisions. Because the conclusions and opinions in  the rescinded reports were used to assess risk in planning subsequent  audits, they impact the reliability of hundreds of other audits and  contracting decisions covering billions of dollars in DOD expenditures.
A management environment and agency culture that focused on  facilitating the award of contracts and an ineffective audit quality  assurance structure are at the root of DCAA’s agencywide audit failures  we identified. DCAA’s focus on a production-oriented mission led DCAA  management to establish policies, procedures, and training that  emphasized performing a large quantity of audits to support contracting  decisions and gave inadequate attention to performing quality audits. An  ineffective quality assurance structure, whereby DCAA gave passing  scores to deficient audits, compounded this problem.
Lack of independence. In seven audits, independence was compromised  because auditors provided material nonaudit services to a contractor they  later audited; experienced access to records problems that were not fully  resolved; and significantly delayed report issuance, which allowed the  contractors to resolve cited deficiencies so that they were not cited in the  audit reports.
Unsupported opinions. Thirty-three of 37 internal control audits did not  include sufficient testing of internal controls to support auditor  conclusions and opinions, which are relied on for 2 to 4 years, and  sometimes longer. The lack of sufficient support for those audit opinions  rendered them unreliable for decision making on contract awards, direct- billing privileges, the reliability of cost estimates, and reported direct cost  and indirect cost rates. For example, we found that:    For many controls, DCAA did not perform any testing at all. For  example, audits of contractor accounting systems focus on a review of  the adequacy of contractor policies and procedures. At least six of the  nine accounting audits we reviewed did not include procedures for  confirming contractor segregation of allowable and unallowable cost.
DCAA issued an “adequate” opinion on the accounting system for a  major DOD contractor, indicating that system controls were effective,  after performing only a walkthrough of the accounting process and  interviewing two employees.
In billing system audits we reviewed, DCAA auditors often tested only  two, three, or sometimes five transactions to support audit conclusions  on contractor systems and related internal controls. Twenty of the 22  billing system audits we reviewed did not include tests to identify  duplicate invoices.
In one audit, DCAA auditors reported on the adequacy of a  contractor’s billing system based on tests of only four vouchers—all  issued on the same day.
In an audit of controls over indirect and other direct cost for a  business segment of one of the top five DOD contractors, DCAA  auditors tested only 12 out of about 22,000 transactions processed  from May through July 2005.
Similarly, the 32 cost-related assignments we reviewed did not contain  sufficient testing to provide reasonable assurance that overpayments and  billing errors that might have occurred were identified. As a result, there is  little assurance that any such errors, if they occurred, were corrected and  that related improper contract payments, if any, were refunded or credited  to the government. Contractors are responsible for ensuring that their  billings reflect fair and reasonable prices and contain only allowable costs,  and taxpayers expect DCAA to review these billings to provide reasonable  assurance that the government is not paying more than it should for goods  and services. We identified the following problems with these  assignments.
Paid voucher reviews. Under the direct-bill program, contractors  may submit their invoices directly to the DOD disbursing officer for  payment without further review. DCAA performs annual testing of paid  vouchers (invoices) to determine if contractor voucher preparation  procedures are adequate for continued contractor participation in the  direct-bill program. For the 16 paid voucher assignments we  reviewed, we found that DCAA auditors failed to comply with DCAA  Contract Audit Manual (CAM) guidance. Auditors generally did not  identify the population of vouchers, did not create sampling plans, and  made a small, nonrepresentative selection of as few as one or two  invoices for testing to support conclusions on their work. Based on the  limited work that was performed, the auditors concluded that controls  over invoice preparation were sufficient to support approval of the  contractors’ direct billing privileges. This is of particular concern  because we determined that Defense Finance and Accounting Service  (DFAS) certifying officers rely on DCAA voucher reviews.
Overpayment assignments. DCAA performs overpayment  assignments to verify that contractors have billing procedures and  internal controls in place to identify and resolve contractor billing  errors and overpayments in a timely manner. We found that auditor  judgments about the population and selection of transactions for these  assignments did not provide a representative universe for testing and  concluding on contractor controls over billings and payments  received. As a result, this work does not provide reasonable assurance  that contractors have adequate controls in place to identify and correct  overpayments and billing errors and make appropriate, timely refunds  and adjustments.
Incurred cost audits. The purpose of incurred cost audits is to  examine contractors’ cost representations and opine on whether the  costs are allowable, allocable to government contracts, and reasonable  in accordance with the contract and applicable government acquisition  regulations. For the four incurred cost audits we reviewed, we found  that the auditors did not perform sufficient, detailed testing of claimed  indirect and direct costs. As a result, the scope of work performed was  not sufficient to identify claimed costs, if any, that were not adequately  supported or unallowable costs, if any, that should have been  questioned.
DCAA’s mission statement, strategic plan, and metrics all focused on  producing a large number of audit reports and provided little focus on  assuring quality audits. For example, in fiscal year 2008, DCAA performed  approximately 30,000 audits with 3,600 auditors. This workload  substantially contributed to the widespread audit quality problems we  identified. While DCAA has increased its staff to about 4,700, of which  about 85 percent are auditors, and reduced the number of reports issued in  fiscal year 2010 to about 10,000. Based on routine audit follow-up work,  we have determined that DCAA has allocated resources to the highest risk  contracts but not yet fully completed actions on a risk-based audit  approach, with consideration of resources and auditing standards, that is  effective in protecting taxpayer interest. In addition, DCAA has not yet  resolved fundamental weaknesses in its strategic plan, metrics, and human  capital practices that had a detrimental effect on audit quality. In addition,  DCAA and the Defense Contract Management Agency (DCMA) identified  as part of their current cost recovery initiative that there is a significant  backlog of Cost Accounting Standards (CAS) cost impact issues requiring  disposition and resolution by administrative contracting officers.  According to DOD Inspector General officials, these CAS issues represent  billions of dollars of unresolved audit findings and the 6-year statute of  limitations is running out on many of them.
Considering the large number of DCAA audit reports issued annually and  the reliance the contracting and finance communities place on DCAA audit  conclusions and opinions, effective and reliable contract audits are  necessary to protecting the public interest.
In our 2009 report, we made 17 specific recommendations to DOD and the  DOD Inspector General (IG) to improve DCAA’s management  environment, audit quality, and oversight. DOD and DCAA have taken a  number of actions on our recommendations, including revising DCAA’s  mission statement, appointing a new DCAA Director and a Western Region  Director, establishing an internal review office to perform periodic  internal evaluations and address hotline complaints, initiating outside  hiring, expanding its audit quality review function, and providing training  on auditing standards. While DCAA has initiated actions on our other  recommendations, as discussed in our report, DCAA will need more time  to complete those actions. Those include achieving changes in its  management environment and culture, developing a strategic plan that  links to performance metrics and a human capital strategic plan,  developing a well-supported risk-based contract audit approach, obtaining  outside expertise on auditing standards to assist in revising its contract  auditing policies and procedures, and providing guidance on sampling and  testing for the various types of audits it performs. DOD IG has expanded  its oversight of DCAA’s audit quality control process.
Our 2009 report also offered some potential actions for strengthening the  organizational effectiveness of DCAA and the contract audit function in  the federal government. These potential actions would require further  study as well as congressional action, and include actions intended to      (1) increase DCAA’s authority and independence, (2) provide for  additional reporting and oversight of audit results, and (3) evaluate  whether certain organizational changes to DCAA could strengthen its  independence and improve audit quality. We have reprinted the detail of  these options in appendix II.
Madam Chairman and Members of the Subcommittee, this concludes my  statement. We would be pleased to answer any questions that you may  have at this time.
section_title: Contacts and Acknowledgments
paragraphs: For further information about this testimony, please contact Jeanette M.  Franzel at 202-512-9471 or franzelj@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this testimony. Major contributors to our testimony include Gayle  Fischer, Assistant Director; F. Abe Dymond, Assistant General Counsel;  Omar Torres, Auditor-in-Charge; and Yiming Wu, auditor.
section_title: Appendix I: DCAA Audit and Nonaudit Services
paragraphs: Table 1 lists several audit and nonaudit services performed by the Defense  Contract Audit Agency (DCAA) during the three phases of the contracting  process—preaward and award, contract administration and management,  and closeout—and cites the statutory and regulatory provisions that  authorize or establish the need to have DCAA perform the service. DCAA  audits also support the contract payment process both directly and  indirectly. For example, audits of contractor-incurred cost claims and  voucher reviews directly support the contract payment process by  providing the information necessary to certify payment of claimed costs.   Other audits of contractor systems, including audits of contractor internal  controls, CAS compliance, and defective pricing, indirectly support the  payment process by providing assurance about contractor controls over  cost accounting, cost estimating, purchases, and billings that the agency  may rely upon when making contract decisions, such as determinations of  reasonable and fair prices on negotiated contracts. For example, an  accounting system deemed to be adequate by a DCAA audit permits  progress payments based on costs to be made without further audit.
section_title: Appendix II: Potential Legislative and Other Actions for Strengthening DCAA and the Contract Audit Function
paragraphs: In our September 2009 report, we identified certain legislative and other  actions, such as authorities and protections similar to those granted to  federal agency Inspectors general (IG) in the IG Act, and changes in  organizational placement, that could enhance Defense Contract Audit  Agency (DCAA) effectiveness and independence. Successful management  initiatives for cultural and organizational change in large private and  public sector organizations can often take several years to accomplish. We  caution that changing DCAA’s organizational placement without first  correcting fundamental weaknesses in mission and the overall  management environment would not assure effective audits.
subsections: section_title: Short-term Legislative Actions
paragraphs: In addition to DCAA management reforms already under way and our  additional recommendations, our 2009 report identified certain legislative  protections and authorities under the IG Act that could enhance DCAA’s  effectiveness. Legislation would be needed in order to grant DCAA such  protections and authorities.
Leadership. The IG Act provides for the President to appoint the IG, with  Senate confirmation, at many federal agencies. Under the act, Congress  must be notified in advance of removing the IG, and only Congress can  eliminate the office of an IG. Currently, the head of DCAA is appointed and  can be removed by the Secretary of Defense. Further, DCAA was created  and can be reorganized or reassigned by departmental order without  notice. IG Act protections Congress could grant to DCAA would therefore  include (1) Senate confirmation of a presidentially appointed DCAA  Director and (2) removal of the DCAA Director conditioned on  congressional notification.  Specifically, the act provides that an IG may  be removed from office by the President and any removal is to be reported  to both Houses of Congress 30 days prior to the removal. In addition to  these IG Act protections, Congress could build additional provisions into  legislation, to include the following:    Requirements that the DCAA Director possess the appropriate  professional qualifications. For example, provisions for appointment of  the DCAA Director could require selection from among individuals  who possess demonstrated ability in managing and leading  organizations, specific accounting or auditing background, general  knowledge of contract management, and knowledge of and extensive  practical experience in financial management practices in large  governmental or business entities.
A mandate permitting the DCAA Director to hold a renewable term  appointment of between 5 to 7 years. Legislation should provide that  the DCAA Director can be removed only for cause or other stated  reasons. These protections would allow the head of DCAA to provide  stability and continuity of leadership that span presidential  administrations and prevent removal except for cause or other  disclosed reasons.
Conflict of interest provisions for the DCAA Director and other key  staff in addition to those provisions currently in law. This would be  intended to ensure that selection of the audit agency head would not  involve a “revolving door” situation between contractors and the  contract audit agency.
Access to independent legal counsel. The IG Act provides for  independent legal advice for IGs rather than requiring the use of agency  legal counsel. Currently, DCAA relies upon DOD legal counsel. DCAA  officials told us that the DCAA Director has not always been apprised of  legal decisions by DOD counsel that have impacted DCAA operations.  Further, according to the DCAA Director, the lack of independent counsel  led to a situation where DOD attorneys provided questionable legal  counsel to a DCAA field office supervisor without the DCAA Director’s  knowledge. Obtaining independent legal counsel would avoid conflicts of  interest between DOD and DCAA, thereby helping to improve DCAA’s  effectiveness.
Budget. The IG Act requires separate budgets for Offices of Inspector  General (OIG) within agency budgets, allowing Congress to review IG  budget requests separately. DCAA currently does not have this protection.  IGs that are appointed by the President with Senate confirmation receive a  separate appropriation, preventing agencies from reprogramming IG funds  to other programs and activities. However, there is currently little visibility  over DCAA’s budget because it is funded under the Operations and  Maintenance, Defense-wide appropriation, which includes numerous DOD  agencies, such as the Defense Contract Management Agency (DCMA), the  Defense Logistics Agency, the Defense Finance and Accounting Service,  and some buying command activities. Therefore, DCAA’s share of annual  appropriations is subject to reprogramming, sometimes without  congressional notification. According to the DCAA Director and  documentation provided by the Director and Office of Comptroller/CFO,  in the past, DOD has reprogrammed funding between DCAA and other  DOD activities on numerous occasions. Because these reprogrammings  were below the $15 million threshold for congressional notification,  Congress did not have notice of these funding decreases at the time they  occurred. For fiscal year 2009, DOD reprogramming increased DCAA’s  funding by $3.5 million. Legislation similar to the IG Act could grant DCAA  a separate budget to provide visibility and protections from  reprogramming of funds to other agency priorities.
Increased authority and independence. Legislation could strengthen  DCAA’s audit authority by providing the same level of access to records  and personnel available to IGs. Currently, DCAA has statutory access to  certain records related to cost-type contracts or those that contain cost  and pricing data, but not to contractor personnel. As a result, DCAA’s  subpoena power is limited to certain records and does not cover  contractor personnel. While we recognize that DCAA auditors have  ongoing discussions with contractor personnel, they do not have statutory  authority to compel contractor officials to meet with them and submit to  interviews. IGs have authority, including subpoena power, to access all  records, reports, audits, reviews, documents, papers, recommendations, or  other material available that relate to programs and operations for which  the IG has responsibilities. Further, IG subpoena authority extends beyond  access to records and documents in that IG auditors can administer or  take an oath in order to obtain information. Our discussions with DCAA  auditors and reviews of audit documentation identified numerous  instances where requests for contractor records were not met. Obtaining  increased access to contracting companies, especially their staff and  documentation, would be an important provision to improve the  effectiveness of DCAA audit staff.
Reporting and oversight of audit results. The IG Act provides for  semiannual reports to the agency head and appropriate committees of  Congress summarizing results of significant audits and investigations.  DCAA currently has no external reporting requirement, reducing  opportunities for oversight and transparency. Congress could mandate  some form of external DCAA reporting in legislation similar to the IG Act.  Moreover, DCAA does not currently provide copies of its audit reports to  other federal agencies that use the same contractors that DOD uses.  According to the DCAA Director, DCAA’s appropriations are specific to  DOD contractor audits, and unless federal agencies request and reimburse  DCAA for audit services, DCAA cannot provide them with copies of its  audit reports even though these reports may cover their contractors.  Legislation could also expressly allow DCAA to provide audit results to  other agencies, a step that would improve its visibility and effectiveness  for the government as a whole.
Legislation to grant DCAA similar protections and authorities as those  provided in the IG Act could enhance reform efforts that are already under  way. Although we found that a lack of DOD Comptroller/CFO and IG  oversight has impaired DCAA’s effectiveness, DOD has begun work to  provide improved oversight of DCAA’s operations. In August 2008, the  DOD Comptroller/CFO conducted a “tiger team” review of DCAA’s audit  quality assurance program, and DOD approved a more comprehensive  Defense Business Board (DBB) study. The new DOD Comptroller/CFO  recognized the need for DCAA oversight and on March 16, 2009, approved  the charter for a DCAA Oversight Committee. Committee members include  the Auditors General of the Army, the Navy, and the Air Force; the DOD  Director of Defense Procurement and Acquisition Policy; and the DOD  Deputy General Counsel for Acquisition and Technology. The committee  held its first meeting in early April 2009. During May 2009, the DCAA  Oversight Committee members reviewed selected DCAA audits and visited  a DCAA field office. The committee is continuing to assess DCAA actions  on recommendations in these reports and identify any gaps for further  action. DCAA has already taken numerous actions to respond to our initial  investigative report as well as DOD Comptroller/CFO and DBB  recommendations.
In the longer term, Congress could consider changes in DCAA’s  organizational placement. However, moving DCAA as an organization or  establishing a new federal contract audit agency would require careful  analysis and planning before implementation. For example, numerous  governmentwide acquisition management reform efforts are currently  under way that could impact the contract audit function. These efforts  include congressional oversight and reform legislation and Presidential  direction on developing governmentwide guidance for reviews of existing  contracts to identify contracts that are wasteful, inefficient, or otherwise  unlikely to meet agencies’ needs, and to formulate corrective action in a  timely manner, as well as interest group studies.
Depending on the outcome of the various contract reform initiatives and  the successful implementation of DCAA management reforms, Congress  may also want to consider increasing the efficacy of these reforms by  establishing an independent governmentwide contract audit agency. The  creation of a statutory governmentwide contract audit agency could  enhance contract auditor effectiveness and independence by placing the  audit agency outside DOD and other federal agencies that make  procurement and contract management decisions. Centralizing the  contract audit function and mandating its use by all federal agencies also  could provide for consistent audit coverage and bring efficiencies and  economies of scale to the contract audit process across the government.  However, our 2009 report cautioned that this would likely entail significant  costs and operational and accountability considerations and would be an  extremely costly option involving significant infrastructure and  reorganization and would require substantial planning and analysis before  deciding whether to proceed and how to implement any changes. Some of  the issues that would need further study and analysis include the  following:  Governance. Governance is the framework of rules and practices by  which a governing body, such as a board of directors, ensures  accountability, fairness, and transparency in the entity’s relationship with  all of its stakeholders, including management, employees, and  government. In order to improve governance and accountability at federal  agencies, a variety of laws covering a range of management and  administrative practices and processes have been enacted. Consideration  of such provisions for a governmentwide contract audit agency should  include application of general laws related to funds control, performance  and financial reporting, accounting and internal control systems, human  resources management, and recordkeeping and access to information,  among others. Further, governance issues unique to a contract audit  agency, such as its relationships to agency contracting officers and the  Congress, should be assessed.
Scope of Work. Scope of work considerations would include roles,  responsibilities, and relationships of the governmentwide contract audit  agency and IGs with regard to contract audits. Another consideration  would be whether the new agency would be available for consultation as  an outside expert on federal agency preaward issues. In addition, a  determination would need to be made on the handling of fraud referrals.  For example, the central new agency could have an investigative division  or it could refer potential contract fraud to federal agency IGs for further  investigation.
Funding. Congress would need to determine how to fund the new  contract audit agency. For example, funding could be provided through  appropriations or from reimbursement by federal agencies. This decision  would likely be tied to decisions on the governmentwide contract audit  agency’s mandate and scope of work and any realignment of contract  audit resources.
Further study and analysis of this potential action would involve input  from the federal agency IGs and agency contracting and finance  communities as well as government contractors and public interest  groups. Numerous additional issues would potentially be identified and  require substantial time and cost for effective consideration and  resolution.
section_title: Related GAO Reports and Testimonies
subsections: section_title: High-Risk Series
paragraphs: DOD’s High-Risk Areas: Actions Needed to Reduce Vulnerabilities and  Improve Business Outcome, GAO-09-460T, Washington, D.C.: March 12,  2009.
High-Risk Series: An Update, GAO-09-271, Washington, D.C.: January  2009.
section_title: DCAA Audits
paragraphs: Defense Management: Widespread DCAA Audit Problems Leave Billions  of Taxpayer Dollars Vulnerable to Fraud, Waste, Abuse, and  Mismanagement, GAO-10-163T, Washington, D.C.: Oct. 15, 2009.
DCAA Audits: Widespread Problems with Audit Quality Require  Significant Reform, GAO-09-468, Washington, D.C.: Sept. 23, 2009.
DCAA Audits: Widespread Problems with Audit Quality Require  Significant Reform, GAO-09-1009T, Washington, D.C.: Sept. 23, 2009.
DCAA Audits: Allegations That Certain Audits at Three Locations Did  Not Meet Professional Standards Were Substantiated, GAO-08-993T,  Washington, D.C.: Sept. 10, 2008.
DCAA Audits: Allegations That Certain Audits at Three Locations Did  Not Meet Professional Standards Were Substantiated, GAO-08-857,  Washington, D.C.: July 22, 2008.
Iraq Contract Costs: DOD Consideration of Defense Contract Audit  Agency’s Findings, GAO-06-1132, Washington, D.C.: Sept. 25, 2006.
section_title: Contract Management
paragraphs: Centers for Medicare and Medicaid Services: Pervasive Internal Control  Weaknesses Hindered Effective Contract Management, GAO-10-637T,  Washington, D.C.: Apr. 28, 2010.
Centers for Medicare and Medicaid Services: Deficiencies in Contract  Management Internal Control Are Pervasive, GAO-10-60, Washington,  D.C.: Oct. 23, 2009.
Contract Management: Minimal Compliance with New Safeguards for  Time-and-Materials Contracts for Commercial Services and Safeguards  Have Not Been Applied to GSA Schedules Program, GAO-09-579,  Washington, D.C.: June 24, 2009.
Defense Acquisitions: Charting a Course for Lasting Reform,  GAO-09-663T, Washington, D.C.: April 30, 2009.
Global War on Terrorism: DOD Needs to More Accurately Capture and  Report the Costs of Operation Iraqi Freedom and Operation Enduring  Freedom, GAO-09-302, Washington, D.C.: Mar. 17, 2009.
Defense Acquisitions: Perspectives on Potential Changes to Department  of Defense Acquisition Management Framework, GAO-09-295R,  Washington, D.C.: February 27, 2009.
Defense Management: Actions Needed to Overcome Long-standing  Challenges with Weapon Systems Acquisition and Service Contract  Management, GAO-09-362T, Washington, D.C.: Feb. 11, 2009.
Defense Management: Actions Needed to Overcome Long- standing  Challenges with Weapon Systems Acquisition and Service Contract  Management, GAO-09-362T, Washington, D.C.: February 11, 2009.
Space Acquisitions: Uncertainties in the Evolved Expendable Launch  Vehicle Program Pose Management and Oversight Challenges,   GAO-08-1039, Washington, D.C.: September 26, 2008.
Financial Management: FBI Has Designed and Implemented Stronger  Internal Controls over Sentinel Contractor Invoice Review and  Equipment Purchases, but Additional Actions Are Needed, GAO-08-716R,  Washington, D.C.: July 15, 2008.
Defense Contracting: Post-Government Employment of Former DOD  Officials Needs Greater Transparency, GAO-08-485, Washington, D.C.:  May 21, 2008.
Defense Contracting: Army Case Study Delineates Concerns with Use of  Contractors as Contract Specialists, GAO-08-360, Washington, D.C.:  March 26, 2008.
Defense Contracting: Additional Personal Conflict of Interest Safeguards  Needed for Certain DOD Contractor Employees, GAO-08-169, Washington,  D.C.: March 7, 2008.
Centers for Medicare and Medicaid Services: Internal Control  Deficiencies Resulted in Millions of Dollars of Questionable Contract  Payments, GAO-08-54 Washington, D.C.: Nov. 15, 2007.
Defense Contract Management: DOD’s Lack of Adherence to Key  Contracting Principles on Iraq Oil Contract Put Government Interests at  Risk, GAO-07-839, Washington, D.C.: July 31, 2007.
Hanford Waste Treatment Plant: Department of Energy Needs to  Strengthen Controls over Contractor Payments and Project Assets,   GAO-07-888, Washington, D.C.: July 20, 2007.
Defense Contracting: Improved Insight and Controls Needed over DOD’s  Time-and-Materials Contracts, GAO-07-273, Washington, D.C.: June 29,  2007.
Defense Contracting: Use of Undefinitized Contract Actions Understated  and Definitization Time Frames Often Not Met, GAO-07-559,  Washington, D.C.: June 19, 2007.
Defense Acquisitions: Improved Management and Oversight Needed to  Better Control DOD’s Acquisition of Services, GAO-07-832T, Washington,  D.C.: May 10, 2007.
Defense Acquisitions: Tailored Approach Needed to Improve Service  Acquisition Outcomes, GAO-07-20, Washington, D.C.: November 9, 2006.
Department of Energy, Office of Worker Advocacy: Deficient Controls  Led to Millions of Dollars in Improper and Questionable Payments to  Contractors, GAO-06-547, Washington, D.C.: May 31, 2006.
Federal Bureau of Investigation: Weak Controls over Trilogy Project Led  to Payment of Questionable Contractor Costs and Missing Assets,   GAO-06-306, Washington, D.C.: Feb. 28, 2006.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.