We substantiated the allegations and auditor concerns made on each of the 13 cases we investigated, involving 14 audits at two locations and forward pricing audit issues at a third location. The 13 cases related to seven contractors. In the 12 cases at locations 1 and 2, we substantiated the allegations and auditor concerns that (1) workpapers did not support reported opinions, (2) DCAA supervisors dropped findings and changed audit opinions without adequate audit evidence for their changes, and (3) sufficient audit work was not performed to support audit opinions and conclusions. We also found that contractor officials and the DOD contracting community improperly influenced the audit scope, conclusions, and opinions of some audits—a serious independence issue. We also substantiated allegations of problems with the audit environment and inadequate supervision of certain forward pricing audits at location 3. Moreover, during our investigation, DCAA managers took actions against their staff at two locations that served to intimidate auditors and create an abusive work environment. DCAA states that its audits are performed according to professional standards (GAGAS). However, in substantiating the allegations, we found numerous failures to comply with these standards in all 13 cases we investigated. The working papers did not adequately support the final conclusion and opinion for any of the 14 audits we investigated. In many cases, supervisors changed audit opinions to indicate contractor controls or compliance with CAS was adequate when workpaper evidence indicated that significant deficiencies existed. We also found that in some cases, DCAA auditors did not perform sufficient work to support draft audit conclusions and their supervisors did not instruct or allow them to perform additional work before issuing final reports that concluded contractor controls or compliance with CAS were adequate. At location 1, we also found undue contractor influence that impaired auditor independence. At location 2, two supervisors were responsible for the 12 audits we investigated, and 11 of these audits involved insufficient work to support the reported opinions. At location 3, we substantiated allegations about inadequate supervision of trainees, reports being issued without final supervisory review, and contracting officer pressure to issue reports before audit work was completed in order to meet contract negotiation time frames—a serious independence issue. Noncompliance with GAGAS in the cases we investigated has had an unknown financial effect on the government. Because DCAA auditors’ limited work identified potential significant deficiencies in contractor systems and accounting practices that were not analyzed in sufficient detail to support reportable findings and recommendations for corrective action, reliance on data and information generated by the audited systems could put users and decision makers at risk. Tables summarizing our findings for all the audits can be found in appendixes I and II. The following examples illustrate problems we found at two DCAA locations: In conducting a 2002 audit related to a contractor estimating system, DCAA auditors reviewed draft basis of estimates (BOE) prepared by the contractor and advised the contractor on how to correct significant deficiencies. BOEs are the means for providing government contract officials with information critical to making contract pricing decisions. This process resulted from an up-front agreement between the DCAA resident auditor and the contractor—one of the top five government contractors based on contract dollar value—that limited the scope of work and established the basis for the audit opinion. According to the agreement, the contractor knew which BOEs would be selected for audit and the audit opinion would be based on the final, corrected BOEs after several DCAA reviews. Even with this BOE review effort, the auditors found that the contractor still could not produce compliant BOEs and labeled the estimating system “inadequate in part.” We found that enough evidence had been collected by the original supervisory auditor and senior auditor to support this opinion. However, after the contractor objected to draft findings and conclusions presented at the audit exit conference, the DCAA resident auditor replaced the original supervisory auditor assigned to this audit and threatened the senior auditor with personnel action if he did not change the summary workpaper and draft audit opinion. The second supervisory auditor issued the final report with an “adequate” opinion without documenting adequate support for the changes. This audit did not meet GAGAS for auditor objectivity and independence because of the up-front agreement, and it did not meet standards related to adequate support for audit opinions. The draft report for a 2005 billing system audit identified six significant deficiencies, one of which allowed the contractor to overbill the government by $246,000 and another that may have led to $3.5 million in overbillings. DCAA managers replaced the supervisory auditor and auditor, and the new staff worked together to modify working papers and change the draft audit opinion from “inadequate,” to “inadequate in part,” and, finally, to “adequate.” Sufficient testing was not documented to support this opinion. The DOD IG concluded that DCAA should rescind the final report for this audit, but DCAA did not do so. Billing system audits are conducted to assess contractor controls for assuring that charges to the government are appropriate and compliant and to support decisions on whether to approve contractors for direct billing. As a result of the 2005 audit, DCAA authorized this contractor for direct billing of its invoices without prior government review, thereby providing quicker payments and improved cash flow to the contractor. On June 20, 2008, when we briefed DOD on the results of our investigation, DCAA advised us that a DCAA Western Region review of this audit in 2008 concluded that the $3.5 million finding was based on a flawed audit procedure. As a result, it rescinded the audit report on May 22, 2008. However, DCAA officials said that they did not remove the contractor’s direct-billing privileges because other audits did not identify billing problems. The draft report for a 2005 CAS 403 compliance audit requested by a Department of Energy administrative contracting officer (ACO) identified four deficiencies related to corporate cost allocations to government business segments. However, a DCAA supervisory auditor directed a member of her staff to write a “clean opinion” report in 1 day using “boilerplate” language and without reviewing the existing set of working papers developed by the original auditor. The supervisory auditor appropriately dropped two significant deficiencies from the draft report, but did not adequately document the changes in the workpapers. In addition, the supervisory auditor improperly referred two other significant deficiencies to another DCAA office that does not have audit jurisdiction, and therefore, did not audit the contractor’s corporate costs or CAS 403 compliance. The final opinion was later contradicted by a September 21, 2007, DCAA report that determined that this contractor was in fact not in compliance with CAS 403 during the period of this audit. We also substantiated allegations that there were problems with the audit environment at a third DCAA location—a resident office responsible for auditing another of the five largest government contractors. For example, the two supervisors, who approved and signed 62 of the 113 audit reports performed at the resident office location during fiscal years 2004 through 2006, said that trainees were assigned to complex forward pricing audits as their first assignments even though they had no institutional knowledge about the type of materials at risk of overcharges, how to look at related sources of information for cost comparisons, or how to complete the analysis of complex cost data required by FAR. The supervisors, who did not always have the benefit of experienced auditors to assist them in supervising the trainees, admitted that they generally did not review workpapers in final form until after reports were issued. Moreover, because the trainee auditors did not have an adequate understanding of DCAA’s electronic workpaper filing system, they did not always enter completed workpapers in the system, resulting in a loss of control over official workpapers. In addition, one of the two supervisory auditors told us that contracting officers would sometimes tell auditors to issue proposal audit reports in as few as 20 days with whatever information the auditor had at that time and not to cite a scope limitation in the audit reports, so that they could begin contract negotiations. If the available information was insufficient, GAGAS would have required the auditors to report a scope limitation. Where scope limitations existed, but were not reported, the contracting officers could have negotiated contracts with insufficient information. Moreover, a 2006 DCAA Western Region quality review reported 28 systemic deficiencies on 9 of 11 forward pricing audits reviewed, including a lack of supervisory review of the audits. The problems at this location call into question the reliability of the 62 forward pricing audit reports issued by the two supervisors responsible for forward pricing audits at the resident office location from fiscal years 2004 through 2006, connected with over $6.4 billion in government contract negotiations. Throughout our investigation, auditors at each of the three DCAA locations told us that the limited number of hours approved for their audits directly affected the sufficiency of audit testing. At the third DCAA location we investigated, two former supervisory auditors told us that the volume of requests for the audits, short time frames demanded by customers for issuing reports to support contract negotiations (e.g., 20 to 30 days), and limited audit resources affected their ability to comply with GAGAS. Our review of DCAA performance data showed that DCAA measures audit efficiency and productivity as a factor of contract dollars audited divided by audit hours. In addition, because customer-requested assignments—such as forward pricing audits requested by contracting officers—which are referred to as demand work by DCAA, take priority, other work, such as internal control and CAS compliance audits, are often performed late in the year. Auditors told us that there is significant management pressure to complete these nondemand audits by the end of the fiscal year to meet field audit office (FAO) performance plans. During the DOD IG and GAO investigations, we identified a pattern of frequent management actions that served to intimidate the auditors and create an abusive environment at two of the three locations covered in our investigation. In this environment, some auditors were hesitant to speak to us even on a confidential basis. For example, supervisory auditors and the branch manager at one DCAA location we visited pressured auditors, including trainees who were in probationary status, to disclose to them what they told our investigators. Some probationary trainees told us this questioning made them feel pressured or uncomfortable. Further, we learned of verbal admonishments, reassignments, and threats of disciplinary action against auditors who raised questions about management guidance to omit their audit findings and change draft opinions or who spoke with or contacted our investigators, DOD investigators, or DOD contracting officials. We briefed cognizant DCAA region and headquarters officials on the results of our investigation in February 2008 and reviewed additional documentation they provided. We briefed DOD and DCAA officials on the results of our investigation on June 20 and 25, 2008. We summarized DCAA’s comments on our corrective action briefing in our investigative report, and we included relevant details of DCAA’s comments at the end of our case discussions. In response to our investigation, DCAA rescinded two audit reports and removed a contractor’s direct billing authorization related to a third audit. DCAA also performed subsequent audits related to three additional cases that resulted in audit opinions that contradicted previously reported adequate (“clean”) opinions and included numerous significant deficiencies. For other cases, DCAA officials told us that although workpaper documentation could have been better, on the basis of other audits DCAA performed, they do not believe the reported opinions were incorrect or misleading. In the cases we investigated, pressure from the contracting community and buying commands for favorable opinions to support contract negotiations impaired the independence of three audits involving two of the five largest government contractors. In addition, DCAA management pressure to (1) complete audit work on time in order to meet performance metrics and (2) report favorable opinions so that work could be reduced on future audits and contractors could be approved for direct billing privileges led the three DCAA FAOs to take inappropriate short cuts— ultimately resulting in noncompliance with GAGAS and internal DCAA CAM guidance. Although it is important for DCAA to issue products in a timely manner, the only way for auditors to determine whether “prices paid by the government for needed goods and services are fair and reasonable” is by performing sufficient audit work to determine the adequacy of contractor systems and related controls, and their compliance with laws, regulations, cost accounting standards, and contract terms. Further, it is important that managers and supervisory auditors at the three locations we investigated work with their audit staff to foster a productive, professional relationship and assure that auditors have the appropriate training, knowledge, and experience. Mr. Chairman and Members of the Committee, this concludes my statement. I would be pleased to answer any questions that you or other members of the committee may have at this time. For further information about this testimony, please contact me at 202- 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Major contributors to this testimony include Gayle L. Fischer, Assistant Director; Andrew O’Connell, Assistant Director and Supervisory Special Agent; F. Abe Dymond, Assistant General Counsel; Richard T. Cambosos; Jeremiah F. Cockrum; Andrew J. McIntosh; and Ramon J. Rodriguez, Senior Special Agent. The DCAA resident office and contractor made an up-front agreement on audit scope, which had the effect of predetermining an “adequate” audit opinion. On the basis of pressure from contractor and buying command to resolve CAS compliance issues and issue a favorable opinion, a DCAA region official directed the auditors not to include CAS compliance problems in the audit workpapers. Branch manager and supervisory auditor terminated audit work and issued opinions without sufficient documentation based on their view that defective pricing did not exist on the related contracts. Supervisory auditor dropped preliminary findings based on a flawed audit procedure instead of requiring auditors to perform sufficient testing to conclude on the adequacy of billing system controls. Auditor was excluded from the exit conference, findings were dropped without adequate support, and supervisor made contradictory statements on her review of the audit. Dropped findings on corporate accounting were referred to another field audit office (FAO), which does not review corporate costs. Supervisor prepared and approved key working papers herself, without required supervisory review. Supervisor directed another auditor to write a clean opinion report without reviewing the working papers. Supervisor then changed the working papers without support and referred two dropped findings to another FAO, which does not review corporate overhead allocations. Inexperienced trainees assigned to complex forward pricing audits without proper supervision. Reports issued with unqualified opinions before supervisory review was completed due to pressure from contracting officers. Significant deficiency and FAR noncompliance related to the lack of contractor job descriptions for executives not reported. Significant deficiency related to subcontract management not reported. Second auditor and supervisor dropped 6 of 10 significant deficiencies without adequate documentation to show that identified weaknesses were resolved. Supervisor identified problems with test methodology but dropped findings instead of requiring tests to be reperformed. Second auditor and supervisor deleted most audit steps and performed limited follow-up work that did not support the reported opinion of overall compliance with CAS. Purpose of audit was to review the corrective action plan (CAP) developed by Contractor A in response to prior findings of inadequate basis of estimates (BOE) related to labor hours. In the face of pressure from DOD’s contracting community to approve Contractor A’s estimating system, we found evidence there was an up-front agreement between DCAA and Contractor A to limit the scope of work and basis of the audit opinion (a significant impairment of auditor independence). Auditors found significant deficiencies with the CAP implementation plan, that is, the contractor could not develop compliant BOEs without DCAA’s assistance at the initial, intermediate, and final stages of the estimates. Original supervisory auditor was reassigned; the resident auditor and new supervisory auditor directed the draft opinion be changed from “inadequate in part” to “adequate” after the contractor objected to DCAA draft findings and opinion. The working papers did not contain audit evidence to support the change in opinion. Field office management threatened the senior auditor with personnel action if he did not change the draft audit opinion to “adequate.” Audit related to a revised proposal submitted after DCAA reported an adverse (inadequate) opinion on Contractor A’s 2005 proposal. At beginning of the audit, buying command and Contractor A officials met with a DCAA regional audit manager to determine how to resolve cost accounting standard (CAS) compliance issues and obtain a favorable audit opinion. Contractor A did not provide all cost information requested for audit. Contrary to DCAA Contract Audit Manual guidance, the regional audit manager instructed auditors that they could not base an “adverse” (inadequate) audit opinion on the lack of information to audit certain costs. On the basis of an “inadequate in part” opinion reported in May 2006, the buying command negotiated a $937 million contract, which has grown to $1.2 billion. Branch manager and supervisory auditor predetermined that there was no defective pricing; however, the auditor concluded that Contractor B’s practice potentially constituted defective pricing and obtained technical guidance that specific contracts would need to be analyzed to make a determination. The branch manager disagreed. Supervisory auditor and branch manager subsequently issued three reports stating that Contractor B’s practice at three divisions did not constitute defective pricing. Insufficient work was performed on these audits to come to any conclusion about defective pricing and as a result, the final opinions on all three audit reports are not supported. Absent DCAA audit support for defective pricing, the contracting officer pursued a CAS 405 noncompliance at 3 contractor divisions and recovered $71,000. On July 17, 2008, Contractor B settled on a Defense Criminal Investigative Service defective pricing case for $620,900. Draft audit report identified six significant deficiencies, one of which led Contractor C to overbill the government by $246,000 and another which potentially led to $3.5 million in overbillings, but audit work was incomplete. The contractor had refunded the $246,000. The original auditor reported that the $3.5 million was for subcontractor costs improperly billed to the government. The supervisor deleted the finding based on a flawed audit procedure, but did not require additional testing. First supervisory auditor and auditor were replaced after draft audit was completed. New auditor and supervisory auditor worked together to modify working papers and alter draft audit opinion from “inadequate,” to “inadequate in part,” and, finally, to “adequate.” Sufficient testing was not performed to determine if the contractor had systemic weaknesses or to support an opinion that contractor billing system controls were adequate. On the basis of the “adequate” opinion, the field audit office (FAO) approved the contractor for direct billing. DOD IG recommended that DCAA rescind the final report for this audit, but DCAA did not do so. Following the briefing on our investigation, the DCAA Western Region rescinded the audit report on May 22, 2008. Auditor identified five deficiencies and concluded the contractor’s system was “inadequate in part.” Auditor did not perform sufficient work to support some findings, but supervisory auditor did not direct the auditor to gather additional evidence. After consulting with the branch manager, the supervisory auditor modified documents and eliminated significant deficiencies, changing the draft audit opinion from “inadequate in part” to “adequate.” Working papers did not properly document the reason for the change in opinion and therefore do not support the final opinion. DOD IG recommended that DCAA rescind the final report for this audit, but DCAA did not do so. On June 27, 2008, the DCAA Western Region informed us that it was rescinding this audit report. Auditor believed audit evidence related to a 24 percent error rate in a small sample of cost pools supported an “inadequate in part” opinion and suggested testing be expanded, but supervisory auditor disagreed. Auditor and supervisory auditor documented their disagreement in the working papers. Supervisory auditor subsequently modified documents to change the draft audit opinion from “inadequate in part” to “adequate” before issuing the final report. Certain final working papers were prepared and approved by the supervisory auditor, without proper supervision. Branch manager and supervisory auditor determined that findings of corporate accounting problems should be referred to another FAO for future audit. However, the other FAO does not audit corporate costs. Working papers do not support the final opinion. Auditor identified four potential instances of noncompliance with CAS 403. Auditor was transferred to a different team before supervisory review of her working papers. Three months later, the supervisory auditor requested that another auditor write a “clean (“adequate”) opinion” report. Second auditor used “boilerplate” (i.e., standardized) language to write the final report and never reviewed the working papers. The supervisor correctly deleted two findings and referred two findings of corporate-level non-compliances to another FAO for future audit. The other FAO does not audit corporate-level costs. Working papers do not support the final “clean opinion,” which was later contradicted by a September 21, 2007, DCAA report that determined Contractor D was in fact not in compliance with CAS 403 during the period of this audit. Two location 3 supervisors issued 62 forward pricing audits related to Contractor E between 2004 and 2006. Supervisors responsible for the 62 forward pricing audits admitted to us that they did not have time to review working papers before report issuance. According to the DCAA region, inexperienced trainee auditors were assigned to 18 of the 62 audits without proper supervision. However, the region did not provide assignment documentation for the 62 audits. An internal DCAA Region audit quality review found audits where the audit working papers did not support the final audit report, working paper files were lost, and working paper files were not archived in the DCAA-required time period. The 62 forward pricing audits were connected with over $6.4 billion in government contract negotiations. Three different auditors worked on this audit. Original auditor did not follow DCAA guidance when developing the audit plan and was reassigned after audit work began. Second auditor lacked experience with compensation system audits and noted in her working papers that she was “floundering” and could not finish the audit by the September 30, 2005, deadline. Third auditor was assigned 10 calendar days before the audit was due to be completed. Although audit was issued with an “adequate” opinion, insufficient work was performed on this audit and, therefore, working papers do not support the final opinion. Significant system deficiencies noted in the working papers were not reported. The DOD Office of Inspector General recommended that DCAA rescind the final report for this audit, but DCAA did not do so. Instead, DCAA initiated another audit during 2007. DCAA agreed with our finding that this audit did not include sufficient testing of executive compensation. In June 2008, the branch office issued a new audit report on Contractor D’s compensation system which identified seven significant deficiencies and an “inadequate in part” opinion. DCAA stated that it is currently assessing the impact of these deficiencies on current incurred cost audits. Auditor found that the contractor was not fulfilling its FAR-related obligations to ensure that subcontractors’ cost claims were audited. This issue was not reported as a significant deficiency in the contractor’s purchasing system. The opinion on the system was “adequate.” The working papers did not include sufficient evidence to support the final opinion. DCAA relied on a 2004 Defense Contract Management Agency (DCMA) review in which the conclusions were based word-for-word on the contractor’s response to a questionnaire without independent testing of controls. DCAA stated that the overall opinion was not based on DCMA’s review. However, DCAA stated that it will address the issue of the contractor’s procedures for ensuring subcontract audits are performed during the next purchasing system audit, which is expected to be completed by December 30, 2008. The branch manager allowed the original auditor to work on this audit after being assured that the auditors would help the contractor correct any billing system deficiencies during the performance of the audit. After the original auditor identified 10 significant billing system deficiencies, the branch manager removed her from the audit and assigned a second auditor to the audit. With approval by the FAO and region management, the second auditor dropped 8 of the 10 significant deficiencies and reported 1 significant deficiency and 1 suggestion to improve the system. The final opinion was “inadequate in part.” Six of the findings were dropped without adequate support, including a finding that certain contract terms were violated and a finding that the contractor did not audit subcontract costs. Despite issuing an “inadequate in part” opinion, the FAO decided to retain the contractor’s direct-billing privileges. After we brought this to the attention of region officials, the FAO rescinded the contractor’s direct billing status in March 2008. DCAA did not agree with our finding that the working papers did not contain adequate support for dropping six draft findings of significant deficiencies. Auditor performed sampling to determine whether sufficient controls over employee timecards existed. Although the work was based on a limited judgmental sample, the auditor found 3 errors out of 18 employee timecards tested and concluded that controls over timecards were inadequate. Supervisory auditor initially agreed with the findings, but later modified working papers to change the draft audit conclusion from “certain labor practices require corrective actions” to “no significant deficiencies.” Working papers did not properly document the reason for the change in conclusion and, therefore, do not support the final audit conclusion. Supervisory auditor later stated that the initial sampling plan was flawed, but eliminated the deficiency finding rather than asking the auditor to redo the work. On April 9, 2008, DCAA issued a new audit report which identified 8 significant deficiencies and concluded that corrective actions were needed on the contractor’s labor accounting system. After original auditor was transferred to another audit, a second auditor significantly limited the scope of the audit with supervisory approval, deleting most of the standard audit steps. Second auditor performed very limited testing and relied on contractor assertions with little or no independent verification. Supervisory auditor approved issuance of the final audit with an opinion that the contractor complied with CAS 418 in all material respects. Insufficient work was performed on this audit and, therefore, the scope of work and the working paper documentation does not support the opinion. Region officials acknowledged that work was insufficient and stated that another CAS 418 audit was initiated; however, DCAA did not rescind the misleading report. On June 25, 2008, DCAA officials told us that the new CAS 418 audit was completed with an “adequate” opinion. Location 2 is a DCAA branch office. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The Defense Contract Audit Agency (DCAA) under the Department of Defense (DOD) Comptroller plays a critical role in contractor oversight by providing auditing, accounting, and financial advisory services in connection with DOD and other federal agency contracts and subcontracts. DCAA has elected to follow generally accepted government auditing standards (GAGAS). These standards provide guidelines to help government auditors maintain competence, integrity, objectivity, and independence in their work. GAO investigated hotline complaints it received related to alleged failures to comply with GAGAS on 14 DCAA audits. Specifically, it was alleged that (1) working papers did not support reported opinions, (2) supervisors dropped findings and changed audit opinions without adequate evidence, and (3) sufficient work was not performed to support audit conclusions and opinions. GAO also investigated issues related to the quality of certain forward pricing audit reports. GAO investigators interviewed over 50 individuals, reviewed working papers and related documents for 14 audits issued from 2003 through 2007 by two DCAA offices, and reviewed documentation on audit issues at a third DCAA office. GAO did not reperform the audits to validate the completeness and accuracy of DCAA's findings. DCAA did not agree with the "totality" of GAO's findings, but it did acknowledge shortcomings with some audits and agreed to take certain corrective actions. GAO substantiated the allegations. Although DCAA policy states that its audits are performed according to GAGAS, GAO found numerous examples where DCAA failed to comply with GAGAS in all 13 cases. For example, contractor officials and the DOD contracting community improperly influenced the audit scope, conclusions, and opinions on three cases--a serious independence issue. At two DCAA locations, GAO found evidence that (1) working papers did not support reported opinions, (2) DCAA supervisors dropped findings and changed audit opinions without adequate evidence for their changes, and (3) sufficient audit work was not performed to support audit opinions and conclusions. GAO also substantiated allegations of inadequate supervision of certain audits at a third DCAA location. The table below contains selected details about three cases GAO investigated. Throughout GAO's investigation, auditors at each of the three DCAA locations told us that the limited number of hours approved for their audits directly affected the sufficiency of audit testing. Moreover, GAO's investigation identified a pattern of frequent management actions at two locations that served to intimidate auditors, discourage them from speaking with investigators, and create a generally abusive work environment.