Our investigation of DCAA hotline allegations and our DCAA-wide follow- up audit document systemic weaknesses in DCAA’s management environment and structure for assuring audit quality. Last year, our investigation of hotline allegations substantiated auditor concerns made on all 14 audits we reviewed at two locations and 62 forward pricing reports we investigated at a third location. We found that (1) workpapers did not support reported opinions, (2) DCAA supervisors dropped findings and changed audit opinions without adequate audit evidence for their changes, and (3) sufficient audit work was not performed to support audit opinions and conclusions. In addition, we found that contractor officials and the DOD contracting community improperly influenced the audit scope, conclusions, and opinions of some audits—a serious independence issue. This year, our follow-on audit found DCAA-wide audit quality problems similar to those identified in our investigation, including compromise of auditor independence, insufficient audit testing to support conclusions and opinions, and inadequate planning and supervision. For example, of the 69 audits and cost-related assignments we reviewed, 65 exhibited serious GAGAS and other deficiencies that rendered them unreliable for decisions on contract awards and contract management and oversight. Although not as serious, the remaining four audits also had GAGAS compliance problems. Of the 69 audits and cost-related assignments, 37 covered key contractor business systems and related controls, including cost accounting, estimating, and billing systems. Contracting officers rely on the results of these audits for 3 or more years to make decisions on pricing, contract awards, and payments. In addition, while DCAA did not consider 26 of the 32 cost-related assignments we reviewed to be GAGAS audits, DCAA did not perform sufficient testing to support reported conclusions on that work related to contractor billings. DCAA has rescinded 81 audit reports in response to our work and the DOD Inspector General’s (IG) follow-up audit because the audit evidence was outdated, insufficient, or inconsistent with reported conclusions and opinions and reliance on these reports for contracting decisions could pose a problem. About one-third of the rescinded reports relate to unsupported opinions on contractor internal controls and were used as the basis for risk-assessments and planning on subsequent internal control and cost-related audits. Other rescinded reports relate to CAS compliance and contract pricing decisions. Because the conclusions and opinions in the rescinded reports were used to assess risk in planning subsequent audits, they impact the reliability of hundreds of other audits and contracting decisions covering billions of dollars in DOD expenditures. Our hotline investigation found numerous examples where DCAA failed to comply with GAGAS. For example, contractor officials and the DOD contracting community improperly influenced the audit scope, conclusions and opinions, and reporting in three cases we investigated—a serious independence issue. For 14 audits at two DCAA locations, we found that (1) audit documentation did not support the reported opinions, (2) DCAA supervisors dropped findings and changed audit opinions without adequate evidence for their changes, and (3) sufficient audit work was not performed to support audit opinions and conclusions. We also substantiated allegations that forward pricing audit reports at a third DCAA location were issued before supervisors completed their review of the audit documentation because of the 20- to 30-day time frames required to support contract negotiations. Throughout our investigation, auditors at each of the three locations addressed in the hotline allegations told us that the limited number of hours approved for their audits directly affected the sufficiency of audit testing. Deficient audits do not provide assurance that billions of dollars in annual payments to these contactors complied with the FAR, CAS, or contract terms. We also found that DCAA managers took actions against staff at two locations, attempting to intimidate auditors, prevent them from speaking with investigators, and creating a generally abusive work environment. The following discussion highlights some of the examples from our investigation. In planning an estimating system audit of a major aerospace company, DCAA made an up-front agreement with the contractor to limit the scope of work and basis for the audit opinion. The contractor was unable to develop compliant estimates, leading to a draft audit opinion of “inadequate-in-part.” The contractor objected to the draft findings, and DCAA management assigned a new supervisory auditor. DCAA management then threatened the senior auditor with personnel action if he did not delete the findings from the report and change the draft audit opinion to “adequate.” Another audit of the above contractor related to a revised proposal that was submitted after DCAA had reported an “adverse” (inadequate) opinion on the contractor’s 2005 proposal to provide commercial satellite launch capability. At the beginning of the audit, the buying command and contractor officials met with a DCAA regional audit manager to determine how to resolve CAS compliance issues and obtain a favorable audit opinion. Although the contractor failed to provide all cost information requested for the audit, the DCAA regional audit manager (RAM) instructed the auditors that they could not base an “adverse” opinion on the lack of information to audit certain costs. The manager directed the auditors to exclude any reference to CAS noncompliance in the audit documentation and to change the audit opinion to “inadequate-in-part.” Based on the more favorable audit opinion, the buying command negotiated a $967 million contract which has since grown to over $1.6 billion through fiscal year 2009. The Defense Criminal Investigative Service is completing a criminal investigation conducted in response to our findings. The DOD IG performed a follow-up audit and confirmed our findings that DCAA’s audit was impaired because of a lack of independence; the audit working papers did not support the reported opinions in the May 8, 2006, proposal audit report; and the draft audit opinion was changed without sufficient documentation. In addition, the DOD IG concluded that the DCAA RAM failed to exercise objective and impartial judgment on significant issues associated with conducting the audit and reporting on the work—a significant independence impairment—and that the RAM did not protect the interests of the government as required by DCAA policy. The DOD IG also concluded that the contractor’s unabsorbed Program Management and Hardware Support (PM&HS) costs represented losses incurred on other contracts and prior accounting periods, including commercial losses—a CAS noncompliance. The DOD IG recommended that the Air Force buying command withhold the balance of $271 million for unabsorbed PM&HS costs (of which $101 million had already been paid) and that the Air Force cease negotiations with the launch services contractor on a $114 million proposal for unabsorbed costs. DCAA is currently performing CAS compliance audits on the commercial satellite launch contract costs. If DCAA determines that the contractor’s costs did not comply with CAS related to unallowable costs, cost accounting period, and allocation of direct and indirect cost, and the FAR related to losses on other contracts, DCAA findings should provide the basis for recovering amounts already paid. For a billing system audit of a contractor with $168 million in annual billings to the government, the field office manager allowed the original auditor to work on the audit after being assured that the auditors would help the contractor correct billing system deficiencies during the performance of the audit. After the original auditor identified 10 significant billing system deficiencies, the manager removed her from the audit and assigned a second auditor who then dropped 8 of the 10 significant deficiencies and reported one significant deficiency and one suggestion to improve the system. The final opinion was “inadequate- in-part.” However, the DCAA field office retained the contractor’s direct billing privileges—a status conveyed to a contractor based on the strength of its billing system controls whereby invoices are submitted directly to the government paying office without prior review. After we brought this to the attention of DCAA western region officials, the field office rescinded the contractor’s direct billing status. Our follow-up audit found that a management environment and agency culture that focused on facilitating the award of contracts and an ineffective audit quality assurance structure are at the root of the DCAA- wide audit failures that we identified for the 69 audits and cost related assignments that we reviewed. DCAA’s focus on a production-oriented mission led DCAA management to establish policies, procedures, and training that emphasized performing a large quantity of audits to support contracting decisions and gave inadequate attention to performing quality audits. An ineffective quality assurance structure, whereby DCAA gave passing scores to deficient audits compounded this problem. Although the reports for all 37 audits of contractor internal controls that we reviewed stated that the audits were performed in accordance with GAGAS, we found GAGAS compliance issues with all of these audits. The issues or themes are consistent with those identified in our prior investigation. Lack of independence. In seven audits, independence was compromised because auditors provided material nonaudit services to a contractor they later audited; experienced access to records problems that were not fully resolved; and significantly delayed report issuance, which allowed the contractors to resolve cited deficiencies so that they were not included in the audit reports. GAGAS state that auditors should be free from influences that restrict access to records or that improperly modify audit scope. Insufficient testing. Thirty-three of 37 internal control audits did not include sufficient testing of internal controls to support auditor conclusions and opinions. GAGAS for examination-level attestation engagements require that sufficient evidence be obtained to provide a reasonable basis for the conclusion that is expressed in the report. For internal control audits, which are relied on for 2 to 4 years and sometimes longer, the auditors would be expected to test a representative selection of transactions across the year and not transactions for just 1 day, 1 month, or a couple of months. However, we found that for many controls, the procedures performed consisted of documenting the auditors’ understanding of controls, and the auditors did not test the effectiveness of the implementation and operation of controls at all. Unsupported opinions. The lack of sufficient support for the audit opinions on 33 of the 37 internal control audits we reviewed rendered them unreliable for decision making on contract awards, direct-billing privileges, the reliability of cost estimates, and reported direct cost and indirect cost rates. Similarly, the 32 cost-related assignments we reviewed did not contain sufficient testing to provide reasonable assurance that overpayments and billing errors that might have occurred were identified. As a result, there is limited assurance that any such errors, if they occurred, were corrected and that related improper contract payments, if any, were refunded or credited to the government. Contractors are responsible for ensuring that their billings reflect fair and reasonable prices and contain only allowable costs, and taxpayers expect DCAA to review these billings to provide reasonable assurance that the government is not paying more than it should for goods and services. Based on our findings that sufficient voucher testing was not performed to support decisions to approve contractors for direct-billing privileges, DCAA recently removed over 200 contractors from the direct-bill program. Production environment and audit quality issues. DCAA’s mission statement, strategic plan, and metrics all focused on producing a large number of audit reports and provided little focus on assuring quality audits that protect taxpayer interest. For example, DCAA’s current approach of performing 30,000 or more audits annually and issuing over 22,000 audit reports with 3,600 auditors substantially contributed to the widespread audit quality problems we identified. Within this environment, DCAA’s audit quality assurance program was not properly implemented, resulting in an ineffective quality control process that accepted audits with significant deficiencies and noncompliance with GAGAS and DCAA policy. Moreover, even when DCAA’s quality assurance documentation showed evidence of serious deficiencies within individual offices, those offices were given satisfactory ratings. Considering the large number of DCAA audit reports issued annually and the reliance the contracting and finance communities have placed on DCAA audit conclusions and opinions, an effective quality assurance program is key to protecting the public interest. Such a program would report review findings along with recommendations for any needed corrective actions; provide training and additional policy guidance, as appropriate; and perform follow-up reviews to assure that corrective actions are taken. GAGAS require that each audit organization performing audits and attestation engagements in accordance with GAGAS should have a system of quality control that is designed to provide the audit organization with reasonable assurance that the organization and its personnel comply with professional standards and applicable legal and regulatory requirements, and have an external peer review at least once every 3 years. On September 1, 2009, the DCAA Director advised us that DCAA needs up to 2 years to revise its current audit approach and establish an adequate audit quality control system before undergoing another peer review. For fiscal year 2008, DOD reported that it obligated over $380 billion for payments to federal contractors, more than double the amount it obligated for fiscal year 2002. With hundreds of billions in taxpayer dollars at stake, the government needs strong controls to provide reasonable assurance that these contract funds are not being lost to fraud, waste, abuse, and mismanagement. Moreover, effective contract audit capacity is particularly important as DOD continues its use of high-risk contracting strategies. For example, we have found numerous issues with DOD’s use of time-and-materials contracts, which are used to purchase billions of dollars of services across the government. Under these types of contracts, payments to contractors are based on the number of labor hours billed at a fixed hourly rate—which includes wages, overhead, and profit—and the cost of any materials. These contracts are considered high risk for the government because the contractor’s profit is tied to the number of hours worked. Because the government bears the responsibility for managing contract costs, it is essential that the government be assured, using DCAA as needed, that the contractor has a good system in place to keep an accurate accounting of the number of hours billed and materials acquired and used. In addition, we have said that DOD needs to improve its management and oversight of undefinitized contract actions, under which DOD can authorize contractors to begin work and incur costs before reaching a final agreement on contract terms and conditions, including price. These contracts are high risk because the contractor has little incentive to control costs while the contract remains undefinitized. In one case, we found that the lack of timely negotiations on a task order issued to restore Iraq’s oil infrastructure increased the government’s risk when DOD paid the contractor nearly all of the $221 million in costs questioned by DCAA. More timely negotiations, including involvement by DCAA, could have reduced the risk to the government of possible overpayment. DCAA initiated a number of actions to address findings in our July 2008 report as well as findings from DOD follow-up efforts, including the DOD Comptroller/Chief Financial Officer (CFO) August 2008 “tiger team” review and the Defense Business Board study, which was officially released in January 2009. Examples of recent DCAA and DOD actions include the following. Eliminating production metrics and implementing new metrics intended to focus on achieving quality audits. Establishing an anonymous Web site to address management and hotline issues. In addition, DCAA’s Assistant Director for Operations has been proactive in handling internal DCAA Web site hotline complaints. Revising policy guidance to address auditor independence, assure management involvement in key decisions, and address audit quality issues. DCAA also took action to halt auditor participation in nonaudit services that posed independence concerns. DCAA also has enlisted assistance from other agencies to develop a human capital strategic plan, assist in cultural transformation, and conduct a staffing study. Further, in March 2009, the new DOD Comptroller/CFO established a DCAA Oversight Committee to monitor and advise on DCAA corrective actions. While these are positive steps, much more needs to be done to address fundamental weaknesses in DCAA’s mission, strategic plan, metrics, audit approach, and human capital practices that have resulted in widespread audit quality problems. DCAA’s production-oriented culture is deeply imbedded and will likely take several years to change. DCAA’s mission focused primarily on producing reports to support procurement and contracting community decisions with no mention of quality audits that serve taxpayer interest. Further, DCAA’s culture has focused on hiring at the entry level and promoting from within the agency and most training has been conducted by agency staff, which has led to an insular culture where there are limited perspectives on how to make effective organizational changes. To address these issues, our September 2009 report contained 15 recommendations to improve the quality of DCAA’s audits and strengthen auditor effectiveness and independence. Key GAO recommendations relate to the need for DCAA to develop a risk- based audit approach and develop a staffing plan in order to match audit priorities to available resources. To develop an effective risk-based audit approach, DCAA will need to work with key DOD stakeholders to determine the appropriate mix of audit and nonaudit services it should perform and determine what, if any, of these responsibilities should be transferred or reassigned to another DOD agency or terminated in order for DCAA to comply with GAGAS requirements. We also made recommendations for DCAA to establish in-house expertise or obtain outside expertise on auditing standards to (1) assist in revising contract audit policy, (2) provide guidance on sampling and testing, and (3) develop training on professional auditing standards. In addition, we recommended that DOD conduct an independent review of DCAA’s revised audit quality assurance program and follow-up to assure that appropriate corrective actions are taken. Mr. Chairman and Members of the Panel, this concludes my statement. We would be pleased to answer any questions that you may have at this time. For further information about this testimony, please contact Gregory D. Kutz at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. Major contributors to our testimony include William T. Woods, Director, Acquisition and Sourcing Management; F. Abe Dymond, Assistant General Counsel; Gayle L. Fischer, Assistant Director; Financial Management and Assurance; Richard Cambosos; Jeremiah Cockrum; Shawnda Lindsey; Andrew McIntosh; Lerone Reid, and Angela Thomas. DOD’s High-Risk Areas: Actions Needed to Reduce Vulnerabilities and Improve Business Outcome, GAO-09-460T, Washington, D.C.: March 12, 2009. High-Risk Series: An Update, GAO-09-271, Washington, D.C.: January 2009. DCAA Audits: Widespread Problems with Audit Quality Require Significant Reform, GAO-09-468, Washington, D.C.: Sept. 23, 2009. DCAA Audits: Widespread Problems with Audit Quality Require Significant Reform, GAO-09-1009T, Washington, D.C.: Sept. 23, 2009. DCAA Audits: Allegations That Certain Audits at Three Locations Did Not Meet Professional Standards Were Substantiated, GAO-08-993T, Washington, D.C.: Sept. 10, 2008. DCAA Audits: Allegations That Certain Audits at Three Locations Did Not Meet Professional Standards Were Substantiated, GAO-08-857, Washington, D.C.: July 22, 2008. Contract Management: Minimal Compliance with New Safeguards for Time-and-Materials Contracts for Commercial Services and Safeguards Have Not Been Applied to GSA Schedules Program, GAO-09-579, Washington, D.C.: June 24, 2009. Defense Acquisitions: Charting a Course for Lasting Reform, GAO-09-663T, Washington, D.C.: April 30, 2009. Defense Management: Actions Needed to Overcome Long-standing Challenges with Weapon Systems Acquisition and Service Contract Management, GAO-09-362T, Washington, D.C.: Feb. 11, 2009. Defense Acquisitions: Perspectives on Potential Changes to Department of Defense Acquisition Management Framework, GAO-09-295R, Washington, D.C.: February 27, 2009. Space Acquisitions: Uncertainties in the Evolved Expendable Launch Vehicle Program Pose Management and Oversight Challenges, GAO-08-1039, Washington, D.C.: September 26, 2008. Defense Contracting: Post-Government Employment of Former DOD Officials Needs Greater Transparency, GAO-08-485, Washington, D.C.: May 21, 2008. Defense Contracting: Army Case Study Delineates Concerns with Use of Contractors as Contract Specialists, GAO-08-360, Washington, D.C.: March 26, 2008. Defense Contracting: Additional Personal Conflict of Interest Safeguards Needed for Certain DOD Contractor Employees, GAO-08-169, Washington, D.C.: March 7, 2008. Defense Contract Management: DOD’s Lack of Adherence to Key Contracting Principles on Iraq Oil Contract Put Government Interests at Risk, GAO-07-839, Washington, D.C.: July 31, 2007. Defense Contracting: Improved Insight and Controls Needed over DOD’s Time-and-Materials Contracts, GAO-07-273, Washington, D.C.: June 29, 2007. Defense Contracting: Use of Undefinitized Contract Actions Understated and Definitization Time Frames Often Not Met, GAO-07-559, Washington, D.C.: June 19, 2007. Defense Acquisitions: Improved Management and Oversight Needed to Better Control DOD’s Acquisition of Services, GAO-07-832T, Washington, D.C.: May 10, 2007. Defense Acquisitions: Tailored Approach Needed to Improve Service Acquisition Outcomes, GAO-07-20, Washington, D.C.: November 9, 2006. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: In fiscal year 2008, the Department of Defense (DOD) obligated over $380 billion to federal contractors, more than doubling the amount it obligated in fiscal year 2002. With hundreds of billions of taxpayer dollars at stake, the government needs strong controls to provide reasonable assurance that contract funds are not being lost to fraud, waste, abuse, and mismanagement. The Defense Contract Audit Agency (DCAA) is charged with a critical role in contractor oversight by providing auditing, accounting, and financial advisory services in connection with DOD and other federal agency contracts and subcontracts. However, last year GAO found numerous problems with DCAA audit quality at three locations in California, including the failure to meet professional auditing standards. In a follow-up audit issued this September, GAO found that these problems existed agencywide. Today's testimony describes widespread audit quality problems at DCAA and provides information about continuing contract management challenges at DOD, which underscore the importance of DCAA audits that meet professional standards. It also discusses some of the corrective actions taken by DCAA and DOD and key GAO recommendations to improve DCAA audit quality. In preparing this testimony, GAO drew from issued reports and testimonies. These products contained statements regarding the scope and methodology GAO used. GAO found substantial evidence of widespread audit quality problems at DCAA. In the face of this evidence, DOD, Congress, and American taxpayers lack reasonable assurance that billions of dollars in federal contract payments are being appropriately scrutinized for fraud, waste, abuse, and mismanagement. An initial investigation of hotline allegations at three DCAA field office locations in California revealed that all 14 audits and 62 forward pricing reports GAO examined were not performed in accordance with professional auditing standards. For example, while auditing the satellite launch proposal for a major U.S. defense contractor, a DCAA manager experienced pressure from the contractor and the DOD buying command to drop adverse findings. The manager directed his auditors to drop the findings, and DCAA issued a more favorable opinion, allowing the contractor to win a contract that improperly compensated the contractor for hundreds of millions of dollars in commercial business losses. Specifically, of $271 million in unallowable costs related to commercial losses, the contractor has already been paid $101 million. This incident is under criminal investigation by the DOD Inspector General (IG). In September of this year, GAO followed up on its initial investigation and identified audit quality problems agencywide at DCAA. Audit quality problems included insufficient audit testing, inadequate planning and supervision, and the compromise of auditor independence. For example, of the 69 audits and cost-related assignments GAO reviewed, 65 exhibited serious deficiencies that rendered them unreliable for decisions on contract awards, management, and oversight. DCAA has rescinded 81 audit reports to date as a result of GAO's and DOD IG's work. Because the rescinded reports were used to assess risk in planning subsequent audits, they affect the reliability of hundreds of other audits and contracting decisions covering billions of dollars in DOD contract expenditures. GAO determined that quality problems are widespread because DCAA's management environment and quality assurance structure were based on a production-oriented mission that prevented DCAA from protecting the public interest while also facilitating DOD contracting. GAO has designated both contract management and weapon systems acquisition as high-risk areas since the early 1990s. DOD acquisition and contract management weaknesses create vulnerabilities to fraud, waste, abuse, and mismanagement that leave hundreds of billions of taxpayer dollars at risk, and underscore the importance of a strong contract audit function. In response to GAO's findings and recommendations, DCAA has taken several steps to improve metrics, policies, and processes, and the DOD Comptroller has established a DCAA oversight committee. To ensure quality audits for contractor oversight and accountability, DOD and DCAA will also need to address the fundamental weaknesses in DCAA's mission, strategic plan, metrics, audit approach, and human capital practices that have had a detrimental effect on audit quality.