This section discusses DOE’s use of management and operating (M&O) and non-M&O contracts, DOE’s contracting structure, and federal and DOE requirements for oversight of contractors’ subcontract management. Since World War II, DOE and its predecessor agencies have depended on the expertise of private firms, universities, and others to carry out federal research and development work and to manage and operate government-owned facilities. DOE relies on contracts to accomplish most of its work. DOE mainly uses M&O contracts, which are agreements under which the government contracts for the operation, maintenance, or support, on its behalf, of a government-owned or government-controlled research, development, special production, or testing establishment wholly or principally devoted to one or more of the major programs of the contracting federal agency. DOE and other agencies with sufficient statutory authority and the need for contracts to manage and operate their facilities may use the M&O form of contract; however, according to DOE, it is the only agency using such contracts. According to the DOE Acquisition Guide, DOE generally requires that the M&O contractors be subsidiaries of their corporate parents, dedicated to performance at the specific location, and supported by performance guarantees from their corporate parents. According to DOE officials, in fiscal year 2016, DOE obligated nearly $21 billion on 22 M&O prime contracts—about three-quarters of its total contract obligations for that year. DOE also used non-M&O contracts for some contracts that were active in fiscal year 2016. For example, DOE used non-M&O contracts for the Mixed Oxide Fuel Fabrication Facility (MOX) construction project at the Savannah River Site in South Carolina, for construction and cleanup at the Hanford Site in Washington State, and for cleanup at the Oak Ridge Reservation in Tennessee. Figure 1 shows the site or project, and contract type, for the 24 largest DOE prime contracts as of fiscal year 2016, in our selection. DOE uses a variety of contract types for its M&O and non-M&O contracts, including cost-reimbursement contracts, time-and-materials contracts, and fixed-price contracts. Under cost-reimbursement contracts, the government reimburses a contractor for allowable costs incurred, to the extent prescribed by the contract. Cost-reimbursement contracts are considered high risk for the government because the government agrees to reimburse the contractors allowable costs, regardless of whether the work is completed. The DEAR states that cost-reimbursement plus award fee contracts are generally the appropriate contract type for M&O contracts, but agencies can choose among a number of different contract types for M&O contracts. A time-and-materials contract provides for acquiring supplies or services on the basis of direct labor hours at specified fixed hourly rates that include wages, overhead, general and administrative expenses, profit, and actual cost for materials. According to DOE’s General Guide to Contract Types for Requirements Officials, this type of contract can fulfill a special need that no other contract type can serve, but it places a heavy burden on technical personnel to perform surveillance to preclude inefficiency or waste, and there is no positive profit incentive for a contractor to control costs. Under fixed-price contracts, the government and contractor agree on a firm pricing arrangement that is subject to adjustment only according to the terms of the contract, and the contractor generally must deliver the product or service for that price. A contractor, for purposes of this report, is a party that has signed a contract with DOE (known as a prime contract), while a subcontractor is a party that has signed a contract with a DOE contractor (or another subcontractor). For example, a contractor may enter into a subcontract to obtain access to a specific set of skills or services that it may not possess, such as construction expertise, equipment services, or technology support. According to the FAR and the DEAR, contractors may subcontract with affiliates or parties to their prime contract under certain circumstances. Subcontracts with M&O contractor affiliates for performance of contract work itself—as distinguished from the purchase of supplies and services needed in connection with the performance of work—require DOE authorization and may involve an adjustment of the contractor’s fee. If the contractor seeks authorization to have some part of the contract work performed by a party to the contract, and the party’s performance of the work was a factor in the negotiated fee, DOE would normally require (1) that the party perform such work without fee or profit; or (2) an equitable downward adjustment to the M&O contractor’s fee, if any. DOE’s oversight of contractors’ subcontract management generally falls into three broad categories: (1) reviewing subcontract costs, including conducting certain subcontract audits, to ensure that subcontract costs are appropriately charged to prime contracts; (2) reviewing and approving contractor business systems, including contractor accounting and purchasing systems, to ensure validity of data and sufficiency of subcontract oversight policies and procedures; and (3) performing subcontract consent reviews to consider, among other things, whether the contractor is complying with contract provisions and assuring against conflicts of interest, such as close working relationships or ownership affiliations between the contractor and subcontractor, which may preclude free competition or result in higher prices. The DOE OIG and other federal agencies or external audit organizations conduct periodic incurred cost audits and assessments of DOE’s prime contracts. The purpose of incurred cost audits is to determine whether such incurred costs are reasonable; applicable to the contract; determined under generally accepted accounting principles and cost accounting standards applicable in the circumstances; and not prohibited by the contract, statute, or regulation. For its M&O contracts, the contractors’ own internal audit staff performs incurred cost audits under a process known as the “cooperative audit strategy.” Under this strategy, each M&O contractor’s internal audit organization is responsible for performing periodic operational and financial audits, assessing the adequacy of management control systems, and conducting an audit of its own incurred cost statements. Each year, the DOE OIG performs an assessment of incurred costs for the 10 M&O contractors that incurred and claimed the most costs that year, according to the DOE OIG’s audit manual. For the remaining M&O contractors, the OIG performs assessments based on risk. These assessments do not follow standards for independent third-party audits; rather, they follow standards for review-level engagements, which are substantially narrower in scope than an audit. These assessments consist of determining whether the contractor’s internal audits complied with professional standards and could be relied upon; the contractor conducted or arranged for audits of its subcontractors when costs incurred were a factor in determining the amount payable to a subcontractor; and the contractor adequately resolved any questioned costs and internal control weaknesses affecting allowable costs that had been identified in prior reports and reviews. For non-M&O prime contracts, DOE has generally relied on the Defense Contract Audit Agency (DCAA), an independent third party, to audit contractors’ incurred costs that they invoiced to DOE. However, resource issues at DCAA have delayed audits and led to a backlog of prime contract audits. Further, the National Defense Authorization Act for Fiscal Year 2016 prohibited DCAA from providing nondefense audit support until DCAA addressed its backlog of incurred cost audits at the Department of Defense. To try to address its audit backlog that accumulated as a result of DCAA’s delays, DOE has used independent public accounting firms, expanded internal audit functions, and relied more heavily on invoice reviews and OIG audits and assessments. However, in February 2015, DOE’s OIG reported that at the time of that report, these methods were not completely effective and did not meet audit standards in some cases. DCAA has since resumed performing audits for civilian agencies. However, while DCAA has made some progress in reducing its backlog of audits, it did not meet its initial goal of eliminating the backlog by fiscal year 2016, and as we found in September 2017, DCAA officials stated that they were unlikely to meet the agency’s revised goal by the end of fiscal year 2018. According to the DEAR, each of DOE’s M&O contracts should include a clause that requires the contractor to conduct or arrange for audits of its subcontractors’ incurred costs when costs incurred are a factor in determining the amount payable to the subcontractor to ensure that subcontract costs are allowable. This subcontract audit requirement includes cost-reimbursement and time-and-materials type subcontracts. This requirement is also included in some of DOE’s large non-M&O contracts, including the seven non-M&O prime contracts in our selection. According to DOE headquarters officials, they included this requirement in the non-M&O contracts because of the large dollar amount of the prime contracts. The DOE OIG, DCAA, or other entities generally include information about the status of required subcontract audits in their audits and assessments of the prime contracts. In March 2017, we found that DOE generally completed audits or assessments of contractors’ incurred costs after DOE had reimbursed the contractors for the costs for DOE’s M&O and non-M&O contracts, including those contractors’ subcontract costs. If, as a result of these audits or assessments, DOE detects fraud or other improper payments— such as reimbursements for costs determined to be unallowable under the contract—DOE will question these costs and work with the contractor to resolve them. Sometimes, this can result in DOE recovering funds. DOE’s oversight of business systems includes oversight of accounting systems and purchasing systems. With regard to accounting systems, under the FAR, agency contracting officers are required to obtain information concerning the adequacy of the contractors’ accounting systems prior to determining whether a prospective contractor is responsible with respect to the contract. Under the FAR, the adequacy and suitability of these systems affects the quality and validity of the contractor data, including subcontract data, on which the government relies to oversee the contractors’ performance. DOE grants approval of the accounting system through headquarters-level reviews, local office reviews, or external audits of the system. With regard to purchasing systems, under the FAR, DOE should review and approve contractors’ purchasing systems, including their procurement policies and procedures. If the contractor does not have an approved purchasing system, the contracting officer is required to approve all cost-reimbursement, time-and-materials, and labor-hour subcontracts (among other types) above the simplified acquisition threshold. According to DOE headquarters officials, an approved purchasing system signifies that the contractor’s purchasing policies and practices are efficient and provide adequate protection of the government’s interests, including the contractor’s ability to award some subcontracts without the need to seek review and consent by the local DOE contracting officers. Local contracting officials use a formal contractor purchasing system review or a combination of other monitoring techniques to grant or extend approval of the contractor’s purchasing system. DOE monitors contractors’ compliance with subcontracting requirements primarily by providing consent to the contractors to award certain subcontracts. DOE determines the subcontracts that require consent prior to award with criteria the agency develops for each prime contract, such as subcontract dollar value and type of contract. Under the FAR, agencies should consider whether a proposed subcontract is appropriate to the risks involved and consistent with current policy when conducting a consent review. DOE officials told us that they generally use these reviews to ensure that the contractor’s accounting and purchasing systems are continuing to operate as intended and that the contractor is following its policies and procedures, including policies to safeguard against conflicts of interest, such as issues precipitated by shared ownership interests. Under the FAR, where consent is required, the consenting official must give particularly careful and thorough consideration to potential conflicts of interest, such as where close working relationships or ownership affiliations between the contractor and subcontractor may preclude free competition or result in higher prices. For subcontracts that are subject to a consent review, the contractor submits a package of information to the local DOE contracting officer. The contracting officer either provides consent or raises issues that the contractor must address before awarding the subcontract. According to DOE documents we reviewed, the package typically includes summary information such as: what the contractor is buying, the type of contract to be used (i.e., cost-reimbursement, fixed-price), who the subcontract will be awarded to, a general description of the scope of work, a summary of the basis for making the award, documentation that shows the contractor conducted a cost and price analysis prior to award and that the contractor adhered to its internal policies and procedures, and conflict of interest determinations and mitigations. In fiscal year 2016, 28 entities were party to DOE’s 24 largest prime contracts. Specifically, DOE awarded 15 prime contracts to contractors composed of groups of two to five entities and awarded the remaining nine of the 24 prime contracts in our selection to contractors composed of a single entity. Our review found that 11 of the 28 participating entities were parties to multiple prime contracts. The prime contracts in which these 11 entities participated represented about 69 percent, or $19.3 billion, of DOE’s total prime contract obligations in fiscal year 2016. Figure 2 shows the relationships among the 11 entities that are parties to multiple prime contracts included in our selection. For example, Battelle Memorial Institute and Bechtel National, Inc. each were party to six prime contracts, based on ownership information DOE provided. It can be difficult to track changes in the ownership of entities that are parties to the prime contracts to understand the entities’ relationships, if any. Our review found that changes in ownership of the parties to six of the 24 prime contracts in our selection occurred prior to fiscal year 2016 but were not reflected in the information DOE provided to us. Therefore, our analyses do not reflect the modified ownership information. The fact that one entity could be party to multiple prime contracts and could acquire other entities that are parties to prime contracts complicated our ability to understand the relationships among them. AECOM—which was identified as a party to three prime contracts in our selection—acquired URS Corporation in 2014, and URS had previously acquired Washington Group International in 2007. This resulted in AECOM becoming a party to the Lawrence Livermore National Security, LLC; Washington River Protection Solutions, LLC; Los Alamos National Security, LLC; and Battelle Energy Alliance, LLC, prime contracts, making AECOM a party to seven of the contracts in our selection. However, the documents DOE provided show it as a party to three of the contracts in our selection. Our review of contractor Lawrence Livermore National Security, LLC’s website showed that BWX Technologies, Inc. split from the Babcock and Wilcox Company in 2015 and replaced it as a party to the contract, making BWX Technologies party to four of the prime contracts in our selection rather than the three reported in DOE’s documents. These changes in ownership occurred prior to fiscal year 2016, the time period we reviewed, but the changes were not reflected in the ownership information DOE provided to us for these prime contracts. Such acquisitions can also complicate DOE’s review of contract proposals. For example, in August 2016, NNSA awarded the contract for the management and operation of the Nevada National Security Site to Nevada Site Science Support and Technologies Corporation. The contractor identified itself as a wholly owned subsidiary of Lockheed Martin. However, after awarding the contract, the NNSA contracting officer was notified that the awardee had been acquired in its entirety by Leidos Innovations Corporation prior to the award. According to NNSA, the request for proposals required offerors to disclose ownership changes that occur during the proposal process, but NNSA was not notified about the ownership change until after the proposal had been awarded. Once the Nevada Site Science Support and Technologies Corporation’s ownership changed from Lockheed Martin to Leidos, its proposal was not compliant with the requirements and NNSA rescinded the award. The 24 contractors in our selection reported obligating funds to more than 169,000 subcontracts to about 23,000 different entities in fiscal year 2016. Contractors subcontracted more than $6.9 billion, an amount equivalent to nearly 30 percent of DOE’s obligations to its prime contracts in fiscal year 2016. The extent to which contractors obligated funds to subcontracts in fiscal year 2016 varied widely, from 13 percent of prime contract obligations to 83 percent, as shown in table 1. The contractors in our selection reported that they awarded about 54 percent, or about $3.7 billion, of their subcontract obligations in fiscal year 2016 as fixed-price contracts and 46 percent, or about $3.2 billion, as cost-reimbursement contracts, cost-reimbursement contracts with no fee earned, or time-and-materials contracts. See figure 3 for the distribution of subcontract obligations by type. We found that in fiscal year 2016, at least 24 of the 28 entities that were parties to the prime contracts were also subcontractors to the prime contracts in our selection. Specifically, these 24 entities held nearly 3,000 subcontracts with fiscal year 2016 subcontract obligations totaling about $927 million. Table 2 shows the parties to prime contracts that also held subcontracts in fiscal year 2016. Further, we found that, in some cases, entities held subcontracts on the specific prime contracts to which they were a party. As discussed previously, subcontracting to an entity that is also a party to the prime contract is allowable under the FAR and DOE regulations. Figure 4 shows the 15 contractors that obligated funds in fiscal year 2016 to subcontracts with parties to their prime contracts. For example, UT Battelle, LLC—the contractor for the Oak Ridge National Laboratory prime contract in fiscal year 2016—had 416 active subcontracts with two parties to that prime contract (University of Tennessee and Battelle Memorial Institute). UT Battelle, LLC obligated more than $34 million for subcontracts to these two entities in fiscal year 2016. In another example, Savannah River Remediation, LLC, the liquid waste contractor for the Savannah River Site, had 30 active subcontracts with three parties to that prime contract (AECOM, Inc.; Bechtel National, Inc.; and CH2M Hill Constructors, Inc.). The contractor obligated about $12 million for subcontracts to these three entities in fiscal year 2016. For more information about the relationships among DOE’s prime contracts, parties to the prime contracts, and subcontractors, see an interactive graphic at https://www.gao.gov/products/GAO-19-107. Each of the 24 prime contracts in our selection required contractors to conduct or arrange for audits of their subcontractors’ incurred costs for certain subcontract types, including cost-reimbursement and time-and- materials contracts, among others. Contracting officers at DOE’s local offices are responsible for overseeing contractors and for ensuring, among other things, that both DOE and the contractor comply with the terms of the prime contract. However, officials from DOE’s local offices have not always ensured that contractors completed the required subcontract audits. DOE relies on the contractors’ subcontract audits to identify unallowable subcontract costs. As previously discussed, the DOE OIG, DCAA, or third parties complete incurred cost audits or assessments of DOE’s prime contracts, which generally report on the extent to which the contractor has completed required audits of subcontract costs. We requested the reports for the two most recent incurred cost audits or assessments that the DOE OIG or third parties conducted, as of February 2018, for the prime contracts in our selection to determine whether contractors had conducted required subcontract audits for the period covered by the reports. In response to our request, the 24 contractors provided a total of 43 reports, 11 of which were audit reports and 32 of which were assessment reports: Twenty contractors provided both requested reports. Three contractors provided only one report each that had been completed. One contractor did not provide the two requested reports because of pending litigation. Of the 43 incurred cost assessment and audit reports we reviewed, 21 reports indicated that contractors had not audited more than $3.4 billion in costs incurred by subcontractors over the 10-year period covered by the reports. These reports documented various reasons that the subcontracts had not been audited, including that a contractor did not appropriately recognize that time-and-materials subcontracts needed to be audited, or that a contractor relied on internal controls or a non-audit procedure to meet subcontract audit requirements. For example, an April 2013 assessment by the DOE OIG found that subcontractor costs of more than $12 million incurred over a 4-year period for two multi-year time-and-materials contracts had not been audited by the contractor, as required by its prime contract, because the local DOE office did not submit a request to DCAA to perform the audits due to the DCAA backlog. In another example, a March 2014 DOE OIG assessment found that a contractor did not conduct required audits of $155 million in subcontract costs incurred during 1 fiscal year because the contractor believed its internal controls met the intent of the requirement to conduct the subcontract audits. Some audit or assessment reports we reviewed included some questioned subcontract costs. For example, in an assessment for fiscal year 2013, the DOE OIG reported that an M&O contractor’s internal audit department performed audits of 78 subcontracts for 30 different subcontractors and questioned nearly $900,000 in subcontractor costs incurred from fiscal year 2009 through fiscal year 2013. As of June 2016, most of the questioned amount had been resolved, and the remaining amount—about $7,900—was deemed unallowable and applied against an invoice from the contractor. In another assessment of an M&O contractor for fiscal year 2013, the DOE OIG questioned subcontract costs identified by the contractor of more than $725,000, with about $8,000 ultimately deemed unallowable. We have previously found that DOE sometimes negotiates questioned costs with its contractors to settle on an amount—potentially lower than the amount initially questioned— ultimately deemed unallowable. Although the amounts of unallowable costs in these examples are small, DOE does not know the full extent of unallowable subcontractor costs that it has reimbursed because required subcontract audits were not always conducted. For some contractors, the issue of unaudited subcontract costs is long- standing and extensive. For example, DOE documents show that, at the time of our review, one contractor had never completed an adequate audit of its subcontractors’ incurred costs over the 16 years of the prime contract period, although its prime contract with DOE requires such audits. In June 2016, the contractor placed the value of its unaudited subcontracts at more than $1.3 billion. This amount included some subcontracts that were closed without being audited, meaning the work had been completed and the final costs under the prime contract had been paid. DOE has been working with the contractor since 2013 to implement corrective actions to resolve the issue; in October 2018, DOE officials told us they reached an agreement with the contractor to complete current audits and address the backlog. We identified three key differences in how contractors and DOE’s headquarters and local office officials interpreted the subcontract audit requirements included in the prime contracts we reviewed that contributed to DOE not always ensuring that contractors audited their subcontractors’ incurred costs. Specifically: Extent of subcontracts that must be audited. We identified differing interpretations of whether the prime contract required contractors to audit all cost-reimbursement and time-and-materials contracts. Specifically, some contractors told us that they had developed risk- based approaches to selecting subcontracts for audit based on thresholds, such as the amount of the subcontract. However, using such a strategy could exclude significant subcontract costs from audit. For example, according to an April 2012 DOE OIG audit, one contractor increased its subcontract audit threshold from $1 million to $15 million in annual incurred costs, thereby excluding from audit nearly $343 million in subcontract costs incurred during fiscal years 2008 and 2009. In its report, the DOE OIG questioned whether the contractor’s subcontract audit strategy provided sufficient audit coverage to ensure that DOE did not pay unallowable costs. In that case, the DOE OIG found that the audit strategy, which was supposed to be based on DCAA requirements, did not meet a key DCAA requirement to audit incurred costs of at least one-third of all subcontracts under $15 million at least once every 3 years. Definition of an audit. Some contractors used invoice reviews in place of audits to meet the requirement. As discussed previously, DOE documents showed that one contractor had never completed an adequate audit of its subcontractors’ incurred costs over the 16 years of the contract. According to contractor representatives, the term “audit” was not defined in their contract, and therefore they performed detailed subcontractor invoice reviews instead of conducting subcontract audits to meet the requirement. DOE found that these invoice reviews did not meet generally accepted government auditing standards. Responsibility for arranging for audits if DCAA is unable to conduct audits. Some contractor representatives we interviewed reported that their subcontracts remained unaudited as a result of the DCAA backlog. Representatives from one contractor told us that they believed that they were not responsible to conduct the audits if DCAA was unable to do so, and another said that they tried to engage a third-party auditor to conduct the audits themselves, but their subcontractor would not allow the third-party auditor to access their records despite specific language establishing the contractor’s responsibilities for audits. Differences in the interpretation of the subcontract audit requirements have continued to occur because DOE has not clearly defined—in guidance or other documents—how these contract requirements should be met, which could eliminate confusion about which subcontracts should be audited, how an audit is defined, and how to meet subcontract audit requirements if DCAA is unable to conduct the audit. Federal internal control standards state that management should externally communicate the necessary quality information to achieve the entity’s objectives so that external parties can help the entity achieve its objectives and address related risks. Until DOE clearly defines how contractors should meet subcontract audit requirements, contractors may not perform subcontract audits as intended and unallowable costs may not be identified or recouped. In addition, we found that audits or assessments of a contractor are usually not conducted immediately after the fiscal year in which funds are spent, partly because of the availability of DCAA staff or third-party auditors to complete the work. Our review of the 43 audit and assessment reports identified reports covering 7 fiscal years that were audited or assessed 6 or more years after the fiscal year in which the costs were incurred; more than $557 million in subcontract costs in those fiscal years had not been audited as required by the prime contracts. The Contract Disputes Act of 1978 imposes a 6-year statute of limitations for the government to seek recovery of unallowable costs that could be identified through subcontract audits, so it is important for audits to be completed in a timely manner. We also found that local offices’ efforts to monitor contractors’ completion of subcontract audits have not ensured that contractors have completed required subcontract audits and that those audits are completed in a timely manner. Officials from the local offices said their approaches for overseeing whether contractors performed required subcontract audits included reviewing and approving the contractors’ internal audit plans, reviewing monthly or quarterly reports from the contractors’ internal audit departments, or reviewing the contractors’ internal audits and reviews of subcontractors’ costs. Additionally, several DOE officials from the local offices said they relied on the DOE OIG and external auditors’ assessments and audits of the contractor to monitor the status of subcontract audits, even though these assessments and audits may be infrequent. Federal internal control standards state that management should implement control activities through policies, such as by documenting such policies in the appropriate level of detail, to allow management to effectively monitor the control activity. These standards state that policies may be further defined through procedures, including the timing of when a control activity occurs, to help personnel implement the control activities for their assigned responsibilities. However, we found that DOE headquarters has not issued documented procedures or guidance that requires local offices to monitor the contractors’ progress in completing the required audits or to specify the time period during which an audit must be completed. Without such procedures or guidance, unallowable costs may go unidentified beyond the 6-year period set by the Contract Disputes Act, preventing DOE from identifying and recovering unallowable costs. In addition to ensuring that contractors conduct required audits of subcontract costs, DOE must meet other requirements to ensure its contractors are effectively overseeing subcontracts, specifically by approving contractors’ accounting and purchasing systems and performing consent reviews to monitor subcontracting actions. With respect to approval of contractors’ accounting and purchasing systems, DOE generally ensures that reviews and approvals of these systems occur, but the frequency of some accounting system reviews varies. With respect to performance of consent reviews to monitor subcontracting actions, most subcontracts are not reviewed by DOE, and we found that while DOE’s local officials could independently review available information on ownership to assist them with their assessment of contractors’ identification of potential conflicts of interest in the consent review process, they generally do not. Further, DOE’s thresholds for conducting consent reviews are inconsistent and there is no requirement to reevaluate the thresholds. In addition, DOE’s annual contractor performance evaluations do not explicitly measure its contractors’ performance in managing or overseeing subcontracts. Under the FAR, federal agencies are to determine the adequacy and suitability of contractors’ accounting systems. The adequacy and suitability of these accounting systems affects the quality and validity of the contractor and subcontractor data upon which the government must rely for its management and oversight of the contractor and contract performance. DOE local contracting officers responsible for the prime contracts in our selection stated that they rely on contractor accounting system approvals to help them determine the contractor’s suitability to appropriately place and manage subcontracts. The FAR provides that the contractor’s accounting system should be adequate during the entire period of contract performance, but does not specify a minimum frequency for performing accounting system reviews. According to interviews with local DOE officials and our review of documentation they provided, DOE may grant accounting system approval through headquarters-level reviews, local office reviews, or external audits of the accounting system. Headquarters-level reviews occur at a level above the local office, such as through NNSA’s Office of Management and Budget. In addition, the contracting officers or other subject matter experts at DOE’s local offices can conduct the reviews of the accounting systems themselves or employ an external audit organization, such as DCAA, to conduct the reviews. DOE conducted at least one review of the accounting systems used for each of the 24 prime contracts in our selection: eight accounting systems were reviewed through headquarters-level organization reviews, nine were reviewed by local offices, and seven were reviewed through external audits. DOE headquarters officials said that no method for review is considered more rigorous or preferred over another, and it is left to the discretion of the contracting officers at DOE’s local offices to determine which method to use. According to our review of documents from DOE’s local offices and interviews with DOE officials from the local offices, 22 of the 24 prime contracts in our selection had approved accounting systems in fiscal year 2016. Contracting officers from the local DOE offices responsible for oversight of the two prime contracts for which there was no approved accounting system for fiscal year 2016 told us that they maintained oversight of the contractors’ accounting systems through mechanisms other than the traditional review and approval process. Specifically: Local DOE officials responsible for oversight of one prime contract, which was awarded in December 2000, told us that they did not have to review or approve the contractor’s accounting system at the local level after the contract was awarded because the contractor’s corporate office was required to have an approved accounting system to enter into its contract with DOE. The officials were not sure whether an approval of the corporate accounting system had been performed since 2000, but DCAA was scheduled to perform a review of the system in late 2018. In a 2017 letter to the DOE local office, DCAA stated that its review of the accounting system was delayed due to staffing issues, and it was the agency’s opinion that the contractor’s internal audits and reviews demonstrated that the contractor was adhering to the criteria of an adequate accounting system. A local official responsible for oversight of another prime contract stated that they had not approved the contractor’s accounting system because it was adopted from the site’s former contractor. The officials told us the former contractor’s accounting system had already been approved and no additional review or approval was necessary. Officials at DOE headquarters agreed that the use or transfer of an existing DOE-approved accounting system satisfies the review requirement. According to the officials responsible for overseeing this prime contract, the local office annually reviews and approves the contractor’s Financial Management System Plan, which would identify any major planned enhancements and upgrades to the current financial management systems and subsystems, including the accounting system. In addition to differences in how accounting system approvals were conducted, local DOE officials said there are differences in the frequency of the contractor accounting system reviews and approvals across local offices. Some accounting systems are approved only at the time the prime contract is awarded, while others are approved annually, on a 3- year cycle, or only if there are major changes to the accounting system. DOE headquarters officials we interviewed said that the frequency of reviews and approvals was determined on a contract-by-contract basis, and for the prime contracts for which the accounting system was approved at the time of contract award, the officials were unaware of what might necessitate an additional review. Figure 5 shows the frequency of accounting system approvals for the 24 prime contracts in our selection as of fiscal year 2016. The DOE Acquisition Guide states that the creation and maintenance of rigorous business, financial, and accounting systems by the contractor is crucial to ensuring the integrity and reliability of the cost data used by DOE officials. Further, the FAR provides that the contractor’s accounting system should be adequate during the entire period of contractor performance. In addition, DOE headquarters officials said that periodic reviews and approvals of the accounting systems are important to ensuring these requirements are met. However, there is wide variation in the frequency of these reviews, in part because DOE has not reviewed the differences in the frequency of its accounting system approvals and whether the basis for these differences is appropriate. Prime contracts can last for decades, so many years may pass without further review of the adequacy of the accounting systems. For example, local officials responsible for overseeing a prime contract with an accounting system that was approved at the time the contract was awarded said that the approval occurred 12 years ago, and they had questions about the adequacy of the system. DOE officials said that they do not have guidance to help contracting officers at local offices determine the appropriate frequency for reviewing accounting systems’ adequacy. Instead, local DOE contracting officers that oversee each prime contract have discretion to determine the manner and frequency of reviews based on their knowledge of the contractor. Under federal standards for internal control, management should design control activities to achieve objectives and respond to risks, including by clearly documenting internal control in management directives, administrative policies, or operating manuals. When reviews are infrequent, or it is unclear when a review should be conducted, subsequent changes to the accounting system may not be promptly evaluated and DOE may not have adequate assurance that contractors’ accounting systems can be relied upon. By reviewing the differences in the frequency of its accounting system reviews and approvals and developing guidance that provides criteria to determine the appropriate frequency of such reviews, DOE could better ensure that adequate accounting systems are in place during the entire period of the contract. Under the FAR, the federal agency should maintain a sufficient level of surveillance to ensure that the contractor is effectively managing its purchasing program. Each of the contractors for the 24 prime contracts in our selection had an approved purchasing system in fiscal year 2016. If a local DOE contracting officer determines that a contractor does not have an approved purchasing system, under the FAR, the office should review and decide whether to approve (i.e. consent to) all cost- reimbursement type subcontracts and unpriced actions for fixed-price subcontracts that exceed the simplified acquisition threshold of $150,000 prior to award. Under the FAR, the contractor is to continue to seek approval for every proposed subcontract that meets these criteria until the issues with the purchasing system that led to the withdrawal of approval are resolved and the system is again approved. Our review of subcontract information provided by DOE’s contractors indicates that, without an approved purchasing system, more than 6,600 of the subcontracts that were active in fiscal year 2016 would have required review and approval prior to award, according to the existing simplified acquisition threshold. According to DOE officials at local offices and headquarters, DOE contracting officers may use a formal contractor purchasing system review or a combination of surveillance and other monitoring techniques to grant or extend approval of a contractor’s purchasing system. DOE headquarters officials told us that the variation in the source and method of purchasing system reviews is intentional to allow the local offices to meet the requirement in a way that works best for their location and contractor, and that the most important aspect of the purchasing system review is the ongoing surveillance of the system. Contracting officers from DOE’s local offices told us they had approved the purchasing system for each of the 24 prime contracts in our selection in a variety of ways: Seven local offices approved contractors’ purchasing systems based on the local contracting officer’s knowledge of the contractor’s work; Six local offices relied on the results of a peer review program; Five local offices considered the results from a combination of internal and external audits and reviews (including peer reviews); Four local offices performed a formal purchasing system review but did not provide specifics as to the source of information, such as internal or external audits or peer reviews; and Two local offices relied on the results of external audits. One of the contractors in our selection of 24 prime contracts, Bechtel National, Inc., had a DOE-approved purchasing system for the construction of the Hanford Waste Treatment and Immobilization Plant at the Hanford Site in Washington State, which was subsequently withdrawn for a 3-month period in 2018. Specifically, in fiscal year 2018, the Defense Contract Management Agency (DCMA) performed a review of the contractor’s corporate purchasing system and identified a number of significant deficiencies—such as inadequate advance notice of subcontract awards, missing subcontractor disbarment disclosures, and general documentation issues with the contractor’s procurement files— that resulted in Bechtel National, Inc.’s corporate purchasing system being disapproved until the identified deficiencies could be resolved. DOE officials said they lifted the restrictions on the contractor in October 2018 following DCMA’s validation that Bechtel National, Inc. implemented the required updates to its purchasing system and procedures. In June 2018, DOE headquarters officials told us they encouraged the local offices to focus on the use of a peer review program to review and approve purchasing systems. NNSA officials further explained that they expected the peer reviews would encourage contractors to remain diligent in the administration of their systems. As a part of this new approach, DOE headquarters officials told us that local officials will be required to assess the need for a purchasing system review every 3 years, and if the local office did not conduct a review, then a peer review would be required at least every 6 years. According to DOE’s November 2018 updated peer review handbook and officials responsible for the handbook, the peer review program is DOE’s preferred method for conducting purchasing system reviews and is now mandatory for DOE’s M&O contracts at least every 6 years and for non- M&O contracts, with a contract length of 5 years or less, at the 3-year mark. NNSA headquarters officials stated that they expect all of their local offices to use the peer review program to assess contractors’ purchasing systems going forward, regardless of the type of contract. According to documents provided by DOE headquarters and local offices, as of July 2018, contractors for 18 of the 24 prime contracts in our selection participated in the peer review program, and six did not participate, including two NNSA contractors. Figure 6 shows the date of the most recent peer review for the 24 prime contracts in our selection, as of July 2018. According to contracting officers and headquarters officials we interviewed, DOE’s local offices use subcontract consent reviews to monitor contractors’ compliance with subcontracting requirements. In addition, local officials told us that they use these reviews to review and assess any reported potential conflicts of interest on the part of the contractor and subcontractors. However, we found that local DOE officials generally do not request additional information on ownership to independently ensure contractors are mitigating these conflicts, nor do they routinely make use of various databases available to government employees that report ownership information for many government contractors. In addition, local offices conduct a limited number of consent reviews for subcontracts, based on a dollar threshold that varies among local offices, which makes it difficult for DOE to ensure that local offices have sufficient visibility into contractors’ subcontracting actions. According to local DOE officials we interviewed, subcontract consent reviews are the primary control method used to monitor contractors’ compliance with subcontracting requirements. Under the FAR, in conducting a consent review, agencies should consider whether a proposed subcontract is appropriate to the risks involved and consistent with current policy. Specifically, local DOE officials told us that they use the consent reviews to monitor contractors’ accounting and purchasing systems between formal reviews of these systems; as well as to monitor their compliance with policies and procedures for subcontracting, including ensuring that subcontracts are awarded competitively, are of appropriate types, and that the contractor adheres to requirements to safeguard against conflicts of interest. According to officials we interviewed, local DOE contracting officers often receive a notice from the contractor of its intention to solicit subcontracted work and, if the proposed subcontract value exceeds an agreed-upon dollar threshold, contracting officers typically will review a consent package from the contractor before the final award of the subcontract. The contractor is to obtain DOE’s consent to the proposed action before proceeding. NNSA’s local offices have a standard consent checklist that directs the contracting officer to consider certain factors before granting consent for the contractor to issue a particular subcontract. These factors include the contractor’s past performance, whether the solicitation for subcontracted work was appropriately competed, the type of subcontract selected, and whether the proposed prices are reasonable for the intended work, among other things. In comparison, individual DOE local offices generally use consent checklists they develop. These checklists have similar review topics to the NNSA checklist, but the specific items and formats vary. According to DOE officials we interviewed, subcontract consent reviews are DOE’s only opportunity to review subcontract pricing and to ensure best value for the government before the contractor awards the subcontract. Furthermore, because fixed-price subcontracts do not have the same audit requirements as cost-reimbursement subcontracts, these consent reviews may be the only opportunity for DOE to review the cost and pricing of fixed-price subcontracts to be awarded by the contractor. As mentioned previously, the contractors for the 24 prime contracts in our selection awarded 54 percent of their fiscal year 2016 subcontract obligations as fixed-price subcontracts, and these contracts may be awarded to parties to the prime contract, subject to certain conditions. DOE contracting officials we interviewed noted a number of ways in which consent reviews have helped them oversee contractors’ compliance with subcontracting requirements. For example, an official described one case in which the contractor was proposing a cost-reimbursement subcontract for items that could have been purchased more favorably under a fixed- price contract. The consent package did not support why the contractor chose the more costly contract type, so the contracting officer denied consent and asked the contractor to review and reissue the solicitation. In another example, the contractor had to renegotiate a subcontract before award, after the contracting officer identified inherent safety concerns in the description of the proposed work upon review of the consent package. DOE requires certain provisions to be included in the prime contracts that require both DOE and the contractor to safeguard against personal and organizational conflicts of interest. Among other things, these contract provisions include requirements from the FAR that prohibit former officials of a federal agency from accepting compensation from a contractor within a year of awarding a contract to that contractor; prohibit contractors from soliciting, accepting, or attempting to accept any kickbacks; and generally prohibit federal agencies from subcontracting with debarred entities. All of the local DOE officials we interviewed said they rely on the contractor to identify and mitigate potential conflicts by including these requirements in contract clauses in their subcontracts and in the contractor’s internal policies and procedures. Headquarters and local DOE officials said they rely on the consent review process to ensure that contractors are following these policies and procedures, and that contractors identify and mitigate subcontract ownership conflicts, such as those that may occur in connection with subcontracts to related parties. If the contractor has identified a conflict of interest in connection with a proposed subcontract, the consent package checklists we reviewed request the contractor to also include in the package either a simple conflict of interest disclosure statement, which would include steps the contractor claims to have taken to mitigate the conflict, or a conflict of interest analysis conducted by the contractor. In both cases, the contracting officer is expected to check that the information is included in the package, but no additional action or assessment by local DOE contracting officers is required. Local DOE officials performing consent reviews told us that subcontracting with related parties is their main concern when assessing conflicts of interest; however, they generally did not independently assess information on subcontractor ownership during their reviews, beyond the information that the contractor reported. Information on subcontractor ownership could alert local contracting officers to potential conflicts of interest, such as preferential treatment in the awarding of subcontracts to parties of the prime contract, and could help DOE to determine if the mitigation plan included in the consent package is adequate to address the potential conflict of interest. However, local DOE officials told us that they generally do not request or review subcontractor ownership information in available databases when reviewing proposed subcontracts because there is no requirement to do so. (See appendix III for a description of data systems available to DOE officials that may contain relevant ownership information about existing contractors or entities.) Local DOE officials told us they have identified instances, through their consent reviews, in which the contractors’ reporting of potential conflicts of interest was inadequate. For example, DOE officials reviewing consent packages at a local office noticed that a number of subcontracts were awarded to a single company. The officials subsequently determined that the contractor’s former president was currently sitting on the board of the subcontracting company, but the contractor had not disclosed this information during the consent review process. According to DOE officials, this case is currently under review. In addition, according to a Department of Justice press release, an employee of one contractor created an entity and then, on behalf of the contractor, ensured that a multimillion-dollar subcontract was awarded to the new entity, and this employee received payments under the subcontract from May 2011 to April 2016. The subcontractor did not disclose this conflict of interest while working for the contractor. As previously discussed, contractor ownership can be complicated, with complex relationships between and among entities. Further, contractor ownership may change over time through various mergers and acquisitions. These relationships and changes can make it difficult for DOE to monitor contractors’ ownership, such as in the previously discussed example in which an awardee did not notify NNSA of an ownership change prior to contract award as required by the request for proposals. In this case, NNSA would have been unable to identify or mitigate potential conflicts of interest in connection with the owner, had the contracting officer not been notified separately of the change in ownership. Nevertheless, according to officials from DOE’s local offices, because DOE is not a party to the subcontracts, agency officials generally do not maintain or request subcontractor ownership information beyond the information that contractors provide during consent reviews. Although DOE has the right to access information about the subcontractors’ costs and performance—through contract clauses that generally allow DOE to request and review information relevant to costs and performance under the prime contract, including the costs and performance of subcontractors as well as through multiple databases available to government employees—officials stated there is no requirement for contracting officers to request or search such information during reviews. According to DOE headquarters officials, depending on the type of prime contract, the government may request direct access to subcontractor records as required. For example, DOE officials from one local office told us that they have access to the contractor’s subcontract information through a direct link to the contractor’s internal restricted network, but they do not routinely access the network to review ownership information. Like data available through other databases, these internal data maintained by the contractors have the potential to be useful to local officials during consent reviews for identifying the risks imposed by potential conflicts of interest between parties to the prime contract and potential subcontractors. Federal internal control standards state that management should identify, analyze, and respond to risks related to achieving the defined objectives, such as analyzing identified risks to estimate their significance, which provides a basis for responding to the risks. As noted above, local officials said that their main concern when assessing conflicts of interest is the contractor subcontracting with related parties. However, local DOE officials told us that they generally do not request or review subcontractor ownership information because there is no requirement to do so. By requiring contracting officers to independently review subcontractor ownership information as part of consent reviews and assess potential conflicts of interest, DOE would have better assurance that contractors are adequately identifying and mitigating organizational conflicts of interest. Although consent reviews have the potential to provide contracting officers with important information on the contractor’s compliance with requirements, the number of reviews conducted by local offices each year varies due to different thresholds at each location. DOE headquarters and local officials told us the numbers of consent reviews conducted by local offices are based on dollar-amount thresholds or other criteria established by the local DOE offices, and these criteria vary among DOE locations. According to DOE officials, consent review thresholds vary for a number of different reasons. For example, a senior agency official and some local DOE officials said that small staff sizes and other oversight responsibilities may limit the number of consent reviews that contracting officers conduct. DOE guidance recommends that when establishing the threshold for consent reviews, the contracting officer should aim to review enough subcontracts annually to provide the local office with sufficient visibility into subcontracting actions without being overly burdensome on either the contractor or the federal staff. The consent review thresholds for the 24 prime contracts in our selection varied widely, and contracting officers performed few reviews for some prime contracts. For example, as shown in table 3, one local office set its subcontract consent threshold at $250,000, which led the local contracting officer to review about 175 consent packages in a year, and another set the threshold at $25 million, which led the local office to review 1 consent package in a year. Local DOE officials told us that most subcontracts are not subject to consent reviews because they fall below the consent threshold. One of the prime contracts with a $25 million consent threshold is held by Bechtel National, Inc., the contractor constructing the Hanford Waste Treatment and Immobilization Plant. As previously discussed, Bechtel National, Inc.’s purchasing system was disapproved for a 3-month period in fiscal year 2018 and, during that time, the contracting officer was required to review and consent to all subcontracts above $250,000. A DOE official told us that the local office reviewed 48 subcontract consent packages during this time period, and the office would not have reviewed any if the purchasing system had not been disapproved. In some cases, DOE contracting officers have adjusted the consent review thresholds during the contract period based on concerns they have identified with subcontracts that the contractor awarded. For example, one local office had concerns that the subcontractor was not disclosing potential conflicts of interest to the contractor and, therefore, the contractor did not mitigate these conflicts of interest. As a result, the contracting officers reduced the consent threshold to increase the number of consent packages they reviewed until they could be certain the contractor was managing subcontracting risks adequately. According to the local DOE officials, part of the reason they did not identify the deficiencies sooner was that high thresholds resulted in the local officials conducting few consent reviews. In another example, a DOE contracting officer from a different local office lowered the consent review threshold in 2017 due to documentation issues—such as files with inadequate documentation to explain or justify proposed prices—as well as the contractor not sending a subcontract to the local office for approval, as required. Local DOE officials told us they requested a peer review of the contractor to see if this was a systemic issue, and they reduced the consent threshold to send a message to the contractor that DOE expected the contractor to improve its subcontracting practices. For more than half of the contracts in our selection, thresholds for required consent reviews have not been reevaluated since the contracts were awarded because, according to DOE officials, there has not been a requirement to do so. Federal internal control standards state that management should design control activities to achieve objectives and respond to risks. As discussed in the examples above, without an appropriate number of subcontract reviews, deficiencies, such as inadequate documentation, have persisted. By requiring contracting officers to periodically reevaluate the thresholds for consent reviews, DOE may be able to better ensure that local offices have sufficient visibility into contractors’ subcontracting actions to ensure that proposed subcontracts are appropriate to the risks involved and consistent with current policy and sound business judgment. After we provided our preliminary results from our review of the consent review process to DOE headquarters officials, the officials told us they planned to reevaluate consent thresholds as part of the peer review process described above, with respect to purchasing system reviews. NNSA headquarters officials stated that they would implement a similar change to its process, based on DOE’s guidance, once DOE implements its changes in the November 2018 update. However, we reviewed the November 2018 update and found that it did not include a requirement to reevaluate consent thresholds as part of the peer review process. According to local DOE officials and documents provided, DOE develops Performance Evaluation and Measurement Plans at the beginning of each fiscal year to establish expectations for contractor performance and to describe how the local office will evaluate the contractors’ performance against those expectations. According to DOE guidance, the plans provide a standard to assess whether the contractors are meeting the mission requirements and performance expectations for goals stipulated within the contracts. In addition, according to DOE guidance, the plans should describe the incentives available, such as award fees, and the methodology for determining the amount of incentives earned by the contractor for the year, based on the evaluation of the contractor’s performance. In general, Performance Evaluation and Measurement Plans we reviewed included goals and performance criteria. Goals are the broad, high-level categories and benchmarks that local DOE officials use to assess the contractor’s annual performance and reflect what local officials consider most important in the contractor’s performance. Performance criteria, also included in the plans we reviewed, refer to the elements officials should consider when reviewing to determine whether the contractor has met the goals. Not all performance criteria need to be met for a contractor to show adequate performance toward a goal. None of the fiscal year 2016 Performance Evaluation and Measurement Plans for the 24 prime contracts we reviewed included goals explicitly related to subcontractor management, and only 3 of the 24 plans included performance criteria that were related to the contractor’s management of subcontractors. According to DOE officials, there is no requirement to include specific goals or performance criteria related to subcontractor management in these plans because the contractor is responsible for completing the scope of work in the prime contract, regardless of whether it was performed by the contractor or a subcontractor. The fiscal year 2016 Performance Evaluation and Measurement Plans we reviewed for 18 of the 24 prime contracts in our selection included a goal for effective and efficient business operations, which includes the contractor’s accounting and purchasing systems. DOE headquarters officials stated that they would expect any subcontract management issues that affected the scope, schedule, or cost of the contract to be identified and addressed within this goal. However, of the three plans that included performance criteria on subcontract management, none of the criteria were included under the business operations goal, as DOE officials said they would have expected. Rather, these performance criteria were included under goals such as “project performance and technical issue resolution” or a “special emphasis area.” The fiscal year 2016 Performance Evaluation and Measurement Plans we reviewed did not reflect the expectations DOE headquarters officials described to us that subcontract management would be reflected in the business operations goal of contractor evaluations, and the plans do not acknowledge the importance of subcontract management and oversight, particularly in light of the high percentage of contract obligations— frequently for cost-reimbursement contracts—that subcontractors ultimately execute. As we mentioned above, contractors in our selection subcontracted out nearly 30 percent of their fiscal year 2016 obligated funds, making subcontract management a key part of the contractors’ work. According to DOE guidance, DOE should use performance-based management as a strategic contract management tool to plan for, manage, and evaluate contractor performance under the prime contract and to align performance with costs. A March 2018 study of NNSA’s M&O contractors and a February 2019 GAO report on DOE performance measures found that performance evaluations tend to be subjective and do not focus on potentially important areas, such as the contractors’ cost performance. The Deputy Secretary of Energy also issued a statement in September 2018 noting the importance of properly incentivizing performance as part of contract management to ensure that the most important performance measures are identified and that incentives are appropriately aligned to those measures. However, the plans we reviewed do not reflect the importance of subcontract management because there is no requirement to include assessments of the contractors’ management of its subcontractors in the plans. By requiring that explicit performance criteria that assess the contractors’ management of subcontractors be included as part of the annual Performance Evaluation and Measurement Plans, DOE would have more reasonable assurance that the agency is emphasizing the importance of subcontract management and providing contractors an additional incentive to properly manage their subcontractors. Contracting officers at DOE’s local offices are responsible for, among other things, ensuring that contractors complete required subcontract audits. DOE’s headquarters and local offices have taken some steps to ensure that contractors comply with their subcontracting requirements. However, differences in how contractors, local DOE offices, and DOE headquarters offices interpret subcontract audit requirements and perform subcontract audits persist because DOE has not clearly defined—in guidance or other documents—how these requirements should be met. Until DOE clarifies which subcontracts should be audited, how an audit is defined, and how to meet subcontract audit requirements if DCAA is unable to conduct the audit, contractors may not perform subcontract audits as intended and unallowable costs may not be identified or recouped. Additionally, DOE’s local offices did not always ensure that contractors audited their subcontractors’ incurred costs for cost- reimbursement and time-and-materials subcontracts as required because DOE headquarters has not issued documented procedures or guidance that requires local offices to monitor contractors’ progress in completing the required subcontract audits in a timely manner. Without such procedures or guidance, unallowable costs may go unidentified beyond the 6-year limitation period of the Contract Disputes Act, preventing DOE from recovering those costs. In addition, the timing of contractor accounting system reviews differs among DOE’s local offices. DOE has not reviewed the differences in the frequency of the reviews and whether the basis for these differences is appropriate, nor provided guidance that includes criteria to determine the frequency of reviews. By reviewing the differences in the frequency of its accounting system reviews and approvals and developing guidance that includes criteria to determine the appropriate frequency of such reviews, DOE acquisition officials could better ensure that adequate accounting systems are in place during the entire period of the contract. DOE uses consent reviews to ensure that other subcontracting requirements are met, including that subcontracts are appropriate to the risks involved and that there are appropriate safeguards related to personal and organizational conflicts of interest. Nevertheless, DOE generally does not independently request or review subcontractor ownership information or assess potential conflicts of interest related to ownership between contractors and subcontractors as part of their consent reviews—beyond information disclosed by the contractor— because there is no requirement to do so. Recent criminal investigations into conflicts of interest, local offices’ own findings of unreported conflicts, and the complex ownership relationships among contractors and subcontractors that we identified emphasize the need for oversight in this area. By establishing such a requirement, DOE would have better assurance that contractors are adequately identifying and mitigating conflicts of interest. DOE’s local offices set thresholds to determine which subcontracts to review. The thresholds often are set at the beginning of the contract and are not reevaluated because there is no requirement to do so. We observed a small number of instances in which DOE local offices decreased thresholds after identifying concerns during consent reviews. We were encouraged that DOE intended to incorporate evaluation of consent review thresholds in their peer review process as part of their planned update to their guidance, but upon subsequent review, the guidance did not contain the requirement. By requiring local offices to periodically reevaluate consent review thresholds, DOE and NNSA acquisition officials may be able to better ensure that local offices have sufficient visibility into contractors’ subcontracting actions to ensure that proposed subcontracts are appropriate and consistent with current policy. Finally, DOE uses Performance Evaluation and Measurement Plans to establish expectations for contractor performance, including performance criteria, used to evaluate contractor performance. However, few of the plans we reviewed included explicit goals or performance criteria related to subcontract management because there is no requirement to do so. By requiring inclusion of explicit performance criteria for assessing the contractors’ management of subcontractors in these plans, DOE and NNSA acquisition officials would have more reasonable assurance that the agency is emphasizing the importance of subcontract management and providing contractors an additional incentive to properly manage their subcontractors. We are making the following six recommendations to DOE: The Director of the DOE Office of Acquisition Management should clearly define—in guidance or other documents—which subcontracts should be audited, how an audit is defined, and how to meet subcontract audit requirements if DCAA is unable to conduct the audit.(Recommendation 1) The Director of the DOE Office of Acquisition Management should develop documented procedures or guidance that requires DOE’s local offices to monitor the contractors’ progress in completing required subcontract audits in a manner that ensures unallowable costs can be recovered within the 6-year limitation period in the Contract Disputes Act. (Recommendation 2) The Director of the DOE Office of Acquisition Management should review the differences in the frequency of DOE’s accounting system reviews and approvals and develop guidance that includes criteria to determine the appropriate frequency of such reviews for prime contracts. (Recommendation 3) The Director of the DOE Office of Acquisition Management should require local officials to independently review subcontractor ownership information as part of DOE consent reviews and assess potential conflicts of interest to ensure contractors are mitigating them. (Recommendation 4) The Director of the DOE Office of Acquisition Management should require local offices to periodically reevaluate consent review thresholds. (Recommendation 5) The Director of the DOE Office of Acquisition Management should require contracting officers to include assessments of the contractors’ management of subcontractors as part of annual Performance Evaluation and Measurement Plans, as appropriate. (Recommendation 6) We provided a draft of this report to DOE for comment. In our draft report, we made twelve recommendations—each of our six current recommendations was made to both DOE and NNSA. In response to DOE’s comments, we consolidated our original twelve recommendations into six recommendations addressed to DOE. We did so with the understanding that NNSA follows DOE guidance and would develop supplemental guidance, as needed, to implement these recommendations. With regard to the remaining six current recommendations, DOE partially concurred with five of the recommendations and did not concur with one of the recommendations. DOE’s written response is reproduced in appendix IV. In addition, DOE provided technical comments which we incorporated as appropriate. DOE did not concur with our fourth recommendation to require local officials to independently review subcontract ownership information as part of DOE consent reviews and assess potential conflicts of interest to ensure contractors are mitigating them. In response to the recommendation, DOE said that it plans to issue guidance emphasizing the importance of contracting officers’ reviewing contractors’ disclosure and mitigation of issues created by potential conflicts of interest or ownership affiliations between contractors and subcontractors, and NNSA plans to evaluate the need for additional action upon issuance of the guidance. DOE officials said they rely on the consent review process to ensure that contractors identify and mitigate subcontract ownership conflicts as required, such as those that may occur in connection with subcontracts to related parties. Local DOE officials told us they have identified instances, through their consent reviews, in which the contractors’ reporting of potential conflicts of interest was inadequate. Furthermore, we have identified several recent high-profile incidents that have involved fraudulent activity by subcontractors related to conflicts of interest that were not disclosed to DOE. DOE officials—including those in local offices—have access to several databases and other sources of information that would allow them to independently verify ownership information that could allow the local offices to identify potential conflicts of interest that were not disclosed. We continue to believe that requiring local officials to independently review subcontractor ownership information as part of consent reviews and assess potential conflicts of interest could provide DOE with greater assurance that the contractors are identifying and mitigating conflicts of interest. In response to our other five recommendations, DOE stated that it partially concurred with each. For each recommendation, DOE said that it would review existing regulations, procedures, guidance, or contract provisions and assess the need for supplemental guidance. We believe that DOE’s plans to further examine the issues raised in our report is a positive step toward resolving the issues; however, we believe that the actions called for in our recommendations remain valid and that DOE could more efficiently resolve the issues by proceeding to implement those actions. We are sending copies of this report to the appropriate congressional committees, the Secretary of Energy, the Administrator of the National Nuclear Security Administration, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-3841 or bawdena@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix V. To address our objectives, we reviewed relevant laws, regulations, and guidance, including the Federal Acquisition Regulation (FAR); the Department of Energy Acquisition Regulation (DEAR); Department of Energy (DOE) policies and guidance on contract management and subcontract oversight; and individual prime contracts to identify requirements that explicitly apply to subcontracting, including DOE’s roles and responsibilities and requirements for the contractor. We also reviewed relevant documentation and interviewed officials from DOE and the National Nuclear Security Administration (NNSA), as well as representatives of DOE’s largest prime contracts and officials from the local DOE offices that oversee these prime contracts. To identify the entities that participated in DOE’s largest prime contracts, the extent to which they subcontracted their work, and the entities that participated in those subcontracts during fiscal year 2016, we reviewed a list of all DOE prime contracts active in that year provided by DOE headquarters officials. That list included information about prime contract type, total prime contract value, fiscal year 2016 obligations, and DOE’s local offices responsible for overseeing the contractors. We selected fiscal year 2016 for review because it was the most recent fiscal year for which complete data were available at the start of our review. DOE’s total prime contract obligations for fiscal year 2016 were $28.2 billion. We determined that an appropriate threshold for establishing our selection would be all single prime contracts for which DOE obligated at least $300 million (about 1% of all contract obligations) in fiscal year 2016, and this resulted in a list of 24 prime contracts that represented about $23.6 billion in obligations, or about 84 percent of DOE’s fiscal year 2016 prime contract obligations. The resulting selection of 24 prime contracts consisted of both management and operating (M&O) and non-M&O prime contracts from the three major program offices within DOE: NNSA, Office of Science, and Office of Environmental Management. We took several steps to determine the reliability of the prime contract data provided by DOE, including interviewing agency officials and reviewing individual prime contract documents, as well as verifying, through contractor and local office interviews, the amount of funds obligated to the prime contract in fiscal year 2016. We determined that the data provided by DOE on the prime contracts, in terms of prime contract obligations in fiscal year 2016, were sufficiently reliable for identifying DOE’s largest prime contracts. To identify the parties to DOE’s largest prime contracts, we reviewed documents and statements the DOE local offices provided about the parties to each of the 24 prime contracts in our selection. For consistency, we used only the information local DOE officials provided about prime contract ownership, either from their direct statements or from the prime contract documents they provided as our source for the information, although we observed that in some cases more recent ownership information was available through the contractors’ websites. In addition to the documents and statements officials from DOE’s local offices provided, we also reviewed contractors’ websites and information from the parties’ websites about acquisitions and mergers to better understand the complicated relationships among all of the contractors and the parties to the prime contracts. Because of changes in entity ownership or the structure of these prime contracts, more entities than we identified in our analysis may be parties to these prime contracts. To identify the subcontractors to the 24 prime contracts in our selection, we requested and reviewed data from the 24 contractors about their active subcontracts in fiscal year 2016. Each contractor provided data on their subcontracts that were $10,000 or more and that were active in fiscal year 2016, including: the subcontractor’s name, Dun & Bradstreet’s Data Universal Numbering System (DUNS) number, location of subcontractor’s office, total award amount, total obligated amount for fiscal year 2016, type of subcontract, contract award date, and contract term. There were some cases in which the contractors did not provide all of the requested subcontract data, or the data provided were not clear, such as the meaning of the type of subcontract. To resolve these issues, we conducted contractor-specific follow-up requests to either collect the missing information, identify the reasons that information was not available, or to clarify data they provided. We were able to collect missing information and clarify the data with two exceptions. First, many contractors did not have DUNS numbers for all of their subcontractors and therefore we did not use this identifier in our analyses. Second, contractor Brookhaven Science Associates, LLC did not track the obligated dollar amount for fiscal year 2016 for its active subcontracts. As a result, we were not able to include it in our analysis of the dollar amount of subcontracted funds, and we indicated that this analysis was therefore based on 23 of the 24 prime contracts in our selection. We took several steps to determine the reliability of the subcontract data provided by the contractors, including requesting and reviewing information from each of the contractors about the systems used to capture the data, and we determined that the information was sufficiently reliable to use in analyses of subcontract information from these 24 contractors in fiscal year 2016. We identified the amount of funds subcontracted, the number of subcontracts, and the number of unique entities subcontracted to during fiscal year 2016. We also identified the amount subcontracted for each contractor by type of subcontract, as defined in the FAR: (1) fixed-price; (2) cost-reimbursement; (3) cost- reimbursement, no-fee; and (4) time-and-materials. In addition, we used the names of the subcontractors to identify any cases in which a party to the prime contract was also a subcontractor to any of the prime contracts in our selection. We used shortened versions of the parties’ names to perform the matching between parties to the prime contract and subcontractors. For example, the party to the Battelle Energy Alliance, LLC prime contract—Battelle Memorial Institute—was shortened to “Battelle,” and we included any subcontract that included the word “Battelle” in its name in our match list. This allowed us to identify a conservative estimate of the number of parties who were also subcontractors in fiscal year 2016. However, this analysis would not have identified any cases in which the subcontractor was a party to the prime contract but had a different name. To develop graphical representations of (1) figure 2, Entities That Were Party to More than One of the 24 Largest Department of Energy Prime Contracts, Fiscal Year 2016 (which explores ownership relationships between parties and prime contracts) and (2) figure 4, Selected Department of Energy Contractors That Awarded Subcontracts to Parties to Their Prime Contract, Fiscal Year 2016 (which explores contracting relationships between prime contracts and subcontractors that were also parties), we performed the name-matching exercise described in the previous paragraph to first structure the data and then develop graphical prototypes using the UCINet network analysis tool, including its NetDraw graphics tool, which were then further refined for GAO publication. For each of the static representations, the graphics juxtaposed two sets of entities in columnar format: (1) for the party-prime contract graphic, we arrayed parties to two or more prime contracts in the first column of entities and the prime contracts in which these parties had ownership in a second column, and (2) for the prime contract-party as subcontractor representation, we arrayed the prime contracts in the first column and the subcontractors who were also parties to their prime contract in the second column. Lines between parties and prime contracts in the first graphic represented the presence of an ownership relationship. The parties were sized according to the number of contracts that the entity was a party to, and the contracts were sized according to the number of parties to that contract. Lines between prime contracts and parties as subcontractors in the second graphic represented the value of subcontracts between the two, with the lines taking on one of four weights corresponding to dollar value ranges. To examine the extent to which DOE ensured that the 24 contractors in our selection audited subcontractors’ incurred costs and met other requirements for subcontract oversight, we developed a structured interview and a request for data and documents, which we administered to representatives of the 24 prime contracts in our selection and to DOE officials at local offices who were responsible for the oversight of the contractors. To develop the list of requested documents and structured interview questions, we reviewed the FAR, DEAR, DOE policies and guidance, and individual prime contracts to identify both DOE’s roles and responsibilities and requirements for the contractor regarding subcontracting. From these sources, we confirmed that the review of subcontract costs, including subcontract audits and DOE access to subcontractor records, was a key requirement and identified two other broad categories that covered the requirements we identified for DOE and the contractor related to subcontracting: (1) the review and approval of contractor business systems, including the accounting and purchasing systems; and (2) DOE’s approval of subcontracts through consent reviews, which are intended to assess the contractors’ adherence to subcontracting requirements and provide assurance against conflicts of interest, including personal and organizational conflicts, and issues with kickbacks, foreign influence, and disbarment. We designed the structured interview questions and document requests to identify how DOE officials met subcontract oversight requirements. We pretested the structured interview questions and document requests at three of DOE’s local offices that included both M&O and non-M&O prime contracts from three major program offices—the Hanford Site in Washington State, Lawrence Livermore National Laboratory, and Pacific Northwest National Laboratory—and made changes to the request for documents and the interview guide as appropriate. We then conducted the structured interviews with DOE’s local officials responsible for oversight of the 24 contractors in our selection, including contracting officers, and with representatives from the 24 contractors during February, March, and April 2018. We also collected documents that addressed DOE’s oversight of the contractors’ management of subcontracts, including, as of February 2018, the two most recent incurred cost audits or assessments of the prime contract—which spanned the 10-year period from 2007 to 2016—the contract management plans, annual contractor performance reviews, peer reviews, and information about the subcontractors and entities that were parties to the prime contracts. We conducted a content analysis of DOE and contractor officials’ responses provided through the structured interview process and on the data and documentation we received, and we summarized the extent to which DOE ensures that contractors were auditing subcontractors’ incurred costs and meeting other requirements for subcontract oversight. We conducted this performance audit from May 2017 to March 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Table 4 provides information on the Department of Energy’s (DOE) 24 largest prime contracts in fiscal year 2016, including the name of the site or project, the name of the contractor, entities that were party to the prime contract, and the amount obligated on the contract in fiscal year 2016. Local DOE officials provided information on parties to the prime contract, either from direct statements or from the prime contract documents. We used information DOE provided as our source for the information in the table, although we observed that in some cases more recent information was available through the contractors’ websites or other sources. There are several key federal data systems that include information on Department of Energy (DOE) contractors. Additionally, DOE has internal systems that include information on contractors. These data systems are available to federal employees and can be used to differing extents to identify information about contractor ownership. In addition to the contact named above, Hilary Benedict (Assistant Director), Kathy Pedalino (Analyst in Charge), Caitlin Dardenne, and Jeffrey (Chris) Wickham made key contributions to this report. Also contributing to this report were Enyinnaya David Aja, David Dornisch, Farrah Graham, Richard P. Johnson, Cynthia Norris, Dan Royer, and Tatiana Winger.

Summary: DOE, including NNSA, is the largest federal civilian contracting agency, spending about 90 percent of its appropriations on contracts with companies, universities, and others for federal research and development, engineering, and production. DOE headquarters and local offices oversee contractors’ activities, including their management of subcontracts. GAO was asked to review contracting at DOE, including the use of subcontractors. This report examines, for fiscal year 2016, (1) the parties that participated in DOE’s largest prime contracts and the extent to which they subcontracted their work; (2) the extent to which DOE ensured that those contractors audited subcontractors’ costs, as required; and (3) the extent to which DOE ensured that contractors met other subcontract oversight requirements. GAO reviewed DOE’s fiscal year 2016 data and documents, analyzed regulations, and interviewed federal officials and contractor representatives for DOE’s 24 largest fiscal year 2016 prime contracts. In fiscal year 2016, 28 entities participated in the Department of Energy’s (DOE) and its National Nuclear Security Administration’s (NNSA) 24 largest prime contracts, which totaled $23.6 billion of DOE’s fiscal year 2016 obligations. The contractors awarded about $6.9 billion (nearly 30 percent) of those obligations to thousands of subcontractors. Further, multiple companies, universities, and other entities can join together to bid on a contract (i.e., become a “party to” a contract). GAO’s review of data about these contracts and subcontracts identified complex ownership relationships among the contractors and subcontractors. For example, GAO found that almost all of the 28 parties to the prime contracts in its review were also subcontractors to some prime contracts, holding a total of nearly 3,000 subcontracts with fiscal year 2016 obligations totaling about $927 million (see figure). GAO found that it can be difficult to track changes in the ownership of parties to the contracts and to understand the relationships between parties. DOE and NNSA did not always ensure that contractors audited subcontractors’ incurred costs as required in their contracts. GAO’s review of 43 incurred-cost assessment and audit reports identified more than $3.4 billion in subcontract costs incurred over a 10-year period that had not been audited as required, and some subcontracts remained unaudited or unassessed for more than 6 years. Completing audits in a timely manner is important because of a 6-year statute of limitations to recover unallowable costs that could be identified through such audits. DOE headquarters has not issued procedures or guidance that requires local offices to monitor contractors to ensure that required subcontract audits are completed in a timely manner, consistent with federal standards for internal control. Without such procedures or guidance, unallowable costs may go unidentified beyond the 6-year limitation period of the Contract Disputes Act, preventing DOE from recovering those costs. DOE and NNSA perform several reviews to ensure that contractors meet other subcontract oversight requirements. For example, DOE’s local offices review proposed subcontracts to ensure they are awarded consistent with policies related to potential conflicts of interest. However, local officials do not independently review information on subcontractor ownership because doing so is not required, although such information could alert officials to potential conflicts of interest. By requiring contracting officers to independently review subcontractor ownership information, DOE and NNSA would have better assurance that contractors are adequately identifying and mitigating organizational conflicts of interest. GAO is making six recommendations, including that DOE develop procedures that require local offices to monitor contractors to ensure timely completion of required subcontract audits, and require local DOE officials to independently review subcontractor ownership information to identify potential conflicts of interest. DOE partially concurred with five of GAO’s six recommendations but did not agree to independently review subcontractor ownership information. GAO maintains that the recommended actions are valid.