Federal acquisition regulations require certain contractors who do business with the government to maintain acceptable business systems that reduce risk to the government and taxpayer. Contractors may have up to six major business systems that require review. DOD’s acquisition regulation establishes criteria for each of the six types of contractor business systems, which are implemented by the inclusion of certain contract clauses. Where a contract includes these clauses, the contractor’s business systems generally must meet the criteria. Factors such as the type of contract and the dollar value determine whether the clauses are included in a contract (see table 1). In certain cases, the absence of an adequate system may preclude the government from using a particular contract type or may require additional oversight or analysis. For example, the FAR states that: A cost-reimbursement contract may be used only when, among other things, contractors’ accounting systems are adequate for determining costs applicable to the contracts or orders; an adequate accounting system is also required for the use of progress payments. Without an approved purchasing system, contractors may require additional oversight of their subcontracting decisions. Significant deficiencies with contractors’ estimating systems shall be considered during negotiation. Alternatively, an adequate estimating system may reduce the scope of reviews to be performed on individual proposals, expedite the negotiation process, and increase the reliability of proposals. DCMA and DCAA are responsible for providing contracting and audit support to the military departments and are responsible for conducting business system reviews, along with a host of other responsibilities (see table 2). Under DCMA’s November 2013 instruction, the final determination of adequacy for all of the contractor business systems resides with the DCMA administrative contracting officers (ACO). An ACO may have responsibility for all or a portion of a single large business or may be responsible for a number of smaller contractors within a particular region. To help inform their system determinations, an ACO can request that either DCMA or DCAA conduct business system reviews or audits when needed. Among other responsibilities, ACOs are responsible for taking actions to impose consequences when contractors do not comply with business system standards. Throughout the last 10 years, GAO and other accountability organizations have reported on challenges DOD faces when conducting CBS reviews or other critical contracting audits, such as incurred cost audits. Over this time Congress has also taken actions through various NDAAs to initiate changes to the CBS review process. In 2009, the Commission on Wartime Contracting and GAO highlighted significant concerns about how DOD was conducting CBS reviews at that time. For example: The Commission reported that billions of dollars in contingency- contract costs in Iraq and Afghanistan could not be verified by government auditors and that inadequate internal controls over contractor business systems hampered the government’s insight into cost errors and material misstatements. The report highlighted instances where DCMA and DCAA came to different conclusions when reviewing the same contracts and had inadequate resources to complete business system reviews. It also stated that DCMA was not aggressive in motivating contractors to improve their business systems because it accepted corrective action plans as sufficient progress to address deficiencies. The commission made recommendations to address each of these issues. We found issues with independence of auditors, sufficiency of evidence, and incomplete reporting of DCAA’s findings. As result, we made 17 recommendations to DOD to help improve the quality of DCAA’s audits, most of which the agency has implemented. Since then, subsequent GAO and DOD Inspector General (IG) reports have pointed to other issues with the CBS review process and DCAA’s incurred cost audit process. Namely, In November 2011, we found that DCAA could not complete the number of CBS reviews needed to be consistent with its guidelines because it was focused on higher priority areas—such as incurred cost audits—and, as a result, DCMA contracting officers maintained systems’ determinations as adequate even though the systems had not been audited by DCAA in a number of years. Among our recommendations, we proposed that DCMA and DCAA identify options, such as hiring external auditors, to assist in the conduct of CBS reviews until DCAA could adequately fulfill those responsibilities with its own workforce. In July 2014, DOD published a proposal to change the DFARS to allow public accounting firms to perform reviews of accounting, estimating, and material management and accounting systems. According to DPC officials, however, the department’s IG raised concerns about consistency between the proposed change and statutory and regulatory requirements for IG oversight of outside audit services. Further, the private sector expressed concerns that CBS audit criteria did not align with generally accepted accounting principles used in the private sector. As result of these challenges, DOD did not implement the proposed regulation change. In December 2012, we found that DCAA’s backlog of incomplete incurred cost audits was a contributing factor in DOD’s inability to close out contracts in a timely manner. To address this backlog, DCAA began implementing a new, risk-based approach that was expected to shift DCAA’s resources to focus on incurred cost audits involving high-dollar value and high risk proposals. In October 2015, the DOD IG found that DCMA contracting officers did not always comply with requirements to report business system deficiencies and found instances where CBS determinations based on DCAA-led reviews were not reported within required timeframes. The IG concluded that this likely caused delays in correcting significant business system deficiencies and lengthened the time the government was unable to rely on data generated by those business systems. In September 2017, we found that despite efforts by DCAA to reduce the backlog of incurred cost proposals awaiting audit, the agency was not able to meet its goals to eliminate the backlog by fiscal year 2016 and that it was unlikely to meet a revised goal of fiscal year 2018. We recommended that DCAA assess and implement options for reducing the length of time to begin incurred cost audits and establish related performance measures. DCAA concurred with these recommendations and took actions to reduce the time it takes to begin audits. Most recently, in a January 2018 report, the Advisory Panel on Streamlining and Codifying Acquisition Regulations—commonly referred to as the Section 809 panel after the legislative provision that created it— reiterated the importance of business system internal controls. Noting that DOD’s CBS reviews are untimely and inconsistent, the Panel made several recommendations that seek to complete reviews, especially for accounting systems, in a more timely way. Among these recommendations are the use of public accounting firms to supplement the DOD audit workforce, a change to accounting system review standards and criteria, and the development of new guidance for the conduct of business system reviews. During the past 10 years, Congress also enacted three provisions related to improving how DOD conducts business system reviews and incurred cost audits. Specifically, Section 893 of the NDAA for Fiscal Year 2011 directed the Secretary of Defense to initiate a program to improve contractor business systems so that the systems provide timely and reliable information. The NDAA required that this program, among other things, establish requirements for each system and a process for identifying significant deficiencies within systems. It also required that DOD identify those officials responsible for approval and disapproval of a system, and that approval or disapproval of a system would be based on whether the system has a significant deficiency. Further, the law authorized DOD to withhold up to 10 percent of contract progress payments, interim payments, and performance-based payments from certain contracts when systems are disapproved based on a significant deficiency. Contractors that require review—or “covered contractors”—were defined as those subject to the cost accounting standards. Section 893 of the NDAA for Fiscal Year 2017 amended the fiscal year 2011 NDAA provisions by (1) revising the definition of a “covered contractor” to generally mean those with government contracts subject to the cost accounting standards accounting for more than 1 percent of the contractor’s total gross revenue and (2) allowing public accounting firms to conduct contractor business system assessments. Section 803 of the NDAA for Fiscal Year 2018 required DOD to be compliant with certain standards of risk and materiality in the performance of incurred cost audits for its contracts. It also required that DOD use public accounting firms to, among other things, perform a sufficient number of incurred cost audits to eliminate the incurred cost audit backlog by October 1, 2020 and to allow DCAA to allocate resources to higher-risk and more complicated audits. Figure 1 below summarizes these reports and congressional actions related to contractor business system activities over the last decade. Since 2011, DOD has taken actions to (1) clarify the roles and responsibilities of DCMA and DCAA in conducting CBS reviews and consolidate the number of reviews to be performed; (2) clarify how often DOD should conduct CBS reviews; (3) establish what criteria are used to evaluate a contractor’s business system; (4) establish timeframes by which ACOs are to make a determination on the adequacy of the contractors’ business systems; and (5) implement the use of payment withholds for contractors that are found to have significant deficiencies in their contractor business systems. DCMA and DCAA officials noted that these changes were implemented primarily to address the 2011 statutory provisions. Our review of six selected contractors’ business system reviews found that the whole process from the review or audit, to the follow up and resolution, can be lengthy. In three out of six selected cases we reviewed, it took 4 or more years for a contractor’s system to be approved. Prior to 2011, DCAA conducted a series of 10 internal control audits on a cyclical basis, while DCMA performed more targeted testing on three systems. During that time, both DCMA and DCAA could review a contractor’s purchasing or earned value management (EVM) system but would evaluate different aspects of each system. As a result, DCMA and DCAA reviewers could issue deficiency reports based on their separate reviews of the same contractor business systems for the consideration of ACOs. As reported in August 2009 by the Commission on Wartime Contracting, these overlapping reviews led to instances where DCMA and DCAA came to different conclusions about the adequacy of the same business system. To address this issue and clarify roles and responsibilities, in November 2013 DCMA established policies that guide oversight and implementation of the CBS review process, to include approval responsibilities and procedures for the conduct and reporting of reviews. DCMA has separate instructions for each type of contractor business system with the exception of accounting. These separate instructions provide more details about appropriate stakeholders for specific reviews, noting particular functional experts such as offices within DCMA or DCAA that are to lead the conduct of the reviews. DCAA issued a separate memorandum in April 2012 that details changes made to accounting system reviews as a result of changes from the NDAA for fiscal year 2011. Under these revised processes, DCMA now has responsibility for reviewing three contractor business systems and DCAA is responsible for the other three. In all cases, the DCMA ACO makes the final determination on whether a system is approved or disapproved. Further, the revised process consolidated the number of audits that DCAA conducts on the adequacy of the contractor’s accounting system from five separate audits to one comprehensive system audit. According to DCAA, this consolidation was based on a comprehensive reassessment of the processes for assessing accounting systems and combined elements from previous internal control reviews. Figure 2 shows DCMA and DCAA responsibilities before and after the changes implemented from the NDAA for Fiscal Year 2011. The revised DCMA instructions and related DCAA memorandums for the CBS review process also clarified timeframes for how often a contractor’s business system must be reviewed. Generally, each system should be reviewed every 3 years unless the ACO makes a determination that a review is not necessary based on a risk assessment or other factors (see table 3). DOD also revised the DFARS in 2012 to provide definitions for acceptable contractor business systems and established individual DFARS clauses that define the criteria for each of the six business systems. As appropriate, these clauses are included in contracts and generally require the contractor to maintain adequate business systems, allow for the government to withhold payments when systems are found to have significant deficiencies, and list the criteria that the systems must meet. The number of criteria varies by system. For example, the DFARS clause for accounting systems includes 18 criteria used to evaluate system features such as proper segregation of direct and indirect costs, timekeeping, and exclusion of unallowable costs. For EVM systems, a contractor’s system must comply with private, institutional standards and includes procedures that generate timely, reliable, and verifiable reports. To test how DCAA-led audits were being implemented under these new criteria, DCAA began a pilot program in 2014 comprised of a team of dedicated auditors to conduct CBS reviews who, in turn, were to recommend changes in audit plans and other practices. DCAA initially focused on material management and accounting systems audits, then moved to estimating systems, and finally accounting systems. As result of this pilot, DCAA issued new audit guidance for all three systems in 2018, with the latest guidance for accounting system audits issued in October 2018. DCAA officials told us that they are implementing lessons learned from the pilot program and developing training on how to conduct the revised audit plans. The revised DCMA instructions provide timeframes for ACOs to communicate their initial and final determinations to contractors (see textbox) and define the responsibilities of DCMA management and ACOs for confirming significant deficiencies and resolving disagreements between functional specialists and the ACO. Revised Contractor Business System Review Process Timeframes According to the revised contractor business system review process, when significant deficiencies are found: Administrative Contracting Officers (ACO) have 10 days to communicate an initial determination of business system compliance to the contractor under review. The contractor is requested to respond to the letter within 30 days after that to respond to the letter communicating whether or not it concurs with the determination. The ACO issues a final determination 30 days after receipt of the contractor’s response. According to Defense Contract Management Agency (DCMA) officials, data for fiscal year 2017 indicated that 80 percent of final determination letters were issued within this required timeframes. In instances where deficiencies are found, these findings are reviewed by a panel within DCMA to help ensure standards are consistently applied. When there is disagreement between the ACO and functional specialist concerning the nature or severity of deficiencies found, a DCMA board of review may be requested by the ACO to resolve differences and produce a final determination. According to DCMA officials responsible for maintaining business system review policies, differences between functional specialists and contracting officers are generally resolved without the need for a board discussion. These officials said that only a few board discussions have been convened since implementation of the new review structure. Section 893 of the NDAA for Fiscal Year 2011 generally established that DOD be allowed to withhold payments under certain contracts when DOD disapproves one or more of a covered contractor’s business systems. DCMA officials previously had the latitude to withhold a portion of the payments owed to contractors as result of deficiencies identified in their reviews, but were not required to do so. From 2011 through 2013, DOD revised the DFARS and related agency instructions to generally require that ACOs apply a 2 to 5 percent contract payment withholding for a single deficient system and a maximum of a 10 percent withhold when multiple systems are found to have significant deficiencies. ACOs are authorized to reduce the amount being withheld after the ACO determines that the contractor has submitted an adequate corrective action plan and began its implementation. Our review of DCMA and DCAA information indicates that for all the CBS reviews conducted between fiscal years 2015 and 2017, DCMA and DCAA often identified significant deficiencies in three business systems. These were the cost estimating, material management and accounting, and purchasing systems. For example, DCAA identified a significant deficiency in nine of the 12 material management and accounting systems reviewed, while DCMA identified significant deficiencies in 260 of the 330 purchasing systems reviewed (see table 4). Because DCMA and DCAA officials do not maintain historical data on payment withholdings, it is not possible to determine the number of payment withholdings that were implemented over these years as a result of these significant deficiencies. The system used to track the status of systems and payment withholdings, CBAR, is updated by ACOs as corrective actions are completed and payment withholdings are removed, and thus shows only a snapshot in time. Our review of CBAR data from July 2018 found that DOD was withholding payments from 11 contractors with a total collective value of approximately $238 million at that time. One third of these payment withholdings were associated with significant deficiencies found in contractors’ estimating systems. DCMA and DCAA officials we spoke with noted that the withhold provision has led to contractors’ increased response to deficiencies, but they did not have data to determine the extent to which contractors’ responsiveness has increased. Some contractors we spoke with stated that because deficiencies will affect the company’s cash flow, senior management and board members have become more engaged in matters of business system compliance. Our review of six selected contractors’ business system reviews illustrates the challenges in identifying and resolving deficiencies in a timely manner. Overall, our review of these six cases found that it took from 15 months to 5 years or more to resolve deficiencies initially identified by DCAA or DCMA. Factors contributing to the time it took to resolve these issues included contractors submitting inadequate corrective action plans, DCMA or DCAA identifying additional deficiencies in subsequent reviews or audits, and the use of different auditors to conduct the reviews. While the selected cases are not generalizable to all CBS reviews, they do highlight issues that can arise during the process. For example: In one case it took almost 4 years to resolve deficiencies identified in a contractor’s accounting system. In this case, DCAA issued an audit report in July 2014 that found seven significant deficiencies including inadequate monitoring and adjusting of rates the contractor was billing the government. DCMA subsequently issued an initial determination 7 days later disapproving the system, citing three of the seven deficiencies identified by DCAA. In August 2014, the contractor responded by providing a corrective action plan for the three deficiencies DCMA cited. DCMA sent a second determination letter the next month citing two additional deficiencies identified by DCAA. In October, the assigned ACO for the contractor left and new staff was assigned to the review. Ten days later, the contractor submitted a second corrective action plan to address the two deficiencies identified. Disagreement between the ACO and DCAA on the inclusion of the two remaining deficiencies identified by DCAA for the accounting system resulted in a need to convene a board of review by DCMA. The board decided that the two deficiencies would be included in the final determination. This, in turn, delayed issuance of a final determination until mid-December 2014. According to contractor representatives, over the next 3 years, they submitted various corrective action plans that DCMA determined were inadequate to address the deficiencies. Each time, the ACO requested additional information and follow-up DCAA audits to help assess the adequacy of the contractor’s corrective action plans. Eventually the contractor’s accounting system was approved in June 2018. In another case, a contractor’s estimating system has been disapproved for over 5 years. In June 2013, DCAA identified four significant deficiencies in the contractor’s system, including inadequate support for commerciality determinations. As a result, following a final determination of inadequacy, DCMA implemented a payment withhold of 5 percent. In response, the contractor submitted a corrective action plan in September 2013 addressing the deficiencies that was accepted by DCMA and the withhold was reduced to 2 percent. In a follow-up review in July 2014, DCAA identified two new deficiencies, which the contractor corrected. In March 2015 DCAA reviewed the contractor’s forward pricing rate proposal and identified 11 new deficiencies in the estimating system. By August 2015, the contractor had corrected the new deficiencies but the system remained disapproved because the previous four deficiencies remained uncorrected. Finally, in September 2016, DCAA canceled its audit of the estimating system because these four deficiencies remained. According to officials, the contractor was not ready for re-evaluation. At the time of this review the system remains disapproved. In another case, a contractor’s property management system was disapproved for more than 4 years. In November 2013, DCMA reviewed the contractor’s property management system and, according to officials, identified nine significant deficiencies, including those related to missing records and supporting documentation for all contracts. DCMA issued an initial determination of disapproval. DCMA officials stated that they did not receive an adequate response from the contractor for nearly 7 months, and in June 2014, DCMA issued a final determination of system disapproval. The contractor subsequently submitted a corrective action plan in August to address the deficiencies. A DCMA official stated that they re-analyzed the system in November 2014 and found one outstanding issue. According to the official, the DCMA property administrator in charge of the review elevated the issue to the assigned ACO, but received no response. According to contractor representatives, they requested a follow-up review from the DCMA ACO several times from August 2014 to June 2015 but did not receive a response until after June 2015. According to a DCMA official, this was due to resource issues as the review went dormant because the new ACO assigned to the contractor went overseas. The system was reviewed again in November 2017 and the contractor’s system was approved in January 2018. In another case, an audit of a contractor’s estimating system took DCAA 2 years to complete. The DCAA audit began in November 2014. According to contractor representatives, they were initially told that the review would take 9 to 12 months, but a number of different DCAA auditors were assigned to the review over time and each identified different findings which led to a prolonged process. DCMA approved the contractor’s estimating system in December 2016. In another case, a contractor’s estimating system was disapproved for 15 months. In June 2016 DCMA disapproved a contractor’s estimating system due to three significant deficiencies, including one related to performing adequate price and cost analysis on subcontractor proposals. According to contractor representatives, they submitted a corrective action plan, but after submitting the plan DCAA performed an audit of the contractor’s forward pricing rates and identified additional deficiencies. In December 2016 DCMA officials determined that the corrective action plan the contractor provided was not sufficient. DCMA subsequently approved the contractor’s estimating system in September 2017. DCMA and DCAA officials believe the cases we analyzed were not representative of the length of time needed to complete the CBS review process, but could not provide data to support their views because DCMA and DCAA do not track data on the length of time it takes to complete the entire CBS review process (i.e., from the start of an audit or review to the resolution of system deficiencies and final determination). Our review of selected cases was not intended to be projectable to all reviews and audits conducted by DCMA and DCAA, but rather to be illustrative of the challenges that may be encountered during the review process. From the perspective of program and contracting officers, the status of a contractor’s business system may have an impact on both contract award decisions and contract monitoring, but officials stated that they can mitigate the risks associated with a disapproved system. For example, Army and Air Force program officials noted that a contractor leading certain weapon system development and logistics efforts had a deficient cost estimating system. According to the contracting officials, as the government could not rely on the contractor’s proposed costs to use a fixed-price contract, they awarded a fixed-price incentive contract for the program to better monitor the contractor’s cost reporting compared to under a fixed-price contract. DCMA and DCAA do not have a mechanism to monitor and ensure that CBS reviews and audits are conducted in a timely manner. DCAA’s data show that it conducted few business system audits in the past 6 years, due, in part, to the need for it to reduce its backlog on completing incurred cost audits. Looking to the future, DCAA has developed plans for the number of CBS audits it intends to perform over the next 3 years and expects that it will be caught up in conducting the audits for which it is responsible by fiscal year 2022. Successfully executing its plan is dependent on several factors, including the ability to shift resources from conducting incurred cost audits to business systems audits, the use of public accounting firms to perform a portion of the incurred cost audits, and the ability of DCAA auditors to use new audit plans and complete the required audits in a timely manner. For its part, DCMA relies on the offices that perform the reviews of the three systems to maintain the information on the reviews completed and to plan for future reviews, but DCMA headquarters does not centrally track its reviews or whether audits conducted by DCAA are being completed within the timeframes described in policy. DCAA officials acknowledged they have not been able to conduct audits of contractor business systems within the timeframes outlined in DCMA instructions. DCAA officials attributed their inability to do so to the need to conduct higher priority audits—such as incurred cost audits—and staffing constraints. For example, in fiscal year 2017, DCAA initially proposed to perform a total of 76 CBS audits for the three business systems in its purview. However, DCAA completed only nine audits after assessing available resources. Further, DCAA estimates that in fiscal year 2017 it spent approximately 44 percent of its resources addressing incurred cost audits, and 17 percent on other audits such as forward pricing rate agreements. In contrast, only 6 percent of its resources were devoted to business system audits and related activities. Recognizing that it cannot perform all of the required CBS audits in a timely fashion to meet current DCMA policy requirements, DCAA officials told us they focus their audits on business systems they identify as high- risk. To do so, DCAA officials consider factors such as the contractor’s current system status, the contractor size in terms of dollars on contract, the amount of cost-type contracts, organizational changes, audit requests by a DOD contracting officer or an ACO, and the types of deficiencies identified and its impact on cost and schedule. DCAA headquarters officials assess the candidates at an annual DCAA planning meeting to determine which audits can be performed given the level of resources available. DCAA officials told us, however, that the current policy requirement—which generally requires review of the systems every three years—would require DCAA to dedicate substantial resources to CBS audits to maintain currency. As of November 2018, DCAA identified 285 systems that require an audit. DCAA officials stated that a risk based approach to reviewing these systems would provide more value than a routine 3 year cycle. DCAA officials stated they are willing to work with others within DOD to develop risk factors that can be used to determine when a business system needs a review. To better assess and plan future workload, DCAA issued a memorandum in January 2017 to introduce a strategic workload resource initiative that will project workload and resource availability in the out-years. Under this process, DCAA field management teams provide information on workload projections in March, and DCAA executive level officials make workload planning recommendations in June that result in an agency-wide plan. DCAA officials noted, however, that the projection for the second year is less accurate, and as a result, the further out year projections are reviewed every six months with adjustments made as needed. DCAA officials also told us that the planning process is currently being expanded to allow the agency to plan three years out. DCAA officials stated that the fiscal year 2021 plans will be tentatively approved by the end of January 2019 and fiscal year 2022 plans will be approved by June 2019. Based on these planning efforts, DCAA plans to conduct a total of 285 CBS audits from fiscal years 2019 through 2022, including 50 audits in fiscal year 2019 and 104 in fiscal year 2020. It also plans to shift some of the hours previously devoted to incurred cost audits to CBS audits (see figure 3). Our analysis indicates that successfully executing this plan is dependent on several factors, including the ability to shift resources from conducting incurred cost audits to business systems audits, the use of public accounting firms to perform a portion of the incurred cost audits, and the ability of DCAA auditors to use new audit plans and complete the required audits in a timely manner. First, the plan is contingent upon DCAA being able to successfully shift resources from incurred cost audits to CBS audits. According to DCAA data, DCAA plans to shift more than 378,000 hours from incurred cost audits to CBS audits between fiscal years 2018 and 2020. DCAA officials noted, however, that although they have made significant progress in addressing incurred cost audits, the fiscal year 2018 NDAA requires DCAA to have all incurred cost audits performed within 12 months. DCAA officials noted that this means it will have to continue to spend significant resources on incurred cost audits in fiscal year 2019 to meet this legislative requirement. Second, DCAA officials stated that these estimates include the resources that are expected to become available to perform CBS audits as DCAA starts using public accounting firms to perform incurred cost audits. In its October 2018 report to Congress on the progress made to implement Section 803 of the Fiscal Year 2018 NDAA, DCAA estimated that public accounting firms would be able to perform 100 incurred cost audits per year for 2019 and 2020, which would then increase to 200 each year for 2021 through 2025. DCAA further projected, for example, that about 147,500 hours would become available in 2020 based on the proposed plan to use public accounting firms. DCAA officials told us they are in the process of developing a solicitation to contract for these services, which they anticipate releasing in the spring of 2019. Lastly, these plans assume that each audit conducted by DCAA can be completed within an average number of hours based on the experiences of the team that developed the revised audit plans released in 2018. DCAA officials noted that these hours assume that DCAA audit teams will experience some challenges conducting the initial set of audits, but will be able to conduct them in fewer hours as they gain more experience in implementing the new audit plans. DCAA officials told us that, if successful, this plan will enable it to be caught up on CBS reviews by 2022. For the DCMA-led reviews, DCMA relies on its functional offices that perform reviews of their respective systems to monitor the status of CBS reviews, but does not use the information to ensure that all three reviews are conducted within the timeframes established under DCMA’s instructions. The three DCMA functional offices use spreadsheets to manually track reviews their office has completed, and track data on when the next review should be scheduled. Each functional office plans and tracks this data individually. For example, The property management functional office identifies the number of contractor property systems requiring review on a monthly basis, and tracks its progress in completing these reviews. In fiscal year 2018, this functional office completed over 95 percent of the 850 property system reviews required. The EVM system functional office identifies the number of reviews that should be conducted annually. In fiscal year 2018, the office reported completion of 92 percent of the 125 required EVM system reviews. The purchasing functional office uses a rolling process to determine which systems require a review. To do this, the ACO performs a required risk assessment every 3 years to identify whether a full business system review is required and then the purchasing functional office develops a prioritization plan for the systems flagged for review. The exact number of reviews conducted in a single year is dependent upon the risk assessments; however, an official from the purchasing system functional office estimated that their office is staffed to complete approximately 125 reviews per year. The official also noted that they do track to ensure all systems are reviewed in the required timeframes. Officials from the functional offices described to us what information they provide to senior leadership, but DCMA headquarters does not collect or use this information to oversee the CBS review process. For example, a supervisor from the property management functional office told us that the office reports monthly to their supervisors on the status of their reviews and whether they are on schedule, which also serves as a method for requesting additional resources if necessary. EVM system functional officials told us they report the number of planned and completed reviews to a DCMA internal website for senior leadership to review, but did not know what senior leadership does with this information. Purchasing officials said their office provides monthly reports on the status of reviews for specific large contractors, and weekly reports of the number of reviews completed to the agency director and component heads. DCMA headquarters officials stated that they informally share information with ACOs in a variety of ways, including quarterly meetings, but headquarters officials could not provide documentation on how this information is used to monitor and assess whether CBS reviews were being conducted in accordance with the policy timeframes. Further, DCMA officials indicated that they do not formally monitor DCAA’s efforts to complete the audits for which DCAA is responsible. Despite being the agency responsible for issuing the instructions and whose ACOs are responsible for making final determinations of business system compliance, DCMA officials indicated that it is not their responsibility to monitor or assess DCAA’s efforts to complete the reviews in DCAA’s area of responsibility. DCMA and DCAA officials stated, however, that they recently began to hold quarterly meetings, during which time they can discuss CBS issues, including potential revisions to the criteria and timeframes for conducting CBS reviews. But it is uncertain what outcomes will come from this or the extent to which this will contribute to improved management of CBS reviews. According to federal standards for internal controls, an agency should use quality information to help ensure that it achieves its objectives. These internal controls also state that monitoring activities should be conducted to ensure that agency objectives are being met. Developing a mechanism to track and monitor the number of CBS reviews that are outstanding, the risk level assigned to those systems and the resources available to conduct such reviews, would help DCMA and DCAA better manage the CBS review process to ensure that contractor systems that are reviewed and approved in a timely fashion. Section 893 of the Fiscal Year 2017 NDAA amended the CBS provisions of the Fiscal Year 2011 NDAA by revising the statutory definition of a covered contractor and by allowing contractors to use registered public accounting firms to review their business systems in place of DOD’s review. As of November 2018, DOD had not yet proposed regulations to implement these legislative changes, and therefore we were unable to fully evaluate the potential effects of these provisions. The Fiscal Year 2017 NDAA did not provide a specific timeframe for DOD to revise its regulations, but the Director of the Defense Acquisition Regulation Council—who is responsible for promulgating proposed and final rule changes to the DFARS— tasked her staff to draft a proposed rule by March 2017. This deadline was subsequently extended to January 23, 2019. In November 2018, Defense Pricing and Contracting (DPC) officials told us that they now expect to issue the proposed rule for public comment in the third or fourth quarter of fiscal year 2019. DPC officials attributed this delay, in part, to a recent executive order that calls for the reduction and control of regulatory costs, as well as the complexity of having public accounting firms perform CBS reviews. Section 893 of the Fiscal Year 2017 NDAA changed the definition of covered contractors—those contractors that may require CBS reviews— from contractors subject to cost accounting standards to generally only those with contracts subject to cost accounting standards that account for more than 1 percent of their gross revenue. DPC officials stated that DOD may require contractors to self-report on their revenue levels to determine whether the contractor’s systems require review. DPC officials told us, however, that they had not yet considered certain aspects of how contractors may calculate revenues. For example, DPC officials had not yet decided whether revenue should be determined based on specific business segments, or whether it should include international sales revenue. These officials also had not yet decided how many years of revenue should be included in the analysis. Further, DPC officials could not yet estimate the potential effect of implementing this provision on contractors. Based on our analysis of publicly available contractor financial data for the 20 contractors that we reviewed, the lowest percentage of total revenue derived from government contracts was 10 percent. Section 893 of the 2017 NDAA also authorized the use of registered public accounting firms to assess compliance with DOD’s CBS requirements. Under this provision, if a registered public accounting firm certifies that a contractor’s business system meets DOD’s requirements, it would eliminate the need for further review by DOD. Some government acquisition officials we spoke with expressed concerns that would need to be addressed to effectively implement the legislation, including: Ensuring that public accounting firms have sufficient understanding of the processes or regulations to conduct the audits and provide conclusions that DOD could rely upon. Encouraging DCMA and DCAA functional experts and auditors to accept public accounting firms’ findings rather than conduct additional reviews and audits on their own, which would undermine the ability to save both government and contractor resources. Determining the potential for the cost of public accounting firm reviews being passed on to the government through the contracts of the businesses under review. The DPC official responsible for implementing this provision stated that they are aware of these concerns. He also stated that, as a first step in implementation, his office has requested that DCMA and DCAA review the criteria and audit plans used by their staff and identify areas where these criteria and plans could be adjusted to make them more consistent with criteria that public accounting firms use in the private sector. By clarifying DCMA and DCAA’s roles and responsibilities as well as the timeframes for conducting the audits, DOD has improved the CBS review process. But there are still issues that need to be addressed. DCAA acknowledges it is well behind in its efforts to complete the three CBS audits for which it is responsible but believes that it can be caught up by the end of fiscal year 2022 if significantly more resources are available. In addition, DCMA does not monitor progress of either its functional offices or of DCAA against the policies that the six systems each be reviewed generally every 3 years. This is because DOD currently lacks a mechanism based on relevant and reliable information, such as the number of CBS reviews that are outstanding, the risk level assigned to those systems, and the resources available to conduct such reviews, to ensure CBS reviews are being completed in a timely fashion. Such information could help inform more strategic oversight to determine whether the current CBS review process is achieving intended results, or whether additional changes to the timing of or criteria for conducting CBS reviews are needed. As the agency that is responsible for issuing the overarching policies that govern CBS reviews and is ultimately responsible for approving contractor business systems, DCMA is in the best position to lead the effort to develop this mechanism. As each agency is responsible for executing its mission and managing its resources, however, this effort should be conducted in collaboration with DCAA. We recommend that the Director, DCMA, in collaboration with the Director, DCAA, develop a mechanism to monitor and assess whether contractor business systems reviews are being completed in a timely manner. (Recommendation 1) DOD agreed with the recommendation. In an email, a DPC official stated that DCMA and DCAA are collaborating to determine the best way to implement the recommendation. DOD’s comments are reprinted in Appendix I. We are sending copies of this report to the appropriate congressional committees; the Acting Secretary of Defense; the Under Secretary of Defense for Acquisition and Sustainment; the Under Secretary of Defense – Comptroller; the Director, DCMA; the Director, DCAA; and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-4841 or by e-mail at dinapolit@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report were Tatiana Winger (Assistant Director), Emily Bond, Matthew T. Crosby, Suellen Foth, Sameena Ismailjee, Jean McSween, Ramzi Nemo, Miranda Riemer, Christy Smith, Roxanna Sun, Tom Twambly, and Jacqueline Wade.

Summary: Contractor business systems produce critical data that contracting officers use to help negotiate and manage defense contracts. These systems and their related internal controls act as important safeguards against fraud, waste, and abuse of federal funding. Federal and defense acquisition regulations and DOD policies require that DOD take steps to review the adequacy of certain business systems, but GAO and other oversight entities have raised questions about the sufficiency and consistency of DOD's review process. The National Defense Authorization Act for Fiscal Year 2018 contained a provision for GAO to evaluate how DOD implemented legislation intended to improve its business system review process. Among other things, this report examines (1) the changes DOD made to its review process and (2) the extent to which DOD is ensuring timely business system reviews. GAO analyzed DOD acquisition regulations, policies, and procedures for conducting contractor business system reviews and analyzed data on reviews conducted between fiscal years 2013 and 2018. Since 2011, the Department of Defense (DOD) has implemented several changes to its processes for reviewing contractor business systems—which include systems such as accounting, estimating, and purchasing. Among other changes, DOD clarified the roles and responsibilities of the Defense Contract Management Agency (DCMA) and the Defense Contract Audit Agency (DCAA)—the two agencies that are responsible for conducting the reviews; clarified timeframes for business system reviews and established criteria for business systems; and withheld payments from contractors that were found to have significant deficiencies in their business systems. DOD does not have a mechanism to monitor and ensure that these reviews are being conducted in a timely manner. For its part, DCAA has conducted few business system audits since 2013, as it focused its efforts on other types of audits. DCAA plans to significantly increase the number of business system audits over the next 4 years, but its success in doing so depends on its ability to shift resources from other audits; to use public accounting firms to conduct other, non-business system audits; and DCAA staff's ability to execute new audit plans in a timely manner. DCMA relies on the three offices responsible for conducting DCMA-led reviews to manage the reviews, but DCMA does not formally monitor whether these reviews are being conducted consistent with policy nor does it monitor DCAA's efforts to complete the audits for which it is responsible. DCMA is ultimately responsible for approving a contractor's business systems. DCMA currently lacks a mechanism based on relevant and reliable information, such as the number of reviews that are outstanding and the resources available to conduct such reviews, to ensure reviews are being completed in a timely fashion. Such information could help inform more strategic oversight on whether the current review process is achieving its intended results, or whether additional changes to the timing of or criteria for conducting reviews are needed. GAO recommends that DCMA, in collaboration with DCAA, develop a mechanism to monitor and ensure contractor business system reviews are conducted in a timely fashion. DOD concurred with the recommendation.