We found audit quality problems at DCAA offices nationwide. Of the 69 audits and cost-related assignments we reviewed, 65 exhibited serious GAGAS or other deficiencies similar to those found in our investigation, including compromise of auditor independence, insufficient audit testing, and inadequate planning and supervision. Although not as serious, the remaining four audits also had GAGAS compliance problems. In addition, while DCAA did not consider 26 of the 32 cost-related assignments we reviewed to be GAGAS audits, DCAA did not perform sufficient testing to support reported conclusions on that work. According to DCAA officials, DCAA rescinded 80 audit reports related to our prior investigation as well as the audit leading to today’s report because the audit evidence was outdated, insufficient, or inconsistent with reported conclusions and opinions and reliance on the reports for contracting decisions could pose a problem. About one third of the rescinded reports relate to unsupported opinions on contractor internal controls and were used as the basis for risk-assessments and planning on subsequent internal control and cost- related audits. Other rescinded reports relate to Cost Accounting Standards (CAS) compliance and contract pricing decisions. Because the conclusions and opinions in the rescinded reports were used to assess risk in planning subsequent audits, they impact the reliability of hundreds of other audits and contracting decisions covering billions of dollars in DOD expenditures. A management environment and agency culture that focused on facilitating the award of contracts and an ineffective audit quality assurance structure are at the root of the agencywide audit failures we identified. DCAA’s focus on a production-oriented mission led DCAA management to establish policies, procedures, and training that emphasized performing a large quantity of audits to support contracting decisions and gave inadequate attention to performing quality audits. An ineffective quality assurance structure, whereby DCAA gave passing scores to deficient audits compounded this problem. Although the reports for all 37 audits of contractor internal controls that we reviewed stated that the audits were performed in accordance with GAGAS, we found GAGAS compliance issues with all of these audits. The issues or themes are consistent with those identified in our prior investigation. Lack of independence. In seven audits, independence was compromised because auditors provided material nonaudit services to a contractor they later audited; experienced access to records problems that were not fully resolved; and significantly delayed report issuance, which allowed the contractors to resolve cited deficiencies so that they were not cited in the audit reports. GAGAS state that auditors should be free from influences that restrict access to records or that improperly modify audit scope. Insufficient testing. Thirty-three of 37 internal control audits did not include sufficient testing of internal controls to support auditor conclusions and opinions. GAGAS for examination-level attestation engagements require that sufficient evidence be obtained to provide a reasonable basis for the conclusion that is expressed in the report. For internal control audits, which are relied on for 2 to 4 years and sometimes longer, the auditors would be expected to test a representative selection of transactions across the year and not transactions for just one day, one month, or a couple of months. However, we found that for many controls, the procedures performed consisted of documenting the auditors’ understanding of controls, and the auditors did not test the effectiveness of the implementation and operation of controls. Unsupported opinions. The lack of sufficient support for the audit opinions on 33 of the 37 internal control audits we reviewed rendered them unreliable for decision making on contract awards, direct-billing privileges, the reliability of cost estimates, and reported direct cost and indirect cost rates. For example, we found that: For many controls, DCAA did not perform any testing at all. For example, audits of contractor accounting systems do not include any transaction testing. Instead, these audits focus on a review of the adequacy of contractor policies and procedures. At least six of the nine accounting audits we reviewed did not include procedures for confirming contractor segregation of allowable and unallowable cost. DCAA issued an adequate opinion on the accounting system for a major DOD contractor after performing a walkthrough of the accounting process and interviewing two employees. In billing system audits we reviewed, DCAA auditors often tested only two, three, or sometimes five transactions to support audit conclusions on contractor systems and related internal controls. Further, the auditors performed limited procedures such as determining whether the vouchers were mathematically correct and included current and cumulative billed amounts. Twenty of the 22 billing system audits we reviewed did not include tests to identify duplicate invoices. DCAA auditors reported on the adequacy of a contractor’s billing system based on tests of four vouchers, all issued on the same day. In an audit of controls over indirect and other direct cost for a business segment of one of the top five DOD contractors, DCAA auditors tested 12 out of about 22,000 transactions processed from May through July 2005. We also found that reports did not adequately disclose the criteria used in performing individual audits. According to GAGAS, audit reports should, among other matters, identify the subject matter being reported and the criteria used to evaluate the subject matter. Criteria identify the required or desired state or expectation with respect to the program or operation and provide a context for evaluating evidence and understanding the findings. None of the 37 internal control audit reports we reviewed cited specific criteria used in individual audits. Instead, the reports uniformly used boilerplate language to state that DCAA audited for compliance with the “FAR, CAS, DFARS, and contract terms.” As a result the user of the report does not know the specific Federal Acquisition Regulation (FAR), Cost Accounting Standards (CAS), or contract terms used as criteria to test contractor controls. This makes it difficult for users of the reports to determine whether the reports provide the level of assurance needed to make contracting decisions. Similarly, the 32 cost-related assignments we reviewed did not contain sufficient testing to provide reasonable assurance that overpayments and billing errors that might have occurred were identified. As a result, there is little assurance that any such errors, if they occurred, were corrected and that related improper contract payments, if any, were refunded or credited to the government. Contractors are responsible for ensuring that their billings reflect fair and reasonable prices and contain only allowable costs, and taxpayers expect DCAA to review these billings to provide reasonable assurance that the government is not paying more than it should for goods and services. We identified the following problems with these assignments. Paid voucher reviews. DCAA performs annual testing of paid vouchers (invoices) to determine if contractor voucher preparation procedures are adequate for continued contractor participation in the direct-bill program. Under the direct-bill program, contractors may submit their invoices directly to the DOD disbursing officer for payment without further review. Although DCAA does not consider its reviews of contractor paid vouchers to be GAGAS engagements, it has not determined what standards, if any, apply to these assignments. In addition, for the 16 paid voucher assignments we reviewed, we found that DCAA auditors failed to comply with DCAA Contract Audit Manual (CAM) guidance. Rather than documenting the population of vouchers, preparing sampling plans, and testing a random (statistical) sample, auditors generally did not identify the population of vouchers, did not create sampling plans, and made a small, nonrepresentative selection of as few as one or two invoices for testing to support conclusions on their work. The auditors performed limited procedures such as determining whether the vouchers were mathematically correct and included current and cumulative billed amounts. Based on this limited work, the auditors concluded that controls over invoice preparation were sufficient to support approval of the contractors’ direct billing privileges. This is of particular concern because we determined that Defense Finance and Accounting Service (DFAS) certifying officers rely on DCAA voucher reviews, and they do not repeat review procedures they believe to be performed by DCAA. Overpayment assignments. DCAA performs overpayment assignments to verify that contractors have billing procedures and internal controls in place to identify and resolve contractor billing errors and overpayments in a timely manner. DCAA guidance states that these engagements should be conducted in accordance with GAGAS to the extent applicable under the circumstances. However, none of the 10 overpayment assignments we reviewed were performed or reported as GAGAS engagements. We found that auditor judgments about the population and selection of transactions for these assignments did not provide a representative universe for testing and concluding on contractor controls over billings and payments received. For example, for the 10 assignments we assessed, the auditors selectively reviewed an accounts receivable aging report to identify overpayments and determine if they had been resolved. As a result, this work does not provide reasonable assurance that contractors have adequate controls in place to identify and correct overpayments and billing errors and make appropriate, timely refunds and adjustments. Incurred cost audits. The purpose of incurred cost audits is to examine contractors’ cost representations and opine on whether the costs are allowable, allocable to government contracts, and reasonable in accordance with the contract and applicable government acquisition regulations. DCAA performs these audits as GAGAS attestation engagements. For the four incurred cost audits we reviewed, we found that the auditors did not adequately document their judgments about control risk or the sampling and test methodologies used. In addition, we found that the auditors traced claimed pool and base costs (indirect costs) to the contractors’ accounting books and records to determine their accuracy and allowability. However, the auditors did not perform sufficient, detailed testing of claimed indirect and direct costs. For example, the auditors traced and reconciled indirect costs to contractor accounting system data, but did not test a representative selection of direct costs.