Figure 1 provides an overview of CBP organizational components that had prime contractor invoice review, approval, and payment responsibilities under the original SBInet program. CBP’s Contracting Division, which is part of the Office of Administration Procurement Directorate’s Enterprise Contracting Office, was assigned SBInet program prime contractor management and administrative responsibilities, including receiving and approving or rejecting invoices. The Office of Technology Innovation and Acquisition within CBP was assigned responsibility for managing key program and contractor oversight acquisition functions associated with SBInet, such as verifying and accepting contract deliverables. This office was also to work closely with CBP’s SBI Contracting Division. Contracting officers (CO) and contracting officer’s technical representatives (COTR) in the SBI Contracting Division were assigned responsibility for reviewing invoices and maintaining contract files. The SBI Business Operations Division was responsible for providing CO-approved invoices to CBP’s National Finance Center (NFC) for processing contractor invoices for payment. In carrying out its assigned prime contractor invoice-related responsibilities under the original SBInet program, CBP relied on the FAR, HSAR, as well as DHS, CBP, and SBI program policies and procedures. The overarching policy for federal contracting is the FAR. DHS issued a supplemental regulation, HSAR, an acquisition manual for DHS contracting and, in October 2008, CBP’s SBI Contracting Division issued standard operating procedures (SOP) setting out required review, approval, and processing steps for all SBI prime contractor invoice processing. Figure 2 provides an overview of CBP’s process for reviewing, approving, and paying prime contractor invoices under the original SBInet program. CBP’s process for reviewing, approving, and paying prime contractor invoices under the original SBInet program relies on both preventative and detective controls. Generally, preventative controls are more efficient and effective than detective controls. CBP’s detective controls began with SBInet’s prime contractor submitting an invoice to the SBI Contracting Division’s CO, COTR, and CBP’s NFC for review. After reviewing the invoice, the COTR was responsible for recommending whether the CO should approve or reject the invoice. If the CO and COTR approved an invoice, the CO was to notify the SBI Business Operations Division within the Program Management Office to check for fund availability. If funds were available, CBP’s NFC was to be notified to process the invoice for payment. Further, while not required, CBP’s COs may request the Defense Contract Audit Agency (DCAA), a defense agency within the U.S. Department of Defense, to conduct an invoice review or rate verification for any invoice. In addition, CBP officials told us that the CO will always request DCAA to conduct a closeout audit (a detective control) for any task order, although this is not required. DHS’s Office of Procurement provides that the CO submit a memorandum to request a final audit for the entire IDIQ contract, or any of it delivery order, or task order components. Under the original SBInet program, CBP took actions intended to establish internal controls over contractor payments. CBP established SOPs setting out required contractor invoice review, approval, and processing steps for CBP’s COs and COTRs to follow. These procedures were based on requirements in the FAR. We identified the need to improve CBP’s controls in two important areas. Specifically, we identified the need to improve CBP’s preventative controls over payments to the SBInet program contractor with respect to requiring invoices with sufficiently detailed data supporting billed costs to facilitate effective invoice review and specific, sufficiently detailed, risk-based invoice review procedures to enable full, effective, and documented reviews prior to making payments. Because CBP’s preventative controls were not fully effective, the agency will continue to (1) be impaired in its ability to provide assurance that the estimated $780 million already paid the prime contractor under the original SBInet program was proper and allowable, in the correct amount, and only for goods and services provided and (2) rely heavily on detective controls (primarily contract closeout audits) for assurance concerning the propriety of SBInet program disbursements. Further, until CBP takes action to improve its preventative controls, it will continue to be impaired in its ability to effectively review the estimated $80 million obligated, but yet to be disbursed, to the prime contractor under the original SBInet program. In addition, our findings have implications as possible “lessons learned” for DHS to consider and address as appropriate in designing and implementing contract payment controls for its new technology portfolio approach. Standards for Internal Control in the Federal Government and related guidance provide that an entity’s internal controls should enable it to verify that ordered (invoiced) goods and services were proper and met the government’s specifications. CBP’s policies and related SOPs applicable to the original SBInet program required the prime contractor to submit invoices showing total costs incurred by cost element (i.e., direct labor, direct materials, major subcontracts, other direct costs, overtime premium, overhead, travel, and general and administrative expenses). However, CBP’s policies and procedures did not require the invoices to include any additional supporting detail. Not requiring such detail not only precluded us from testing whether invoiced costs complied with the SBInet contract and were properly supported, but, more important, resulted in numerous instances in which CBP’s COs and COTRs did not have the detailed support they needed to effectively review the SBInet contractors’ invoices. For example, in one instance a CO requested additional detailed information such as travel dates and travel destinations to review the reasonableness of a lump sum invoiced cost amount for travel. Figure 3 shows an example of a SBInet prime contractor invoice submitted and paid for costs incurred for the period from September 12 through 25, 2008. Figure 3 also highlights lump sum invoiced costs for the “Direct Labor” and “Travel” cost elements. In this example, the SBInet prime contractor billed, and CBP paid, a total of $3,705,718.70, including $1,518,873.38 for the period for direct labor without any supporting details such as the hours worked and labor rate category. Supporting details are necessary to allow reviewing officials to determine, for example, whether the appropriate rate was charged and to assess the reasonableness of the hours charged. Similarly, for the $108,148.57 billed for travel for the period, the contractor did not provide supporting details necessary for a reviewing official to assess the amount claimed, such as the purpose of the trip and travel destination. Supporting details help CBP’s COs and COTRs assess the propriety of invoice cost elements billed to the government, and effectively review the prime contractor’s invoices. Lacking sufficiently detailed data supporting the original SBInet contractor’s invoiced costs, we were unable to determine whether the 99 invoices we sampled for review were proper and in compliance with original SBInet program contract provisions. Our review identified numerous instances of CBP CO and COTR frustration when they were unable to obtain detail to support SBInet contractor lump sum invoiced costs, despite repeated requests. The SBInet prime contractor denied these requests on the basis that CBP’s policies did not require supporting detail. CBP paid the invoiced amounts in all cases. In November 2009, CBP requested, and the SBInet prime contractor began providing, some additional information with its invoices submitted under the original SBInet program task orders. For example, the prime contractor included additional information on work performed for the invoice period. However, the additional information the contractor provided did not include sufficient additional detail needed to support an effective review of invoiced costs, such as hours worked, labor rate category, purpose of travel, or travel destination. CBP could have relied on a provision of the contract to obtain additional support for lump sum invoiced costs. That is, as authorized by the contract’s Allowable Cost and Payment Clause (FAR 52.216-7 (a) (1)), CBP could have required the SBInet contractor to provide, in such form and with reasonable details, support for lump sum invoiced cost element claims. CBP and SBI Contracting Division management officials told us they were aware of their ability to obtain supplemental detailed supporting cost information under the FAR Allowable Cost and Payment clause. However, they also told us that CBP made a business decision for the overall SBI program (including the original SBInet program) not to request such detailed supporting data from its prime contractor, but rather to rely on other oversight mechanisms (such as closeout audits) to help identify any contractor billing issues. Closeout audits are less effective as a control to identify or correct any contractor payment issues because they may not be conducted until a number of years after completion of a contract. The contractor’s ability to repay any improper payments may deteriorate, responsible prime contractor officials may change, their memories may fade, or needed supporting data may be lost. As provided by Standards for Internal Control in the Federal Government, well-developed and consistently implemented policies and procedures are critical in providing reasonable assurance that management’s directives are carried out and program risks, such as the risk of improper payments, are minimized.