On December 19, 2008 DCAA issued new guidance for audit of and reporting on internal controls that — in two short pages of sometimes cryptic text — (a) redefines the agency’s approach to the critical concepts of "significant deficiency" and "material weakness" in internal controls and (b) establishes new criteria for auditor reports of deficiencies in large contractor internal control systems, and recommendations as to the adequacy of the contractor systems, including recommendations that the Contracting Officer pursue suspension of progress payments on reimbursement of costs.
The new guidance is contrary to prior DCAA guidance and current generally accepted government auditing standards in that it severely restricts the discretion of DCAA field auditors to exercise judgment in making determinations as to the significance of internal control deficiencies and recommendations as to the adequacy of contractor systems. DCAA’s departure from government-wide standards and its own prior procedures appears to be a hyper-defensive reaction to (a) a July 2008 GAO Report finding that DCAA management forced field auditors to change their findings relating to contractor internal control systems and related recommendations that contractor systems were inadequate and (b) resultant Congressional criticism that DCAA’s audit process was "fundamentally corrupt." 90 Federal Contracts Report 201 (July 29, 2008).
The new guidance may at first glance appear to be of small consequence to contractors. But its restriction of auditor judgment has converted the internal control audit process from one in which internal control deficiencies are to be viewed objectively as to their impact on contractor costs and operations to one in which contractor failure to accomplish any internal control objective could automatically result in a determination that the system is inadequate and a recommendation that the Contracting Officer suspend progress payments or reimbursement of costs.
The new guidance is on its face directly contrary to government-wide policy regarding the role of auditors generally and specifically in the conduct of audits of and reporting on contractor internal controls. What prompted DCAA to place itself in a position so obviously contrary to the position of the GAO in its role as guardian and arbiter of generally accepted government auditing standards? How DCAA came to this pass is discussed chronologically below.
July 2007: GAO Issues Revised GAGAS That Retain and Reinforce Field Auditor Exercise of Objective Independent Judgment As To Internal Controls
In July 2007 the GAO issued GAGAS 2007, a revision of generally accepted government auditing standards that superseded its 2003 revision. Government Auditing Standards (July 2007)("GAGAS 2007”); Government Auditing Standards (July 2003) ("GAGAS 2003").
GAGAS 2003 stated the following general standard related to professional judgment:
"Professional judgment should be used in planning and performing audits and attestation engagements and in reporting the results." (GAGAS 2003, Section 3.33) (emphasis added.)
"[s]ignificant deficiencies [as] those matters coming to the auditor’s attention that, in the auditor’s judgment, affect the results of the auditors’ work and the auditors’ conclusions and recommendations about those results" GAGAS 2003, Section 8.17, fn 91. (emphasis added.) And "[W]hen auditors detect deficiencies in internal control that are not significant, they should communicate those deficiencies in a separate letter to officials of the audited entity unless the deficiencies are clearly inconsequential considering both qualitative and quantitative factors" GAGAS 2003 Section 8.16. The standards further provide that, "[a]lthough room exists for considerable judgment in determining the content of reports, those that are fact based but concise are likely to achieve greater results. GAGAS 2003 at Section 8.54. (emphasis added.)
As to reporting on internal controls in financial audits, GAGAS 2003 provides that "[a]uditors should report deficiencies in internal control considered to be reportable conditions as defined in AICPA standards" , i.e., significant deficiencies in the design or operation of internal control that could adversely affect the entity’s ability to record, process, summarize, and report financial data consistent with the assertions of management in the financial statements. GAGAS 2003 Section 5.16, fn55 And "[a]uditors should use their professional judgment in deciding whether or how to communicate to officials of the audited entity deficiencies in internal control that are clearly inconsequential." GAGAS 2003 Section 5.16. In October 2008 the GAO issued Interim Guidance in light of certain changes AICPA had made to the definition of “significant deficiency.” This change, however, did not affect the basic concept of auditor exercise of judgment or revise the definition of significant deficiency in such a way as to remove the ability of the auditor to determine whether a "reasonable possibility" of such judgment exists.
GAGAS 2007 maintains the emphasis on independent, objective auditor judgment, retaining the basic standard of professional judgment and defining the term significant deficiency as "a deficiency in internal control, or combination of deficiencies, that adversely affects the entity’s ability to initiate authorize, record, process or report financial data…such that there is more than a remote likelihood — i.e., it is "at least reasonably possible" — that a misstatement of the entity’s financial statements will result. GAGAS 2007 at 5.11, fn 65.
March 3, 2008: Prior DCAA Internal Control Audit Guidance; Maintain Auditor Authority To Exercise Judgment As To Internal Control
On March 3, 2008, DCAA promulgated guidance on reporting internal control deficiencies that defined "significant deficiency" as "a deficiency or combination of deficiencies that (1) adversely affects contractor’s ability to initiate, authorize record, process or report …costs….(2) results in at least a reasonable possibility that unallowable costs will be charged to the Government, and (3) the potential unallowable cost is not clearly immaterial. DCAA MRD 08-PAS-011(R) (March 3, 2008). The March guidance defined "material weakness" as a significant deficiency (or combination of significant deficiencies) that results in or could result in material unallowable costs…". And it further provided that "[a]ll internal control deficiencies that result in or could result in costs being charged to Government contracts …should be reported as significant deficiencies and be considered material weaknesses, unless the potential unallowable cost is clearly immaterial."
In brief, DCAA’s guidance as of March 2008 implicitly provided that auditors were (a) to use their judgment to determine whether there was a reasonable possibility that a deficiency would cause unallowable costs to be charged to the government before identifying the deficiency as significant and (b) to use their judgment to determine whether the unallowable costs would be material before identifying a significant deficiency as a material weakness.
Similarly, with regard to auditor recommendations as to the adequacy of contractor systems, the March guidance provided that, "if significant deficiencies/material weaknesses are identified" the determination as to " [w]hether the system is adequate or inadequate or inadequate in part is a matter of auditor judgment." (italics added.)
July 2008: GAO and Congressional Criticism of DCAA Process for Audit of Internal Controls
In 2006 the GAO investigated hotline complaints alleging DCAA failures to comply with GAGAS in the conduct of 14 audits of large contractors at two locations in Southern California. The resultant GAO report issued in July 2008 was highly critical of DCAA conduct of the audits, including, for example, findings that work papers did not support audit report conclusions that internal controls for the estimating system of a major contractor were adequate because management threatened the senior auditor with personnel action if he did not delete the findings of significant deficiencies so that the estimating system could be found "adequate." In another audit, the supervisory auditor and auditor were replaced by other auditors who dropped findings of significant deficiencies and changed the draft audit opinion from "inadequate" to "adequate." GAO-85-857 Investigation of Certain Audits At Three Locations Did Not Meet Professional Standards Were Substantiated (July 2008) at 5-6.
Congressional response to the GAO Report was predictably negative, as exemplified by the response of Senator Claire McCaskill, a former Missouri state auditor, that "DCAA has been exposed as fundamentally corrupt in the way they issue audits" and that the agency has "gotten caught in what could be the biggest auditing scandal in the history of this town." 90 Federal Contract Reports 95 (July 29, 2008).
DCAA responded that it was taking the GAO findings "very seriously" and taking appropriate steps to address the matter. It did not, however, accept GAO’s findings that management had brought improper pressure to bear on field auditors and it is not clear that any disciplinary action was taken. Nevertheless, DCAA does seem to have taken the findings seriously. But DCAA’s solution to the problem of unjustified agency management interference in auditor judgment was not logical. Rather than addressing the problems by enhancing the efficacy of the agency’s own internal controls, DCAA simply removed the authority of field auditors to exercise judgment in making determinations.
The Basics of The New Guidance
The new guidance (i) "clarifies what constitutes a significant deficiency/material weakness" in contractor internal control systems by providing that contractor "failure to accomplish any control objective will or could …result in unallowable costs…even when the control objective does not have a direct relationship to charging costs to Government contracts" and therefore (ii) constitutes a significant deficiency/material weakness in contractor’s internal controls and (iii) requires the resulting audit report to identify "any significant deficiencies/material weaknesses" and to include an opinion that the contractor system under review is inadequate. (italics added.) The guidance further (iv) requires the audit report to identify the portions of the system affected by the internal control deficiencies while (v) directing a recommendation that the contracting officer disapprove the system.
The new guidance contains no reference to the current definitions of the terms "significant deficiency" and "material weakness" as set out in generally accepted government auditing standards nor to the exercise of judgment by agency auditors in making determination regarding internal controls.
No Coincidence: DCAA Issued New Guidance One Week After Effective Date of New Ethics Rule Mandating Controls "To Detect and Prevent Improper Conduct In Connection With the Award or Performance of Any Contract…"
The issuance of the new guidance just one week after the December 12, 2008 effective date of the new "Contractor Business Ethics Compliance Program and Disclosure Requirements" ("new ethics rule") is almost certainly not coincidental. The new guidance implicitly invokes the new rule’s mandate that contractors "[e]stablish and maintain specific internal controls to detect and prevent improper conduct…." by identifying "the control objective related to ethics and integrity" as an example of a control objective "not directly related to charging costs to Government contracts" but which, "if not accomplished, "creates an environment that could ultimately result in mischarging." This language suggests that DCAA issued its new guidance with a view to playing in the new "ethics and integrity" ball game by auditing the "non-financial" internal controls contractors will implement pursuant to the new ethics rule.
Click here to read the article by Louis Victorino and John Chierichella, "The FAR’s ‘Contractor Business Ethics Compliance Program and Disclosure Requirements’ Require Significant changes for All Government Contractors And Subcontractors" 50 Government Contractor Paragraph 439 (December 17, 2008).
The New Guidance Is No Mere Clarification
DCAA claims the new guidance merely clarifies previous guidance. This is no mere clarification. The new guidance so restricts the authority of DCAA auditors to exercise judgment constitutes a radical departure prior DCAA guidance and from the generally accepted government auditing standards that provide the fundamental "professional standards and guidance" applicable to all government audit agencies and their auditors. DCAA Contract Audit Manual, Chapter , Audit of Policies, Procedures, and Internal Controls Relative to Accounting and Management Systems (November 5, 2008); Government Auditing Standards , July 2007 Revision ("GAGAS 2007") at 1, 5.
The new guidance justifies this conversion with the following logical sleight of hand:
….by limiting internal control audits to major contractors, DCAA only performs audits of contractor systems that are material to Government contract costs. As a result, internal control deficiencies identified in DCAA audits will generally have an impact or potential impact to Government contract costs that is material. Therefore, a contractor’s failure to accomplish any applicable control objective should be reported as a significant deficiency/material weakness.…[and] any significant deficiencies/material weaknesses will result in an opinion that the system is inadequate
This is, of course, directly contradictory to prior DCAA procedure and practice, which provides that portions of systems can contain deficiencies that render portions of the system inadequate without requiring a finding that the entire system is inadequate. DCAA Contract Audit Manual, Section 5-110(a)(1) (November 5, 2008).
The new text actually rewrites the previous guidance and practice so that:
(a) failure to accomplish any control objective tested for in DCAA’s internal control audits," will
(b) automatically result in potential "unallowable costs charged to government contracts " which, in turn, will
(c) automatically cause the deficiency to be a "significant deficiency/material weakness," thereby
(d) minimizing auditor ability to exercise professional judgment as to the materiality of control deficiencies.
DCAA is equally misleading as to the true nature of its new guidance for reporting deficiencies in large contractor internal control systems. This guidance stipulates that:
(a) auditor identification of any significant deficiencies /material weakness in internal controls will
(b) automatically yield an auditor opinion that the entire system under review is inadequate, thereby eliminating in two sentences the long-standing requirement of the DCAA Manual that audit reports present "an over-all opinion of the system (i.e., adequate, inadequate in part, or inadequate)" DCAA Contract Audit Manual, Section 5-110(a)(1) (November 5, 2008). This opinion, in turn,
(c) automatically gives rise to a recommendation that the contracting officer disapprove the system and/or suspend payments or reimbursement of costs, thereby eliminating a related Manual requirement that the report include a "recommendation for partial or total disapproval of the [internal control] system" and, in the case of an estimating system, to "identify specific portions that should be disapproved." DCAA Contract Audit Manual, Section 5-110(a)(1), 5-1216c. (November 5, 2008). The required recommendation
(d) eliminates auditor ability to exercise professional judgment as to the adequacy of contractor internal control systems.
"Independent Professional Auditors" Reduced To Automatons
DCAA has some 3,473 auditors, of whom virtually all are college graduates, hundreds hold advanced degrees, and 1,172 are Certified Public Accountants (CPAs). www.DCAA.mil/staff Government Auditing Standards provide that these people are to be considered professionals who adhere to standards that "provide a framework for performing high-quality audit work with competence, integrity, objectivity, and independence" and who are to exercise professional judgment in performance of their audit work. Government Auditing Standards , July 2007 Revision, at 1, 5, 20.
DCAA’s new definitions and procedures effectively reduce its own staff to the status of automatons as to internal control audit determinations. That status is completely at odds with the concept of the independent auditor whose highest duty is to render objective professional judgments.
Authored by:
(202) 741-8426