GAO-09-468 DCAA Audits: Widespread Problems with Audit Quality Require Significant Reform

GAO

United States Government Accountabilit

Office

Report to the Committee on Homeland

Security and Governmental Affairs,

U.S. Senate

DCAA AUDITS

Widespread Problems

with Audit Quality

Require Significant

Reform

September 2009

GAO-09-468

What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

September 2009

DCAA AUDITS

Widespread Problems with Audit Quality Require

Significant Reform

Highlights of GAO-09-468, a report to the

Committee on Homeland Security and

Governmental Affairs, U.S. Senate

The Defense Contract Audit

Agency (DCAA) under the

Department of Defense (DOD)

Comptroller plays a critical role in

contractor oversight by providing

auditing, accounting, and financial

advisory services in connection

with DOD and other federal agency

contracts and subcontracts.

Last year, GAO found numerous

problems with DCAA audit quality

at three locations in California,

including the failure to meet

professional auditing standards.

This report addresses audit quality

issues at DCAA offices nationwide.

GAO was asked to (1) conduct a

broad assessment of DCAA’s

management environment and

audit quality assurance structure,

(2) evaluate DCAA actions to date

to correct previously identified

problems, and (3) identify potential

legislative and other actions for

improving DCAA effectiveness and

independence. To achieve these

objectives, GAO analyzed DCAA’s

mission, strategic plan, audit

policies, and quality assurance

program; conducted interviews;

reviewed selected audits at DCAA

offices; and analyzed legislative

and other actions.

What GAO Recommends

GAO makes 17 recommendations

to DOD and the DOD Inspector

General (IG) to improve DCAA’s

management environment, audit

quality, and oversight. GAO also

discusses matters that Congress

should consider to enhance the

effectiveness and independence of

DCAA contract audits. DOD and

DOD IG generally agreed with

GAO’s recommendations,

concurring with all but two.

GAO found audit quality problems at DCAA offices nationwide, including

compromise of auditor independence, insufficient audit testing, and

inadequate planning and supervision. GAO’s conclusions stem from a review

of 69 audit assignments supporting contract award and administrative

decisions; an assessment of DCAA’s audit quality assurance structure, which

found similar audit quality problems but gave satisfactory ratings to deficient

audits; and DCAA’s rescission of 80 problem audit reports. The rescinded

audits supported decisions on pricing and contract awards and impacted the

planning and reliability of hundreds of other DCAA audits, representing

billions of dollars in DOD expenditures. GAO findings include the following.

Selected Details of Audits GAO Reviewed

Contractor Audit Significant case study issues

Research and

development

grantee

Billing

system

• DCAA auditors spent 530 hours to support an audit of a

nonexistent billing system and reported adequate system controls.

• Instead, DCAA should have relied on the Single Audit Act report on

the grantee’s cash management system. DCAA agrees.

Combat

systems

Billing

system

• This was a new system and therefore high risk, but auditors

deleted key audit steps related to contractor policies and internal

controls over progress payments without explanation.

• One auditor told GAO he did not perform detailed tests because

“the contractor would not appreciate it.”

• DCAA allowed the contractor 7 months to address 6 significant

deficiencies, dropping 2 and downgrading the other 4.

• DCAA rescinded this audit report following GAO’s review.

Iraq

reconstruction

Accounting

system

• Contractor objected to draft report, which included 8 significant

deficiencies in the accounting system.

• Auditors dropped 5 significant deficiencies and downgraded 3

others to suggestions to improve without performing new work.

• Supervisory auditors directed audit staff to delete some audit

documents, generate others, and in one case, copy the signature

of a prior supervisor onto new documents making it appear that the

prior supervisor had approved a revised risk assessment.

• Supervisory auditor who approved altered documents was later

promoted to western region quality assurance manager, where he

served as quality control check over thousands of audits.

Source: GAO.

GAO found DCAA’s management environment and quality assurance structure

were based on a production-oriented mission that put DCAA in the role of

facilitating DOD contracting without also protecting the public interest. DCAA

has taken several positive steps. However, DOD and DCAA have not yet

addressed fundamental weaknesses in DCAA’s mission, strategic plan,

metrics, audit approach, and human capital practices that had a detrimental

effect on audit quality.

To improve DCAA oversight, the DOD Comptroller requested Defense

Business Board and “tiger team” reviews and established a DCAA Oversight

Committee. In addition, in the short-term, Congress could provide DCAA with

certain legislative protections and authorities similar to those available to IGs.

In the longer term, Congress may wish to consider organizational changes to

elevate DCAA to a component agency reporting to the Deputy Secretary or to

establish an independent governmentwide contract audit agency.

View GAO-09-468 or key components.

For more information, contact Gregory Kutz at

(202) 512-6722 or kutzg@gao.gov.

Page i GAO-09-468

Contents

Letter 1

Background 5

Nationwide Audit Quality Problems Are Rooted in DCAA’s Poor

Management Environment 14

DCAA Has Made Progress, but Correcting Fundamental Problems

in Agency Culture That Have Impacted Audit Quality Will

Require Sustained Leadership 42

Legislative and Other Actions To Improve DCAA’s Effectiveness

and Independence 61

Conclusions 69

Recommendations for Executive Action 70

Matters for Congressional Consideration 72

Agency Comments and Our Evaluation 73

Appendix I Internal Control System Audits Did Not Meet

Professional Standards 83

Appendix II DCAA Does Not Perform Sufficient Work to Identify

and Collect Contractor Overpayments 100

Appendix III Objectives, Scope, and Methodology 105

Appendix IV Comments from the Department of Defense 113

Appendix V Comments from the Department of Defense Inspector

General 143

Tables

Table 1: Examples of DCAA Audit and Nonaudit Services 10

Table 2: Summary of Five Selected Internal Control Audits 20

Table 3: Summary of Five Selected Cost-Related Assignments 28

Table 4: Summary of Selected DCAA Audit Quality Review Results 34

DCAA Audit Environment

Table 5: GAGAS Noncompliance on 37 Selected Audits of

Contractor Controls 84

Table 6: Case Studies of Problem DCAA Cost-Related Assignments 103

Table 7: Summary of DCAA Audits Reviewed for GAGAS

Compliance 107

Table 8: Summary of DCAA Cost-Related Audits Reviewed 108

Figures

Figure 1: DCAA Opinions on Contractor Internal Control Systems

Audits 18

Figure 2: Comparison of DOD Contract Obligations and DCAA

Workforce for Fiscal Years 2002 through 2008 53

Figure 3: DCAA Questioned Costs and Amounts Sustained by

Contracting Officers 102

Abbreviations

AICPA American Institute of Certified Public Accountants

AT AICPA Statements on Attestation Standards

AT&L Acquisition, Technology, and Logistics

APO Audit Policy and Oversight (a Defense Inspector General

organization)

AU AICPA Statements on Auditing Standards

CAS Cost Accounting Standards

CAM Contract Audit Manual, also referred to as the DCAA Contract

Audit Manual, or DCAM

CFO Chief Financial Officer

COSO Committee on Sponsoring Organizations

DBB Defense Business Board

DCAA Defense Contract Audit Agency

DCAM DCAA Contract Audit Manual

DCMA Defense Contract Management Agency

DFARS Defense Federal Acquisition Regulation Supplement

DFAS Defense Finance and Accounting Service

DFMR Defense Financial Management Regulation

DOD Department of Defense

DPAP Director of Defense Procurement Policy

FAO field audit office

FAR Federal Acquisition Regulation

Page ii GAO-09-468 DCAA Audit Environment

FLA Financial Liaison Advisor

FMR Financial Management Regulation, also referred to as the

Defense Financial Management Regulation, or DFMR

GAGAS generally accepted government auditing standards

GAS Government Auditing Standards

GPRA Government Performance and Results Act

GS General Schedule

IG Inspector General

IGDH Inspector General, Defense Handbook

OIG Office of Inspector General

PCIE President’s Council on Integrity and Efficiency, renamed the

Council of the Inspectors General on Integrity and Efficiency

SAS AICPA Statements on Auditing Standards

SES Senior Executive Service

SIGIR Special Inspector General for Iraq Reconstruction

SSAE AICPA Statements on Standards for Attestation Engagements

USC United States Code

USD Under Secretary of Defense

This is a work of the U.S. government and is not subject to copyright protection in the

United States. The published product may be reproduced and distributed in its entirety

without further permission from GAO. However, because this work may contain

copyrighted images or other material, permission from the copyright holder may be

necessary if you wish to reproduce this material separately.

Page iii GAO-09-468 DCAA Audit Environment

Page 1 GAO-09-468

United States Government Accountability Office

Washington, DC 20548

September 23, 2009

The Honorable Joseph I. Lieberman

Chairman

The Honorable Susan M. Collins

Ranking Member

Committee on Homeland Security and

Governmental Affairs

United States Senate

The Honorable Claire C. McCaskill

Chairman

Subcommittee on Contracting Oversight

Committee on Homeland Security and

Governmental Affairs

United States Senate

This report addresses audit quality problems and independence issues at

the Defense Contract Audit Agency (DCAA). In a September 2008 hearing

before the Committee, we testified

that DCAA failed to meet professional

audit standards at three locations in California. Specifically, we found that

the audit documentation for 14 selected audits at two locations did not

support reported opinions, that DCAA supervisors dropped findings and

changed audit opinions without adequate audit evidence for their changes,

and that sufficient audit work was not performed to support audit

opinions and conclusions. Further, we found that contractor officials and

the Department of Defense (DOD) contracting community improperly

influenced the audit scope, conclusions, and opinions of several audits,

including forward pricing audits at a third location—a serious

independence issue. During our investigation, DCAA managers took

actions against their staff at two locations that served to intimidate

auditors and create an abusive work environment. For example, we

learned of verbal admonishments, reassignments, and threats of

disciplinary action against auditors who spoke with or contacted our

investigators, DOD investigators, or DOD contracting officials.

GAO, DCAA Audits: Allegations That Certain Audits at Three Locations Did Not Meet

Professional Standards Were Substantiated, GAO-08-993T (Washington, D.C.: Sept. 10,

2008).

DCAA Audit Environment

At the time of the September 2008 hearing, we were conducting a broad

assessment of DCAA’s management environment and audit quality

assurance structure at DCAA offices nationwide. Given the evidence

presented at this hearing, you requested that we expand our ongoing

assessment. This report therefore presents (1) an assessment of DCAA’s

management environment and quality assurance structure; (2) an analysis

of DCAA’s corrective actions in response to our July 2008 report,

the

Under Secretary of Defense (Comptroller/Chief Financial Officer)

“tiger

team” review,

and the Defense Business Board study;

and (3) potential

legislative and other actions that could improve DCAA’s effectiveness and

independence.

To assess DCAA’s overall management environment and quality assurance

structure, we analyzed DCAA’s mission statement and strategic plan,

performance metrics, policies and audit guidance, and system of quality

control. We also reviewed audit documentation for selected audits at

certain field audit offices (FAO) in each of DCAA’s five regions for

compliance with generally accepted government auditing standards

(GAGAS)

and other applicable standards. We selected 37 audits of

contractor internal control systems performed by seven geographically

disperse DCAA field offices within the five DCAA regions during fiscal

years 2004 through 2006.

These were the most recently completed fiscal

years at the time we initiated our audit. Our approach focused on DCAA

offices that reported predominately adequate, or “clean,” opinions on

audits of contractor internal controls over cost accounting, billing, and

GAO, DCAA Audits: Allegations That Certain Audits at Three Locations Did Not Meet

Professional Standards Were Substantiated, GAO-08-857 (Washington, D.C.: July 22, 2008).

Hereafter referred to as the DOD Comptroller/CFO.

Under Secretary of Defense—Comptroller, Memorandum for Director Defense Contract

Audit Agency, Subject: Implementation of Corrective Actions, (Washington, D.C.: Aug. 20,

2008).

Defense Business Board, Report to the Secretary of Defense: Independent Review Panel

Report on the Defense Contract Audit Agency, October 2008.

GAO, Generally Accepted Government Auditing Standards, GAO-03-673G (Washington,

D.C.: June 2003) and GAO-07-731G (Washington, D.C.: July 2007).

In the case of follow-up audits, we also reviewed the documentation for the previous audit

to gain an understanding of the scope of work and deficiencies identified in the prior audit.

Page 2 GAO-09-468 DCAA Audit Environment

cost estimating systems issued in fiscal years 2005 and 2006.

We selected

DCAA offices that report predominately adequate opinions on contractor

systems and related internal controls because contracting officers rely on

these opinions for three or more years to make decisions on pricing and

contract awards, and payment. For example, audits of estimating system

controls support negotiation of fair and reasonable prices.

Also, the FAR

requires contractors to have an adequate accounting system prior to award

of a cost-reimbursable or other flexibly priced contract.

Billing system

internal control audit results support decisions to authorize contractors to

submit invoices directly to DOD and other federal agency disbursing

offices for payment without government review.

In addition, DCAA uses

the results of internal control audits to assess risk and plan the nature,

extent, and timing of tests for other contractor audits and other

assignments. When a contractor has received an adequate opinion on its

systems and related controls, DCAA would assess the risk for subsequent

internal control and cost-related audits as low and would perform less

testing on these audits. Although our selection of the seven offices and 37

internal control audits was not statistical, it represented about 9 percent of

the total 76 DCAA offices that issued audit reports on contractor internal

controls and nearly 18 percent of the 40 offices that issued 8 or more

reports on contractor internal controls during fiscal year 2006. Of the 37

internal control audits we reviewed, 32 reports were issued with adequate

opinions and 5 reports were issued with inadequate-in-part opinions.

At the same seven DCAA field offices, we selected an additional 32 paid

voucher, overpayment, request for equitable adjustment, and incurred cost

assignments that were completed during fiscal years 2004 through 2006 for

review of supporting documentation to determine whether DCAA auditors

were identifying and reporting contractor overpayments and billing

In selecting the seven DCAA offices, we considered a 2-year history of internal control

audit results. The seven DCAA offices we selected reported adequate opinions on 89

percent or more of the internal control reports they issued during fiscal year 2006. During

fiscal year 2005, 4 of the 7 offices reported adequate opinions in 85 percent or more of the

internal control reports they issued, and the other 3 offices issued adequate opinions in 50

to 69 percent of the internal control audit reports they issued.

DCAA, Contract Audit Manual (CAM) 5-1202.1a and Defense Federal Acquisition

Regulation Supplement (DFARS) 215.407-5.

FAR §§ 16.104(h) and 16.301-3(a)(1).

FAR § 42.101 and DFARS § 242.803.

Page 3 GAO-09-468 DCAA Audit Environment

errors.

In total, we reviewed 69 DCAA audits and cost-related

assignments.

To address our second objective, we assessed the status

and analyzed several key actions that DCAA initiated as a result of our

earlier investigation, including changes in performance metrics and policy

and procedural guidance, as well as DCAA efforts in response to DOD

Comptroller/CFO and Defense Business Board

recommendations. To

achieve our third objective to identify potential legislative and other

actions that could improve DCAA’s effectiveness and independence, we

considered DCAA’s current role and responsibilities; the framework of

statutory authority for auditor independence in the Inspector General Act

of 1978, as amended;

best practices of leading organizations that have

made cultural and organizational transformations; our past work on DCAA

organizational alternatives; GAGAS criteria for auditor integrity,

objectivity, and independence; and GAO’s Standards for Internal Control

In the Federal Government

on managerial leadership and oversight.

Throughout our audit, we met with the DCAA Director and DCAA

headquarters policy, quality assurance, and operations officials and DCAA

region and FAO managers, supervisors, and auditors. We also met with

DOD Office of Inspector General (OIG) auditors responsible for DCAA

audit oversight and DOD OIG hotline office staff. We conducted this

performance audit from August 2006 through December 2007, at which

time we suspended this work to complete our investigation of hotline

complaints regarding audits performed at three DCAA field offices. We

resumed our work on this audit in October 2008 and performed additional

Contractor overpayments can occur as a result of errors made by paying offices, such as

duplicate payments and payments in excess of amounts billed, and contractor billing

errors, such as using the wrong overhead rate, failing to withhold designated amounts on

progress payments, duplicate billings, or billing for unallowable cost. Recoveries of

overpayments can be accomplished through refunds, subsequent billing offsets, or other

adjustments to correct billing errors.

Although we selected 73 assignments for review, two internal control assignments were

assist audits and two cost related assignments were not completed assignments. As a

result, we did not consider these four assignments in our analysis, and we discuss the

results of our analysis of the 69 completed assignments that we reviewed.

On August 19, 2008, at the request of the DOD Defense, Comptroller, the Deputy

Secretary of Defense established an independent review panel under the Defense Business

Board (DBB) to review DCAA operations and make recommendations for improvements.

Codified in an appendix to Title 5 of the United States Code (hereafter 5 U.S.C. App.).

GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1

(Washington, D.C.: November 1999).

Page 4 GAO-09-468 DCAA Audit Environment

work through mid-September 2009 to evaluate DCAA’s quality assurance

program during fiscal years 2007 and 2008, assess DCAA corrective actions

on identified audit quality weaknesses, and consider legislative and

organizational placement options. During our assessment of DCAA

corrective actions and analysis of legislative and organizational placement

options for DCAA, we met with the former DOD Comptroller/CFO to

discuss plans for Office of Comptroller/CFO and Defense Business Board

reviews, and we continued to meet with and obtain information from the

new DOD Comptroller/CFO and his staff. We also met with Comptroller’s

new DCAA Oversight Committee, which includes the Auditors General of

the Army, the Navy, and the Air Force; the DOD Director of Defense

Procurement and Acquisition Policy; and the DOD Deputy General

Counsel for Acquisition. We obtained DOD and DOD OIG comments on a

draft of this report. DOD and DOD IG comments are summarized in the

Agency Comments and Our Evaluation section of this report. DOD

comments are reprinted in appendix IV and DOD OIG comments are

reprinted in appendix V. We conducted our audit in accordance with

generally accepted government auditing standards. Those standards

require that we plan and perform the audit to obtain sufficient, appropriate

evidence to provide a reasonable basis for our findings and conclusions

based on our audit objectives. We believe that the evidence obtained

provides a reasonable basis for findings and conclusions based on our

audit objectives. We performed our investigative procedures in

accordance with quality standards set forth by the Council of the

Inspectors General on Integrity and Efficiency (formerly the President’s

Council on Integrity and Efficiency). A detailed discussion of our

objectives, scope, and methodology is included in appendix III.

DOD contract management continues to be a high-risk area for the

government.

With hundreds of billions of taxpayer dollars at stake,

strong controls are needed to provide reasonable assurance that contract

funds are not lost to fraud, waste, abuse, and mismanagement. Downsizi

of contract administration personnel during the 1990s coupled wit

increased contract spending since 2000 have exacerbated the risks

associated with DOD contract management. Our work continues to

Background

GAO, High-Risk Series: An Update, GAO-09-271 (Washington, D.C.: January 2009).

Page 5 GAO-09-468 DCAA Audit Environment

identify significant problems with federal agency contract payments

and

contract management.

DCAA is charged with a critical role in DOD contractor oversight by

providing auditing, accounting, and financial advisory services in

connection with the negotiation, administration, and settlement of

contracts and subcontracts. DCAA also performs contract audit services

and payment reviews for other federal agencies, as requested, on a fee-for-

service basis. DCAA contract audit services are intended to be a key

control to help assure that prices paid by the government for needed

goods and services are fair and reasonable and that contractors are

charging the government in accordance with applicable laws, regulations

(e.g., Federal Acquisition Regulation (FAR) and Defense Federal

Acquisition Supplement (DFARS), standards (e.g., Cost Accounting

Standards (CAS)), and contract terms.

DCAA is headed by a director who reports to the Under Secretary of

Defense (Comptroller/CFO). DCAA’s placement provides the DOD

Comptroller/CFO with access to financial information on defense

contracts and allows the Comptroller/CFO to make this information

available to the Secretary and Deputy Secretary of Defense. In addition, it

permits the Comptroller/CFO to elevate policy issues concerning the

scope of DCAA’s authority and level of resources. The DCAA Director is

GAO, Global War on Terrorism: DOD Needs to More Accurately Capture and Report the

Costs of Operation Iraqi Freedom and Operation Enduring Freedom, GAO-09-302

(Washington, D.C.: Mar. 17, 2009); Centers for Medicare and Medicaid Services: Internal

Control Deficiencies Resulted in Millions of Dollars of Questionable Contract Payments,

GAO-08-54 (Washington, D.C.: Nov. 15, 2007); Defense Contract Management: DOD’s Lack

of Adherence to Key Contracting Principles on Iraq Oil Contract Put Government

Interests at Risk, GAO-07-839 (Washington, D.C.: July 31, 2007); Hanford Waste Treatment

Plant: Department of Energy Needs to Strengthen Controls over Contractor Payments

and Project Assets, GAO-07-888 (Washington, D.C.: July 20,2007); Iraq Contract Costs:

DOD Consideration of Defense Contract Audit Agency’s Findings, GAO 06-1132

(Washington, D.C. Sept. 25, 2006); Department of Energy, Office of Worker Advocacy:

Deficient Controls Led to Millions of Dollars in Improper and Questionable Payments to

Contractors, GAO-06-547 (Washington, D.C.: May 31, 2006); and Federal Bureau of

Investigation: Weak Controls over Trilogy Project Led to Payment of Questionable

Contractor Costs and Missing Assets, GAO-06-306 (Washington, D.C.: Feb. 28, 2006).

GAO, Defense Acquisitions: Assessments of Selected Weapon Programs, GAO-09-326SP

(Washington, D.C.: Mar. 30, 2009); Defense Management: Actions Needed to Overcome

Long-standing Challenges with Weapon Systems Acquisition and Service Contract

Management, GAO-09-362T (Washington, D.C.: Feb. 11, 2009); and Defense Acquisitions:

DOD’s Increased Reliance on Service Contractors Exacerbates Long-standing Challenges,

GAO-08-621T (Washington, D.C.: Jan. 23, 2008).

Page 6 GAO-09-468 DCAA Audit Environment

responsible for day-to-day management of DCAA, development of strategic

plans, audit guidance and procedures, and the quality of DCAA’s audit

services. DCAA’s Contract Audit Manual (CAM)

prescribes the

standards, policies, and techniques to be followed by DCAA personnel in

conducting contract audits. DCAA emphasizes and supplements CAM

guidance through policy memorandums and other written notices, as well

as through training and oral communications.

The IG Act gives the DOD IG broad responsibilities to provide policy

direction for and to conduct, supervise, and coordinate audits and

investigations in DOD and in contractor operations, if warranted. DOD IG

duties pertaining to DCAA include (1) providing policy direction for all

DOD audits; (2) investigating fraud, waste, and abuse uncovered as a

result of audits; (3) monitoring and evaluating adherence by all DOD

auditors to audit policies, procedures, and standards; and (4) requesting

assistance as needed from other auditors in DOD. As part of its audit

policy and oversight responsibilities, the DOD IG reviews DCAA’s system

of audit quality control on a 3-year basis that is intended to meet the

requirements under GAGAS for a peer review.

DCAA History and

Organizational Structure

Audits of military contracts can be traced back to at least the World War I

era. Initially, the various branches of the military had their own contract

audit function and associated instructions and accounting rulings.

Contractors and government personnel recognized the need for

consistency in both contract administration and audit. The Navy and the

Army Air Corps made the first attempt to perform joint audits in 1939. By

December 1942, the Navy, the Army Air Corps, and the Ordnance

Department had established audit coordination committees for selected

areas where plants were producing different items under contracts for

more than one service. On June 18, 1952, the three military services jointly

issued a contract audit manual that later became the DCAA CAM.

In May 1962, Secretary of Defense Robert S. McNamara instituted “Project

60” to examine the feasibility of centrally managing the field activities

DCAA, Contract Audit Manual (CAM), DCAAM 7640.1.

Page 7 GAO-09-468 DCAA Audit Environment

concerned with contract administration and audit.

An outcome of this

study was the decision to establish a single contract audit capability within

DOD and DCAA was established on June 8, 1965.

At that time, DCAA’s

mission to perform all necessary contract audits for DOD and provide

accounting and financial advisory services regarding contracts and

subcontracts to all DOD components responsible for procurement and

contract administration was established. The former Deputy Comptroller

of the Air Force was selected as the DCAA Director and the former

Director of Contract Audit for the Navy, was selected as the Deputy

Director. DCAA was placed under management control of the Under

Secretary of Defense (Comptroller), where it remains today.

DCAA consists of a headquarters office at Fort Belvoir, Virginia, and six

major organizational components—a field detachment office, which

handles audits of classified contracting activity, and five regional offices

within the United States. The regional offices manage field audit offices

(FAO), which are identified as branch offices, resident offices, or

suboffices. Resident offices are located at larger contractor facilities in

order to facilitate DCAA audit work. In addition, regional office directors

can establish suboffices as extensions of FAOs to provide contract audit

services more economically. A suboffice depends on its parent FAO for

release of audit reports and other administrative support. In total, there

are more than 300 FAOs and suboffices throughout the United States and

overseas. During fiscal year 2008, DCAA employed about 3,600 auditors at

more than 300 FAOs throughout the United States, Europe, the Middle

East, and in the Pacific to perform audits and provide nonaudit services in

support of contract negotiations related to approximately 10,000

contractors.

DCAA Audit and Nonaudit

Services

DCAA’s mission encompasses both audit and nonaudit services in support

of DOD contracting and contract payment functions. FAR subpart 42.1,

“Contract Audit Services,” and DOD Directive 5105.36, Defense Contract

Project 60 also resulted in consolidation of the military services’ contract management

activities under the Defense Contract Management Agency (DCMA), formerly the Defense

Contract Management Command (DCMC) within the Defense Logistics Agency. On March

27, 2000, DCMC was established as DCMA under the authority of the Under Secretary of

Defense (Acquisition, Technology, and Logistics).

DOD, General Plan: Consolidation of Department of Defense Contract Audit Activities

into the Defense Contract Audit Agency (Feb. 17, 1965).

Page 8 GAO-09-468 DCAA Audit Environment

Audit Agency (DCAA), establish DCAA as the department’s contract audit

agency

and set forth DCAA’s responsibilities.

FAR 42.101 prescribes contract audit responsibilities as submitting

information and advice to the requesting activity, based on the analysis of

contractor financial and accounting records or other related data as to the

acceptability of the contractors’ incurred and estimated costs; reviewing

the financial and accounting aspects of contractor cost control systems;

and, performing other analyses and reviews that require access to

contractor financial and accounting records supporting proposed and

incurred costs. DOD Directive 5150.36 lists several responsibilities and

functions that shall be performed by the DCAA Director,

including:

• “Assist in achieving the objective of prudent contracting by providing

DOD officials responsible for procurement and contract

administration

with financial information and advice on proposed or

existing contracts and contractors, as appropriate.”

• “Audit, examine, and/or review contractors’ and subcontractors’

accounts, records, documents, and other evidence; systems of internal

control; [and] accounting, costing, and general business practices and

procedures; to the extent and in whatever manner is considered

necessary to permit proper performance of other functions ….” These

other functions cover contract audit and nonaudit services. In addition,

the Directive states that the DCAA Director shall perform such other

functions as may be assigned by the Secretary and Deputy Secretary of

Defense or the Under Secretary of Defense (Comptroller/CFO).

• “Approve, suspend, or disapprove costs on reimbursement vouchers

received directly from contractors, under cost-type contracts,

transmitting the vouchers to the cognizant Disbursing Officer.”

DCAA uses the term audit to refer to a variety of evaluations of various

types of data.

In fiscal year 2008, DCAA reported that over 97 percent of

its service work hours were spent on audits, meaning that DCAA has opted

to provide nearly all of its services to the contracting and finance

DODD 5105.36, paragraph 4.2, reissued on February 28, 2002.

DODD 5105.36, paragraphs 5.1 through 5.14.

Contract administration responsibilities are set forth in FAR Subparts 42.2 and 42.3.

CAM 2-001.

Page 9 GAO-09-468 DCAA Audit Environment

communities under applicable auditing standards, as discussed below.

Table 1 lists several audit and nonaudit services provided by DCAA during

the three phases of the contracting process—pre-award, contract

administration, and close-out—and cites the statutory and regulatory

provisions that authorize or establish the need to have DCAA perform the

service. DCAA audits also support the contract payment process both

directly and indirectly. For example, audits of contractor incurred cost

claims and voucher reviews directly support the contract payment process

by providing the information necessary to certify payment of claimed

costs.

Other audits of contractor systems, including audits of contractor

internal controls, CAS compliance, and defective pricing, indirectly

support the payment process by providing assurance about contractor

controls over cost accounting, cost estimating, purchases, and billings that

the agency may rely upon when making contract decisions, such as

determinations of reasonable and fair prices on negotiated contracts. For

example, an accounting system deemed to be adequate by a DCAA audit

permits progress payments based on costs to be made without further

audit.

Table 1: Examples of DCAA Audit and Nonaudit Services

Payment support

Contract phase and

assignment Audit and Nonaudit services

Contracting

support Direct Indirect

Pre-award phase:

Accounting system

Audit: DCAA determines adequacy of the contractor’s accounting

system prior to award of a cost-reimbursable or other flexibly

priced contract. FAR § 16.301-3(a)(1).

X X

Contractor accounting

disclosure statements

Audit: DCAA reviews the contractor’s Disclosure Statement for

adequacy and CAS compliance and determines whether the

contractor’s Disclosure Statement is current, accurate, and

complete. DCAA also reviews Disclosure Statements during the

post award phase if contractors revise them. FAR §§ 30.202-6(c),

30.202-7 and 30.601(c).

X X

Estimating system

Audit: DCAA determines adequacy of contractor estimating

systems. FAR § 15.407-5 and DFARS § 252.215-7002(d), (e).

X X

Disbursing officers are authorized to make payments on the authority of a voucher

certified by an authorized certifying officer, who is responsible for the legality, accuracy,

and propriety of the payment. 31 U.S.C. §§ 3325, 3521(a), and 3528(a).

FAR § 32.503-4.

Page 10 GAO-09-468 DCAA Audit Environment

Payment support

Contract phase and

assignment Audit and Nonaudit services

Contracting

support Direct Indirect

Contract price

proposals and forward

pricing proposals

Audit: DCAA examines contractor records to ensure that cost or

pricing data is accurate, current, and complete and supports the

determination of fair and reasonable prices. 10 U.S.C. §§ 2306a

and 2313 (DOD) and 41 U.S.C. § 254d (other agencies); FAR

Subpart 15.4 (esp. FAR § 15.404-2(c)) and § 52.215-2(c); and

DFARS § 215.404-1.

X X

Financial liaison

advisory services

Nonaudit: DCAA Director establishes and maintains liaison

auditors and financial advisors, as appropriate, at major procuring

and contract administration offices. These services are also

provided during the post-award phase, as needed. DODD

5105.36, paras. 7.1.1 and 5.9.

Post award/administration phase:

Internal control system

audits (generally)

Audit: DCAA reviews the financial and accounting aspects of the

contractor’s cost control systems, including the contractor’s

internal control systems. FAR § 42.101(a)(3) and DFARS §

242.7501.

X X

Billing system audits

Audit: DCAA determines adequacy of contractors’ billing system

controls and reviews accuracy of paid vouchers. DCAA uses audit

results to support approval of contractors to participate in the

direct-bill program. FAR § 42.101 and DFARS § 42.803 (b)(i)(C).

X X

Purchasing system

review b

Audit: DCAA determines adequacy of a contractor’s or

subcontractor’s purchasing system. FAR Subpart 44.3.

X X

Progress payments

Audit: DCAA verifies amount claimed, determines allowability of

contractor requests for cost-based progress payments, and

determines if the payment will result in undue financial risk to the

government. FAR §§ 32.503-3, 32.503-4, and 52.232-16.

X X

Incurred cost claims

Audit: DCAA determines acceptability of the contractors’ claimed

costs incurred and submitted by contractors for reimbursement

under cost-reimbursable, fixed-price incentive, and other types of

flexibly priced contracts and compliance with contract terms, FAR,

and CAS, if applicable. FAR §§ 42.101, 42.803(b), and DFARS §

242.803.

X X

Billing rates and final

indirect cost rates

Audit: DCAA establishes billing rates for interim indirect costs and

final indirect cost rates. FAR §§ 42.704, 42.705 and 42.705-2 and

DFARS § 42.705-2.

X X

Defective pricing

Audit: DCAA determines the amount of cost adjustments related

to defective pricing. See above authorities to audit contractor cost

and pricing data and FAR § 15.407-1.

X X

CAS compliance

Audit: DCAA determines contractor and subcontractor compliance

with CAS set forth in 48 CFR § 9903.201 and determines cost

impacts of noncompliance. FAR §§ 1.602-2, 30.202-7, and

30.601(C).

X X

Other specially

requested services

Audit and nonaudit services: DCAA conducts performance audits

and other audits based on requests from DOD components and

requests from other federal agencies. DOD Directive 5105.36,

Sec. 5.

X X

Page 11 GAO-09-468 DCAA Audit Environment

Payment support

Contract phase and

assignment Audit and Nonaudit services

Contracting

support Direct Indirect

Paid voucher reviews

Nonaudit services: DCAA reviews vouchers after payment to

support continued contractor participation in the direct bill

program. CAM 6-1007.6; FAR § 42.803; DFARS § 242.803;

DODD 5105.36, paras. 5.4 and 5.5; and DOD Financial

Management Regulation (FMR), vol. 10, ch. 10, para. 100202.

X X

Approval of vouchers

prior to payment

Nonaudit: DCAA reviews and approves contractor interim

vouchers for payment and suspends payment of questionable

costs. FAR § 42.803; DFARS § 242.803(b)(i)(B); DOD Directive

5105.36, paras. 5.4 and 5.5; and DOD FMR vol. 10, ch. 10, para.

100202.

X X

Overpayment reviews

Non audit services: At the request of the contracting officer, DCAA

reviews contractor data to identify potential contract

overpayments. FAR §§ 2.605, 52.216-7(g), (h)2.

X X

Close-out/termination phase:

Contract close-out

procedures and

audits

Audit: DCAA reviews final completion vouchers and the

cumulative allowable cost worksheet and may review contract

closing statements. DFARS § 242.803(b)(i)(D).

X X

Source: GAO analysis.

Indicates DCAA audit and nonaudit services covered in this audit.

Indicates types of audits covered in our prior investigation (GAO-08-857). We reviewed progress

payment and contract close-out audits that related to audits in our earlier investigation or this audit

where the auditors considered the evidence in those audits.

Importance of Audits in

Accordance with GAGAS

DCAA policy states

that it follows GAGAS

when conducting audits.

These standards provide a framework for conducting high quality

government audits and attestation engagements. These standards also

provide guidelines to help government auditors maintain competence,

integrity, objectivity, and independence in their work and require that they

obtain sufficient evidence to support audit conclusions and opinions.

When auditors are required to follow GAGAS or are representing to others

that they followed GAGAS, they should follow all applicable GAGAS

requirements and should refer to compliance with GAGAS in the auditor’s

report.

Most DCAA audits are performed as attestation audits under

GAGAS. For attestation audits, GAGAS incorporates the American

CAM, 2-101. Except where stated otherwise in this report, various types of evaluations

entailing different levels of assurance that DCAA refers to as audits—such as examinations,

attestations, and reviews—were subject to GAGAS.

GAO-03-673G, §1.01, and GAO-07-731G, §1.03.

GAO-07-731G, § 1.11.

Page 12 GAO-09-468 DCAA Audit Environment

Institute of Certified Public Accountants (AICPA) general standard on

criteria, and the field work and reporting standards and the related

Statements on Standards for Attestation Engagements (SSAE), unless

specifically excluded or modified by GAGAS.

DCAA also conducts

performance audits upon request. This report addresses DCAA attestation

audits and related supporting assignments.

GAGAS state that the public expects auditors to observe the principles of

serving the public interest and maintaining the highest degree of integrity,

objectivity, and independence in discharging their professional

responsibilities. Serving the public interest and honoring the public trust

are critical when performing government audits. Auditors increase public

confidence when they conduct their work with an attitude that is

objective, fact-based, nonpartisan, and non-ideological with regard to

audited entities and users of the auditors’ reports. Auditors also should be

intellectually honest and free of conflicts of interest in discharging their

professional responsibilities.

Management of the audit organization sets

the tone for ethical behavior throughout the organization by maintaining

an ethical culture, clearly communicating acceptable behavior and

expectations to each employee and creating an environment that

reinforces and encourages ethical behavior throughout all levels of the

organization.

The credibility of auditing in the government sector is

based on auditors’ objectivity and integrity in discharging their

professional responsibilities.

GAO-03-673G, § 6.01, and GAO-07-731G, § 6.01.

GAO-07-731G, §§ 2.06 through 2.10.

GAO-07-731G, § 2.01.

GAO-07-731G, § 2.10.

Page 13 GAO-09-468 DCAA Audit Environment

We found audit quality problems at DCAA offices nationwide, as

demonstrated by serious quality problems in the 69 audits and cost-related

assignments we reviewed, DCAA’s ineffective audit quality assurance

program, and DCAA’s rescission of 80 audit reports in response to our

work.

Of the 69 audits and cost-related assignments we reviewed for this

report, 65 exhibited serious GAGAS or other deficiencies similar to those

found in our prior investigation, including compromise of auditor

independence, insufficient audit testing, and inadequate planning and

supervision. Although not as serious, the remaining four audits also had

GAGAS compliance problems. The 69 audits and cost-related assignments

we reviewed included 43 audits that DCAA reported were performed in

accordance with GAGAS and 26 non-GAGAS cost-related assignments,

including 10 overpayment and 16 paid voucher assignments. According to

DCAA officials, DCAA rescinded the 80 audit reports because the audit

evidence was outdated, insufficient, or inconsistent with reported

conclusions and opinions and reliance on the reports for contracting

decisions could pose a problem. Nearly one third (24) of the 80 rescinded

reports relate to unsupported opinions on contractor internal controls,

which were used as the basis for risk-assessments and planning on

subsequent internal control and cost-related audits. Other rescinded

reports relate to CAS compliance and contract pricing decisions. Because

the conclusions and opinions in the rescinded reports were used to assess

risk in planning subsequent audits, they impact the reliability of hundreds

of other audits and contracting decisions covering billions of dollars in

DOD expenditures. We found that DCAA’s focus on a production-oriented

mission led DCAA management to establish policies, procedures, and

training that emphasized performing a large quantity of audits to support

contracting decisions over audit quality. An ineffective quality assurance

structure compounded this problem.

Nationwide Audit

Quality Problems Are

Rooted in DCAA’s

Poor Management

Environment

Audit Quality Problems

Found in All Audits GAO

Reviewed

We found audit quality problems, including GAGAS compliance problems,

with all 37 audits of contractor internal controls and the 4 incurred cost

and the 2 request for equitable adjustment audits we reviewed at 7 FAOs

across the 5 DCAA regions covered in this audit. In addition, none of the

26 cost-related assignments we reviewed from these same FAOs included

sufficient testing to identify contractor overpayments and billing errors.

According to documentation provided by DCAA as of the end of July 2009, the 80

rescinded reports include 62 reports related to findings in our July 2008 investigative report

and 18 reports related to this audit.

Page 14 GAO-09-468 DCAA Audit Environment

For additional details on our analysis of these DCAA audits and

assignments, including narrative case-studies, see appendixes I and II.

DCAA performs attestation audits of contractors’ systems for cost

accounting, estimating, and billing to gather evidence to express an

opinion on the adequacy of the contractor’s systems and related internal

controls for compliance with applicable laws and regulations and contract

terms. A contractor must have an adequate accounting system to be

awarded a government cost-reimbursement contract, an adequate billing

system to submit invoices for payment without government review, and an

acceptable estimating system to support a contracting officer’s approval of

pricing proposals. A secondary objective of DCAA’s audits of contractor

systems and controls is to determine the degree of reliance that can be

placed on the contractor’s internal controls as a basis for planning the

scope of other related audits. For example, if a contractor receives an

adequate opinion on various systems control audits, auditors assess risk as

low and reduce the level of testing on subsequent internal control and

cost-related audits, including audits of contractors’ annual incurred cost

claims. Although the reports for all 37 audits of contractor internal

controls that we reviewed stated that the audits were performed in

accordance with GAGAS, we found GAGAS compliance issues with all of

these audits. Examples of GAGAS compliance issues we found included:

Internal Control Audits

Independence issues. For 7 audits we reviewed, DCAA independence

was compromised because auditors provided material nonaudit services

to a contractor they later audited; experienced access to records problems

that were not fully resolved; or significantly delayed report issuance in

order to allow the contractors to resolve cited deficiencies. GAGAS state

that auditors should be free from influences that restrict access to records

or improperly modify audit scope.

Insufficient evidence. We found that 33 of the 37 internal control audits

did not include sufficient testing of internal controls to support auditor

conclusions and opinions. GAGAS for examination-level attestation

engagements require that sufficient evidence be obtained to provide a

reasonable basis for the conclusion that is expressed in the report.

However, our review of audit documentation often found that only two,

three, or sometimes five transactions were tested to support audit

See GAO-03-673G, § 3.19, and GAO-07-731G, § 3.10.

GAO-03-673G, § 6.04b.

Page 15 GAO-09-468 DCAA Audit Environment

conclusions, and the audit documentation did not contain a justification

for the small sample sizes selected for testing. For internal control audits,

which are relied on for 2 to 4 years and sometimes longer, the auditors

would be expected to test a representative selection of transactions across

the year and not transactions for just one day, one month, or a couple of

months.

For many controls, the procedures performed consisted of

documenting the auditors’ understanding of controls, and the auditors did

not test the effectiveness of the implementation and operation of controls.

Generally, the basis for an auditor’s determination of sufficient testing

should include (1) an adequate risk assessment, taking into consideration

any auditor alerts arising from related audits, past findings, and corrective

actions; (2) the contractor’s overall control environment; and (3) the

nature and volume of transactions and associated materiality and risk of

error. For example, decisions on sufficient testing of contractor internal

controls would include consideration of the number and types of contracts

or proposals; the nature, dollar amount, and volume of transactions; and

key control attributes or special characteristics of the transactions.

Further, a representative selection would include a representative number

of transactions from a population of transactions representing a

reasonable period of time, in order for test results to support conclusions

and opinions on the overall adequacy of the contractor’s systems and

effectiveness of the related controls. For example, under the GAO/PCIE

Financial Audit Manual,

the minimum sample size for an attribute

sample of a control would be 45 items.

Reporting problems. According to GAGAS, audit reports should, among

other matters, identify the subject matter being reported and the criteria

used to evaluate the subject matter. Criteria identify the required or

desired state or expectation with respect to the program or operation and

provide a context for evaluating evidence and understanding the findings.

None of the 37 internal control audit reports we reviewed cited specific

criteria used in individual audits. Instead, the reports uniformly used

boilerplate language to state that DCAA audited for compliance with the

“FAR, CAS, DFARS, and contract terms.” As a result the user of the report

AICPA Statements on Auditing Standards, AU 350, and Audit and Accounting Guide:

Audit Sampling, §§ 3.14, 3.29-3.34, 3.58, and 3.61.

GAO/PCIE, Financial Audit Manual, GAO-08-585G (Washington, D.C.: July 2008).

GAO-07-731G, § 4.15.

Page 16 GAO-09-468 DCAA Audit Environment

does not know the specific Federal Acquisition Regulation (FAR), Cost

Accounting Standards (CAS), or contract terms used as criteria to test

contractor controls. This makes it difficult for users of the reports to

determine whether a particular report provides the level of assurance

needed to make contracting decisions.

The lack of sufficient support for the audit opinions on 33 of the 37

internal control audits we reviewed rendered them unreliable for decision

making on contract awards, direct billing privileges, the reliability of cost

estimates, and reported direct cost and indirect cost rates. For example,

the FAR requires

government contracting officers to determine the

adequacy of a contractor’s accounting system before awarding a cost-

reimbursement contract. Of the 9 audits of contractor accounting system

internal controls that we reviewed, only two of the audits included

sufficient testing to support DCAA’s audit opinion that internal controls

over the contractors’ accounting systems were adequate. In addition, none

of the 20 audits of contractor billing system internal controls we reviewed

contained sufficient testing of controls to support the reported opinions.

Adequate opinions on billing system audits are the basis for DCAA

decisions to approve contractors for the direct bill program, whereby

contractors submit invoices directly to a government disbursing office

without prior review.

Four of the 6 audits of contractor estimating

system controls that we reviewed did not include sufficient testing to

support the reported opinions. DOD requires

that large contractors have

acceptable estimating systems. Opinions on contractor estimating system

support DCAA decisions on the extent of testing performed on contract

proposals. Neither of the two internal control audits of contractor indirect

and other direct costs we reviewed included sufficient testing to support

reported opinions. As shown in figure 1, at the time these audits were

performed, DCAA policy guidance provided for three categories of

opinions on internal control audits. This policy provided for different

opinions and criteria for judging them based on the severity of the

problems identified. Professional standards have long recognized differe

levels of severity with regard to reporting deficiencies and material

weakness

es in internal controls.

FAR §§ 16.104(h) and 16.301-3(a)(1).

FAR § 42.101 and DFARS § 242.803(b)(i)(C).

DFARS § 215.407-5-70; see FAR § 15.407-5.

Page 17 GAO-09-468 DCAA Audit Environment

Figure 1: DCAA Opinions on Contractor Internal Control Systems Audits

Source: GAO analysis of DCAA policy.

Risk

Adequate

Inadequate

No significant

deficiencies were

identified in the audit

Auditors identified one

or more significant

deficiencies that render

the entire contractor

system unreliable

Auditors identified one

or more significant

deficiencies that affect

parts of the contractor’s

system

Scope of future audits will be decreased based on assurance provided by

adequate controls.

Contractor is required to make improvements and DCAA is to perform follow-up

testing within 6 months.

Inadequate opinion requires expanded audit scopes on other audits because

controls do not provide reasonable assurance that data generated by the

contractor’s system are reliable.

Contractor is required to make improvements, and DCAA is to perform follow-up

testing within 6 months.

Inadequate in part opinion also requires expanded audit scopes on future and

concurrent audits until the contractor’s corrective actions are confirmed by

the auditors.

adequate in part

eRairetirCnoinipo AACD sultant actions

Low

High

Supervisors of the DCAA internal control audits we reviewed dropped

auditor findings of significant deficiencies from the audit reports or

treated them as suggestions for improvement without adequate support,

including instances of FAR noncompliance that should have been reported

as material weaknesses. In some cases, auditors reported “inadequate-in

part” opinions when the severity of the deficiencies or material

weaknesses identified would have called for “inadequate” opinions.

On December 19, 2008, DCAA revised its policy to eliminate the

“inadequate-in-part” opinion and the requirement to report suggestions for

improvement.

The new DCAA policy defines “significant

deficiency/material weakness” as an internal control deficiency that

(1) adversely affects the contractor’s ability to initiate, authorize, record,

process or report government contract costs in accordance with

applicable government contract laws and regulations; (2) results in a

reasonable possibility that unallowable costs will be charged to the

government; and (3) the potential unallowable cost is not clearly

immaterial. The new DCAA policy also establishes new guidance on

DCAA, “Audit Guidance on Significant Deficiencies/Material Weaknesses and Audit

Opinions on Internal Control Systems,” 08-PAS-043R (Dec. 19, 2008).

Page 18 GAO-09-468 DCAA Audit Environment

reporting audit opinions on contractors’ internal control systems. For

example, the new DCAA policy states that audit reports that identify any

significant deficiencies/material weaknesses in contractors’ internal

control systems will include opinions that the systems are “inadequate.”

The policy notes that the contractor’s failure to accomplish any control

objective tested in DCAA’s internal control audits will or could ultimately

result in unallowable costs being charged to government contracts, even

when the control objective does not have a direct relationship to charging

costs to government contracts. As an example, the policy notes the control

objective related to ethics and integrity is not directly related to charging

costs to government contracts, but that the contractor’s failure to

accomplish the control objective creates an environment that could

ultimately result in mischarging to government contracts.

By eliminating the “inadequate-in-part” opinion, the new policy does not

recognize different levels of severity and could unfairly penalize

contractors whose systems have less severe deficiencies by giving them

the same opinion—”inadequate”—as contractors having material

weaknesses or serious deficiencies that in combination would constitute a

material weakness.

At the time we finalized our draft report for DOD comment, DCAA had

rescinded 18 of the 33 audits of contractor internal controls that we

determined did not contain sufficient testing to meet GAGAS.

Unreliable

audit opinions on contractor internal controls pose a significant risk

because DCAA generally performs these audits on a 2- to 4-year cycle and

the audit results are relied on for several years to make decisions on

testing in various audits of contractor internal controls and cost-related

assignments. In response to our earlier investigation in November 2008,

DOD added DCAA audits not meeting professional standards to its list of

material weaknesses.

Table 2 provides details on five case studies that

are typical of the flawed internal control audits that we reviewed during

the course of our work. For more detail on the internal control audits we

reviewed, see appendix I.

Under its decentralized management environment, DCAA headquarters obtains field

office agreement to rescind audit reports that do not meet GAGAS.

DOD, Fiscal Year 2008 Agency Financial Report, Department of Defense (Washington,

D.C.: Nov. 17, 2008).

Page 19 GAO-09-468 DCAA Audit Environment

Table 2: Summary of Five Selected Internal Control Audits

Case Region Audit type Case details

1 Western Billing system (2004)

• DCAA auditors inappropriately planned and performed a billing system audit of a

federally funded research and development center (grantee) with $1.5 billion in annual

funding. The grantee does not have a “billing system.”

• The grantee is funded by a line of credit, which provides for cash draws and

transaction reporting by the grantee’s accounting system.

• DCAA auditors spent 530 hours revising Single Audit Act cash management audit

documentation to address procedures required in DCAA’s standard audit program for

billing system internal controls and developed a billing system audit report, when the

auditors could have simply forwarded the results of work on the grantee’s cash

management system performed under the Single Audit Act to the federal agency’s

buying command.

• As a result of our review, DCAA reassessed the need to perform a billing system audit

for the grantee and determined that it would rely on the Single Audit reports in the

future.

2 Western Accounting system

(2004)

• This audit involving accounting controls for one of the five largest DOD contractors

working in Iraq was initiated in November 2003.

• In September 2005, after nearly 2 years of audit work, DCAA provided draft findings

and recommendations to the contractor that included 8 significant deficiencies in the

contractor’s accounting design and operation.

• The contractor objected to the findings, stating that the auditors did not fully

understand its new policies and procedures, which were just being developed for the

fast track effort in Iraq.

• Following the contractor’s objections, various supervisory auditors directed the

auditors to revise and delete some workpapers, generate new workpapers, and in one

case, copy the signature of a prior supervisor onto new workpapers making it appear

that the prior supervisor had approved a revised risk assessment.

• On August 31, 2006, after dropping 5 significant deficiencies and downgrading 3

significant deficiencies to suggestions for improvement, DCAA reported an “adequate”

opinion on the contractor’s accounting system without adequate audit evidence for the

changes.

• The interim audit supervisor, who instructed the lead auditor to copy and paste the

prior supervisor’s name onto key risk assessment workpapers, was subsequently

promoted to be the Western Region’s quality assurance manager where he served as

quality control check over thousands of audits, including those GAO reported on last

year.

• In April 2007, the Special IG for Iraq Reconstruction (SIGIR) reported that despite

being paid $3 million to complete the renovation of a building in Iraq, the contractor’s

work led to plumbing failures and electrical fires in a building occupied by the Iraqi

Civil Defense Directorate.

• DCAA rescinded the audit report on December 2, 2008.

Page 20 GAO-09-468 DCAA Audit Environment

Case Region Audit type Case details

3 Eastern Billing system (2005)

• In May 2005, DCAA reported an inadequate-in-part opinion on the billing system

internal controls of a second of the five largest DOD contractors.

• After issuing the report, DCAA auditors helped the contractor develop policies and

procedures related to accounts receivable, overpayments, and system monitoring

before performing a required follow-up audit—a serious impairment to auditor

independence.

• In June 2006, DCAA reported an adequate opinion on the contractor’s billing system

internal controls, including the policies and procedures DCAA helped the contractor

develop.

• As a result of GAO’s review, DCAA rescinded the follow-up audit report on March 6,

2009.

4 Central Billing system

(2005)

• This audit, which was initiated in July 2005, covered a new billing system at a

business segment of another of the five largest DOD contractors. Although DCAA

considers new systems to be high-risk and requires increased testing, auditors

deleted key audit steps related to contractor policies and internal controls over

progress payments from the standard audit program without explanation and

performed little or no testing of the contractor’s billing controls.

• The contractor objected to requests for documentation to test whether billing clerks

had received necessary training.

• One auditor told GAO he did not perform other tests because “the contractor would

not appreciate it.”

• The auditors provided draft findings and recommendations to the contractor in

February 2006 that included six suggestions to improve the system related to the

need for internal audits, oversight of subcontractor accounting systems, and

improvements in policies and procedures and desk instructions.

• Instead of issuing the report, when audit work was completed and noting the status of

any contractor actions to address identified control weaknesses, the auditors

monitored contractor corrective actions for 7 months, dropping the two suggestions for

improvement related to internal audits and monitoring subcontractor accounting

systems. The failure to monitor subcontractor accounting systems should have been

considered a significant deficiency.

• On September 15, 2006, DCAA reported an “adequate” opinion on the contractor’s

billing system.

• Following GAO’s review of this audit, DCAA rescinded the audit report on February

10, 2009.

Page 21 GAO-09-468 DCAA Audit Environment

Case Region Audit type Case details

5 Central Billing system (2006)

• A fraud investigation by the Army’s Criminal Investigative Division was under way at

the time DCAA performed this contractor’s billing system audit. The FAO was aware

of the substance of the Army’s investigation.

• The auditor requested increases in budgeted audit hours to perform increased testing

because of fraud risk and the contractor’s use of temporary accounts for charging

costs that had not yet been authorized by the contracting officer.

• The auditor drafted an “inadequate” opinion on the contractor’s billing system, which

was overturned by the supervisor and FAO manager.

• Despite a reported $2.8 million in fraud for this contractor, DCAA reported an

“inadequate-in-part” opinion related to 3 significant deficiencies in the contractor’s

billing system on August 31, 2005, and an “adequate” opinion on September 11,

2006, related to a follow-up audit.

• The auditor, whose performance appraisal was lowered for performing too much

testing and exceeding budgeted audit hours, was assigned to and then removed from

the follow-up audit. The auditor left DCAA in March 2007.

• Following GAO’s review, DCAA rescinded both audit reports on November 20, 2008.

Source: GAO analysis of DCAA audit documentation and auditor interviews.

The 32 cost-related assignments we reviewed did not contain sufficient

testing to provide reasonable assurance that overpayments and billing

errors that might have occurred were identified. As a result, there is little

assurance that any such errors, if they occurred, were corrected and that

related improper contract payments, if any, were refunded or credited to

the government. Contractors are responsible for ensuring that their

billings reflect fair and reasonable prices and contain only allowable costs,

and taxpayers expect DCAA to review these billings to provide reasonable

assurance that the government is not paying more than it should for goods

and services. Further, we found that DCAA does not consider some cost-

related assignments to be GAGAS audits, even though these assignments

are used to provide assurance of the reasonableness of contractor billings,

for example:

Cost-Related

ssignments

Paid voucher reviews. DCAA performs annual testing of paid vouchers

(invoices) to determine if contractor voucher preparation procedures are

adequate for continued contractor participation in the direct-bill

program.

Under the direct-bill program, contractors may submit their

invoices directly to the DOD disbursing officer for payment without

further review. Although DCAA does not consider its reviews of contractor

DCAA does not perform paid voucher reviews during the year that it performs an audit of

the contractor’s billing system internal controls.

Page 22 GAO-09-468 DCAA Audit Environment

paid vouchers to be GAGAS engagements; it has not determined what

standards, if any, apply to these assignments. In addition, for the 16 paid

voucher assignments we reviewed, we found that DCAA auditors failed to

comply with CAM guidance.

Rather than documenting the population of

vouchers, preparing sampling plans, and testing a random (statistical)

sample, auditors generally did not identify the population of vouchers, did

not create sampling plans, and made a small, nonrepresentative selection

of as few as one or two invoices for testing to support conclusions on their

work. Even when DCAA auditors tested 20 or 30 invoices, they did not test

billing controls or review supporting documentation for goods and

services purchased. Instead, the auditors performed limited procedures

such as determining whether the vouchers were mathematically correct

and included current and cumulative billed amounts. Based on this limited

work, the auditors concluded that controls over invoice preparation were

sufficient to support approval of the contractors’ direct billing privileges.

However, the limited work performed does not provide assurance that

contractor billings are accurate and comply with applicable laws, the FAR,

CAS, and contract terms. This is of particular concern because we

determined that Defense Finance and Accounting Service (DFAS)

certifying officers rely on DCAA voucher reviews, and they do not repeat

review procedures they believe to be performed by DCAA.

Professional literature contains guidance to help auditors determine the

level of testing that should be performed to obtain sufficient, appropriate

evidence to support a conclusion that internal controls are effectively

designed, implemented, and operating effectively. Inquiry alone does not

provide sufficient, appropriate evidence to support a conclusion about the

effectiveness of a control. Some of the factors that affect the risk

associated with a control include

• the nature and materiality of misstatements that the control is intended

to prevent,

• the inherent risk associated with the related account(s) and

assertion(s),

• whether there have been changes in the volume or nature of

transactions that might adversely affect control design or operating

effectiveness,

CAM 6-1007.

Page 23 GAO-09-468 DCAA Audit Environment

• the degree to which the control relies on the effectiveness of other

controls (i.e., information technology controls),

• the competence of personnel who perform the control or monitor its

performance, and whether there have been changes in key personnel

who perform the control or monitor performance, and

• whether the control relies on performance by an individual or is

automated (an automated control would generally be expected to be

lower risk if relevant IT general controls are effective).

Professional standards

state that the auditor should focus more attention

on the areas of highest risk. As the risk associated with the control being

tested increases, the evidence that the auditor should obtain increases. In

addition, the GAO/PCIE Financial Audit Manual provides guidance on

sampling control tests that would be relevant to DCAA testing of

contractor invoices.

The auditor should assess risk in determining the

control attributes to be tested and select a sample that the auditor expects

to be representative of the population. Attribute sampling requires random

or systematic, if appropriate, selection of sample items without

considering the transactions’ dollar amount or other special

characteristics. To determine the sample size, the auditor uses

professional judgment to determine three factors—confidence level,

tolerable rate (maximum rate of deviations from the prescribed control

that the auditor is willing to accept without altering the preliminary

control risk), and expected population deviation rate (expected error

rate).

AU § 350.19 and SSAE §§15.64 and 15.69.

AU §§ 350.07 through 350.14.

GAO-08-585G, § 450.

Confidence interval is the probability associated with the precision, that is, the

probability that the true misstatement is within the confidence interval.

For example, for a confidence level of 90 percent and a tolerable rate of 5 percent, a

sample size of 45 transactions would have an acceptable number of deviations of zero and

a sample size of 78 transactions would have an acceptable number of deviations of one. For

the same confidence level of 90 percent and a tolerable rate of 10 percent, a sample size of

45 would have an acceptable number of deviations of one and a sample size of 78 would

have an acceptable number of deviations of four.

Page 24 GAO-09-468 DCAA Audit Environment

Finally, the American Institute of Certified Public Accountants (AICPA)

Audit and Accounting Guide: Audit Sampling

(Audit Guide) contains

attestation guidance on the application of SSAEs in specific

circumstances, including engagements for entities in specialized

industries. The Audit Guide states that an auditor using nonstatistical

sampling is not required to compute the sample size using statistical

theory. However, sample sizes of statistical and nonstatistical samples

ordinarily would be comparable when the same sampling parameters are

used.

Overpayment assignments. DCAA intends these audits to verify that

contractors have billing procedures and internal controls in place to

identify and resolve contractor overpayments in a timely manner. DCAA

guidance states that these engagements should be conducted in

accordance with GAGAS to the extent applicable under the

circumstances.

However, none of the 10 overpayment assignments we

reviewed were performed or reported as GAGAS engagements. We found

that auditor judgments about the population and selection of transactions

for these assignments did not provide a representative basis for testing

and concluding on contractor controls over billings and payments

received. For example, for the 10 assignments we reviewed, the auditors

selectively reviewed an accounts receivable aging report to identify

overpayments and determine if they had been resolved. The auditors did

not attempt to identify the population of transactions subject to

overpayments and over billings during the year, and they did not

document their rationale for selecting a particular dollar threshold,

number of transactions, or time period for testing contractor invoices. Our

assessment of these assignments includes the same concerns regarding

insufficient evidence to support the auditors’ conclusions as discussed

above for annual testing of paid vouchers. As a result, this work does not

provide reasonable assurance that contractors have adequate controls in

place to identify and correct overpayments and billing errors and make

appropriate, timely refunds and adjustments.

The AICPA Audit Guide is an interpretive publication pursuant to AT section 50, SSAE

Hierarchy (AICPA, Professional Standards, vol. 1).

AICPA Audit Guide § I-17, and AU § 350.23. Statements on Auditing Standards (SAS) 39

is referred to as AU 350.

DCAA, “Audit Program: Audit of Contractor Overpayments,” (Activity Code 17310), April

2004, September 2007, and May 2008.

Page 25 GAO-09-468 DCAA Audit Environment

Incurred cost audits. The purpose of incurred cost audits is to examine

contractors’ cost representations and opine on whether the costs are

allowable, allocable to government contracts, and reasonable in

accordance with the contract and applicable government acquisition

regulations.

DCAA performs these audits as GAGAS attestation

engagements. For the four incurred cost audits we reviewed, we found

that the auditors did not adequately document their judgments about

control risk or the sampling and test methodologies used. In addition, we

found that the auditors traced claimed pool and base costs (indirect costs)

to the contractor’s accounting books and records to determine their

accuracy and allowability. However, the auditors did not perform

sufficient, detailed testing of support for claimed indirect and direct costs.

The scope of work performed was not sufficient to identify claimed costs,

if any, that were not adequately supported or unallowable costs, if any,

that should have been questioned.

In addition to the testing failures we identified on the 32 cost-related

assignments, several additional issues came to our attention during our

review:

Exempting from professional standards certain assignments that

were used as support for internal control system audits. We noted

that paid voucher reviews and overpayment assignments, which were used

to support direct-bill decisions and billing system audits, were not

performed under GAGAS, even though some of them used the same

terminology as GAGAS engagements to describe the work performed,

including “comprehensive examination” and “audit.” According to DCAA’s

CAM and DCAA officials, paid voucher reviews and most overpayment

assignments are not intended to meet GAGAS standards. However, paid

voucher reviews are intended to serve as audits of contractor payments,

and DCAA’s standard audit program for overpayment assignments states

that the assignments are to be performed in accordance with GAGAS,

unless there are specific exceptions. When these types of assignments are

not conducted under professional standards, it is important for the report

to clearly state the procedures performed and the intended uses of the

report, such as verifying compliance with certain FAR requirements, in

order to provide context for understanding the stated conclusions of the

work and avoid misleading users of the report.

CAM 6-102.

Page 26 GAO-09-468 DCAA Audit Environment

Auditor objectivity issues. We also determined that DCAA’s role with

regard to making decisions to approve contractors for participation in the

direct-bill program

presented an impairment to auditor objectivity—

which includes being independent in fact and appearance when providing

audit and attestation engagements.

The objectivity impairment relates to

DCAA’s audit role in authorizing contractors to participate in the direct-

bill program, which places it in the position of making decisions that

impact its nonaudit workload related to the review of contractor invoices

prior to payment. For example, when contractors do not have direct billing

privileges, DCAA acts as the authorized representative of the DOD

contracting officer in reviewing contractor invoices prior to submission

for payment. However, if DCAA auditors determine that a contractor has

an adequate billing system, DCAA may authorize a contractor to

participate in the direct-bill program, thereby eliminating workload related

to review of the contractor’s invoices prior to payment. In addition, the 20

billing system audits and follow-up audits we reviewed lacked sufficient

testing to support reported opinions, or the opinions reported were

inconsistent with the audit evidence. DCAA had approved all but 2 of the

16 contractors involved in these audits for the direct bill program.

At the end of our audit, DCAA had not rescinded any of the memorandums

or reports on the results of the cost-related assignments we reviewed.

Table 3 provides details on five selected case studies of flawed cost-

related assignments that we reviewed during the course of our work.

FAR 42.101, DFARS 242.803(b)(1)(c), and CAM 6-1007.

GAO-03-673G, §§ 3.03 through 3.18.

Page 27 GAO-09-468 DCAA Audit Environment

Table 3: Summary of Five Selected Cost-Related Assignments

Case Region

Type of

assignment

Case details

1 Eastern

Paid voucher review

(2004)

Non-GAGAS

• This contractor generates $1.1 billion in annual billings to the government.

• The auditor assessed risk as low for this assignment without documenting the basis

for the decision. The auditor then judgmentally selected 3 vouchers totaling $88,000

for testing out of a total of 222 vouchers submitted to the government for payment

from March 2003 through February 2004.

• The auditor tested the first voucher selected and performed limited testing on the

remaining 2 vouchers. The workpapers do not include any evidence to show that the

auditor performed most of the audit steps required in the standard audit program.

• Despite limited testing, on March 31, 2004, DCAA prepared a Memorandum for the

Record, stating “continued reliance can be placed on the contractor’s procedures for

the preparation of interim vouchers…” and “the contractor has met the criteria for

continued participation in the direct billing program.”

2 Mid-Atlantic Paid voucher review

(2004)

Non-GAGAS

• In 2004, DCAA reviewed interim vouchers submitted by a contractor with $40 million

in annual sales.

• The auditor chose a nonrepresentative selection of 3 vouchers totaling $621,000

from a 3-month period. The auditor should have used a population covering a 12-

month period because this assignment was designed to cover a 1-year period.

• The auditor did not document the sample selection methodology as required by

DCAA’s CAM. Although testing of 3 vouchers is not sufficient to support a

conclusion on the effectiveness of the contractor’s controls over preparation of

interim vouchers, the auditor removed one of the 3 vouchers from testing and did not

document a reason.

• The auditor did not identify any errors in testing the two remaining vouchers.

• On August 31, 2004, DCAA reported “continued reliance can be placed on the

contractor’s procedures for the preparation of interim vouchers” and “the contractor

had met the criteria for continued participation in the direct billing program.”

3 Western

Paid voucher

review (2005)

Non-GAGAS

• This DOD contractor with over $1 billion in annual billings to the government was

one of several contractors that performed work to support the FBI’s Trilogy

investigative systems upgrade project.

• The auditor tested less than 20 vouchers of 5,530 vouchers issued in a 12-month

period.

• On April 14, 2005, DCAA issued a Memorandum for the Record, stating “continued

reliance can be placed on the contractor’s procedures for the preparation of interim

vouchers” and “the contractor has met the criteria for continued participation in the

direct-bill program.

• One year later, a GAO audit report revealed that during the time of this DCAA

assignment, the contractor had over billed the FBI by over $400,000 in labor and

improper first-class travel costs.

Page 28 GAO-09-468 DCAA Audit Environment

Case Region

Type of

assignment

Case details

4 Central

Overpayment

assignment (2005)

Non-GAGAS

• This DCAA assignment covered one of the five largest DOD contractors.

• The auditor tested 4 transactions from a listing of potential underpayments and

overpayments prepared by the contractor. The auditor did not independently verify

the accuracy or completeness of the contractor’s listing.

• The audit program required the auditor to determine whether the contractor monitors

the billings submitted by its top 3 to 5 subcontractors. However, the auditor

performed this procedure for only 1 subcontractor based on “auditor judgment” and

did not document the basis for this judgment in the audit documentation.

• The auditor also relied on the unverified contractor-provided listing to identify

refunds to the government. The auditor then “judgmentally selected” 2 refunds for

testing from the contractor’s listing.

• The auditors’ conclusions that the contractor’s controls are sufficient to detect and

correct billing errors and overpayments were not supported by sufficient testing or

other independent evidence.

5 Western

Incurred cost

audit (2004)

GAGAS

• This audit covered a $516 million incurred cost claim submitted by a contactor

performing reconstruction work in Iraq.

• The auditors reported about $6 million in questioned costs and about $83 million in

unsupported costs based on assist audits (portions of the audit performed by other

FAOs) that had not been received by the report issue date.

• Although the auditors charged 2,292 hours to this assignment, GAO determined that

the auditors did not perform sufficient work to support the audit opinion. For

example, the auditors traced claimed pool and base costs to the contractor’s

accounting books and records using a threshold of $5 million for cost-type contracts

and $2 million for time and materials contracts, but did not perform detailed testing

of support for transactions. Tracing amounts to the general ledger is not sufficient

work to support an examination-level opinion and the auditors did not document the

basis for the judgment used to determine the multimillion dollar thresholds.

• Further, the auditors relied on testing performed in a related accounting system

audit, which DCAA rescinded on December 2, 2008, in response to GAO concerns.

• As a result, the auditor’s risk assessment used to plan the incurred cost audit is no

longer supported.

Source: GAO analysis of DCAA audit documentation and auditor interviews.

We did not attempt to re-perform these assignments to find out whether

actual overpayments or billing errors existed. For additional details on the

cost-related assignments we reviewed, see appendix II.

Poor Management

Environment and Quality

Assurance Structure at

DCAA Impacted Audit

Quality

We found that a management environment and agency culture that

focused on facilitating the award of contracts and an ineffective audit

quality assurance structure are at the root of the agencywide audit failures

we identified. DCAA’s mission and management goals focus on producing

a large quantity of audits to support procurement and contract

administration rather than assuring proper contract costs that help save

Page 29 GAO-09-468 DCAA Audit Environment

taxpayer dollars. In addition, an ineffective audit quality control system

and a “clean” peer review opinion compounded the problem, hindering

DCAA management from identifying and correcting agencywide audit

quality problems.

DCAA’s current mission statement does not address protecting the public

interest in the manner in which it carries out audits to help assure that

contractors charge fair and reasonable prices that comply with applicable

laws and regulations, cost accounting standards, and contract terms.

Instead, DCAA’s mission statement calls for it to perform all necessary

contract audits for DOD and provide accounting and financial advisory

services regarding contracts and subcontracts to all DOD components

responsible for procurement and contract administration. Similarly,

DCAA’s 2006 strategic plan focused on various processes and outputs.

DCAA’s strategic plan contains the following five strategic goals with

targeted completion dates from 2006 through 2008:

DCAA’s Mission Statement and

Strategic Plan Do Not Focus on

the Public Interest

1. fostering a quality work-life environment that promotes trust,

teamwork, mutual respect, superior job performance and high morale;

2. assuring customer satisfaction by providing timely and responsible

audits and financial services that meet or exceed customer

requirements and expectations;

3. attaining the highest level of professional competence through

continuous improvement in the management and performance of

audits and services;

4. providing best value audit and financial services through continuous

evaluation and improvement of audit and administrative processes;

and

5. providing an integrated information technology structure that

promotes effectiveness and efficiency in providing services for internal

and external customers.

DCAA objectives under each strategic goal focus on process

improvements and do not contain a clear plan for achieving the respective

goal or adequate quantitative and qualitative measures for determining

success, for example:

• One DCAA quality of work-life objective is to assess whether the

participative work team concept is the best model for facilitating

continuous process improvement. The underlying activities include

internal meetings and brainstorming sessions, literature reviews, and

developing recommendations for executive committee review. None of

Page 30 GAO-09-468 DCAA Audit Environment

the activities included refer to identifying best practices or working

with outside experts.

• Another objective is to hold or lower attrition in high turnover areas.

DCAA activities in this area include analyzing causes of attrition, and

conducting surveys of new hires and departing employees. None of the

related activities include surveys of like organizations, consideration of

best practices, or identifying and addressing causes of high attrition.

Moreover, in response to our requests for attrition data, DCAA

provided high-level summaries without any analysis.

• DCAA’s strategic goal for customer satisfaction, included the objective

of increasing by 20 percent annually the number of incurred cost audit

reports issued with contractor cumulative allowable cost worksheets,

completing 100 percent of identified incurred cost audits necessary to

accomplish Defense Contract Management Agency (DCMA)

performance goals for contract close-out and canceling funds.

DCAA’s strategic plan contains no explanation of the importance o

these objectives or how they link to DCAA’s mis

sion.

• A key goal related to best value audit services is for DCAA to manage

its cost per direct audit hour at a level sufficient to maintain DCAA’s

competitive advantage over the comparable national public firm

composite rate. One of the ways DCAA has achieved a low cost per

audit hour is to maintain a pay structure that caps journey-level

auditors at the GS-12 level. In addition, our work identified numerous

instances where entry-level auditors with little or no experience often

perform audit assignments by themselves. However, lower grade levels

and limited experience can place auditors at a disadvantage when

dealing with contractor officials.

The Government Performance and Results Act of 1993 (GPRA)

directed

federal agencies to shift their focus from traditional concerns of staffing

and activity levels to a broad focus on outcomes or results by (1) defining

a clear mission and desired outcomes instead of outputs, (2) measuring

performance to gauge progress, and (3) using performance information as

a basis for decision making. The act required agencies to meet with

Congress and key stakeholders to clearly define their mission and develop

Canceling funds refers to the point in time at which the availability of a fixed-year

appropriation cancels and is no longer available for recording, adjusting, and liquidating

obligations properly chargeable to the appropriation. (31 U.S.C. §§ 1552(a) and 1553(b)).

Pub. L. No. 103-62, 107 Stat. 285 (Aug. 3, 1993).

Page 31 GAO-09-468 DCAA Audit Environment

long-term strategic goals as well as annual goals that were linked to them.

Although these legislated requirements were directed at federal agencies,

including DOD, DCAA’s mission statement and strategic plan were not

revised to conform to GPRA requirements.

GPRA also requires that once federal agencies establish their strategic

goals they are to develop results-oriented measures for assessing

performance in meeting those goals and publicly report on how well they

are doing. However, most of DCAA’s performance metrics continued to

focus on output. Several DCAA managers noted that fear of outsourcing

the contract audit function led DCAA to emphasize performance metrics

that demonstrated high productivity and low cost. In fiscal year 2008,

DCAA reported some results-oriented performance measures, such as

return on investment and net savings related to questioned cost. However,

most of DCAA’s metrics focused on production and audit cost, including

cost per direct audit hour, 30-day cycle time on forward pricing audits, and

dollars audited per hour. In addition, DCAA’s focus on completing over

30,000 assignments annually with about 3,600 auditors continued to

emphasize production of audits instead of performing quality audits that

assured taxpayers that the government was paying fair and reasonable

prices for contracted goods and services.

Performance Metrics Were

Designed To Measure Output

DCAA’s audit quality assurance program was not properly implemented,

resulting in an ineffective quality control process that accepted audits with

significant deficiencies and noncompliance with GAGAS and DCAA policy.

Moreover, even when DCAA’s quality assurance documentation showed

evidence of serious deficiencies within individual offices, those offices

were given satisfactory ratings. GAGAS require that each audit

organization performing audits and attestation engagements in accordance

with GAGAS should have a system of quality control that is designed to

provide the audit organization with reasonable assurance that the

organization and its personnel comply with professional standards and

applicable legal and regulatory requirements, and have an external peer

review at least once every 3 years.

DCAA’s

udit Quality

Assurance Program Was

Ineffective

Our analysis of DCAA audit quality review documentation for 14 of 48

offices covered in audit quality reviews during fiscal years 2004 through

2006—the period covered in the last DOD OIG peer review—found that

although DCAA gave satisfactory ratings to 13 of the 14 FAOs, DCAA

GAO-07-731G, §§ 3.50-3.52.

Page 32 GAO-09-468 DCAA Audit Environment

reviewers reported that 10 of these offices had 2 or more instances of

serious GAGAS noncompliance, including inadequate planning, lack of

proper supervision, and insufficient support for reported conclusions and

opinions. However, DCAA gave only 1 of the 14 FAOs reviewed an

unsatisfactory rating. The failed FAO had 5 of 9 assignments reviewed with

at least two significant instances of noncompliance with GAGAS or DCAA

policy. Further, although DCAA headquarters performed a follow-up

review to confirm that problems identified at the failed office were

corrected, DCAA headquarters officials told us they did not perform

follow-up reviews to assure that the problems identified at other offices

were corrected.

In response to a DOD IG finding that DCAA quality assurance reviews did

not cover a sufficient number of internal control system audits, DCAA

increased the number of audits covered to date in its fiscal year 2007 and

2008 quality assurance reviews. However, DCAA continued to

inappropriately conclude that audits “demonstrated professional

judgment,” allowing reviewers to disregard serious deficiencies with

GAGAS in concluding on overall audit quality.

DCAA failed only 1 of the

40 FAOs as a result of its fiscal year 2007 and 2008 audit quality reviews.

Our analysis of DCAA’s audit quality results showed that 19 of the 40

FAO’s had two or more audits with at least 2 instances of significant

noncompliance with GAGAS or DCAA policy. However, 18 of these FAOs

received a satisfactory rating. DCAA headquarters has not yet followed up

with offices that had deficient audits.

The examples in table 4 show the disparity between DCAA quality

assurance reports of a “satisfactory level of compliance” and actual results

documented by quality assurance reviewers. The examples below also

illustrate the long-term nature of this problem.

In using professional judgment, GAGAS (GAO-07-731G, §§ 3.32 and 3.35) require auditors

to act diligently in accordance with applicable professional standards and ethical principles

in all aspects of carrying out their professional responsibilities.

Page 33 GAO-09-468 DCAA Audit Environment

Table 4: Summary of Selected DCAA Audit Quality Review Results

Region

Number and type

of audits

DCAA audit quality review conclusions and findings

Eastern 5 incurred cost

audits

On October 28, 2008, DCAA reported a satisfactory level of compliance for the FAO reviewed.

Supporting documentation showed that reviewers found that 2 of 5 audits reviewed had at least

2 instances of significant noncompliance with GAGAS and DCAA policy, including insufficient

supervisory involvement and inadequate workpaper documentation to support significant auditor

judgments and conclusions.

North-eastern 8 forward pricing

audits

On September 27, 2007, DCAA reported satisfactory compliance by the FAO reviewed.

Supporting documentation showed that reviewers found that 4 of 8 audits had at least 2

significant instances of noncompliance with GAGAS or DCAA policy and 2 of the 4 audits had 3

instances of noncompliance, including inadequate planning and supervision and failure to

exercise reasonable professional judgment.

Central 8 other (various)

assignments

On April 4, 2006, reviewers gave the FAO reviewed a satisfactory rating. However, supporting

documentation showed that audit quality reviewers found that 2 of 8 assignments had at least

two significant deficiencies related to noncompliance with GAGAS and DCAA policy, including

inadequate planning on 3 assignments and inadequate supervision on 2 assignments.

Reviewers also determined that the auditor on one other assignment had not met the annual

requirement for continuing professional education.

Western 5 incurred cost

audits

On April 26, 2005, reviewers gave the FAO a satisfactory rating. Although the audit quality

review documentation identified only 1 audit that had at least 2 instances of significant

deficiencies, the documentation noted limited testing and stated that statistical sampling was not

used, as required. The reviewers also found that audit working papers did not support the

conclusions in the audit report. The reviewers noted that insufficient supervisory involvement

was responsible in part for the deficiencies found in the audit.

Mid-Atlantic 6 incurred cost

audits

On September 29, 2005, reviewers reported a satisfactory level of compliance for this FAO.

However, supporting documentation showed that 4 of the 6 audits had at least 2 significant

deficiencies related to noncompliance with GAGAS and DCAA policy. For example, audit quality

reviewers noted that the risk assessment for one assignment inappropriately stated the

contractor’s accounting system was adequate. In addition, reviewers stated that conclusions and

opinions in reports for three audits were not based on sufficient evidence. Reviewers also noted

that three audits had significant deficiencies, including insufficient testing, inadequate

procedures to identify illegal acts and noncompliance with laws and regulations, and reporting

problems. Reviewers also found inaccuracies in reporting on three audits and stated that reports

on 2 of the audits should not have been issued and a reported qualification in the report for the

third audit was worded incorrectly and implied that work had been performed when the related

assist audits had not been completed.

Eastern 6 internal control

audits

On June 8, 2004, DCAA reported satisfactory compliance by the FAO reviewed. However,

supporting documentation showed that 2 of 6 audits reviewed had at least 2 instances of

significant noncompliance with GAGAS and DCAA policy, including inadequate supervision,

missing workpapers on the contractor’s control environment, and insufficient and incomplete

workpaper evidence to support conclusions in the audit reports.

North-eastern 8 forward pricing

audits

On June 26, 2003, DCAA reviewers reported satisfactory level of compliance by the FAO

reviewed. Audit quality review documentation showed that reviewers found that 6 of the 8 audits

had at least 2 instances of significant GAGAS or DCAA policy noncompliance. For example, 2

audits were not adequately planned and 4 audits had inadequate supervisory involvement. In

addition, supervisory review was performed 10 days after the report was issued on one audit,

and audit work did not support the reported opinion on a second audit.

Source: GAO analysis of DCAA documentation.

Page 34 GAO-09-468 DCAA Audit Environment

In March 2009, DCAA officials advised us that going forward, DCAA plans

to report all audit quality review findings along with recommendations for

corrective action and follow-up to assure that FAOs have taken

appropriate corrective action.

The DOD IG reported an adequate (“clean”) opinion on DCAA’s most

recent peer review results although the reported evidence indicated that

numerous audits had serious deficiencies in audit quality.

In conducting

DOD’s audit oversight review of DCAA audits for fiscal year 2006, DOD IG

audit oversight reviewers considered the same results of DCAA’s internal

audit quality assurance reviews that we analyzed and reviewed numerous

additional audits, which also identified significant GAGAS noncompliance

as evidenced by DOD IG peer review findings and recommendations.

Although the DOD IG report contained evidence of significant, systemic

noncompliance with professional standards throughout DCAA audits that

OIG staff reviewed, and the IG report included numerous findings and

recommendations related to those issues, the DOD IG gave DCAA a

“clean” peer review opinion,

concluding that:

DOD IG Peer Review O

inion

on DCAA’s Audit Quality

Control System Is Inconsistent

with the Underlying

Deficiencies Reported

“In our opinion, the DCAA system of quality control for audits and

attestation engagements performed during the FY ended September 30,

2006, was designed in accordance with quality standards established by

Government Auditing Standards (GAS). Further, the internal quality

control system was operating effectively to provide reasonable

assurance that DCAA personnel were following established policies,

procedures, and applicable auditing standards. Accordingly, we have

determined that the DCAA system of quality control used on audits and

attestation engagements for the review period ended September 30,

2006, is adequate.”

The overall report conclusion in the DOD IG report is not consistent with

the detailed observations in the report, which indicate numerous

significant deficiencies in DCAA’s system of quality control. Furthermore,

based on DCAA’s actions to rescind dozens of audit reports

related to our

All 10 categories of recommendations in the DOD IG’s report related to GAGAS

compliance problems.

DOD Inspector General, Oversight Review: Review of the Defense Contract Audit

Agency Quality Control System, Report No. D-2007-6-006 (Arlington, VA: May 1, 2007).

Of the 80 rescinded audit reports, 39 reports were issued in fiscal year 2006—the period

covered in the DOD IG peer review report on DCAA.

Page 35 GAO-09-468 DCAA Audit Environment

prior investigation and this audit and our analysis of DCAA’s internal audit

quality review procedures and documentation—all of which relate to the

period covered by the DOD IG peer review—we concluded that DCAA’s

quality control system for the period covered by the last DOD IG peer

review was not effectively designed and implemented to provide

assurance that DCAA and its personnel comply with professional

standards. The DCAA audits performed during fiscal years 2007 and 2008

were performed under the same policy guidance and production-related

performance metrics as the earlier audits and had the same types of

GAGAS noncompliance, as indicated by DCAA’s internal audit quality

review findings for audit reports issued in fiscal years 2007 and 2008.

In the absence of a risk-based audit planning approach, DCAA has

historically performed 30,000 to 40,000 audits annually to support

contracting community decisions on contract awards, administration, and

close-out using 3,000 to 4,000 auditors—an average of about 10 audit

reports per year for each auditor. The large number of assignments has

contributed to the production-oriented environment and widespread

problems we have identified with audit quality. The failure to perform

quality audits leaves government contracting officers and disbursing

officers with inadequate information, ultimately putting taxpayers at risk

of improper contract payments and fraud, waste, abuse, and

mismanagement. GAO’s Standards for Internal Control in the Federal

Government

require federal agency managers to identify and assess

relevant risks the agency faces from external and internal sources

associated with achieving agency objectives, such as those defined in

strategic and annual performance plans developed under the GPRA. To do

this, management needs to consider all significant interactions between

the entity and other parties as well as internal factors at the agency and

activity levels. The specific risk analysis methodology used can vary by

agency because of differences in agency missions and the difficulty in

qualitatively and quantitatively assigning risk levels. For example, DCAA

would need to consider requirements in law and federal regulation to audit

contractor cost, price, schedule, systems, and compliance with laws,

regulations, cost accounting standards, and contract terms. DCAA also

would need to consider risks associated with contractor activity and the

materiality of contractor costs. Once risks have been identified, sound

management controls require that they should be analyzed for their

DCAA Lacks a Risk-Based

Audit Planning Approach

GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1

(Washington, D.C.: November 1999).

Page 36 GAO-09-468 DCAA Audit Environment

possible effect, and management should decide how to manage the risk

and what actions should be taken.

A risk-based audit approach would help identify and prioritize which

audits are the most important or have the highest return on investment

and determine what constitutes appropriate testing for various audit and

nonaudit services. Basing future audit plans on historical DCAA audit hour

data is problematic because DCAA has not yet determined the time and

effort that would be needed to perform quality audits. For example,

historical audit hour data do not accurately reflect either the time needed

to complete a quality audit or the hours actually worked on various audits

because many auditors performed limited procedures or they performed

audit procedures on their own time to meet budgeted audit hour metrics.

In addition, some audits may not be necessary. For example, we

concluded that 3 of the 37 internal control audits that we reviewed were

not necessary. For one of the three audits, DCAA could have relied on the

audit of a grantee that was performed under the Single Audit Act.

DCAA

agreed with our conclusion. Two other unnecessary audits involved

estimating systems of contractors that only have one contract with the

government. Because contract proposals, which would be tested as part of

the estimating system audit for these contractors, are separately audited

when they are submitted, we questioned the need for separate estimating

system audits for these contractors. DCAA officials told us they would

reconsider the need for separate estimating system audits in such cases.

Developing a risk-based audit approach that considers the risk of

improper contract payments and available resources would also be a first

step in determining the level of audit resources and training needed to

accomplish effective contract audits. In addition, determining appropriate

roles and responsibilities for nonaudit assignments would further clarify

DCAA audit resource needs as well as needed job skills and funding for

buying commands and DCMA.

The most pervasive audit deficiency we identified was insufficient testing

to support DCAA’s reported conclusions and opinions. Limited audit

testing was directly related to DCAA’s goal of performing 30,000 or more

Codified, as amended, at 31 U.S.C. ch. 75. The Single Audit Act requires that a state, local

government or non-profit organization that expends more than $500,000 in a fiscal year

undergo a single audit, which includes an audit of the entity’s financial statements and

Schedule of Expenditures of Federal Awards, as well as testing of and reporting on certain

internal controls.

Page 37 GAO-09-468 DCAA Audit Environment

audit assignments annually. Achieving a goal of performing quality audits

will depend, in part, on appropriate guidance on testing coupled with

adequate training and supervision. Quality audits will also be dependent

upon contracting community support of a risk-based audit approach and

an appropriate delegation of nonaudit contract administration activities

and audit responsibilities among DCMA, buying commands, and DCAA. As

noted above, DCAA provides nearly all of its services to the contracting

and finance communities as GAGAS audits. However, a risk-based audit

approach may require these communities to re-evaluate whether all such

services should be provided as audits and whether DCAA, as an

independent audit organization would perform any nonaudit services.

DCAA’s deficiencies in audit quality are directly related to its human

capital management. Effective, efficient contract audits and oversight are

dependent on a workforce that has the required skills to meet

organizational goals and perform quality audits that serve the public

interest, especially the taxpayer. Both GAGAS and GAO’s Internal Control

Standards

require that personnel possess and maintain a level of

competence that allows them to accomplish their assigned duties. GAGAS

specifically requires that the staff assigned to conduct audit or attestation

engagements under GAGAS must collectively possess the technical

knowledge, skills, and experience necessary to be competent for the type

of work being performed before beginning that assignment.

GAGAS also

requires attestation engagements to be properly supervised.

Accordingly,

agency management has a responsibility to identify appropriate

knowledge and skills needed for various jobs and provide needed training,

as well as candid and constructive counseling, and performance

appraisals. DCAA’s human capital management practices of hiring auditors

at the entry-level and assigning them to complex audits with little

classroom training or on-the-job experience and minimal supervision have

contributed to the audit problems we identified.

DCAA Lacks Effective Human

Capital Management

Inadequate training and supervision. DCAA headquarters officials

acknowledged that the agency could improve developmental training and

that it does not have continuing training for DCAA auditors throughout

their career, referred to by DCAA as life-cycle training. Given the

GAO-07-731G §§ 3.40 through 3.49, and GAO/AIMD-00-21.3.1.

GAO-07-731G, § 3.43.

GAO-03-673G, § 60.04a, and GAO-07-731G, § 6.04a.

Page 38 GAO-09-468 DCAA Audit Environment

complexity of contract audits and identified DCAA audit quality problems,

timely and effective training and appropriate supervision are critical to

achieving effective audits. Auditors also should understand the

professional standards they are required to follow.

In addition, we found that on-the-job-training and supervision, which are

key components of developmental training, were not consistently provided

to new auditors. On-the-job training for new auditors varied by supervisor

and by DCAA field office. For example, we previously reported

that one

of the offices in our hotline investigation had addressed this training need

by assigning one supervisor to oversee trainee auditors and assigning

trainee auditors to senior auditors who provided them on-the-job training

during a particular audit. However, we identified 13 CAS compliance

audits at this same office to which trainee auditors were assigned with

little or no training or supervision. In addition, documentation for one of

the team performance awards that we recently obtained from this office

contained evidence that some trainee auditors were immediately given an

audit assignment to carry out on their own. The performance award

documentation stated as an achievement that “new hires were purposely

assigned their own assignments as early as deemed appropriate in order to

instill in them early the concept that they are responsible for the planning

and conduct of their assigned audits. The supervisory and senior

auditor…made a conscious decision to do this to avoid dependency issues

with the new auditors.”

Our discussions with auditors in DCAA’s 5 regions provide anecdotal

examples of the training problems we found. For example, one auditor

told us that entry level training is a “one-size-fits-all” approach that does

not provide the right training at the right time, while four auditors told us

they were not given enough time to develop their skills. One consistent

comment from auditors was that on-the-job training was key to auditor

effectiveness, but DCAA provided little or no opportunity for new auditors

to obtain this developmental experience. Several auditors told us that

trainees in their offices are given assignments to do on their own and that

while trainees may work with a senior level auditor, sometimes these

senior auditors do not take a leadership role that would provide a learning

experience for trainees. In addition, several auditors described DCAA’s

internal training courses as “good,” but noted that the courses covered

high-level conceptual and technical information and did not provide the

GAO-08-857.

Page 39 GAO-09-468 DCAA Audit Environment

detailed knowledge on how to apply this information when performing a

particular contractor audit. Some FAO managers share this concern.

Supervisors responsible for deficient audits identified in GAO’s

prior investigation were promoted. At the September 2008 hearing,

Committee Members expressed concerns about DCAA promotions of

supervisors who were responsible for improperly dropped audit findings,

unsubstantiated changes in audit opinions, and abusive management

actions against whistleblowers at locations covered in our investigation.

Best practices of leading organizations making organizational and cultural

changes include top leadership who set the direction, pace, and tone and

provides a clear, consistent rationale that unites staff together behind a

single mission. Agency management plays a key role by setting and

maintaining the organization’s ethical tone, providing guidance for proper

behavior, removing temptations for unethical behavior, and providing

discipline, when appropriate. Our review of GAO hotline allegations

received since our investigation showed that meeting metrics related to

producing reports within budgeted hours and planned time frames

resulted in performance awards for auditors who performed deficient

audits with little or no testing and lower performance ratings and

personnel actions that resulted in downgrades and termination of auditors

who did not meet these metrics. Further, our analysis of performance

appraisals and performance award information for auditors and

supervisors at the location in our investigation where supervisors had

been promoted

showed that the supervisory auditors responsible for

deficient audits at this location were rewarded with high performance

appraisals, cash awards, and promotions.

We obtained performance evaluations and performance award

documentation for auditors and supervisors involved with 12 audits that

had serious deficiencies at the first location we investigated in our prior

work. The DCAA Director told us that there are legal issues associated

with holding employees, such as the supervisory auditors, accountable for

actions that were identified after-the-fact. However, the two supervisory

auditors responsible for the deficient audits were approved for promotion

even though Western Region managers who made promotion decisions

were aware of the GAGAS compliance problems. DCAA’s Western Region

management had received the DOD IG’s January 24, 2007, memorandum of

investigation covering 10 audits performed at this location that did not

GAO-08-857.

Page 40 GAO-09-468 DCAA Audit Environment

meet GAGAS. Further, during the summer of 2007, Region management

was responding to issues identified in our hotline investigation, which

mirrored the IG’s concerns and raised concerns about GAGAS compliance

with four additional audits. Despite these findings, we found no evidence

that supervisors and auditors who did not follow GAGAS and DCAA policy

were disciplined, counseled, or required to take additional training.

Instead, our review of performance appraisal and awards documentation

showed that the supervisors and auditors responsible for the deficient

audits received performance appraisals ranging from “exceeds fully

successful” to “outstanding” along with numerous cash awards. One of the

two supervisors responsible for inappropriate decisions to drop audit

findings and change opinions without supporting evidence was promoted

on October 14, 2007, and the second supervisor was selected for

promotion on July 25, 2008—3 days after our investigative report was

issued. DCAA placed a hold on the second supervisor’s promotion pending

further investigation. In addition, a senior auditor who dropped audit

findings without support at the direction of the second supervisor was

promoted to a supervisory auditor position on January 6, 2008. In contrast,

the performance appraisal of the senior auditor witness from that office

who testified at the Committee’s September 2008 hearing was lowered two

levels from “outstanding” to “fully successful” following the submission of

her hotline complaint, and she received no cash awards. DCAA has

rescinded all 12 audit reports and re-performed the 12 audits associated

with our investigation at this field location.

Allegations about abusive management actions have continued. We

found that DCAA’s current organization is highly decentralized, fostering a

culture of region autonomy. Within this culture, DCAA’s Western Region

appears to have continuing problems with unresolved allegations of

abusive management actions. For example, 21 of the 34 DCAA hotline

allegations we received since our July 2008 report,

include examples of

abusive management actions, such as auditors being penalized for

attempting to perform what they believe was sufficient testing to support

audit opinions and auditors not completing work within established

timeframes. Nine of these 21 allegations relate to DCAA’s Western

Region—the subject region in our prior hotline investigations. Seven of the

9 allegations relate to current problems in the Western Region. Our review

We spoke to the auditors and reviewed documentation they provided. To the extent that

the auditors also submitted complaints to DCAA’s anonymous Web site, we reviewed

DCAA’s handling of their complaints.

Page 41 GAO-09-468 DCAA Audit Environment

of DCAA anonymous Web site contacts as of the end of May 2007 showed

that over 40 percent (65 of 152) of the DCAA contacts also relate to the

Western Region, including several that pertain to abusive management

actions.

Although DCAA headquarters officials have followed up on some

of the complaints about management abuse that they received, decisions

on disciplinary or corrective action typically have been delegated to region

management. DCAA headquarters officials explained that in several cases,

Western Region management has not agreed to take disciplinary or other

available corrective actions. The officials told us that DCAA hotline staff

have no recourse in these situations.

Although DCAA has taken several positive steps, much more needs to be

done to address widespread audit quality problems. DCAA’s production-

oriented culture is deeply imbedded and likely will take several years to

change. Under the decentralized management environment, there has been

little headquarters oversight of DCAA regions, as demonstrated by

nationwide audit quality problems. Further, DCAA’s culture has focused

on hiring and promoting from within the agency and most training has

been conducted by agency staff. This has led to a very insular culture

where there are limited perspectives on how to make effective

organizational changes. In response to our July 2008 investigative report,

DOD’s former Comptroller/CFO and Defense Business Board (DBB)

conducted reviews

of DCAA operations and made recommendations for

corrective actions. The recommendations of the DBB are consistent with

many of the recommendations discussed later in this report. DCAA has

taken actions to revise performance metrics, change certain policy

guidance, and obtain an independent organizational assessment (staff

survey); however, DCAA has not yet addressed the fundamental

weaknesses in its mission, strategic plan, audit approach, and human

capital practices. Moreover, DCAA actions to date have focused on

DCAA Has Made

Progress, but

Correcting

Fundamental

Problems in Agency

Culture That Have

Impacted Audit

Quality Will Require

Sustained Leadership

After we provided our report to DOD for comment, we received updated information on

DCAA anonymous Web site complaints. As of the end of July 2009, DCAA had established

209 cases. Eight of those cases were immediately referred to the DOD IG for investigation.

Of the 209 cases, 82 were for the Western Region.

GAO-08-857.

Based on audit quality problems identified in our July 2008 report, in August 2008, the

DOD Comptroller/CFO conducted a tiger team review in August 2008 and also asked the

Secretary of Defense for support in conducting a study of DCAA. With the Secretary’s

approval, the DOD Advisory Panel determined that the Defense Business Board would

perform this study.

Page 42 GAO-09-468 DCAA Audit Environment

process and have not addressed the agency’s decentralized organizational

structure that has fostered a culture of DCAA region autonomy. On

October 23, 2008, the DBB discussed its preliminary findings and

recommendations at a public meeting, and on January 22, 2009, the DBB

released its DCAA study report, which concluded that:

• DCAA’s mission focused primarily on supporting the procurement

community with no mention of protecting taxpayer interest. The

current mission statement also provided for advisory services that

raised serious questions about DCAA’s independence and objectivity

under GAGAS.

• DCAA’s strategic plan did not address essential elements required by

GPRA, and it did not address emerging issues that could affect mission

accomplishment or contain a human capital strategic plan despite

spending 80 percent of its budget on personnel.

• None of DCAA’s 24 performance measures addressed audit quality,

such as conformance to GAGAS, and only 8 could be tied to DCAA’s

strategic plan.

• DCAA’s decentralized organizational culture dilutes effectiveness of

managerial oversight and affects GAGAS compliance and audit quality.

• DCAA has not established a human capital strategic plan as a key tool

to facilitate human capital management and workforce development in

support of DCAA’s mission and implementation of its strategic plan.

The following discussion summarizes the status of DCAA corrective

actions on identified weaknesses, including actions on key DBB and DOD

Comptroller/CFO recommendations.

DCAA’s Mission Statement

and Strategic Plan Have

Not Yet Been Revised

The DBB report, released in January 2009, pointed out that DCAA had five

versions of a mission statement, noting that each version focused

primarily on supporting the procurement community. The Board

concluded that DCAA’s mission should be refocused to protect the

taxpayer’s interests, writing: “The mission fostered the culture of

supporting contracting officials, and the value system was one of quantity

(number, cost, and timeliness of audits) over quality…which was further

reinforced by the performance metrics that drove the organization.” In

addition, the Board reported that instead of complying with GPRA

strategic planning requirements for long-term goals and objectives for

Page 43 GAO-09-468 DCAA Audit Environment

major operations and functions, DCAA’s plan resembled a short-term

process improvement checklist and did not address enterprise risk,

external factors, or emerging issues that could affect mission

accomplishment. In addition, the Board noted that DCAA’s strategic plan

did not include an adequate human capital strategy to facilitate workforce

development, recruiting, retention, and succession planning.

The DBB report recommended that the Secretary of Defense revise

DCAA’s mission to focus on protecting the interest of taxpayers, with the

taxpayer as the primary customer, and that DCAA establish a core value of

performing high quality, independent, and objective contract audits that

adhere to GAGAS and ensure that taxpayer dollars are spent on fair and

reasonable contract prices. The DBB did not address any amendments that

might need to be made to the FAR, DFARS, and DOD Directives and policy

documents that reflect DCAA’s primary role as an advisor to government

contracting officers and disbursing officers.

The Secretary of Defense Has

Not Yet Developed a DCAA

Mission Statement That

Focuses on Protecting the

Public Interest

Leading organizations that have undergone cultural and organizational

transformation have identified top leadership involvement in developing a

mission statement and strategic plan as a best practice. These

organizations consider top leadership commitment in setting the direction,

pace, and tone for the transformation as essential to provide a clear,

consistent rationale that unites agency components behind the mission to

guide the transformation. In meetings with DCAA officials, we expressed

our concern that the Secretary of Defense had not taken action to revise

DCAA’s mission statement. On March 12, 2009, following a discussion on

the preliminary results of our audit, the DCAA Director submitted a

proposed revision to DCAA’s mission statement to the Comptroller/CFO

for review. The proposed revision inserted phrases that refer to “…serving

the public interest” and “…ensure taxpayer dollars are spent on fair and

reasonable contract prices.” Although the revised mission statement had

not been approved by the Secretary of Defense as of the end of July 2009,

these changes would be positive.

The DBB also recommended that DCAA develop a strategic plan that

cascades from the revised mission statement and concurrently develop (1)

an annual performance operating plan and a balanced scorecard tied to

the strategic plan and (2) a human capital strategic plan. In addition, the

DCAA Has Not Yet Developed a

Strategic Plan To Provide a

Framework for Organizational

and Cultural Reform

On most contracting matters with DCAA involvement, the cognizant agency contracting

officer makes final decisions based on DCAA’s findings and recommendations.

Page 44 GAO-09-468 DCAA Audit Environment

DBB recommended that DCAA obtain an independent assessment of

resource needs and engage an external professional organization to assist

in a cultural transformation.

DCAA officials told us they are having difficulty identifying an

independent external professional organization to assist the agency in

developing a strategic plan because DCAA audits most of the organizations

that should be able to provide this type of assistance. In her February 27,

2009, response to the DBB report, the DCAA Director stated that DCAA

expects to complete action on this recommendation by September 2009.

With regard to the recommendation to develop a balanced score card, the

DCAA Director reported that based on agreements with prior DOD

Comptroller/CFOs, DCAA plans to use a monthly status report of agency

performance measures rather than developing a balanced score card.

Together with the change in performance measures for fiscal year 2009,

DCAA implemented the monthly performance report in October 2008. The

DCAA Director stated that DCAA will refine the annual performance plan

in accordance with development of a revised strategic plan.

The DCAA Director also stated that DCAA initiated a process to

reengineer its human capital strategic plan in November 2008. The

Director stated that DCAA obtained example plans from other

organizations and attended training on human capital plan preparation and

maintenance. DCAA is also seeking assistance from external organizations

in reengineering its human capital plan.

DCAA’s Director Took

Immediate Action To

Eliminate Production

Metrics, but Concerns

about Audit Quality

Measures Remain

The Committee’s September 2008 DCAA oversight hearing raised concerns

that DCAA’s performance metrics focused on producing reports rather

than performing quality audits and that auditors who attempted to perform

quality audits were penalized for not meeting production goals. The DCAA

Director acknowledged problems with the agency’s metrics and stated that

she had initiated a project to assess the agency’s use of performance

measures that would be completed by September 30, 2008. Performance

metrics provide the basis for measuring achievement of agency mission

and strategic goals. Accordingly, performance measures should be

consistent with agency strategic goals. Although DCAA’s mission

statement and strategic plan have not yet been revised to provide new

goals, the DCAA Director took action in September 2008 to eliminate

production-oriented performance measures. On September 30, 2008, the

Director issued a policy memorandum that eliminated 18 performance

measures, identified 9 performance measures with goals for use in fiscal

year 2009, and clarified the use and level of reporting on the revised

Page 45 GAO-09-468 DCAA Audit Environment

measures. Some of the new performance metrics focus on outcomes,

while others continue to focus on producing low cost audits in fixed time

frames.

The DOD Comptroller/CFO required DCAA to develop standard metrics to

measure and re-enforce compliance with GAGAS and CAM across DCAA

by February 28, 2009. The DCAA Director reported that the new metrics

established on September 30, 2008, met this requirement. DCAA identified

the following six new performance metrics as focusing on the intended

outcome-related goal of achieving quality audits that comply with

GAGAS.

New Performance Metrics

Intended To Focus on

Achieving Quality Audits

1. Obtaining an unqualified DOD IG peer review opinion.

2. DCAA’s internal quality assurance program results show that 100

percent of the audits reviewed reflected professional judgment.

3. Checklist confirmation that issued reports did not include serious

deficiencies.

4. A goal that 45 percent of audit reports will have findings as an

indication of the tangible value of the audit work performed.

5. A goal that 15 percent of the audits will use quantitative methods to

measure the extent to which advanced level audit techniques are used.

6. A goal that auditors will meet 100 percent of their continuing

professional education requirements on time.

Only metrics number 1, 3, and 6 have a direct relationship to audit quality.

Although metric number 2 could improve audit quality if properly

implemented, DCAA gave passing scores to deficient audits. Given the

problems with DCAA’s ineffective quality assurance program and DOD IG

peer review results, for these three metrics to achieve the intended audit

quality goal, significant changes will be needed in policy guidance and

training on audit standards, appropriate procedures, and audit

documentation in order to comply with GAGAS. The fourth goal that 45

percent of DCAA audit reports will have findings is approximately the

same as the actual percentage of 41 percent of the reports in 2008.

Because findings would support recommendations for corrective action,

this metric could contribute to improvements in accountability over

contractor cost and billings. Regardless of the goal, findings should be

reported as appropriate based on the completion of quality audits. Further,

the use of quantitative methods of analysis in audit reports needs to be

DCAA also established contracting officer sustention rates related to questioned cost and

net savings as an informational goal to show return to the taxpayer.

Page 46 GAO-09-468 DCAA Audit Environment

supported by training on the appropriate methods for sampling and testing

contract costs, controls, and compliance to help auditors perform

sufficient testing to support audit conclusions and opinions.

Although three of DCAA’s fiscal year 2009 metrics are important in that

they address responsiveness to contracting officer requests for audits, if

not properly managed, they could impact the effectiveness of DCAA’s new

audit quality metrics. In the past, DCAA’s efforts to meet contracting

officer requests for audits within specified time frames caused auditors to

sacrifice audit quality. The following three performance metrics continue

to address issuing reports within specified times to support contract

awards and closeouts.

Performance Metrics That

Continue To Measure Output

• A forward-pricing audit timeliness goal of 95 percent based on

agreement with requesters.

• Incurred cost audit timeliness goals of 90 percent of corporate audits

completed within 12 months, 90 percent of major contractor audits

completed in 15 months, and 95 percent of non-major contractor audits

completed in 24 months.

• An efficiency goal of cost per direct audit hour of less than $113.45 to

be monitored at the agency level only.

It is critical that agreements with the contracting community on timeliness

goals for forward-pricing and incurred cost audits allow performance of

sufficient audit procedures to help contracting officers ensure that prices

paid by the government are fair and reasonable, and that contract costs

comply with applicable laws, regulations, cost accounting standards, and

contract terms. In addition, keeping cost per direct audit hour in line with

past practices indicates that DCAA likely would continue to use trainee or

junior auditors on assignments without senior auditor or supervisory

auditor involvement. GAGAS requires that staff assigned to perform the

audit or attestation engagement must collectively possess adequate

professional competence for the tasks required.

Moreover, DCAA has not

agreed to develop a risk-based audit approach to address how it will

perform required audits with available audit resources, reassess the need

to perform 30,000 or more audits annually, and establish priorities for

performing quality audits that meet GAGAS within available resources.

GAO-07-731G, § 3.40.

Page 47 GAO-09-468 DCAA Audit Environment

On October 30, 2008, DCAA required regional audit managers to provide

training on changes in performance metrics to all FAOs by December 31,

2008, as part of the effort to get the word out that DCAA’s mission should

be to protect taxpayer interest and that auditors should perform quality

audits that meet GAGAS. The DCAA Director stressed to us that budgeted

audit hours would be captured for planning purposes, but they were never

intended and should not have been used to evaluate auditor performance.

The DCAA Director also told us that DCAA auditor performance

appraisals should not have considered exceeding budgeted audit hours as

a performance failure. In addition, DCAA implemented an anonymous Web

site for capturing feedback on inappropriate use of the new performance

measures and abusive management actions.

During random telephone calls made to 17 auditors across 15 FAOs in the

five DCAA regions, we found mixed results on FAO implementation of

DCAA’s new performance metrics. DCAA’s Assistant Director of

Operations told us she also had become aware of some problems with

regional audit managers meeting the requirement to provide training to

FAOs on implementation of the new DCAA performance metrics. The

Operations Assistant Director told us that she planned to follow-up with

all FAOs in this regard. In response to our telephone calls, for example:

Inconsistent Implementation

and Training on New Metrics

• Auditors at 13 of the FAOs told us that metrics related to meeting

budget hours for completing audits have been relaxed. Although most

of these auditors were not aware of audit completion dates in fiscal

year 2009 program plans for their offices, two auditors told us that

audit completion dates had been pushed back to allow more time for

performing individual audits. An auditor at a Northeast Region FAO

told us the use of budget hours was flexible before the metrics

changes, so there was no noticeable difference. An auditor at a

Western Region FAO said that although budget hours are no longer a

metric for individual auditor performance, there is still a lot of pressure

on auditors to meet budgeted hours.

• Auditors at 5 of the 15 FAOs told us they had received the mandatory

training on changes in performance metrics prior to December 31,

2008. However, auditors at 4 FAOs told us they received the mandatory

training after December 31, 2008, including two auditors at one Eastern

Region FAO who told us they did not receive the required training until

February 13, 2009. Auditors at the other 6 FAOs told us they received

the metrics training, but they could not remember the dates of the

training.

Page 48 GAO-09-468 DCAA Audit Environment

• Auditors at 5 FAOs told us they were permitted to charge from 1 to 2

hours of administrative time per pay period for reading e-mails on

DCAA policy changes and new policy memorandums. Auditors at 2

FAOs said they were not given an administrative code for this purpose.

One of these auditors told us they read the policies on their own time.

Auditors at the remaining 8 FAOs did not mention a time limit for

reading DCAA policy memoranda. DCAA headquarters officials told us

that auditors should be permitted to charge administrative codes for

this purpose and that they are working to resolve this issue across

DCAA.

The DCAA Director advised DCAA employees that the new performance

metrics would be revisited after 6 months to determine if changes are

needed. On February 11, 2009, DCAA revised its fiscal year 2009 job

objectives/performance plans to reflect the new performance measures,

and DCAA’s Deputy Assistant Director of Operations advised us that

DCAA initiated an assessment of the new performance metrics in April

2009.

DCAA Has Centralized, but

Has Not Yet Restructured

Its Audit Quality

Assurance Program

DCAA has taken some actions to improve its quality assurance program.

However, staffing difficulties and other issues have left the outcome of this

important initiative uncertain. As previously discussed, GAGAS require

that each audit organization performing audits and attestation

engagements in accordance with GAGAS should have a system of quality

control that is designed to provide the audit organization with reasonable

assurance that the organization and its personnel comply with

professional standards and applicable legal and regulatory requirements,

and have an external peer review at least once every 3 years.

In addition,

considering the large number of DCAA audit reports issued annually and

the reliance the contracting and finance communities have placed on

DCAA audit conclusions and opinions, an effective quality assurance

program is key to protecting the public interest. Such a program would

report review findings along with recommendations for any needed

corrective actions; provide training and additional policy guidance, as

appropriate; and perform follow-up reviews to assure that corrective

actions were taken. When we briefed DCAA on our preliminary findings in

March 2009, DCAA had not yet taken action to correct serious deficiencies

in its quality assurance program, including problems with DCAA’s

application of the professional judgment standard, whereby quality

GAO-07-731G, §§ 3.49-3.52.

Page 49 GAO-09-468 DCAA Audit Environment

assurance program officials gave satisfactory ratings when significant

noncompliance with GAGAS had been identified by reviewers.

In response to our previous report, on August 20, 2008, the DOD

Comptroller/CFO required that DCAA take certain actions to improve

audit quality, which included a restructuring of DCAA’s quality assurance

function. Accordingly, on August 22, 2008, DCAA established a new

headquarters Directorate for Quality Assurance and Integrity, which

centralized the quality assurance function at DCAA headquarters. The

DOD Comptroller/CFO directed that the new Quality Assurance

Directorate be headed by a Senior Executive Service (SES) Deputy

Director. Because DOD did not grant DCAA an additional SES position for

this purpose, the DCAA Director assigned responsibility for leading

DCAA’s quality assurance function to a level GS-15, Assistant Director for

Integrity and Quality Assurance. Under DCAA’s management environment

and culture, which continue to foster autonomous regions headed by SES-

level directors, the grade level and experience of the GS-15 equivalent

Assistant Director for Integrity and Quality Assurance pose a challenge

when dealing with SES-level regional directors, deputy directors, and

regional audit managers. For example, when presented with our findings

and conclusions that various audits did not comply with GAGAS, DCAA

headquarters policy and quality assurance managers allowed regions and

FAO’s to decide whether to rescind the subject audit reports. In March

2009, DCAA officials advised us that the GS-15, Assistant Director for

Integrity and Quality Assurance position is an intended SES position and

that two GS-15 Assistant Directors will perform as Chief of Integrity and

Chief of Quality Assurance.

In centralizing the quality assurance program, DCAA’s new quality

assurance organization provides for five GS-14 senior quality assurance

auditors at DCAA headquarters and up to 27 GS-13 quality assurance

auditors in the field assigned across the 5 DCAA regions. However, a

headquarters requirement that all senior quality assurance staff relocate to

DCAA headquarters at Fort Belvoir, Virginia, resulted in all but one of the

five senior staff accepting other positions within DCAA because they did

not wish to relocate. It took several months to recruit DCAA staff for the

senior quality assurance positions at DCAA headquarters. On July 10, 2009,

a DCAA headquarters official advised us that DCAA had selected staff to

fill the two remaining vacancies, and these staff would be reporting for

duty in the next few weeks.

In response to our concerns that DCAA’s quality assurance program has

not resulted in audits that comply with GAGAS, DCAA officials advised us

Page 50 GAO-09-468 DCAA Audit Environment

that going forward, DCAA will no longer rate an FAO’s overall compliance

with GAGAS and DOD policy. The officials told us that instead, DCAA

headquarters plans to (1) report the detailed results of the audit quality

reviews, (2) make recommendations to FAOs for any needed corrective

actions, (3) conduct follow-up reviews for all FAOs with identified audit

deficiencies to ensure that corrective actions are taken, and (4) provide

training and policy guidance, as appropriate. If properly implemented,

these procedures would help to assure an effective audit quality assurance

program.

DCAA Disagrees with the

DBB Recommendation for

a Risk-Based Audit

Planning Process

The DBB recommended that DCAA establish a risk-based planning

process that expands DCAA self-initiated audits and increases the

potential for identifying fraud, waste, and abuse, and higher rates of return

to the taxpayer by April 2009. The DBB intended for DCAA to audit any

and all contracts awarded by the department. On February 27, 2009, in

responding to the DBB recommendation, the DCAA Director stated that

(1) DCAA’s practice of auditing only certain contracts was due to

regulation or statute and (2) absent the DCAA access-to-records clause in

certain types of contracts, DCAA has no legal basis to obtain cost data

from a contractor. The DCAA Director suggested that the DBB

recommendation should be directed to the Under Secretary for

Acquisition, Technology and Logistics, who oversees DCMA, and not

DCAA. The DCAA Director told us that she believes that DCMA should

address this recommendation because DCMA decides what audits DCAA

should perform to support contracting decisions and DCMA would need to

initiate action to change audit-related FAR requirements.

Generally, DCAA, as the agent of the Secretary of Defense, has authority

to examine records of (1) a contractor performing any cost-

reimbursement, incentive, time-and-materials, labor-hour, or price re-

determinable contracts and subcontractors performing such contracts of

the contractor and (2) to evaluate the accuracy, completeness, and

currency of certified cost or pricing data required to be submitted

pursuant to law, all records of the contractor or subcontractor related to

the proposal, and discussions conducted on the proposal, pricing of the

contract or subcontract or performance of the contract or subcontract.

This authority is implemented by insertion of the Audit of Records clause

in solicitations for negotiated contracts.

In addition, the Director of

10 U.S.C. § 2313 and § 2306a.

FAR §§ 52.214-26, 52.215-2.

Page 51 GAO-09-468 DCAA Audit Environment

DCAA may require by subpoena the production of any records of a

contractor that the Secretary of Defense is authorized to audit or examine.

While DCAA does not have access to the records of all DOD contractors or

statutory rights of access to contractor officials, we believe it has

sufficient authority to undertake a risk-based audit approach consistent

with its existing authority. Therefore, we believe the DBB

recommendation for DCAA to develop a risk-based audit planning

approach is appropriate. DOD acquisition officials we met with agree.

Further, as previously discussed, a risk-based audit approach would

provide a basis for determining audit resource requirements.

DCAA has selected the Army Force Management Support Agency

perform its staffing study. However, DCAA is conducting a staffing study

as a stand-alone effort rather than performing the study in concert with an

effort to establish a risk-based planning process. To provide useful

information for decision making, it is important that the staffing study and

risk-based audit planning approach are conducted as integrated efforts. It

is also important for the DOD contracting and finance communities to be

involved in the staffing study analysis and planning process because, as

discussed earlier, a risk-based audit approach may require these

communities to re-evaulate whether all DCAA services should be provided

as audits and whether DCAA, as an independent audit organization, should

perform any nonaudit services.

To address immediate staffing needs, DCAA requested funds for additional

audit staff and training from the Defense Acquisition Workforce

Development Fund,

including 300 positions for fiscal year 2009 and

another 200 positions in 2010. DCAA received approval of this request in

December 2008. In May 2009, as part of DOD’s request for an additional

9,000 positions for contract management and oversight, the DCAA request

was increased from 500 to 700 new positions that are to be phased in from

The Army Force Management Support Agency’s mission includes providing requirements

studies and staffing analysis as well as determining whether organizations have the

appropriate staff to carry out their mission. The Army Force Management Support Agency

also provides services to DOD components.

Pub. L. No. 110-181, §1705, 122 Stat. 3 (Jan. 28, 2008), the National Defense Authorization

Act for Fiscal Year 2008, authorized the Secretary to establish the Department of Defense

Acquisition Workforce Fund, in addition to other funds that may be available, for the

recruitment, training, and retention of department acquisition personnel. The fund is

managed by the Under Secretary of Defense for Acquisition, Technology, and Logistics.

Page 52 GAO-09-468 DCAA Audit Environment

fiscal year 2009 through 2011.

As previously discussed, without

developing a risk-based audit approach, it is difficult to determine the level

of resources needed to perform effective, quality contract audits.

However, federal acquisition and contract audit resources have not kept

pace with the growth on federal procurements. As shown in figure 2,

although procurement obligations related to greater reliance on

contractor-provided services and support of the Global War on Terrorism

have more than doubled since fiscal year 2002, DCAA audit resources have

remained about the same. In addition, contractor and subcontractor

relationships have become more complex, increasing the complexity of

contract audits. These changes underscore the need for a risk-based audit

plan and assessment of auditor resource and training needs.

ine the level