A copy of any request from DCAA to a contractor for access to such reports, and

Transcription

1 56 Contract Management June 2013

2 Contract Management June

3 In section 832 of the 2013 National Defense Authorization Act, 2 Congress instructed the director of the Defense Contract Audit Agency (DCAA) to issue guidance concerning DCAA s right of access to contractors internal audit reports. This guidance must be issued by the first week in July Section 832 requires requests for internal audit reports to be adequately documented. The required documentation shall include: A written determination that such reports are necessary to complete required evaluations of contractor business systems, A copy of any request from DCAA to a contractor for access to such reports, and The response received from the contractor, including the contractor s rationale if access to requested reports was denied. The statute prohibits DCAA from using internal audit reports for any purpose other than evaluating and testing the efficacy of contractor internal controls and the reliability of associated contractor business systems. Section 832 does not give DCAA any right of access to contractor internal audit reports. It only requires DCAA to issue guidance on this topic and places limits on the uses that can be made of internal audit reports. Despite this, it is probable that DCAA will rely upon this section as giving DCAA authority to obtain a contractor s internal audit reports. However, this reliance would be misplaced and if DCAA has a right to obtain internal audit reports, that right must emanate from some other source. 58 Contract Management June 2013

4 DCAA s Mission and General Authority DCAA is a creature of regulation. It was established by Department of Defense (DOD) Directive Although DCAA auditors are part of the DOD acquisition workforce, the director is under the authority, direction, and control of the under secretary of defense (comptroller). In accordance with its charter: The DCAA, while serving the public interest as its primary customer, shall perform all necessary contract audits for the Department of Defense and provide accounting and financial advisory services regarding contracts and subcontracts to all DOD components responsible for procurement and contract administration. These services shall be provided in connection with negotiation, administration, and settlement of contracts and subcontracts to ensure taxpayer dollars are spent on fair and reasonable contract prices. DCAA shall provide contract audit services to other federal agencies, as appropriate. Thus, DCAA s two functions are to perform contract audits and to provide advice to procurement officials. DCAA s charter does not provide it with any authority to issue procurement regulations. 4 Accordingly, nothing in DCAA s Contract Audit Manual (CAM), which is available at is binding on contractors or contracting officers. The CAM s sole function is to provide audit guidance to DCAA auditors. 5 Current CAM Guidance on Access to Internal Audit Reports The current CAM guidance on access to internal audit reports is found at CAM The CAM requires contract audit coordinator 6 offices and field audit offices at major contractor locations to establish a process and a central point of contact (CPC) to obtain and monitor access to and use of internal audit reports. To accomplish this, the CPC will: Coordinate with the contractor and obtain a semiannual summary level listing of all internal audit reports issued. The summary document will contain sufficient descriptions to ascertain whether the internal audit may affect government contracts. Review the summary list of internal audits. If the summary is not adequate to determine which internal audits may affect government contracts, coordinate with the contractor to obtain the information necessary. Provide the summary list to the contract audit coordinator network or the field audit office s audit teams responsible for audits of the contractor. Send a request to the contractor for copies of reports and/or working papers considered pertinent by the auditors, and provide the auditors copies of the information obtained from the contractor. Once the audit teams receive the summary list, the auditors will determine which reports may apply to their specific audit assignments and coordinate with the CPC to obtain copies of pertinent reports. Upon receipt of the reports, the auditors are to review them and determine if they contain sufficient information for use in identifying risk in audit assignments. In order for the internal audit report to be useful, the auditor needs to understand the scope of the review, the reported deficiencies, and any recommended corrective actions. If sufficient information on these points is not included in a report, the auditors are to coordinate with the CPC to request access to the contractor s audit working papers for review. These same procedures apply for non-major contractors; however, a formal tracking process or a CPC is not mandatory. Two things are apparent from this guidance. First, it does not address what authority DCAA has to demand that contractors disclose internal audit reports. Second, the guidance does not place any limits on the uses that can be made of contractor internal audit reports. DCAA s Authority to Audit Costs Incurred DCAA s audit authority is derived from various statutes, regulatory provisions, and contract clauses in the Federal Acquisition Regulation (FAR). The most relevant statute regarding the audit of a contractor s costs is 10 U.S.C. 2313(a)(1), which reads: Agency Authority 1) The head of an agency, acting through an authorized representative, is authorized to inspect the plant and audit the records of a) a contractor performing a cost-reimbursement, incentive, time-and-materials, labor-hour, or price-redeterminable contract, or any combination of such contracts, made by that agency under this chapter; and b) a subcontractor performing any cost-reimbursement, incentive, time-and-materials, laborhour, or price-redeterminable subcontract, or any combination of such subcontracts under a contract referred to in subparagraph (a). The statute defines records as including books, documents, accounting procedures and practices, and other data, regardless of type and regardless of whether such items are in written form, in the form of computer data, or in any other form. Subsection (a)(1) of section 2313 is implemented at FAR (b), which states, in pertinent part: If this is a cost-reimbursement, incentive, time-and-materials, labor-hour, or priceredeterminable contract, or any combination of these, the contractor shall maintain and the contracting officer, or an authorized representative of the contracting officer, shall have the right to examine and audit all records and other evidence sufficient to reflect properly all costs claimed to have been incurred or anticipated to be Contract Management June

5 Education Partners To increase the depth and breadth of learning opportunities for our members, NCMA has entered into formal partnership with leading training and education providers. Whether your goal is an advanced degree, specialized training courses, or certification, NCMA Education Partners can help. American Graduate University 733 N. Dodsworth Avenue Covina, CA American Public University System ASI Government 1655 N. Fort Myer Drive Suite 1000 Arlington, VA Bottomline Concepts, LLC Madison, AL Centre Consulting 1953 Gallows Road Suite 650 Vienna, VA Chicago Training and Consultancy Core Concepts Group P.O. Box 821 Diablo, CA ESI International 901 North Glebe Road Suite 200 Arlington, VA FedBid, Inc Leesburg Pike Suite 602 Vienna, VA Federal Market Group Federal Publications Seminars th Street, NW Suite 200 Washington, DC George Washington University Master of Science in Government Contracts 2000 H St. NW Burns Hall 510 Washington, DC msgc@gwu.edu George Washington University Master of Science in Project Management 2201 G St. NW Funger Hall, Ste. 415 Washington, DC Interactive Technologies Group, Inc Eisenhower Ave. Suite 210 Alexandria, VA Management Concepts 8230 Leesburg Pike Vienna, VA Next Level Purchasing PO Box 901 Moon Township, PA Northwest Procurement Institute, Inc. PO Box 1328 Edmonds, WA Old Dominion University Online Procurement and Contract Management Program 5115 Hampton Blvd. Norfolk, VA dl.odu.edu Public Contracting Institute PO Box Washington, DC Saint Louis University 3840 Lindell Blvd. Saint Louis, MO Training Resource Consultants Inc. 732 Eden Way North, Ste E-506 Chesapeake, VA University of California Irvine Extension Irvine, CA thinc, LLC 725 Green Garden Circle Chester, VA Villanova University Online 9417 Princess Palm Avenue Tampa, FL Want to become an NCMA education partner? Contact: CHRIS MARTIN cmartin@networkmediapartners.com KEITH PRICE kprice@networkmediapartners.com

6 There are other FAR clauses that provide DCAA with audit rights. However, those rights are not enforceable through DCAA s subpoena power. incurred directly or indirectly in performance of this contract. In addition, FAR (g) requires the clause to be inserted in subcontracts that are costreimbursement, incentive, time-and-materials, labor-hour, or price-redeterminable type, or any combination of these, and which exceed the simplified acquisition threshold. 7 Three things are notable concerning the statute and FAR (b). First, they do not give the government the right to audit a firm-fixed-price contract, a firm-fixed-price subcontract, or any subcontract under a firm-fixed-price contract. Thus, to the extent that a contractor has subcontracts under a firm-fixed-price prime contract, those subcontracts are not subject to audit in regard to an incurred cost audit regardless of the subcontract type. Similarly, a firm-fixed-price subcontract under any type of prime contract is not subject to audit. Finally, they do not give the government the authority to demand that a contractor or subcontractor prepare any specific records for the auditor. Instead, they only authorize the auditor to examine the books and records that the contractor keeps in the ordinary course of business. encountered contract types are costreimbursement and time-and-materials contracts for noncommercial items. 9 In regard to cost-reimbursement contracts, FAR , Allowable Cost and Payment, permits the government to audit all costs claimed by the contractor to determine if they are allowable under the cost principles of FAR Part 31. In contrast, under time-andmaterials contracts, 10 the government is permitted to audit the cost of material to determine if it is allowable in accordance with the cost principles. However, the government is not allowed to audit the actual labor cost incurred by the contractor in performing the contract. Instead, the government can only verify that the contractor has substantiated the amount claimed on vouchers: by evidence of actual payment and by (i) (ii) Individual daily job timekeeping records; Records that verify the employees meet the qualifications for the labor categories specified in the contract; or Defective Pricing Audits A second significant statutory audit right is found at 10 U.S.C. 2313(a)(2), which states: The head of an agency, acting through an authorized representative, is authorized, for the purpose of evaluating the accuracy, completeness, and currency of certified cost or pricing data with respect to a contract or subcontract, to examine all records of the contractor or subcontractor related to (A) (B) (C) (D) the proposal for the contract or subcontract; the discussions conducted on the proposal; pricing of the contract or subcontract; or performance of the contract or subcontract. This right is implemented in FAR (c), which essentially restates the statute. In this regard, because is a flowdown clause, it is to be included in all subcontracts for which certified cost or pricing data were required. 12 Again, FAR (c) does not mention internal audit reports. Moreover, because of the limitations placed on the use of internal audit reports by section 832, it would appear that DCAA could not reasonably assert that it has a right to an internal audit report under (c). It should be noted that neither of the payment clauses for fixed-price-incentive contracts 8 contains an audit provision. However, FAR is authorized for use in such contracts. Therefore, DCAA would be permitted to audit costs claimed under fixed-price-incentive contracts pursuant to if it is included in a fixed-priceincentive contract. In addition to FAR , other FAR clauses give the government the right to audit costs claimed under the specific contract types previously mentioned. Probably the two most frequently (iii) Other substantiation approved by the contracting officer. None of these clauses explicitly gives DCAA a right to obtain internal audit reports. 11 Moreover, because they all deal with costs incurred or to be incurred, it would appear that section 832 provides a solid ground for asserting that DCAA is not entitled to internal audit reports in connection with an audit conducted under these authorities because section 832 limits DCAA s use of internal audit reports to evaluating a contractor s internal controls and business systems, not the allowability of costs. DCAA s Subpoena Power To enforce the audit rights contained in 10 U.S.C. 2313(a), section 2313(b) gives the DCAA director authority to issue subpoenas if a contractor refuses to grant DCAA access to the records covered by 2313(a). 13 These subpoenas are enforceable in U.S. District Court. DCAA has rarely used its subpoena power. However, one instance in which it did is germane to this discussion. 14 DCAA sought access to internal audit materials generated by Newport News Shipbuilding and Dry Dock Co. s internal audit department by serving a subpoena on the company demanding: Contract Management June

7 Schedules of internal audits performed or expected to be accomplished, working papers generated during any audit, written summary reports on the results of audit, [and] follow-up action taken by [Newport News] in response to internal audit recommendations. Newport News refused to surrender the records and the government responded by seeking summary enforcement of the subpoena. The district court denied enforcement of the subpoena, holding that the internal audit materials were not related to the negotiation, pricing, or performance of a particular contract, and were thus beyond the scope of DCAA s subpoena power. 15 The government appealed this ruling. The 4th Circuit upheld the district court holding that in this case, the subpoena was not valid because it exceeded the statutory power of DCAA: Sec. 2313(a)[(1)] was intended to allow verification of the costs charged to the government by contractors. The provision was intended to enable the government to determine whether charges made by contractors were incurred for the purpose of performing the contract. There is no evidence that, as DCAA contends, Sec. 2313(a) was meant to allow wide-ranging investigations into the general efficiency 16 of any company that performs cost-type government contracts. In this case, the court could find no evidence that DCAA demanded access to the internal audit reports in order to evaluate the costs claimed on any specific contract. As for DCAA s right of access to the internal audit reports under section 2313(a)(2), the Court observed that the right to obtain access to contractor records is limited. Specifically: [T]he statute reaches objective factual information concerning contract costs, such as invoices, vouchers, and time logs, rather than the subjective assessments sought in this case. Finally, the material covered must be related to the specific contract involved. The court went on to say: [The statute] was meant to provide access to materials needed for factual verification of cost and pricing data, including those pertaining to general and administrative costs, that are related to particular government contracts. The court s interpretation of the records to which DCAA has access under 10 U.S.C. 2313(a) bolsters the conclusion that because of the limitations placed on DCAA s use of internal audit reports by section 832, DCAA cannot rely upon that statutory provision as conveying a right of access to internal audit reports. Membership 101 Did you know NCMA has a Women s Forum? Join the NCMA Women s Forum Community on LinkedIn or attend one of our in-person events at World Congress in July. You could even volunteer to hold an event at your chapter. Learn more on LinkedIn by visiting 62 Contract Management June 2013

8 Other FAR Audit Rights There are other FAR clauses that provide DCAA with audit rights. However, those rights are not enforceable through DCAA s subpoena power. For example, FAR (g)(1) requires contractors to give the government reasonable opportunity to examine and verify the contractor s books, records, and accounts in order to properly administer the progress payments clause. This is beyond the uses of internal audit reports permitted by section 832. government approval or periodic review of the system. CAM provides guidance to auditors regarding this requirement. In DCAA s view, these periodic reviews should take place annually. Further, the CAM instructs auditors to review these evaluations. If they are in the form of internal audit reports, DCAA could probably make a case that it is entitled to receive them, particularly if the contractor had made a disclosure of potential misconduct as required In this regard, DCAA has issued Memorandum For Regional Directors (MRD) 11-OTS- 034(R), dated July 14, 2011, 19 providing guidance on what steps auditors are to take when they receive a disclosure. Auditors are to conduct a risk assessment concerning the disclosure to include a determination of the disclosure s impact on contractor internal control systems. In addition to other actions that should be taken if the contractor does not provide full cooperation, the MRD directs auditors to consider whether the contractor s unsatisfactory cooperation impacts the contractor s control environment and responsibility. Based on this MRD, it is clear that DCAA would expect to obtain internal audit reports regarding the disclosure or the area of contractor operations involved in the disclosure. Another possible avenue for DCAA to obtain access to a contractor s internal audits is through the pre-award survey process described in FAR A pre-award survey is normally required only when the information on hand or readily available to the Similarly, the Cost Accounting Standards clauses 17 require contractors to permit any authorized representatives of the government to examine and make copies of any documents, papers, or records relating to compliance with the requirements of this clause. Once again, these clauses should not provide any authority for DCAA to obtain internal audit reports because they deal with compliance with the Cost Accounting Standards. FAR , Contractor Code of Business Ethics and Conduct, presents an interesting issue in regard to internal audit reports. This clause requires a large business contractor to establish an internal control system that complies with the criteria stated in the clause. One of those criteria is that the system must provide for [p]eriodic reviews of company business practices, procedures, policies, and internal controls for compliance with the contractor s code of business ethics and conduct and special requirements of government contracting. Interestingly, the clause does not require by the clause. 18 In that case, the clause requires the contractor to provide [f]ull cooperation with any government agencies responsible for audits. For these purposes, full cooperation includes providing timely and complete response to government auditors request for documents. Accordingly, it is possible that DCAA could obtain internal audit reports under this clause to evaluate a contractor s internal controls. contracting officer is not sufficient to make a responsibility determination. In this regard, having adequate accounting and operational controls is an element of responsibility. When a pre-award survey is conducted, one of the areas of contractor operations that is evaluated is whether a contractor has an adequate accounting system. DCAA performs this function and reports the results of its evaluation on Standard Form Guidance on performing this function is contained at CAM The CAM states that the auditor should examine the design of the accounting system to determine if it is designed to meet the standards expressed in Standard Form The design of a system would include internal controls to ensure that the standards are met. Accordingly, internal audit reports could be used to assist in accomplishing this evaluation. Although internal audit reports may be of assistance to DCAA in determining if the Contract Management June

9 contractor s accounting system is designed to meet FAR requirements, because no contract exists, there are no contract clauses upon which DCAA can rely to obtain access to internal audit reports. Thus, the question remains: What is DCAA s mechanism for obtaining access to such reports in the preaward environment? The answer to this question lies in the contractor s self-interest. If DCAA cannot get access to internal audit reports, DCAA may issue a negative report that would likely result in the contractor being determined nonresponsible, in which case it would not receive a contract. Therefore, this possibility may cause the contractor to voluntarily provide DCAA with the desired internal audit reports. Sticking with the topic of contractor accounting systems, FAR (a)(12) states that the administrative contracting officer is responsible for determining the adequacy of the contractor s accounting system. It goes on to assert that the contractor s accounting system should be adequate during the entire period of contract performance. Although the FAR has no clause implementing this policy, the Defense FAR Supplement (DFARS) business systems rule fills this void for DOD. The DFARS Business Systems Rule The rule identifies six business systems: Accounting, Estimating, Material management and accounting, Purchasing, Earned value management, and Property management. There is a DFARS clause for each system that sets forth the criteria each system must meet to be considered adequate. 20 The rule also includes a separate Business Systems clause that is intended to give contracting officers the tools they need, including the ability to withhold payments from contractors, to enforce the systems clauses. The accounting system clause is DFARS Per DFARS , it is to be inserted in solicitations and contracts when the government is contemplating either a cost-reimbursement, incentive type, time-and-materials, or labor-hour contract; or a fixed-price contract with progress payments made on the basis of costs incurred by the contractor or on a percentage or stage of completion. The clause defines accounting system as: [The contractor s] system or systems for accounting methods, procedures, and controls established to gather, record, classify, analyze, summarize, interpret, and present If you haven t participated in an NCMA Webinar lately, then what s holding back? you 100% of surveyed NCMA webinar attendees will attend future NCMA webinars. Don t miss out on important information relevant to your professional success. Upcoming Webinars June 6: 5 C s of Successful Contract Management and Engagement June 18: Ten Tools for Subcontracting Earn 1.5 CLPs/CPE hours for each webinar you attend. Missed a live event? Purchase the recording at 64 Contract Management June 2013

10 Another possible avenue for DCAA to obtain access to a contractor s internal audits is through the pre-award survey process described in FAR accurate and timely financial data for reporting in compliance with applicable laws, regulations, and management decisions, and may include subsystems for specific areas such as indirect and other direct costs, compensation, billing, labor, and general information technology. Significantly, the clause specifically mentions controls as an element of an accounting system. For purposes of the clause, an adequate accounting system is a system that complies with the system criteria in paragraph (c) of the clause. For these purposes, the system must not evidence a significant deficiency concerning any of the criteria. In this regard, a significant deficiency is a shortcoming in the system that materially affects the ability of officials of the Department of Defense to rely upon information produced by the system that is needed for management purposes. As for the criteria listed in the clause, the first one listed is [a] sound internal control environment. Despite the DFARS clause not expressly stating that DCAA can have access to internal audit reports, DCAA can make a strong argument for such access under section 832. Further, although DCAA cannot issue a subpoena for records in regard to an audit of a contractor s accounting system, the contractor s self-interest in having an adequate system should induce the contractor to provide DCAA with internal audit reports. Conclusion As the foregoing discussion demonstrates, section 832 is not an access to records provision. It only addresses the uses that can be made of internal audit reports. Further, although there are several statutes and FAR clauses that permit DCAA to audit a contractor, most of those statutes and clauses deal with the contractor s ability to recover costs under specific government contracts. Accordingly, they cannot be relied upon as a basis for DCAA s right of access to internal audit reports. However, the FAR provisions dealing with an adequate accounting system in the pre-award context and the DFARS accounting system clause, DFARS , coupled with a contractor s self-interest in not having its accounting system determined inadequate, would seem to provide DCAA with the ability to obtain internal audit reports. CM About the Authors JOHN FORD is a senior consultant with Cherry Bekaert LLP and a member of the firm s Government Contractor Services Group. He can be reached at jford@cbh.com. SUSAN MOSER is the founder of Cherry Bekaert LLP s Government Contractor Services Group and managing partner of the Industries & Specialization practice at Cherry Bekaert. She can be reached at smoser@cbh.com. Send comments about this article to cm@ncmahq.org. Endnotes 1. U.S. v. Newport News Shipbuilding and Dry Dock Co., 837 F.2d 162 (4th Cir. 1988). 2. Pub. L DCAA s charter is found at CAM 1-1S1 Supplement. 4. DCAA s responsibilities in this regard are to [p]rovide assistance, as requested, in the development of procurement policies and regulations. 5. CAM states: This manual is issued to provide technical audit guidance, audit techniques, audit standards, and technical policies and procedures to be followed by DCAA personnel in the execution of the contract audit mission. Reference to this manual should not be made in audit reports or correspondence addressed to offices other than those of DCAA. 6. See CAM Currently $150,000 for most acquisitions. (See FAR ) 8. See FAR Payments under time-and-materials/labor hour contracts for commercial items are addressed in Alt I subsection (i). Subsection (i)(4) is captioned access to records and provides the government with a right of access to the material listed there. 10. See FAR However, FAR (d)(2)(iv) states that the government may require a contractor to disclose a [l]ist of all internal audit reports issued since the last disclosure of internal audit reports to the government, and the contractor s [a]nnual internal audit plan of scheduled audits to be performed in the fiscal year when the final indirect cost rate submission is made. 12. The wording of FAR (g) can present some implementation issues because certified cost or pricing data may not have been required when a subcontract is awarded, but a later modification to the subcontract would require the submission of such data. 13. From a contractual perspective, this would include the audit rights contained in FAR , , and See U.S. v. Newport News Shipbuilding and Dry Dock Co., note See Newport News Shipbuilding and Dry Dock Co. v. Reed, 655 F.Supp. 1408, (E.D.Va. 1987). 16. As a side note, this should call into question DCAA s ability to conduct what it calls operations audits. 17. FAR (c), (c), (c), and (c). 18. DOD has issued DOD Instruction , DOD Contractor Disclosure Program, to establish procedures for processing such disclosures, including DCAA s role in the process. 19. MRDs can be found at the DCAA website, under the guidance tab. 20. DCAA is responsible for evaluating compliance with the first three systems and the Defense Contract Management Agency is responsible for the last three. Contract Management June