GAO report on business system audits presents some tidbits of interest to the government contract community

On February 7, GAO released its report to congressional committees (GAO-19-212) on DCAA’s and DCMA’s effectiveness in monitoring and managing contractor business system evaluations. In a nutshell, GAO recommends DCMA and DCAA collaborate better to monitor and conduct business system reviews more timely. Aside from matters of DCAA and DCMA efficiency, GAO presented some tidbits of interest to the government contracting community. 

Perhaps most noteworthy is the 285 business system audits DCAA plans to perform between 2019 and 2022, which represents a significant increase over the past six years. GAO illustrates DCAA’s plans to perform approximately 50 business systems audits in 2019, 100 in 2020, 85 in 2021, and 50 in 2020. This audit mix would include 125 accounting systems, 48 material management and accounting systems, and 112 estimating systems.

Number of Contractor Business System audits completed or planned by Defense Contract Audit Agency

Source: GAO analysis of Defense Contract Audit Agency data. | GAO-19-212

DCAA’s goal, however, does not reflect history. According to GAO, DCAA planned 76 business system audits in FY2017, but only completed nine because of the Agency’s continued focus on incurred cost audits. GAO also presented the following table summarizing the number of business system audits completed between 2015 and 2017 by both DCAA and DCMA.

Source: GAO analysis of data from Defense Contract Management Agency functional offices and Defense Contract Audit Agency. | GAO-19-212

To achieve its business system audit goal, DCAA plans to shift over 378,000 hours from incurred cost audits between fiscal years 2018 and 2020, and use public accounting firms (as prescribed in Section 803 of the FY 2018 NDAA) to fill the void. DCAA anticipates that public accounting firms will perform 100 incurred cost audits in 2019 and 2020, increasing to 200 audits per year between 2021 and 2025. DCAA’s foundation for achieving the targeted number of business system audits is based on experience of audit teams utilizing revised business system audit programs released in 2018. 

Although GAO didn’t question DCAA’s ability to accomplish its business system audit goal, its review of six recent contractor business system audit experiences suggests DCAA and DCMA process improvements are a necessary prerequisite. GAO reported that the length of time to obtain approval of a business system under DCAA’s purview can take between 15 months to over five years, with three of the audits taking over four years to complete. GAO attributed the lengthy audits to inadequate contractor corrective actions plans, successive deficiencies identified during follow-up audits, auditor turnover, and changes in audit teams. It’s hard for us to square the experiences identified by GAO with each Agency’s guidance on business system audit frequency; in particular DCAA’s when the tables above and below are compared.

Source: GAO analysis of DOD policies and regulations | GAO-19-212

Regardless of whether or not DCAA will achieve its business system audit goal, the writing is on the wall for contractors: DCAA is shifting its priority to business system audits. Many of our clients have already been notified that one or more business systems is in DCAA’s and/or DCMA’s near-term audit plans. For those contractors that don’t have a regular DCAA/DCMA presence or dialog, we recommend assessing the risk factors for business system audit selection. Risk factors include current system status, elapsed time since prior audits, cost reimbursable contract dollar volume, significant business growth and/or M&A activity, and major business system software changes.

To avoid protracted audits and business system approvals, contractors should be proactive and prepared, which may include performing self-assessments, preparing system descriptions, and assigning process walkthrough responsibilities. Communicate early and often with the auditors by highlighting how your control environment and business processes protect the government’s interests. Prepare clear, concise, and dispassionate responses to issues raised. Set expectations for, and keep commitments to, providing information. Finally, actively engage prior to and throughout the audit, and ask for frequent status meetings. These strategies apply to any business system audit, as well as incurred cost, forward pricing, and price proposal audits.

For more information on this topic, or to learn how Baker Tilly specialists can help, contact our team.