DOD has relieved DCAA of yet another of its responsibilities and put the burden squarely on government contractors. A proposed change to the Defense FAR supplement published in the Federal Register July 15th, would make government contractors responsible for audits of their own accounting, estimating and material accounting systems, including engaging and paying a CPA firm to perform the audits.
Click here to read the rule.
DOD’s Business Systems Rule started raising issues in the acquisition world the day it was effective in May 2011. The unintended side effects were more significant than the intended purpose of the rule. It was intended to provide a framework of rules for withholding of payments to incentivize contractors to maintain adequate systems. What it really did was expose a huge backlog of systems audits – some years overdue – and thousands of unassessed systems with no immediate prospect of being reviewed.
DOD has addressed the issue by imposing a new requirement on contractors to report the status of their own systems and engage (and pay) a CPA firm to audit their systems. They also propose to hold the contractor accountable for qualifying the CPA firm selected to do the work, including qualifications to perform audits under Generally Accepted Government Auditing Standards (GAGAS), status of the firm’s peer review, and licensure of the individuals performing the audit(s).
This might even work if it were not for one thing. The proposed rule would require contractors over a certain size to submit their CPA firm’s audit strategy, risk assessment and audit work program(s) to the contracting officer and the contractor’s cognizant government auditor (usually DCAA) for pre-approval before the audit is performed. When the audit is complete, the audit report is then required to be submitted to the auditor and contracting officer along with the system status report.
Let’s be clear about the timeline. The report is required within six months after the end of the contractor’s fiscal year. In that period, the contractor must:
1. Close its books and qualify and engage a CPA firm to do the audit;
2. Obtain from the selected firm a description of the audit strategy, a risk assessment of the contractor, and audit work programs for the audits to be performed;
3. Submit the strategy, risk assessment and work programs to the ACO and DCAA for approval;
4. Obtain the approval of the ACO (DCAA will make a recommendation to the ACO); and
5. Be audited by the CPA firm, obtain a report and submit it to the ACO.
Six months seems optimistic. Given DCAA’s track record, step 5 alone could take six months. And, there could be thousands of contractors in the queue for audit approval the first year.
It sounds like DOD is about to exchange one intractable backlog for another. Of course, the rule as proposed has massive holes in it. What happens if the report is late, or simply isn’t submitted? The comments on this rule are going to be brutal.
Watch this space tomorrow for an analysis of the unintended consequences for small businesses…