Policy Letter

POGO requests clarifications to Defense regulations to ensure independent audits and timely corrections to deficiencies found in contractor business systems, including withholds

Defense Acquisition Regulations System

ATTN: Mr. Mark Gomersall

OUSD (AT&L), DPAP (DARS)

IMD 3D139

3062 Defense Pentagon

Washington, DC 20301-3062

Re: DFARS Case 2009-D038, Defense Federal Acquisition Regulation Supplement; Business Systems – Definition and Administration

Dear Mr. Gomersall:

Thank you for the opportunity to comment on the Defense Federal Acquisition Regulation Supplement (DFARS) proposed rule entitled "Business Systems – Definition and Administration" (75 FR 2457, January 15, 2010). Founded in 1981, the Project On Government Oversight (POGO) is an independent nonprofit that investigates and exposes corruption and other misconduct in order to achieve a more effective, accountable, open, and ethical federal government. As such, one of POGO's areas of focus is government contracting. Accordingly, we urge the DFARS Council to ensure that contractors are provided with appropriate incentives to correct deficiencies in their business systems in a timely manner including, but not limited to, withholds on interim payments.

Although POGO endorses the intent of the proposed rule, we offer the following comments to strengthen the rule.

Proposed 242.70X1 – Paragraph (b) Reporting deficiencies

We are troubled by the language of paragraph (b) under the proposed 242.70X1. The proposed rule states that the audit report shall "describe the deficiencies in sufficient detail to allow the contracting officer to understand what the contractor would need to correct to comply with the applicable standard or system requirement." (Emphasis added) POGO asks the Council to clarify the proposed rule to ensure that auditors are not providing a contracting officer or the contractor with "correction information" with respect to what would be needed to correct a system deficiency. Rather, the role of the auditor is to describe the deficiencies in sufficient detail to allow the contracting officer to understand those deficiencies. Compliance with applicable standards and system requirements including correction of deficiencies is the responsibility of the contactor. Requiring the auditor to describe what is in essence the correction to the system could be considered a violation of the auditor's independence under applicable auditing standards, since the auditor could be placed in the untenable position of auditing a correction to a system which they proposed as the "fix" in the audit report. The Government Accountability Office (GAO) has stated that that Defense Contract Audit Agency (DCAA) compromised its independence in several audits of contractor internal control systems by providing the contractor with feedback on proposed corrections to system deficiencies and later issuing an opinion as a result of auditing those corrections.[1] The DFARS should not place auditors in a position that would violate auditing standards. We recommend the language of paragraph (b) be revised to state: "describe the deficiencies in sufficient detail to allow the contracting officer to understand the deficiencies."

Proposed 242.70X1 – Paragraph (b)(2) Evaluation of contractor's response

Paragraph (b)(2) states that the Administrative Contractor Officer (ACO) will consult with the auditor when evaluating the contractor's response to the initial determination of deficiencies. POGO does not believe the auditor should only be consulted by the ACO. Rather, we believe the auditor should be requested to audit the contractor's response to ensure that it represents the contractor's accounting records and policy and procedures. We are aware of too many instances where the contracting officer approved a system based on a response provided to an initial determination or other request from the contracting officer without verifying that the response was reflective of the contractor's actions. Several examples of this were discussed at a hearing of the Commission on Wartime Contracting in Iraq and Afghanistan (CWC) held on August 11, 2009. To mitigate the temptation of contracting officers approving a system based solely on a contractor's written response, we recommend that the language be revised to state that the ACO needs to obtain an audit of the contractor's response. Although our comment is addressing the language at the new 242.70X1(b)(2), it applies to all places in the proposed rule that address the ACO's evaluation of the contractor's response.

Proposed 252.242-7YYY – Paragraph (c) Accounting system requirements

We do not believe the accounting system requirements rule is adequate. While, for the most part, it appears the proposed rule's accounting system requirements duplicate the evaluation checklist contained in Standard Form 1408, Preaward Survey of Prospective Contractor Accounting System, it fails to require a system of internal controls related to the accounting system and does not require compliance with Generally Accepted Accounting Principles (GAAP). Compliance with GAAP is an important part of any accounting system and although many contractors are required to comply with the Cost Accounting Standards and the FAR Part 31 cost principles, these represent additional requirements and are not meant to be a substitute for GAAP. Other systems described in the proposed rule such as the purchasing system at 252.244-7XXX require a system of internal controls including internal audits and management reviews. We recommend that the accounting system definition be expanded to include a requirement for a system of internal controls and compliance with GAAP.

Proposed 252.242-7YYY – Paragraph (e) Withholding Payments

In various places in the proposed rule, including the new 252.242-7YYY(e), the ACO is given the authority to withhold a portion of interim payments when a final determination of deficiencies is issued. POGO concurs with strengthening the contracting officer's ability to withhold payments for system deficiencies. However, we do not agree with delaying the implementation of a withhold until a final determination has been made by the contracting officer. We are aware of instances where months (or even years) have passed between the initial identification of deficiencies by the auditor and the contracting officer's final determination. In many instances, the delays were to permit the contractor additional time to prepare a corrective action plan. Several examples were discussed at the August 11, 2009, CWC hearing. Consequently, we recommend that the proposed DFARS language be revised to permit the contracting officer to implement the withhold at the time the auditor reports the deficiencies. This action will provide an even greater incentive for contractors to correct the deficiencies. POGO's position is supported by the comments made during the August 12, 2009, CWC hearing. Mr. Forrest Evans, Deputy Program Manager and Senior Contracting Officer's Representative for the linguist program under the U.S. Army Intelligence and Security Command, stated that withholds were an effective incentive for contractors to correct system deficiencies.[2] Consequently, we see no reason to delay the implementation of the withhold.

Access to Internal Audits and Management Reviews

In several places in the proposed rule, including 252.244-7XXX(a)(1) on purchasing systems, the requirements for an adequate system include internal audits and management reviews, which are a sound internal control practice for any business system. We offer two recommendations related to this requirement. First, the requirement stated at 252.244-7XXX(a)(1) for the purchasing system should be a requirement of all business systems and should be based on the comprehensive Committee of Sponsoring Organizations of the Treadway Commission (COSO) internal control framework. Compliance with the COSO internal control framework has become standard for the majority of businesses and should be explicitly required. By including the requirement for some systems but not others, the DFARS is sending the wrong message that sound internal controls are only required for certain systems rather than all business systems. Second, in order for the government to ensure contractors' compliance, the proposed rule should be revised to require a contractor to provide internal audits and management reviews to the contracting officer and the auditor. POGO is aware that, over the years, external auditors and contractors alike have ignored the broad requirements allowing the contracting officer or their representative access to contractor information. The government should be provided complete access to contractors' internal control systems including internal audit reports and management reviews to ensure a contractor has implemented appropriate corrections in response to audits and reviews.

Thank you for your consideration of these comments. If you have any questions, please contact me at (202) 347-1122.

Sincerely,

Scott Amey

General Counsel

1 GAO Report GAO-08-857, DCAA Audits: Allegations that Certain Audits at Three Locations Did Not Meet the Processional Standards Were Substantiated, July 2008. Available at http://www.gao.gov/new.items/d08857.pdf; GAO Report GAO-09-468, DCAA Audits: Widespread Problems with Audit Quality Require Significant Reform, September 2009. Available at http://www.gao.gov/new.items/d09468.pdf

2 Transcript of the August 12, 2009, Hearing of the Commission on Wartime Contracting on Linguist Support Services, p. 12.