Letting Contractors Pick Their Own Auditors is a Bad Idea

Last year, in annual legislation setting defense policy, Congress gave military contractors the authority to hire their own auditors to review the bills those contractors send to the government. For decades, the Pentagon’s own Defense Contract Audit Agency (DCAA) has helped government contracting officials negotiate better deals by examining a contractor’s charges. But last year’s legislation, which goes into effect next year, diminishes the DCAA’s oversight authority to the detriment of taxpayers.

The topic was broached in an important, but under-the-radar Congressional oversight hearing in April.

Most of the hearing centered on the cost of government versus private auditors, with two conflicting tales being told. But a bigger issue went largely unaddressed: whether allowing contractors to pick their own auditors creates inherent conflicts of interest since the auditors would be in the position of serving contractors—their client—rather than taxpayers. There is a reasonable fear that these private sector auditors, in an effort to keep their client happy and win repeat business, would be reluctant to disclose to the government that the contractor is overcharging taxpayers.

The law in question is the 2017 National Defense Authorization Act (NDAA) passed late last year. Section 820 of the law states that “contractors with the Department of Defense may present, and the Defense Contract Audit Agency shall accept without performing additional audits, a summary of audit findings prepared by a commercial auditor” of contractors’ indirect costs (with some exceptions). This section is scheduled to go into effect on October 1, 2018.

New legislation pending before Congress would rescind Section 820, but it would also allow “contractors to engage commercial auditors to perform incurred cost audits,” according to a Department of Defense (DoD) analysis. The analysis also states that the new provision creates “several unintended consequences that will negatively impact the Department and industry.” The DoD opposes both Section 820 and the new Congressional language. The DoD’s proposed alternative keeps the power to conduct these audits in DCAA’s hands with an option allowing the government (rather than the contractors) to hire private sector auditors on a case-by-case basis. After analyzing the issue, POGO supports the Department’s proposed alternative.

DCAA’s Role

DCAA is responsible for auditing the financial side of certain defense contracts to “ensure that warfighters get what they need at fair and reasonable prices,” according to its website. DCAA looks for whether contractor costs are “allowable, allocable, and reasonable,” and it performs other audits to ensure contractors have adequate business and accounting systems and adhere to federal cost and accounting principles. DCAA’s report for fiscal year 2016 notes that it audited $287 billion in contract costs that year. These audits are not usually intended to uncover fraud, although DCAA sometimes finds indicators of criminal activity and participates in law enforcement investigations.

What Are “Indirect Costs” and Why Do They Matter?

Contractors charge the government for two types of costs: direct costs that specifically relate to the contract, such as labor and materials, and indirect costs that exist apart from specific work on the contract, such as the rent a contractor pays for its office or fringe benefits for employees.

But there’s nothing fringe about these costs. Within incurred cost audits, indirect costs make up the majority of all questioned costs, according to DCAA Director Anita Bales. Because they are less clear-cut than direct audits, audits of indirect costs can be contentious—especially when auditors want more access to contractor information than the contractor is willing to provide—and quite technical. For instance, contractors are allowed to charge the government for indirect costs associated with litigation under some circumstances, but not in other situations. Contractors can easily pad their profits at taxpayers’ expense if these costs are not carefully examined.

An example of indirect cost overbilling made the news in February 2016 when the Justice Department announced that Centerra Services International (formerly known as Wackenhut Services LLC) agreed to pay $7.4 million to resolve a whistleblower lawsuit alleging the company had defrauded taxpayers. According to the Justice Department, Centerra double billed its labor costs while providing firefighting services on a military base in Iraq. The government alleged Centerra “inflated its labor costs by billing the salaries of certain managers as direct costs under the subcontract, when those salaries had already been charged as indirect costs.”

The Centerra case isn’t a one-off. In 2015, a DCAA audit questioned $14.6 million in costs that a contractor charged the government, according to a DoD Inspector General report to Congress. The vast majority—$14 million—involved wrongly billed indirect costs.

Lessons from the Recent Past

We don’t have to look very far back in history to see that allowing profit-motivated companies to hire their own profit-motivated auditors can lead to problems.

The Enron scandal showed that accountants and auditors aren’t immune from conflicts of interest. “Obviously the history of Enron and the financial crisis suggest we have to be very careful in this situation,” Representative Seth Moulton (D-MA), Ranking Member of the House Armed Services Oversight and Investigations Subcommittee said during his opening statement at the April hearing. Arthur Andersen, Enron’s auditor, had conflicts of interest. It was simultaneously employed as internal and external auditor, meaning that the supposedly independent external auditor could cover up the inaccuracies of the internal audit team.

More recently, during the fallout of the Great Recession, the government required banks to conduct mortgage foreclosure reviews. Banks were allowed to hire for those reviews their own “independent consultants” who proved to be not so independent. The New York Department of Financial Services (NYDFS) punished several of these consultants, including Promontory Financial Group, Deloitte, and PricewaterhouseCoopers, for “misconduct, violations of law, and lack of autonomy.” Settlements generally included multi-million dollar fines and temporary bans from consulting.

“A consultant's allegiance too often goes to the client that pays the bills,” former NYDFS General Counsel Daniel Alter wrote in a 2015 piece for American Banker. Laws like Sarbanes-Oxley, which create criminal liability for misrepresenting financial statements, have helped to prevent future Enrons by balancing that pressure. However, criminal liability doesn’t apply to other types of financial reporting, such as the consulting work done in the aftermath of the housing crisis and the proposed contract audits.

When it comes to contract auditing, giving audit responsibilities to a company working directly for a contractor hampers the government’s ability to negotiate good deals for taxpayers.

Counting the Costs

At the April Congressional hearing, DCAA Director Anita Bales testified that third-party auditors would cost an estimated 30 percent more than DCAA auditors. David Berteau, President and CEO of the Professional Services Council, a contractor lobbying group, countered in his testimony that when civilian agencies have used private auditors, they have in some cases paid significantly less than they used to pay DCAA.

Bales’ claim that DCAA auditors were 30 percent cheaper was based on a comparison of hourly billing rates, according to emails provided to POGO through the Freedom Of Information Act (FOIA). Berteau and other employees of the Professional Services Council did not respond to emails requesting evidence supporting their claims.

Other members of the federal auditing community have told POGO that the comparison of auditing costs is not clear cut. DCAA has more specialized experience and might charge lower costs per auditor hour, but they may also take longer to conduct audits (which may be a good thing in the long run, as more thorough audits may save even more money). Pricing for private auditors can also vary widely from company to company and even year to year, making a comprehensive analysis difficult.

And although cost was the most-discussed factor at the hearing, it isn’t the only factor that needs to be examined. A federal source, not authorized to speak on the record, who is familiar with both DCAA and private contract audits for civilian agencies said the work of private auditors still has to be closely checked, even when they are hired directly by the government. Both last year’s NDAA and a recent proposal for this year’s NDAA prohibit DCAA from examining the work of private auditors before accepting the results.

There is also concern over how the records generated by private auditors would be handled: Will they be subject to FOIA? How would the discovery of potential fraud be handled? Would private sector audits be incorporated into the DCAA’s “Management Information System” that tracks audit data so that auditors can spot trends and look at the bigger picture?

What About Incurred Costs?

New Congressional language would rescind Section 820 but would allow contractors to hire auditors to audit incurred costs. The argument for this is DCAA’s lower rate of return when it audits incurred costs. However, DCAA’s other auditing work with the same contractor and on the same contracts benefits from its incurred cost audits, and vice-versa. For instance, DCAA conducts audits of contractors’ billing, accounts, and internal control systems. The insights DCAA gains from those audits assists DCAA when it audits a contractor’s incurred costs. According to a DoD analysis of the impacts of the recently proposed legislation, keeping incurred cost audits in the hands of DCAA:

…allows for the continuation of many initiatives that DCAA has put in place to more efficiently and effectively perform audits (e.g., the use of the low risk sampling process, the coordination of subcontract assist audits, and the process for obtaining and determining adequacy of incurred cost proposals). Without one group coordinating the need for commercial auditors, the Department will lose many of these efficiencies and will lose adequate oversight over the complete incurred cost audit process. [emphasis added]

One of the primary motivations for the new Congressional language on incurred cost audits is DCAA’s incurred cost audit backlog, which was relatively large until a few years ago and has recently become more manageable according to DCAA’s most recent annual report. The agency said it was on track to eliminate the backlog by next year, although with the hiring freeze it may have to re-evaluate that goal. Regardless of whether the backlog is eliminated one or three or even five years from now, Congress is proposing a rather drastic solution to a problem that is no longer drastic itself.

This is not a backyard experiment with few consequences for failure. Billions of taxpayer dollars are on the line every year. While DCAA has room for improvement, privatizing the agency’s work would most likely make it harder to crack down on contractor overbilling.

Given the large risks and the unclear benefits or privatizing contract audits, Section 820 should be repealed. If DCAA needs a temporary boost, it should be given authority to hire more staff on a temporary basis, or perhaps even hire private sector auditors on a short-term basis. The Defense Department proposes the latter, calling it “much more effective” while ensuring “that a function that is inherently governmental in nature continues to be performed by Government auditors when feasible, but allows for the use of commercial auditors when necessary to address incurred cost backlog.”

POGO does not often agree with the Defense Department, but its proposal makes sense. Let’s learn from our past mistakes rather than repeat them.