DCAA Audits:

Widespread Problems with Audit Quality Require Significant Reform

GAO-09-468: Published: Sep 23, 2009. Publicly Released: Sep 23, 2009.

Additional Materials:

Contact:

Gregory D. Kutz
(202) 512-9505
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

The Defense Contract Audit Agency (DCAA) under the Department of Defense (DOD) Comptroller plays a critical role in contractor oversight by providing auditing, accounting, and financial advisory services in connection with DOD and other federal agency contracts and subcontracts. Last year, GAO found numerous problems with DCAA audit quality at three locations in California, including the failure to meet professional auditing standards. This report addresses audit quality issues at DCAA offices nationwide. GAO was asked to (1) conduct a broad assessment of DCAA's management environment and audit quality assurance structure, (2) evaluate DCAA actions to date to correct previously identified problems, and (3) identify potential legislative and other actions for improving DCAA effectiveness and independence. To achieve these objectives, GAO analyzed DCAA's mission, strategic plan, audit policies, and quality assurance program; conducted interviews; reviewed selected audits at DCAA offices; and analyzed legislative and other actions.

GAO found audit quality problems at DCAA offices nationwide, including compromise of auditor independence, insufficient audit testing, and inadequate planning and supervision. GAO's conclusions stem from a review of 69 audit assignments supporting contract award and administrative decisions; an assessment of DCAA's audit quality assurance structure, which found similar audit quality problems but gave satisfactory ratings to deficient audits; and DCAA's rescission of 80 problem audit reports. The rescinded audits supported decisions on pricing and contract awards and impacted the planning and reliability of hundreds of other DCAA audits, representing billions of dollars in DOD expenditures. GAO found DCAA's management environment and quality assurance structure were based on a production-oriented mission that put DCAA in the role of facilitating DOD contracting without also protecting the public interest. DCAA has taken several positive steps. However, DOD and DCAA have not yet addressed fundamental weaknesses in DCAA's mission, strategic plan, metrics, audit approach, and human capital practices that had a detrimental effect on audit quality. To improve DCAA oversight, the DOD Comptroller requested Defense Business Board and "tiger team" reviews and established a DCAA Oversight Committee. In addition, in the short-term, Congress could provide DCAA with certain legislative protections and authorities similar to those available to IGs. In the longer term, Congress may wish to consider organizational changes to elevate DCAA to a component agency reporting to the Deputy Secretary or to establish an independent governmentwide contract audit agency.

Matter for Congressional Consideration

  1. Status: Closed - Implemented

    Comments: The House Armed Services Acquisition Committee introduced H.R. 5013 to Congress, which would amend United States Code Title 10 to include the following provisions: (1) establish a separate Defense Contract Audit Agency Office of General Counsel; (2) require that any contractor business system review carried out by a military department, a Defense Agency, or a Department of Defense Field Activity (a) comply with generally accepted government auditing standards (GAGAS), (b) is performed by an audit team that does not engage any other official activity involving the contractor, (c) is performed in a time and manner consistent with a documented assessment of the risk to the Federal Government, and (d) involves testing a representative sample of transactions sufficient to fully examine the integrity of the system; (3) the Secretary of Defense shall issue guidance relating to contract audits that are not contractor business system reviews that (a) requires that such audits comply with GAGAS and are performed in a time and manner consistent with a documented assessment of risk to the Federal Government, (b) establishes guidelines for discussions of the scope of the audit with the contractor concerned that ensure that such scope is not improperly influenced by the contractor, (c) provides for withholding of contract payments when necessary to compel the submission of documentation from the contractor, and (d) requires that the results of contract audits performed on behalf of an agency of the Department of Defense be shared with other Federal agencies upon request, without reimbursement.

    Matter: In addition to our recommendations to DOD for improving DCAA audit quality and auditor objectivity, integrity, and independence, Congress may wish to consider the following legislative actions for enhancing DCAA's effectiveness and independence. In considering these options, the Congress would need to weigh DCAA's ability to accomplish significant reforms within its current environment and the cost and administrative effort involved with the alternative options along with the potential benefits. Timing would also need to be considered, given significant reforms that DCAA is already undertaking and the additional burden that a change in organizational placement would add at this time. (1) In the short term, as DCAA makes progress in correcting fundamental weaknesses that have impacted audit quality, Congress could consider enhancing DCAA reform efforts by enacting legislation to grant it protections and authorities similar to those embodied in the Inspector General Act, as amended. (2) In the medium term, Congress could consider elevating the contract audit function within DOD by moving DCAA from under the DOD Comptroller/CFO and placing it under the Deputy Secretary of Defense. (3) In the longer term, depending on the outcome of acquisition management reform initiatives under way and the success of DCAA management reforms, Congress could consider creating an independent, governmentwide contract audit agency. Legislation to move DCAA should incorporate the protections and authorities similar to those embodied in the Inspector General Act, if these have not already been granted to DCAA.

Recommendations for Executive Action

  1. Status: Closed - Implemented

    Comments: On January 4, 2010, the Deputy Secretary of Defense issued a revised DCAA mission statement in DOD Directive 5105.36 that highlights protecting the public interest as the agency's primary mission focus. Specifically, under the new mission statement, contract audits and advisory services provided on contract negotiation, contract administration, and settlement of contracts are to ensure that taxpayer dollars are spent on fair and reasonable contract prices.

    Recommendation: To improve the quality of the agency's audits and strengthen auditor integrity, objectivity, and independence, including recommendations for actions on findings in this report that are aligned with certain Defense Business Board (DBB) findings and recommendations, the Secretary of Defense should revise DCAA's mission statement to reflect the need for quality contract audits and related nonaudit services that take into account serving the public interest.

    Agency Affected: Department of Defense

  2. Status: Closed - Implemented

    Comments: In fiscal year 2012, DCAA established a strategic plan with short and long-term milestones for the agency that are tied to specific goals, and DCAA incorporated these metrics in its new strategic plan. These actions will help DCAA better ensure that it is making progress toward improving the quality of the agency's audits as well as strengthening auditor integrity, objectivity, and independence.

    Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA, in concert with the revised mission statement, to develop a strategic plan with short-term and long-term outcome-related goals.

    Agency Affected: Department of Defense

  3. Status: Closed - Implemented

    Comments: In fiscal year 2012, DCAA established a strategic plan with short and long-term milestones for the agency that are tied to specific goals, and DCAA incorporated these metrics in its new strategic plan. These actions will help DCAA better ensure that it is making progress toward improving the quality of the agency's audits as well as strengthening auditor integrity, objectivity, and independence.

    Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA to measure progress in achieving strategic goals, ensure that metrics are tied to the revised mission statement and strategic plan and support the agency's annual work plan.

    Agency Affected: Department of Defense

  4. Status: Closed - Implemented

    Comments: In fiscal year 2011, DCAA, in consultation with stakeholders, implemented a risk-based framework for prioritizing audits. Additionally, DCAA began to use this risk-based approach to inform staffing allocations, priorities, and training. As a result, DCAA can better ensure that its limited resources are being effectively employed to manage its highest risk audits.

    Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA to consult with DOD stakeholders and engage outside experts to develop a risk-based contract audit approach that identifies resource requirements and focuses on performing quality audits that meet generally accepted government auditing standards (GAGAS).

    Agency Affected: Department of Defense

  5. Status: Closed - Implemented

    Comments: In August 2008, DCAA established the position of Assistant Director, Integrity and Quality Assurance with responsibility for DCAA's quality assurance program. On July 9, 2009, this position was approved as an SES-level position. The position was filled internally through promotion of the DCAA Field Detachment Deputy Director, on March 28, 2010.

    Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA to establish an SES-level position with responsibility for audit quality assurance that requires demonstrated knowledge and experience in applying professional audit standards.

    Agency Affected: Department of Defense

  6. Status: Closed - Implemented

    Comments: In 2011, DCAA established two directorates to conduct critical internal inspector general functions related to DCAA Quality Assurance Program and address hotline complaints. DCAA's Integrity and Quality Assurance Directorate also established policies and procedures requiring monitoring of its quality assurance program and requiring periodic audit quality reviews. Also in May of 2011, DCAA created the Internal Review Directorate responsible for operating DCAA's Hotline and maintaining an internal website for anonymous reporting of allegation of misconduct against agency employees.

    Recommendation: Consistent with DBB report observations, the Secretary of Defense should direct the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA to establish a separate DCAA internal review organization to conduct critical internal inspector general functions, including performing periodic internal evaluations and reviews and addressing DCAA hotline complaints.

    Agency Affected: Department of Defense

  7. Status: Closed - Implemented

    Comments: DCAA worked with external stakeholders and outside experts to implement actions and changes to its portfolio of audits and nonaudits that were incorporated into a Risk Based Approach issued in March 21, 2012. This approach summarized the changes DCAA has made to audit policy/guidance/processes that focused on providing quality products that are GAGAS compliant and directing audit resources to the highest risk areas. In addition, DCAA issued multiple Memorandums for Regional Directors (MRD) in 2010 and 2011 that revised the audit guidance and processes for certain audits such as financial capability audits/risk assessments, performance of Earning Value Management System (EVMS) and forward pricing threshold. The financial capability/risk assessment audits have been assigned to the Defense Contract Management Agency (DCMA) eliminating the requirement for DCAA to perform these audits and DCAA will no longer self initiate audits. DCMA has established a Financial Capability Group that will perform the financial capability/risk assessment audits unless requested by the contracting officer due to unique circumstances. Also, DCAA will no longer self initiate the EVMS audits and DCMA will only provide written request to DCAA for an EVMS audit based on its continuous surveillance and independent risk assessment. In addition, the EVMS audits, when requested, will be limited to the eight Guidelines under DCAA's purview. Finally, DCAA revised the Department of Defense Federal Acquisition Regulation Supplement (DFARS) Procedures, Guidance, and Information to limit the contracting officers requests for DCAA audit assistance to Fixed-Priced proposals exceeding $10 million and Cost-Type proposals exceeding $100 million. As a result of the steps taken by DCAA to implement our recommendation, DCAA will be able to focus on those contracting areas of greatest risk and better align the workload requirements with available resources.

    Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA in consultation with DOD stakeholders, to review DCAA's current portfolio of audit and nonaudit services to determine if any should be transferred or reassigned to another DOD agency or terminated in order for DCAA to comply with GAGAS integrity, objectivity, and independence requirements.

    Agency Affected: Department of Defense

  8. Status: Closed - Implemented

    Comments: In fiscal year 2011, DCAA, in consultation with stakeholders, implemented a risk-based framework for prioritizing audits. Additionally, DCAA began to use this risk-based approach to inform staffing allocations, priorities, and training. As a result, DCAA can better ensure that its limited resources are being effectively employed to manage its highest risk audits.

    Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA based on the risk-based audit approach, to develop a staffing plan that identifies auditor resource requirements as well as auditor skill levels and training needs.

    Agency Affected: Department of Defense

  9. Status: Closed - Implemented

    Comments: In July 2012, DCAA revised its Contract Audit Manual to assign the responsibility for developing and formulating DCAA's contract audit policy and guidance for compliance with auditing standards to its Auditing Standard (PAS) Division. The PAS division was also issued responsibility for developing training and providing technical assistance on GAGAS requirements.

    Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA to establish a position for an expert on auditing standards or consult with an outside expert on auditing standards to assist in revising contract audit policy, providing guidance on sampling and testing, and developing training on professional auditing standards.

    Agency Affected: Department of Defense

  10. Status: Closed - Implemented

    Comments: During 2010 and 2011 DCAA issued multiple Memorandums for Regional Directors (MRD) that revised the audit programs for price proposal audits, parts of proposal audits, cost realism audits, and major incurred cost audits that provided on what constitutes sufficient testing. DCAA issued variable and attribute sample policies that established guidance for sample sizes and reporting sample results in audit reports. DCAA also updated its Contract Audit Manual (CAM) to provide more detail on testing requirements.

    Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA to revise DCAA audit policy to provide appropriate guidance on what constitutes sufficient testing to comply with GAGAS. Update DCAA's Contract Audit Manual, as appropriate.

    Agency Affected: Department of Defense

  11. Status: Closed - Implemented

    Comments: DCAA developed and deployed a mandatory GAGAS web based training that emphasized the level of assurance to be provided by various types of DCAA engagements and provided guidance to help ensure DCAA auditor independence, planning, fraud risk, supervision, auditor judgment, audit documentation, and reporting. DCAA also incorporated detailed guidance on testing requirements into their training curriculum, such as their Orientation to Contract Audits and Statistical Sampling courses.

    Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA to develop agencywide training on government audit standards. This training should emphasize the level of assurance intended by the various types of engagements and provide detailed guidance on auditor independence, planning, fraud risk, level of testing, supervision, auditor judgment, audit documentation, and reporting.

    Agency Affected: Department of Defense

  12. Status: Closed - Implemented

    Comments: The Department of Defense (DOD) Office of Inspector General (OIG) conducted a peer review on the Defense Contract Audit Agency (DCAA) and issued its report in August 2014. The report includes an opinion that the system of quality control is adequately designed except certain deficiencies, and makes a recommendation for addressing those deficiences. This opinion will allow DCAA to again issue reports in compliance with Generally Accepted Government Auditing Standards (GAGAS) and take steps to further improve its audit function.

    Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA to conduct a comprehensive, independent review of DCAA's revised audit quality assurance function. This review should focus on the consistent application of criteria used for assessing audit quality and assuring timely, consistent, and appropriate reporting of review results.

    Agency Affected: Department of Defense

  13. Status: Closed - Implemented

    Comments: In July 2012, the DCAA Integrity and Quality Assurance Directorate established a process for making recommendations to address annual quality assurance review findings of serious deficiencies and GAGAS noncompliance to the DCAA Director on a real-time basis. DCAA assigned the Assistant Director of the Integrity and Quality Assurance Directorate (Quality Directorate) responsibility for providing these recommendations and actions necessary. The Quality Directorate developed a database to track the status of the recommendations and determine when a follow-up review will be required. The Quality Directorate also provided training on the GAGAS deficiencies identified during the reviews and performed the required follow-up reviews to determine whether the implementation of the corrective action plans successfully addressed the deficiencies noted in the quality reviews.

    Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA to make appropriate recommendations to address annual quality assurance review findings of serious deficiencies and GAGAS noncompliance, provide training, and follow-up to assure that appropriate corrective actions have been taken.

    Agency Affected: Department of Defense

  14. Status: Closed - Not Implemented

    Comments: In 2013, DCAA reported it had revised its direct billing process and eliminated the direct billing program. The agency provided us with information on the new framework that has replaced the direct billing program. However, GAO continues to have concerns because the same supervisory auditor makes decisions on risk level of a contract, a decision that affects the number of vouchers to be reviewed; and also reviews the associated vouchers for the contract. While DCAA has branch managers involved in the process it does not adequately address the recommendation.

    Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA to establish policies and procedures to ensure that auditors who make direct bill decisions are independent of DCAA employees who perform a DOD management function by reviewing vouchers of contractors not eligible for the direct billing program, thereby reducing situations where DCAA auditors are encouraged to reduce their office workload by approving contractors for the direct-bill program.

    Agency Affected: Department of Defense

  15. Status: Closed - Not Implemented

    Comments: The DOD IG revisited the May 2007 DCAA peer review report conclusions and decided not to rescind its report on the overall conclusion of DCAA quality controls. However, on August 26, 2009, the DOD IG instructed DCAA to qualify its audits with a statement that it no longer complies with the peer review requirements of Generally Accepted Government Auditing Standards (GAGAS).

    Recommendation: The Department of Defense Inspector General should reconsider its overall conclusions in the May 2007 DOD IG report on the audit of DCAA's quality control system in which it reported an adequate ("clean") opinion on DCAA system of quality control in light of the serious deficiencies and findings included in that report and the additional evidence identified in our audit.

    Agency Affected: Department of Defense

  16. Status: Closed - Implemented

    Comments: DOD concurred with our recommendation. In July 2012, the DOD Comptroller created the DCAA Oversight Committee (DOC). The DOC was assigned responsibility for monitoring DCAA's progress in addressing their audit quality deficiencies and to meet with the related DOD stakeholders to report on DCAA's progress.

    Recommendation: To improve the quality of the agency's audits and strengthen auditor integrity, objectivity, and independence, including recommendations for actions on findings in this report that are aligned with certain Defense Business Board (DBB) findings and recommendations, the Secretary of Defense should require the Under Secretary of Defense (Comptroller/CFO) to establish milestones for completing DCAA corrective actions and monitor and regularly report on DCAA progress to assure timely completion of critical actions.

    Agency Affected: Department of Defense

  17. Status: Closed - Not Implemented

    Comments: The DOD IG determined that it was not necessary to rescind its May 2007 DCAA peer review report. However, on August 26, 2009, the IG instructed DCAA to qualify its audits with a statement that it no longer complies with the peer review requirements of Generally Accepted Government Auditing Standards (GAGAS).

    Recommendation: The Department of Defense Inspector General should determine whether the May 2007 DOD IG report on the audit of DCAA's quality control system should be rescinded or modified.

    Agency Affected: Department of Defense

 

Explore the full database of GAO's Open Recommendations »

Sep 22, 2014

Jul 9, 2014

Jun 19, 2014

May 30, 2014

May 15, 2014

May 13, 2014

May 12, 2014

May 2, 2014

Mar 27, 2014

Looking for more? Browse all our products here