DCAA Audits: Widespread Problems with Audit Quality Require Significant Reform

On January 4, 2010, the Deputy Secretary of Defense issued a revised DCAA mission statement in DOD Directive 5105.36 that highlights protecting the public interest as the agency's primary mission focus. Specifically, under the new mission statement, contract audits and advisory services provided on contract negotiation, contract administration, and settlement of contracts are to ensure that taxpayer dollars are spent on fair and reasonable contract prices.

In fiscal year 2012, DCAA established a strategic plan with short and long-term milestones for the agency that are tied to specific goals, and DCAA incorporated these metrics in its new strategic plan. These actions will help DCAA better ensure that it is making progress toward improving the quality of the agency's audits as well as strengthening auditor integrity, objectivity, and independence.

In fiscal year 2012, DCAA established a strategic plan with short and long-term milestones for the agency that are tied to specific goals, and DCAA incorporated these metrics in its new strategic plan. These actions will help DCAA better ensure that it is making progress toward improving the quality of the agency's audits as well as strengthening auditor integrity, objectivity, and independence.

In fiscal year 2011, DCAA, in consultation with stakeholders, implemented a risk-based framework for prioritizing audits. Additionally, DCAA began to use this risk-based approach to inform staffing allocations, priorities, and training. As a result, DCAA can better ensure that its limited resources are being effectively employed to manage its highest risk audits.

In August 2008, DCAA established the position of Assistant Director, Integrity and Quality Assurance with responsibility for DCAA's quality assurance program. On July 9, 2009, this position was approved as an SES-level position. The position was filled internally through promotion of the DCAA Field Detachment Deputy Director, on March 28, 2010.

In 2011, DCAA established two directorates to conduct critical internal inspector general functions related to DCAA Quality Assurance Program and address hotline complaints. DCAA's Integrity and Quality Assurance Directorate also established policies and procedures requiring monitoring of its quality assurance program and requiring periodic audit quality reviews. Also in May of 2011, DCAA created the Internal Review Directorate responsible for operating DCAA's Hotline and maintaining an internal website for anonymous reporting of allegation of misconduct against agency employees.

DCAA worked with external stakeholders and outside experts to implement actions and changes to its portfolio of audits and nonaudits that were incorporated into a Risk Based Approach issued in March 21, 2012. This approach summarized the changes DCAA has made to audit policy/guidance/processes that focused on providing quality products that are GAGAS compliant and directing audit resources to the highest risk areas. In addition, DCAA issued multiple Memorandums for Regional Directors (MRD) in 2010 and 2011 that revised the audit guidance and processes for certain audits such as financial capability audits/risk assessments, performance of Earning Value Management System (EVMS) and forward pricing threshold. The financial capability/risk assessment audits have been assigned to the Defense Contract Management Agency (DCMA) eliminating the requirement for DCAA to perform these audits and DCAA will no longer self initiate audits. DCMA has established a Financial Capability Group that will perform the financial capability/risk assessment audits unless requested by the contracting officer due to unique circumstances. Also, DCAA will no longer self initiate the EVMS audits and DCMA will only provide written request to DCAA for an EVMS audit based on its continuous surveillance and independent risk assessment. In addition, the EVMS audits, when requested, will be limited to the eight Guidelines under DCAA's purview. Finally, DCAA revised the Department of Defense Federal Acquisition Regulation Supplement (DFARS) Procedures, Guidance, and Information to limit the contracting officers requests for DCAA audit assistance to Fixed-Priced proposals exceeding $10 million and Cost-Type proposals exceeding $100 million. As a result of the steps taken by DCAA to implement our recommendation, DCAA will be able to focus on those contracting areas of greatest risk and better align the workload requirements with available resources.

In fiscal year 2011, DCAA, in consultation with stakeholders, implemented a risk-based framework for prioritizing audits. Additionally, DCAA began to use this risk-based approach to inform staffing allocations, priorities, and training. As a result, DCAA can better ensure that its limited resources are being effectively employed to manage its highest risk audits.

In July 2012, DCAA revised its Contract Audit Manual to assign the responsibility for developing and formulating DCAA's contract audit policy and guidance for compliance with auditing standards to its Auditing Standard (PAS) Division. The PAS division was also issued responsibility for developing training and providing technical assistance on GAGAS requirements.

During 2010 and 2011 DCAA issued multiple Memorandums for Regional Directors (MRD) that revised the audit programs for price proposal audits, parts of proposal audits, cost realism audits, and major incurred cost audits that provided on what constitutes sufficient testing. DCAA issued variable and attribute sample policies that established guidance for sample sizes and reporting sample results in audit reports. DCAA also updated its Contract Audit Manual (CAM) to provide more detail on testing requirements.

DCAA developed and deployed a mandatory GAGAS web based training that emphasized the level of assurance to be provided by various types of DCAA engagements and provided guidance to help ensure DCAA auditor independence, planning, fraud risk, supervision, auditor judgment, audit documentation, and reporting. DCAA also incorporated detailed guidance on testing requirements into their training curriculum, such as their Orientation to Contract Audits and Statistical Sampling courses.

The Department of Defense (DOD) Office of Inspector General (OIG) conducted a peer review on the Defense Contract Audit Agency (DCAA) and issued its report in August 2014. The report includes an opinion that the system of quality control is adequately designed except certain deficiencies, and makes a recommendation for addressing those deficiences. This opinion will allow DCAA to again issue reports in compliance with Generally Accepted Government Auditing Standards (GAGAS) and take steps to further improve its audit function.

In July 2012, the DCAA Integrity and Quality Assurance Directorate established a process for making recommendations to address annual quality assurance review findings of serious deficiencies and GAGAS noncompliance to the DCAA Director on a real-time basis. DCAA assigned the Assistant Director of the Integrity and Quality Assurance Directorate (Quality Directorate) responsibility for providing these recommendations and actions necessary. The Quality Directorate developed a database to track the status of the recommendations and determine when a follow-up review will be required. The Quality Directorate also provided training on the GAGAS deficiencies identified during the reviews and performed the required follow-up reviews to determine whether the implementation of the corrective action plans successfully addressed the deficiencies noted in the quality reviews.

DOD concurred with our recommendation. In July 2012, the DOD Comptroller created the DCAA Oversight Committee (DOC). The DOC was assigned responsibility for monitoring DCAA's progress in addressing their audit quality deficiencies and to meet with the related DOD stakeholders to report on DCAA's progress.