DCAA’s focus on audits of contractor business systems highlighted in its latest report to congress

10 USC 3847 requires the director of the Defense Contract Audit Agency (DCAA) to prepare an annual report on the activities of the agency and to provide that report to congress no later than March 30 of each year. The report includes information from the previous government fiscal year about the audits conducted during the year, challenges encountered during those audits, recommendations to improve the audit process and a description of outreach activities with industry.

The majority of the report is focused on the agency’s performance during the year and the content of the “audit performance” section has remained relatively consistent over the years with regular reporting on the types of audits the agency performs and performance metrics such as number of audit reports issued, timeliness of audits, audit exceptions and questioned cost, sustention of recommendations and cost savings. The report states that in fiscal year 2022, the agency completed 2,560 audit reports identifying over $5.7 billion in audit exceptions from $262.3 billion in contract costs examined. The agency claimed $3 billion in savings, a return on investment of $4.6 to $1 relative to the total annual cost of agency operations. Of particular interest in this latest report from the DCAA, the agency specifically highlights its recent emphasis on — and progress made — auditing contractor business systems. The report indicates that the agency’s focus on business system audits over the past few years resulted in the agency completing 288 system audits by the end of fiscal year 2022.

In February 2019, the Government Accountability Office (GAO) issued a report addressing the Department of Defense’s (DoD’s) lack of attention to reviews of contractor business systems. The GAO reported that the DoD had made several changes to its processes for reviewing contractor business systems but had no mechanism to monitor and ensure that these reviews were being conducted in a timely manner. The report also said that in 2012, the DoD recognized some duplication of effort and clarified roles for the DCAA and the Defense Contract Management Agency (DCMA) with respect to business system reviews. The clarifications included directing that the DCAA had responsibility for three systems and the DCMA had responsibility for three systems. In all cases, the DCMA Administrative Contracting Officer (ACO) makes the final determination on whether a system is approved or disapproved. With respect to DCAA business system audits, the GAO reported that the agency had conducted few business system audits since 2013 because it focused its efforts and resources on other types of audits. In response to the GAO report, the DoD agreed to have the DCMA and the DCAA collaborate to determine the best way to develop a mechanism to monitor and assess whether contractor business system reviews were being completed in a timely manner. During the GAO audit, the DCAA identified 285 systems that required an audit and the agency planned to complete audits of the 285 systems from fiscal years 2019 through 2022.

The DCAA business systems audits verify contractors’ systems are compliant with Defense Federal Acquisition Regulation Supplement (DFARS) business system requirements. The three systems that the DCAA is responsible to audit are accounting systems, cost estimating systems and material management and accounting systems (MMAS). These three systems underpin the controls over contractor’s contract costs, so verifying the compliance of a given system increases the reliability of costs produced by the system. Also, performance of the system audits improves the auditors’ understanding of these systems increasing the effectiveness and efficiency of other DCAA audits. The DCAA reports that it was successful in completing 288 audits by the end of FY 2022. These audits were conducted primarily for the larger defense contractors but, in its report, the DCAA says it also completed 1,300 business system type audits on contractors of other sizes.

The DCAA reports that its ability to complete a large number of business system type audits was the culmination of several years of preparatory work. Beginning in fiscal year 2019, the DCAA prioritized business system audits to meet the goal of completing 285 audits by fiscal year 2022. The DCAA first created a business system team bringing together auditors with expert knowledge on this type of audit. The team then assisted other field audit offices as they conducted audits and helped develop a business system audit course at the Defense Contract Audit Institute (DCAI) to train and maintain the skills of all DCAA’s auditors. In fiscal year 2022, the business system team stood down and the responsibility to conduct business system audits passed fully to the field audit offices. In addition, the DCAA’s report to congress states that with fewer requested proposal audits in 2021 and 2022, the agency was able to apply more resources and conduct more business system audits.

Since the GAO report was issued in 2019, the DCAA has focused significantly on contractor business systems and has committed considerable resources to conducting lengthy, detailed and complex audits. This resource commitment will likely continue in the coming years as the DCAA works to become and remain up to date on business system audits — institutionalizing a structured approach to scheduling and conducting these types of audits.

The Baker Tilly team has extensive experience in contractor business system audits and reviews and can help you implement compliant business systems and prepare for — or respond to — DCAA and DCMA audits and reviews.