Project No. D2016-DAPOCF-0122.000

26
INTEGRITY EFFICIENCY ACCOUNTABILITY EXCELLENCE Inspector General U.S. Department of Defense External Peer Review on the Defense Contract Audit Agency Letter of Comment NOVEMBER 17, 2017 Project No. D2016-DAPOCF-0122.000

Transcript of Project No. D2016-DAPOCF-0122.000

Page 1: Project No. D2016-DAPOCF-0122.000

I N T E G R I T Y E F F I C I E N C Y A C C O U N TA B I L I T Y E XC E L L E N C E

Inspector General U.S. Department of Defense

External Peer Review on the Defense Contract Audit Agency Letter of Comment

N O V E M B E R 1 7 , 2 0 1 7

Project No. D2016-DAPOCF-0122.000

Page 2: Project No. D2016-DAPOCF-0122.000

I N T E G R I T Y E F F I C I E N C Y A C C O U N T A B I L I T Y E X C E L L E N C E

MissionOur mission is to provide independent, relevant, and timely oversight of the Department of Defense that supports the warfighter; promotes

accountability, integrity, and efficiency; advises the Secretary of Defense and Congress; and informs the public.

VisionOur vision is to be a model oversight organization in the Federal Government by leading change, speaking truth,

and promoting excellence—a diverse organization, working together as one professional team, recognized

as leaders in our field.

dodig.mil/hotline |800.424.9098

HOTLINEDepartment of Defense

F r a u d, W a s t e, & A b u s e

For more information about whistleblower protection, please see the inside back cover.

Page 3: Project No. D2016-DAPOCF-0122.000

Project No. D2016-DAPOCF-0122.000 │ i

INSPECTOR GENERALDEPARTMENT OF DEFENSE4800 MARK CENTER DRIVE

ALEXANDRIA, VIRGINIA 22350-1500

November 17 2017

MEMORANDUM FOR DIRECTOR, DEFENSE CONTRACT AUDIT AGENCY

SUBJECT: External Peer Review on the Defense Contract Audit Agency Letter of Comment

Attached is the letter of comment resulting from our review of the Defense Contract Audit Agency (DCAA) system of quality control for the period ended June 30, 2016, which we conducted in accordance with Government Auditing Standards and the Council of the Inspectors General on Integrity and Efficiency Guide for Conducting Peer Reviews of the Audit Organizations of Federal Offices of Inspector General.

The letter of comment should be read in conjunction with Report No. DODIG-2018-028, External Peer Review on the Defense Contract Audit Agency, System Review Report, November 17, 2017 (hereafter referred to as the “system review report”). The findings described in the letter of comment were not considered to be of sufficient significance to affect the opinion expressed in the system review report.

We considered management comments on a draft of this letter of comment when preparing the final letter. Comments from DCAA conformed to the requirements of DoD Instruction 7650.03; therefore, we do not require additional comments.

We appreciate the courtesies extended to the staff. Please direct any inquiries to Ms. Carolyn R. Hantz at (703) 604-8877, or [email protected].

Randolph R. StoneDeputy Inspector General Policy and Oversight

Enclosures:As stated

Transmittal

Page 4: Project No. D2016-DAPOCF-0122.000
Page 5: Project No. D2016-DAPOCF-0122.000

Project No. D2016-DAPOCF-0122.000 │ 1

INSPECTOR GENERALDEPARTMENT OF DEFENSE4800 MARK CENTER DRIVE

ALEXANDRIA, VIRGINIA 22350-1500

November 17, 2017

MEMORANDUM FOR DIRECTOR, DEFENSE CONTRACT AUDIT AGENCY

SUBJECT: External Peer Review on the Defense Contract Audit Agency Letter of Comment

We reviewed the system of quality control for Defense Contract Audit Agency (DCAA) in effect for the period ended June 30, 2016, and issued our system review report on November 17, 2017, in which DCAA received a rating of pass with deficiencies. The system review report should be read in conjunction with the comments in this letter. The findings described in the following sections were not considered to be of sufficient significance to affect the opinion expressed in the report. Enclosure 1 of this letter of comment identifies the findings by DCAA assignment number.

DocumentationFinding 1. DCAA Did Not Sufficiently Document the Work Performed Government Auditing Standards (GAS) 5.16a requires auditors to prepare audit documentation in sufficient detail to enable an experienced auditor to understand from the documentation the nature, timing, extent, and results of procedures performed, the evidence obtained, and the conclusions reached. In 40 of 67 DCAA audits we reviewed (60 percent), the documentation was insufficient to understand the nature, timing, extent, and results of work performed.1 For 9 of the 40 audits with deficiencies, we found 4 or more significant documentation deficiencies and we addressed the deficiencies in the External Peer Review on the Defense Contract Audit Agency, System Review Report.

For the remaining 31 audits, we found between 1 and 3 documentation deficiencies. As a result of the documentation deficiencies, we had to hold extensive discussions with DCAA auditors to understand the work performed and to determine that DCAA auditors had obtained sufficient evidence in support of the reported opinion. We found documentation deficiencies in all six DCAA regions.

1 See Enclosure 1 of the External Peer Review on the Defense Contract Audit Agency System Review Report for a list of the 67 audits we selected for review.

Memorandum

Page 6: Project No. D2016-DAPOCF-0122.000

2 │ Project No. D2016-DAPOCF-0122.000

Among the 31 audits, common deficiencies involved the auditor not adequately documenting:

• updates or changes in conditions that impact the scope of audit and assessed risk,

• rationale for significant judgments or conclusions reached,

• the development of reported findings,

• the audit criteria tested,

• the testing performed to verify compliance with the audit criteria, and

• working paper references to supporting documents.

For example, in DCAA Assignment No. 1211-2009E10100009, the auditor planned transaction testing of the contractor’s medical insurance cost accounts, which represented 32 percent of total proposed indirect costs. During fieldwork, the auditor chose not to test the accounts based on the results of prior-year audits. However, the auditor did not update the planning document for the significant change to planned transaction testing, as DCAA procedures require.

In DCAA Assignment No. 9721-2015A23000001, the auditor did not appropriately document the development of a reported finding. The audit report questioned $437,000 in executive compensation costs based on Federal Acquisition Regulation (FAR) 31.205-6(p), “Compensation for Personal Services.” However, we could not reconcile the $437,000 amount back to the working papers without obtaining an explanation from the auditor that multiple amounts had to be added together to calculate it. Also, the working papers do not document the basis for questioning the costs. Finally, the lead working papers do not provide a reference to where the contractor’s reaction to the finding can be found in the working papers.

In DCAA Assignment No. 2171-2010L10100003, the auditor did not clearly document the purpose and criteria used to perform various tests of other direct costs. The auditor subsequently clarified that the purpose of the procedures was to determine the reasonableness of the other direct costs.

Our review did not disclose any inadequacies with DCAA policies and procedures related to documenting the work performed in accordance with GAS. However, the auditors did not comply with established DCAA procedures. Given the number and significance of documentation deficiencies we found, DCAA should assess the effectiveness of its controls for ensuring compliance with established agency policies and procedures.

Page 7: Project No. D2016-DAPOCF-0122.000

Project No. D2016-DAPOCF-0122.000 │ 3

Recommendation, Management Comments, and Our ResponseRecommendation 1The Defense Contract Audit Agency Director should assess and implement actions to improve the quality control procedures to help ensure that auditors adequately document:

a. Updates or changes in conditions that impact the scope of audit and assessed risk.

b. The rationale for significant judgments or conclusions reached.

c. The development of reported findings.

d. The audit criteria tested.

e. The testing performed to verify compliance with the audit criteria.

f. Working paper references to supporting documents.

DCAA Director CommentsDCAA agreed with the recommendation, even though DCAA stated that it disagreed with some of the finding’s factual matters. In response to the recommendation, DCAA provided training on audit criteria to 26 DCAA field audit offices (FAOs), and DCAA anticipates completing the remainder of the audit criteria training by February 2018. Regarding the specific areas listed in the recommendation, DCAA is providing training to DCAA FAO representatives at workshops being held in October and November of 2017. In turn, the FAO representatives will provide the training to their respective FAOs by March 2018. In addition, DCAA identified the following actions already taken to improve working paper documentation:

• In March 2017, DCAA provided training that included the importance of appropriately documenting judgmental selections.

• In February 2017, DCAA updated its Briefing Contracts E-learning course to provide guidance on the importance of identifying special contract provisions.

• In February and March 2016, DCAA conducted training workshops on how to properly document procedures to develop elements of a finding.

• In February 2016, DCAA updated its audit manual to include a more detailed example of working paper documentation required when using judgmental selection.

• In September 2015, DCAA began offering two training courses addressing documentation requirements that all new DCAA auditors must complete.

• In the summer of 2015, DCAA updated its Incurred Cost training course to include guidance on determining whether claimed amounts comply with special contract provisions.

Page 8: Project No. D2016-DAPOCF-0122.000

4 │ Project No. D2016-DAPOCF-0122.000

Our ResponseDCAA’s plan to provide training on areas listed in the recommendation, along with already completed training course and guidance updates, adequately addresses the recommendation. Therefore, the recommendation is resolved but remains open. We verified that DCAA already completed the training course and guidance updates listed in its response. We will close the recommendation when DCAA provides evidence that:

• the audit criteria training scheduled for completion in February 2018 has been provided to all DCAA FAOs and

• the training covering the areas listed in the recommendation, which is scheduled for completion in March 2018, has been provided to all DCAA FAOs.

ReportingFinding 2. DCAA Did Not Communicate Information to the Contracting Officer or ContractorGAS Chapter 5, Standards for Attestation Engagements, addresses various requirements for properly reporting audit findings. For example, GAS 5.04 requires auditors to communicate pertinent information to individuals requesting the audit. In addition, GAS 5.33 states that providing a draft report to the audited entity and obtaining the entity’s comments helps the auditor develop a report that is fair, complete, and objective. Consistent with GAS 5.33, DCAA policy requires the auditor to obtain the DoD contractor’s comments and incorporate them in the final report. We identified reporting deficiencies within 12 of the 67 audits that we reviewed (18 percent). Of the 12 audits, 8 are addressed in the External Peer Review of Defense Contract Audit Agency, System Review Report, because they had a material impact on the reported findings.

The reporting deficiencies associated with the remaining four audits did not have a material impact on the reported findings, but they nevertheless deserve attention by DCAA management. In all four cases, the DCAA audit report did not communicate important information to the contracting officer or contractor in accordance with GAS or DCAA policy. We found this deficiency in three of the six DCAA regions. For example, in DCAA Assignment No. 6161-2009G10100035, the auditor found that $1.5 million in proposed costs were not in compliance with FAR 31.201-2(d), “Determining Allowability.” However, the auditor did not provide a copy of the draft report to the contractor for review and comment. As a result, the auditor did not receive comments from the contractor to help ensure that the reported findings were fair, complete, and objective.

Page 9: Project No. D2016-DAPOCF-0122.000

Project No. D2016-DAPOCF-0122.000 │ 5

We reviewed DCAA’s procedures for reporting pertinent information to the contracting officer and we found no inconsistencies with GAS. Our results reflect that DCAA auditors did not follow DCAA policy. DCAA should reemphasize to its auditors the importance of communicating important information in accordance with GAS.

Recommendation, Management Comments, and Our ResponseRecommendation 2The Defense Contract Audit Agency Director should emphasize to auditors the need to report important information to the contracting officer and contractor, in accordance with the reporting requirements of Government Auditing Standard, Chapter 5, and agency policy.

DCAA Director Comments

DCAA agreed with the recommendation, even though DCAA stated that it disagreed with some of the facts in the finding. In response to the recommendation, DCAA stated that training will be presented to representatives of all DCAA FAOs in October and November 2017. In turn, the FAO representatives will train their respective FAO staff by March 2018. In addition, according to DCAA, the agency created a new training course titled Developing an Effective Audit Report. Finally, DCAA stated that it will continue to emphasize its quality processes over audit reporting to ensure compliance with GAS and DCAA policy.

Our Response

The DCAA comments adequately addressed the recommendation; therefore, the recommendation is resolved but remains open. We will close the recommendation once DCAA provides evidence that DCAA:

• provided training to all DCAA FAOs emphasizing the reporting requirements of GAS and agency policy and

• began providing the Developing an Effective Audit Report training course to DCAA auditors to emphasize the reporting requirements of GAS and DCAA policy.

PlanningFinding 3. DCAA Did Not Adequately Consider Criteria in PlanningAttestation Standard (AT) 101.43 states that proper planning directly influences the selection of appropriate procedures and the timeliness of their application. AT 101.45 requires that the auditor consider the criteria to be used in planning an audit. For 7 of the 67 audits (10 percent), the auditor did not adequately consider the criteria to be used in planning the audits. Planning deficiencies could lead to evidence issues because the auditors may not plan procedures to fully address the audit objective. We found this deficiency in five of the six DCAA regions.

Page 10: Project No. D2016-DAPOCF-0122.000

6 │ Project No. D2016-DAPOCF-0122.000

In these seven audits, the auditors did not adequately plan procedures to accomplish the reported audit objective, which was to determine if the contractor complied with contract or solicitation terms related to accumulating and billing of contract costs. To accomplish the objective, DCAA used the applicable criteria found in FAR, Cost Accounting Standards (CAS), and special contract or solicitation terms. However, DCAA auditors did not plan sufficient procedures to determine the contractor’s compliance with special contract or solicitation terms. Among the seven audits, we found the following:

• In two instances, the auditors did not review the contracts to identify whether special contract or solicitation provisions existed and plan appropriate procedures to determine compliance with the provisions.

• In five instances, the auditors identified special contract or solicitation terms, but they did not plan procedures to test compliance with the terms.

For example, in DCAA Assignment No. 2171-2010P10100001, DCAA reported that the audit objective was to determine compliance with contract terms related to accounting and billing of fringe benefit costs. The auditor did not review the contractor’s contracts to identify whether related special contract provisions existed and plan appropriate compliance procedures.

In DCAA Assignment No. 6321-2010V10100022, the auditors identified special contract provisions relating to overtime, general and administrative costs, and subcontract pass-through costs. However, the auditors did not plan any steps documenting the nature, extent, and timing of testing needed to determine compliance with the provisions.

We attribute this finding in part to a change in DCAA policy. In September 2014, DCAA modified the standard reporting criteria for two major types of audits, incurred-cost audits and price-proposal audits. For incurred-cost audits, DCAA changed the criteria used in its reports from FAR and CAS to “contract terms pertaining to accumulating and billing amounts.” For price-proposal audits, DCAA similarly changed the reported criteria from compliance with FAR and CAS to “solicitation terms.” However, until recently, DCAA did not make significant changes to its standard audit programs to help auditors focus on the change in the reported criteria.2 In addition, DCAA did not provide training to auditors on the expectations for appropriately planning steps to address the modified reporting criteria.

In April 2017, DCAA revised its standard audit program steps to address the modified reporting criteria from FAR and CAS to contract and solicitation terms. We do not know the effectiveness of the revised steps because our testing involved audits issued between July 1, 2015, and June 30, 2016. In future DCAA internal quality reviews, DCAA should

2 DCAA maintains standard audit programs for each major type of audit that DCAA auditors conduct. The programs outline the specific audits steps and techniques that auditors should complete as they conduct an audit.

Page 11: Project No. D2016-DAPOCF-0122.000

Project No. D2016-DAPOCF-0122.000 │ 7

consider focusing on testing audits for compliance with the modified reporting criteria. Also, DCAA should consider providing training to highlight the need to appropriately plan steps for addressing the modified reporting criteria.

Recommendation, Management Comments, and Our ResponseRecommendation 3The Defense Contract Audit Agency Director should consider:

a. Providing training to highlight the need to plan steps for addressing the modified reporting criteria.

b. Focusing on testing for compliance with the modified reporting criteria in future Defense Contract Audit Agency quality reviews.

DCAA Director CommentsDCAA agreed and stated that it prepared training to address audit criteria and DCAA anticipates presenting the training to each DCAA FAO by February 2018. The DCAA Quality Directorate will monitor DCAA FAOs to ensure consistency between the auditor’s planned and executed audit steps. In addition, DCAA stated that it completed the following DCAA training course updates.

• In February 2017, DCAA updated its Briefing Contracts course to provide guidance on the importance of identifying special contract provisions.

• In the summer of 2015, DCAA updated its Incurred Cost course to include guidance on planning procedures to verify that the claimed amounts comply with special contract provisions for significant contracts.

Our ResponseThe DCAA comments adequately addressed the recommendation; therefore, the recommendation is resolved but remains open. We reviewed the audit criteria training developed by DCAA and determined that it adequately addresses the types of planning issues we found during our review. Also, we clarified that the DCAA Quality Directorate will monitor DCAA FAOs to ensure that auditors appropriately identify special contract provisions as well as ensure consistency between the auditor’s planned and executed audit steps. In addition, we verified that DCAA updated the Briefing Contracts and Incurred Cost training courses to appropriately address special contract provisions. We will close the recommendation when DCAA provides evidence that:

• it has presented the audit criteria training to all DCAA FAOs, and

• its Quality Directorate is monitoring DCAA FAOs to ensure that auditors identify special contract provisions and consistently execute planned audit steps.

Page 12: Project No. D2016-DAPOCF-0122.000

8 │ Project No. D2016-DAPOCF-0122.000

Finding 4. DCAA Did Not Follow Up on Corrective Actions for Prior Findings and RecommendationsGAS 5.06 requires auditors to evaluate whether the audited entity has taken appropriate corrective action to address findings and recommendations from prior audits. Also, GAS 5.06 requires auditors, during planning, to inquire of the audited entity about prior audits and studies related to the subject matter of the audit. Auditors use this information in assessing risk and determining the nature, timing, and extent of current testing.

For 7 of the 67 audits (10 percent), the auditor did not adequately evaluate whether DoD contractors took appropriate action on prior findings and recommendations. We found this deficiency in five of the six DCAA regions. For example, in DCAA Assignment No. 1751-2015C17600001, the auditors identified 16 previously reported issues with the contractor’s financial ability to perform on Government contracts. However, the auditors did not conduct any followup to evaluate whether the contractor took appropriate corrective action on the issues. Because the auditors did not follow up on corrective actions, they did not gain the information needed to assist in designing appropriate current tests based on risk. If the contractor did not make corrections, this may have resulted in increased risk of finding a significant noncompliance or misstatement.

DCAA Actions on a Previous DoD Office of Inspector General RecommendationIn the letter of comment from the previous DCAA peer review, “DCAA Peer Review: Letter of Comment,” August 21, 2014, the DoD Office of Inspector General (OIG) reported 11 instances in which DCAA auditors did not adequately evaluate whether the contractor took appropriate corrective action on previous audit findings. The DoD OIG recommended that DCAA reemphasize its policy for reviewing prior audit reports to ensure auditors comply with GAS 5.06.

In February 2015, DCAA added steps to its standard audit programs to address GAS 5.06 and to emphasize the need to make inquiries about contractor actions in response to previously reported deficiencies. In April 2015, DCAA headquarters provided training to DCAA field audit offices on the expectations for complying with GAS 5.06. Also in May 2015, DCAA modified its checklist for conducting quality reviews to better monitor audit compliance with GAS 5.06. Finally, in October 2015, DCAA issued an audit alert to field offices emphasizing the need to assess contractor corrective actions on previously reported audit findings.

DCAA’s corrective actions adequately address the previous DoD OIG recommendation. Because DCAA recently implemented the corrective actions, they did not take effect before DCAA issued several of the audits we selected. As a result, we are not making any recommendation for this finding.

Page 13: Project No. D2016-DAPOCF-0122.000

Project No. D2016-DAPOCF-0122.000 │ 9

DCAA Policy and ProceduresFinding 5. Audit Staff Did Not Comply with DCAA Policy for Documenting IndependenceGAS 3.02 states that in all matters relating to the audit work, the audit organization and the individual auditor, whether government or public, must be independent. DCAA policy requires audit team members to assess their independence on each assignment and to sign a statement confirming their independence (hereafter referred to as the “Independence Determination”). The Independence Determination is maintained in the working papers for each DCAA assignment. The instructions for the Independence Determination state that it should be “signed by each auditor who is directing, performing, or reporting on this audit as a member of the audit team prior to starting work on the audit.”

For 34 of 67 audits (51 percent), we found one or more instances in which audit staff did not fully comply with DCAA policy for documenting independence on the Independence Determination. We found this noncompliance in all six DCAA regions. Among the 34 audits, we found a total of 45 instances when some audit staff did not appropriately complete the audit Independence Determination.

• We identified 17 instances when at least one assignment staff member did not sign the Independence Determination. For example, in DCAA Assignment No. 1271-2012G10100001, the supervisory auditor and branch manager did not sign the Independence Determination.

• We identified 28 instances when at least one staff member signed the Independence Determination, but only after starting work on the audit. For example, in DCAA Assignment No. 6321-2008V10100027, the branch manager signed the Independence Determination 9 months after starting work on the audit, and the supervisor and the auditor signed the Independence Determination 5 months after starting work on the audit.

For these 34 audits, we evaluated the actual independence of the auditors who did not complete the Independence Determination in accordance with DCAA policy. Our evaluation did not disclose any actual impairments to their independence. Nevertheless, the DCAA Independence Determination is an important form for assessing and documenting the independence of DCAA auditors. If DCAA auditors do not routinely complete the form, they are not documenting their assessment of independence relative to each assignment in accordance with agency procedure. Furthermore, the failure to properly complete the Independence Determination increases the risk of a DCAA auditor performing an audit who is not sufficiently independent of the auditee.

Page 14: Project No. D2016-DAPOCF-0122.000

10 │ Project No. D2016-DAPOCF-0122.000

Recommendation, Management Comments, and Our ResponseRecommendation 4The Defense Contract Audit Agency Director should:

a. Remind employees of the critical need for all audit staff to assess their independence in accordance with Government Auditing Standard 3.02 and to complete the Independence Determination form in accordance with agency policy.

b. Improve the quality controls for ensuring that each audit team member signs the Independence Determination before starting work on an audit.

DCAA Director CommentsDCAA agreed and stated that it is developing training to address the recommendation. The training will be provided to DCAA FAO representatives at workshops being held in October and November 2017. By March 2018, the FAO representatives will train all audit staff at their respective FAOs. In addition, DCAA will implement software that will include safeguards to ensure that auditors complete the independence determination form before they can access the working papers.

Our ResponseThe DCAA comments adequately addressed the recommendation; therefore, the recommendation is resolved but remains open. We verified that DCAA developed adequate training to address the recommendation. We will close the recommendations when DCAA provides evidence that:

• the auditor independence training has been provided to all DCAA FAOs, and

• safeguards for completing the independence determination form have been implemented.

Finding 6. Audit Staff Did Not Comply with the DCAA Canceled Assignment Policy GAS 6.50 states that determining whether and how to communicate the reason for canceling an assignment to those charged with governance (such as a contracting officer) and the auditee is a matter of professional judgment. DCAA policy further states that the auditor should notify the contractor and contracting officer of canceled assignments if they were previously notified that the assignment had been initiated.

We selected a random sample of 45 canceled assignments from a total of 5,588 assignments that DCAA canceled between March 15, 2015, and March 15, 2016. For 13 of the 45 assignments (29 percent), the audit staff did not fully comply with DCAA policy for canceled assignments. We found this noncompliance in five of the six DCAA regions.

Page 15: Project No. D2016-DAPOCF-0122.000

Project No. D2016-DAPOCF-0122.000 │ 11

Among the 13 assignments, we found a total of 15 noncompliances when the auditor did not notify either the contracting officer or the contractor that an initiated assignment had been canceled.

• We identified 11 instances when the auditor did not notify the entity under audit that an initiated assignment was canceled.

• We identified 4 instances when the auditor did not notify the contracting officer that an initiated assignment was canceled.

DCAA should remind auditors of DCAA’s policy to inform contracting officers and contractors of a canceled assignment when they were advised that the assignment had been initiated.

Recommendation, Management Comments, and Our ResponseRecommendation 5The Defense Contract Audit Agency Director should reemphasize the agency’s policy for canceled assignments to ensure the audit staff appropriately coordinates with the contractor and contracting officer on the cancelation.

DCAA Director CommentsDCAA agreed and stated that DCAA developed training to address the recommendation, which will be presented to DCAA FAO representatives at workshops being held in October and November 2017. By March 2018, the FAO representatives will train all audit staff at their respective FAOs.

Our ResponseThe DCAA comments adequately addressed the recommendation; therefore, the recommendation is resolved but remains open. We verified that DCAA developed training that reemphasizes the agency’s policy for canceled assignments. We will close the recommendation when DCAA provides evidence that all DCAA FAOs have received the training.

Finding 7. DCAA Did Not Appropriately Classify Advisory ServicesGAS 3.33 through 3.58 covers the requirements and guidance for evaluating threats to independence while performing nonaudit services for an audited entity.3 DCAA advised us that it had performed approximately 34,000 nonaudit services during the 3-year period ended June 30, 2016. We initiated a sample review of the services to determine if DCAA complied with the related GAS independence requirements. However, we discontinued the review after

3 GAS 2.12 defines nonaudit services as a professional services other than audits or attestation engagements. Additionally, GAS 3.33 states that auditors have traditionally provided a range of nonaudit services that are consistent with their skills and expertise to entities where they perform audits.

Page 16: Project No. D2016-DAPOCF-0122.000

12 │ Project No. D2016-DAPOCF-0122.000

determining that the services did not meet the GAS definition of nonaudit services because DCAA performed the services for the contracting officer, not the audited entity (the DoD contractor). Therefore, DCAA incorrectly classified the services as “nonaudit services,” which could result in DCAA unnecessarily evaluating threats to independence that only apply to nonaudit service engagements.

DCAA Corrective Actions TakenIn May 2017, DCAA informed its employees that “nonaudit services” have been reclassified as “advisory services” and that it would appropriately update DCAA policies and procedures to reflect the reclassification. As part of the effort, DCAA issued an Advisory Services Guidebook to assist auditors in performing advisory services for contracting officers.

In July 2017, DCAA completed the effort to reclassify its services from nonaudit to advisory services in its policies and procedures. The DCAA corrective actions fully addressed the finding; therefore, we are not making a recommendation.

Finding 8. DCAA Did Not Revise All of its Policies and Procedures for the Current Revision to GASIn 2011, the Government Accountability Office issued the GAS 2011 Revision, which became effective for financial audits and attestation engagements for periods ending on or after December 15, 2012. The 2011 revision of GAS superseded the 2007 revision of GAS. However, as of May 2017, Chapter 2 of the DCAA Contract Audit Manual still included several references to the outdated 2007 revision.

DCAA Corrective Action TakenIn June 2017, DCAA updated Chapter 2 of the DCAA Contract Audit Manual to reference only the GAS 2011 Revision. This corrective action adequately addressed the finding; therefore, we are not making a recommendation for this finding.

If you have any questions, please contact Carolyn R. Hantz at (703) 604-8877 or [email protected].

Randolph R. StoneDeputy Inspector General Policy and Oversight

Enclosures:As stated

Page 17: Project No. D2016-DAPOCF-0122.000

Project No. D2016-DAPOCF-0122.000 │ 13

Enclosure 1Table. Letter of Comment Findings by DCAA Assignment Number

Assignment Number Audit TypeFindings

Documentation Reporting Planning Independence

1 3151-2015E19100009 Disclosure Statement X X

2 3161-2012J10100028 Incurred Cost X

3 3161-2015J19100001 Disclosure Statement X

4 3161-2015J19100002 Disclosure Statement X

5 3201-2009R10100006 Incurred Cost X X

6 3231-2009M10100046 Incurred Cost X

7 3231-2014L23000005 Forward Pricing Rate Proposal X

8 3231-2016L21000002 Price Proposal X X

9 3521-2016J27010003 Cost Realism X X

10 3531-2011E10100006 Incurred Cost X

11 3531-2014L19200001 Noncompliance with CAS X X X

12 1211-2009E10100009 Incurred Cost X X

13 1241-2009S10100009 Incurred Cost X X

14 1271-2012G10100001 Incurred Cost X X

15 1281-2015B17741003Post-Award Accounting System

X

16 1311-2016N21000001 Price Proposal X X

17 1461-2010H10100001 Incurred Cost X

18 1461-2016B21000003 Price Proposal X X

19 1641-2016G21000001 Price Proposal X

20 1751-2015C17600001 Financial Capability X X

21 9711-2014E19100005 Disclosure Statement X

22 9721-2015A23000001 Forward Pricing Rate Proposal X X X

23 9721-2016A23300001External Restructuring Proposal

X X

Page 18: Project No. D2016-DAPOCF-0122.000

14 │ Project No. D2016-DAPOCF-0122.000

Assignment Number Audit TypeFindings

Documentation Reporting Planning Independence

24 9761-2011E10100002 Incurred Cost X

25 9841-2009G10100001 Incurred Cost X

26 9871-2008M10100029 Incurred Cost X X

27 6161-2009G10100035 Incurred Cost X X

28 6211-2015C23000002 Forward Pricing Rate Proposal X

29 6321-2008V10100027 Incurred Cost X X

30 6321-2010M10100035 Incurred Cost X X

31 6321-2010V10100022 Incurred Cost X X

32 6331-2015M17740006Preaward Accounting System

X

33 6501-2010T10100001 Incurred Cost X

34 6501-2016C21000002 Price Proposal X

35 6701-2011N10100008 Incurred Cost X X

36 6711-2008K10100007 Incurred Cost X

37 6711-2013B19200001 Noncompliance with CAS X

38 6811-2008U10100001 Incurred Cost X

39 6811-2009U42000001 Defective Pricing X

40 6841-2014N17500001 Progress Payment X X

41 6871-2014D11090001Business System Deficiency

X X

42 2161-2010P10100020 Incurred Cost X X

43 2171-2010L10100003 Incurred Cost X

44 2171-2010P10100001 Incurred Cost X X

45 2201-2016H28000001 Agreed-Upon Procedures X

46 2641-2015A21000006 Price Proposal X X

47 4151-2015D17740004Preaward Accounting System

X X X

48 4231-2010V10100023 Incurred Cost X

Table 1. Selected DCAA Assignments (cont’d)

Page 19: Project No. D2016-DAPOCF-0122.000

Project No. D2016-DAPOCF-0122.000 │ 15

Assignment Number Audit TypeFindings

Documentation Reporting Planning Independence

49 4281-2010U10100013 Incurred Cost X

50 4531-2015V23000002 Forward Pricing Rate Proposal X X

51 4531-2016P21000003 Price Proposal X X

52 4901-2010C10100001 Incurred Cost X

Total 31 4 13 34

Table 1. Selected DCAA Assignments (cont’d)

Page 20: Project No. D2016-DAPOCF-0122.000

16 │ Project No. D2016-DAPOCF-0122.000

Enclosure 2

DCAA Director Comments

Page 21: Project No. D2016-DAPOCF-0122.000

Project No. D2016-DAPOCF-0122.000 │ 17

DCAA Director Comments (cont’d)

Page 22: Project No. D2016-DAPOCF-0122.000

18 │ Project No. D2016-DAPOCF-0122.000

DCAA Director Comments (cont’d)

Page 23: Project No. D2016-DAPOCF-0122.000

Project No. D2016-DAPOCF-0122.000 │ 19

DCAA Director Comments (cont’d)

Page 24: Project No. D2016-DAPOCF-0122.000
Page 25: Project No. D2016-DAPOCF-0122.000

Whistleblower ProtectionU.S. Department of Defense

The Whistleblower Protection Ombudsman’s role is to educate agency employees about prohibitions on retaliation and employees’

rights and remedies available for reprisal. The DoD Hotline Director is the designated ombudsman. For more information, please visit

the Whistleblower webpage at www.dodig.mil/Components/Administrative-Investigations/DoD-Hotline/.

For more information about DoD OIG reports or activities, please contact us:

Congressional Liaison 703.604.8324

Media [email protected]; 703.604.8324

DoD OIG Mailing Listswww.dodig.mil/Mailing-Lists/

Twitter www.twitter.com/DoD_IG

DoD Hotline www.dodig.mil/hotline

Page 26: Project No. D2016-DAPOCF-0122.000

DEPARTMENT OF DEFENSE │ OFFICE OF INSPECTOR GENERAL4800 Mark Center Drive

Alexandria, Virginia 22350-1500www.dodig.mil

Defense Hotline 1.800.424.9098