This is the accessible text file for GAO report number GAO-09-1009T 
entitled 'DCAA Audits: Widespread Problems with Audit Quality Require 
Significant Reform' which was released on September 23, 2009. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 


Before the Committee on Homeland Security and Governmental Affairs, 
U.S. Senate: 

United States Government Accountability Office: 

For Release on Delivery: 
Expected at 10:00 a.m. EDT:
Wednesday, September 23, 2009: 

DCAA Audits: 

Widespread Problems with Audit Quality Require Significant Reform: 

Statement of Gregory D. Kutz, Managing Director: 
Forensic Audits and Special Investigations: 

Gayle L. Fischer, Assistant Director: 
Financial Management and Assurance: 


[End of section] 

Mr. Chairman and Members of the Committee: 

Thank you for the opportunity to discuss our recent audit of the 
Defense Contract Audit Agency's (DCAA) overall management environment 
and quality assurance structure. DCAA is charged with a critical role 
in Department of Defense (DOD) contractor oversight by providing 
auditing, accounting, and financial advisory services in connection 
with the negotiation, administration, and settlement of contracts and 
subcontracts.[Footnote 1] DCAA's mission encompasses both audit and 
nonaudit services in support of DOD contracting and contract payment 
functions. DCAA audits of contractor internal controls in accounting, 
billing, estimating, and other key systems support decisions on pricing 
and contract awards. Internal control audits also impact the planning 
and reliability of other DCAA audits because DCAA uses the results of 
these audits to assess risk and plan the nature, extent, and timing of 
tests for other contractor audits and assignments. 

Last year, we reported[Footnote 2] the results of our investigation of 
allegations about certain DCAA audits at three locations in California, 
which substantiated claims that (1) audit documentation did not support 
the reported opinions; (2) DCAA supervisors dropped findings and 
changed audit opinions without adequate audit evidence for their 
changes; and (3) sufficient work was not performed to support the audit 
opinions and conclusions. At that time we were conducting a broader 
audit of DCAA's overall organizational environment and quality control 
system. Given the evidence presented at the Committee's September 2008 
hearing, you requested that we expand our ongoing assessment. Our 
current report,[Footnote 3] which the Committee is releasing today, 
presents the results of our DCAA-wide audit, including (1) an 
assessment of DCAA's management environment and quality assurance 
structure; (2) an analysis of DCAA's corrective actions in response to 
our July 2008 report and two DOD reviews,[Footnote 4] and (3) potential 
legislative and other actions that could improve DCAA's effectiveness 
and independence. 

To assess DCAA's overall management environment and quality assurance 
structure, we analyzed DCAA's mission statement and strategic plan, 
performance metrics, policies and audit guidance, and system of quality 
control. We also reviewed audit documentation for 69 selected audits 
and cost-related assignments at certain field audit offices (FAO) in 
each of DCAA's five regions for compliance with generally accepted 
government auditing standards (GAGAS)[Footnote 5] and other applicable 
standards. We selected 37 audits of contractor internal control systems 
performed by seven geographically disperse DCAA field offices within 
the five DCAA regions during fiscal years 2004 through 2006.[Footnote 
6] Our approach focused on DCAA offices that reported predominately 
adequate, or "clean," opinions on audits of contractor internal 
controls over cost accounting, billing, and cost estimating systems 
issued in fiscal years 2005 and 2006. [Footnote 7] We did this because 
contracting officers rely on these opinions for 3 or more years to make 
decisions on pricing and contract awards, and payment. For example, 
audits of estimating system controls support negotiation of fair and 
reasonable prices.[Footnote 8] Also, the FAR requires contractors to 
have an adequate accounting system prior to award of a cost- 
reimbursable or other flexibly priced contract.[Footnote 9] Billing 
system internal control audit results support decisions to authorize 
contractors to submit invoices directly to DOD and other federal agency 
disbursing offices for payment without government review.[Footnote 10] 
Because DCAA uses the results of internal control audits to assess risk 
and plan the nature, extent, and timing of tests for other contractor 
audits and assignments, the conclusions and opinions in these audits 
impact hundreds of other DCAA audits. At the same seven DCAA field 
offices, we selected an additional 32 cost-related assignments for 
review, including 16 paid voucher reviews, 10 overpayment assignments, 
2 requests for equitable adjustment audits, and 4 incurred cost audits 
that were completed during fiscal years 2004 through 2006. We reviewed 
supporting documentation for the cost-related assignments to determine 
whether DCAA auditors were identifying and reporting contractor 
overpayments and billing errors.[Footnote 11] 

To assess DCAA corrective actions, we reviewed the status and analyzed 
several key actions that DCAA initiated as a result of our earlier 
investigation, including changes in performance metrics and policy and 
procedural guidance, as well as DCAA efforts in response to DOD 
Comptroller/Chief Financial Officer (CFO)[Footnote 12] and Defense 
Business Board[Footnote 13] recommendations. To identify potential 
legislative and other actions that could improve DCAA's effectiveness 
and independence, we considered DCAA's current role and 
responsibilities; the framework of statutory authority for auditor 
independence in the Inspector General Act of 1978, as amended;[Footnote 
14] best practices of leading organizations that have made cultural and 
organizational transformations; our past work on DCAA organizational 
alternatives; GAGAS criteria for auditor integrity, objectivity, and 
independence; and GAO's Standards for Internal Control in the Federal 
Government[Footnote 15] on managerial leadership and oversight. 

Throughout our audit, we met with the DCAA Director and DCAA 
headquarters policy, quality assurance, and operations officials and 
DCAA region and FAO managers, supervisors, and auditors. We also met 
with DOD Office of Inspector General (OIG) auditors responsible for 
DCAA audit oversight and DOD OIG hotline office staff. In addition, we 
met with the former DOD Comptroller/CFO to discuss plans for the Office 
of Comptroller/CFO and Defense Business Board reviews, and we continued 
to meet with and obtain information from the new DOD Comptroller/CFO 
and his staff. We also met with the Comptroller's new DCAA Oversight 
Committee. We conducted our performance audit from August 2006 through 
December 2007, at which time we suspended this work to complete our 
investigation of hotline allegations regarding audits performed at 
three DCAA field offices. We resumed our work on the performance audit 
in October 2008 and performed additional work through mid-September 
2009 to evaluate DCAA's quality assurance program during fiscal years 
2007 and 2008, assess DCAA corrective actions on identified audit 
quality weaknesses, and consider legislative and organizational 
placement options for DCAA. We conducted our performance audit in 
accordance with generally accepted government auditing standards. Those 
standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe that 
the evidence obtained provides a reasonable basis for findings and 
conclusions based on our audit objectives. We performed our 
investigative procedures in accordance with quality standards set forth 
by the Council of the Inspectors General on Integrity and Efficiency 
(formerly the President's Council on Integrity and Efficiency). 

Today, I will summarize the results of our audit. 

Widespread Management Environment and Audit Quality Problems: 

We found audit quality problems at DCAA offices nationwide. Of the 69 
audits and cost-related assignments we reviewed,[Footnote 16] 65 
exhibited serious GAGAS or other deficiencies similar to those found in 
our investigation, including compromise of auditor independence, 
insufficient audit testing, and inadequate planning and supervision. 
Although not as serious, the remaining four audits also had GAGAS 
compliance problems. In addition, while DCAA did not consider 26 of the 
32 cost-related assignments we reviewed to be GAGAS audits, DCAA did 
not perform sufficient testing to support reported conclusions on that 
work. According to DCAA officials, DCAA rescinded 80 audit reports 
related to our prior investigation as well as the audit leading to 
today's report because the audit evidence was outdated, insufficient, 
or inconsistent with reported conclusions and opinions and reliance on 
the reports for contracting decisions could pose a problem. About one 
third of the rescinded reports relate to unsupported opinions on 
contractor internal controls and were used as the basis for risk- 
assessments and planning on subsequent internal control and cost- 
related audits. Other rescinded reports relate to Cost Accounting 
Standards (CAS) compliance and contract pricing decisions. Because the 
conclusions and opinions in the rescinded reports were used to assess 
risk in planning subsequent audits, they impact the reliability of 
hundreds of other audits and contracting decisions covering billions of 
dollars in DOD expenditures. 

A management environment and agency culture that focused on 
facilitating the award of contracts and an ineffective audit quality 
assurance structure are at the root of the agencywide audit failures we 
identified. DCAA's focus on a production-oriented mission led DCAA 
management to establish policies, procedures, and training that 
emphasized performing a large quantity of audits to support contracting 
decisions and gave inadequate attention to performing quality audits. 
An ineffective quality assurance structure, whereby DCAA gave passing 
scores to deficient audits compounded this problem. 

Although the reports for all 37 audits of contractor internal controls 
that we reviewed stated that the audits were performed in accordance 
with GAGAS, we found GAGAS compliance issues with all of these audits. 
The issues or themes are consistent with those identified in our prior 

Lack of independence. In seven audits, independence was compromised 
because auditors provided material nonaudit services to a contractor 
they later audited; experienced access to records problems that were 
not fully resolved; and significantly delayed report issuance, which 
allowed the contractors to resolve cited deficiencies so that they were 
not cited in the audit reports. GAGAS state that auditors should be 
free from influences that restrict access to records or that improperly 
modify audit scope.[Footnote 17] 

Insufficient testing. Thirty-three of 37 internal control audits did 
not include sufficient testing of internal controls to support auditor 
conclusions and opinions. GAGAS for examination-level attestation 
engagements require that sufficient evidence be obtained to provide a 
reasonable basis for the conclusion that is expressed in the 
report.[Footnote 18] For internal control audits, which are relied on 
for 2 to 4 years and sometimes longer, the auditors would be expected 
to test a representative selection of transactions across the year and 
not transactions for just one day, one month, or a couple of 
months.[Footnote 19] However, we found that for many controls, the 
procedures performed consisted of documenting the auditors' 
understanding of controls, and the auditors did not test the 
effectiveness of the implementation and operation of controls. 

Unsupported opinions. The lack of sufficient support for the audit 
opinions on 33 of the 37 internal control audits we reviewed rendered 
them unreliable for decision making on contract awards, direct-billing 
privileges, the reliability of cost estimates, and reported direct cost 
and indirect cost rates. For example, we found that: 

* For many controls, DCAA did not perform any testing at all. For 
example, audits of contractor accounting systems do not include any 
transaction testing. Instead, these audits focus on a review of the 
adequacy of contractor policies and procedures. At least six of the 
nine accounting audits we reviewed did not include procedures for 
confirming contractor segregation of allowable and unallowable cost. 

* DCAA issued an adequate opinion on the accounting system for a major 
DOD contractor after performing a walkthrough of the accounting process 
and interviewing two employees. 

* In billing system audits we reviewed, DCAA auditors often tested only 
two, three, or sometimes five transactions to support audit conclusions 
on contractor systems and related internal controls. Further, the 
auditors performed limited procedures such as determining whether the 
vouchers were mathematically correct and included current and 
cumulative billed amounts. Twenty of the 22 billing system audits we 
reviewed did not include tests to identify duplicate invoices. 

* DCAA auditors reported on the adequacy of a contractor's billing 
system based on tests of four vouchers, all issued on the same day. 

* In an audit of controls over indirect and other direct cost for a 
business segment of one of the top five DOD contractors, DCAA auditors 
tested 12 out of about 22,000 transactions processed from May through 
July 2005. 

We also found that reports did not adequately disclose the criteria 
used in performing individual audits. According to GAGAS, audit reports 
should, among other matters, identify the subject matter being reported 
and the criteria used to evaluate the subject matter. Criteria identify 
the required or desired state or expectation with respect to the 
program or operation and provide a context for evaluating evidence and 
understanding the findings.[Footnote 20] None of the 37 internal 
control audit reports we reviewed cited specific criteria used in 
individual audits. Instead, the reports uniformly used boilerplate 
language to state that DCAA audited for compliance with the "FAR, CAS, 
DFARS, and contract terms." As a result the user of the report does not 
know the specific Federal Acquisition Regulation (FAR), Cost Accounting 
Standards (CAS), or contract terms used as criteria to test contractor 
controls. This makes it difficult for users of the reports to determine 
whether the reports provide the level of assurance needed to make 
contracting decisions. 

Similarly, the 32 cost-related assignments we reviewed did not contain 
sufficient testing to provide reasonable assurance that overpayments 
and billing errors that might have occurred were identified. As a 
result, there is little assurance that any such errors, if they 
occurred, were corrected and that related improper contract payments, 
if any, were refunded or credited to the government. Contractors are 
responsible for ensuring that their billings reflect fair and 
reasonable prices and contain only allowable costs, and taxpayers 
expect DCAA to review these billings to provide reasonable assurance 
that the government is not paying more than it should for goods and 
services. We identified the following problems with these assignments. 

Paid voucher reviews. DCAA performs annual testing of paid vouchers 
(invoices) to determine if contractor voucher preparation procedures 
are adequate for continued contractor participation in the direct-bill 
program.[Footnote 21] Under the direct-bill program, contractors may 
submit their invoices directly to the DOD disbursing officer for 
payment without further review. Although DCAA does not consider its 
reviews of contractor paid vouchers to be GAGAS engagements, it has not 
determined what standards, if any, apply to these assignments. In 
addition, for the 16 paid voucher assignments we reviewed, we found 
that DCAA auditors failed to comply with DCAA Contract Audit Manual 
(CAM) guidance.[Footnote 22] Rather than documenting the population of 
vouchers, preparing sampling plans, and testing a random (statistical) 
sample, auditors generally did not identify the population of vouchers, 
did not create sampling plans, and made a small, nonrepresentative 
selection of as few as one or two invoices for testing to support 
conclusions on their work. The auditors performed limited procedures 
such as determining whether the vouchers were mathematically correct 
and included current and cumulative billed amounts. Based on this 
limited work, the auditors concluded that controls over invoice 
preparation were sufficient to support approval of the contractors' 
direct billing privileges. This is of particular concern because we 
determined that Defense Finance and Accounting Service (DFAS) 
certifying officers rely on DCAA voucher reviews, and they do not 
repeat review procedures they believe to be performed by DCAA. 

Overpayment assignments. DCAA performs overpayment assignments to 
verify that contractors have billing procedures and internal controls 
in place to identify and resolve contractor billing errors and 
overpayments in a timely manner. DCAA guidance states that these 
engagements should be conducted in accordance with GAGAS to the extent 
applicable under the circumstances.[Footnote 23] However, none of the 
10 overpayment assignments we reviewed were performed or reported as 
GAGAS engagements. We found that auditor judgments about the population 
and selection of transactions for these assignments did not provide a 
representative universe for testing and concluding on contractor 
controls over billings and payments received. For example, for the 10 
assignments we assessed, the auditors selectively reviewed an accounts 
receivable aging report to identify overpayments and determine if they 
had been resolved. As a result, this work does not provide reasonable 
assurance that contractors have adequate controls in place to identify 
and correct overpayments and billing errors and make appropriate, 
timely refunds and adjustments. 

Incurred cost audits. The purpose of incurred cost audits is to examine 
contractors' cost representations and opine on whether the costs are 
allowable, allocable to government contracts, and reasonable in 
accordance with the contract and applicable government acquisition 
regulations. [Footnote 24] DCAA performs these audits as GAGAS 
attestation engagements. For the four incurred cost audits we reviewed, 
we found that the auditors did not adequately document their judgments 
about control risk or the sampling and test methodologies used. In 
addition, we found that the auditors traced claimed pool and base costs 
(indirect costs) to the contractors' accounting books and records to 
determine their accuracy and allowability. However, the auditors did 
not perform sufficient, detailed testing of claimed indirect and direct 
costs. For example, the auditors traced and reconciled indirect costs 
to contractor accounting system data, but did not test a representative 
selection of direct costs. As a result, the scope of work performed was 
not sufficient to identify claimed costs, if any, that were not 
adequately supported or unallowable costs, if any, that should have 
been questioned. 

Production environment and audit quality issues. DCAA's mission 
statement, strategic plan, and metrics all focused on producing a large 
number of audit reports and provided little focus on assuring quality 
audits. For example, DCAA's current approach of performing 30,000 to 
35,000 audits and issuing over 22,000 audit reports with 3,600 auditors 
substantially contributed to the widespread audit quality problems we 
identified. Within this environment, DCAA's audit quality assurance 
program was not properly implemented, resulting in an ineffective 
quality control process that accepted audits with significant 
deficiencies and noncompliance with GAGAS and DCAA policy. Moreover, 
even when DCAA's quality assurance documentation showed evidence of 
serious deficiencies within individual offices, those offices were 
given satisfactory ratings. Considering the large number of DCAA audit 
reports issued annually and the reliance the contracting and finance 
communities have placed on DCAA audit conclusions and opinions, an 
effective quality assurance program is key to protecting the public 
interest. Such a program would report review findings along with 
recommendations for any needed corrective actions; provide training and 
additional policy guidance, as appropriate; and perform follow-up 
reviews to assure that corrective actions were taken. GAGAS require 
that each audit organization performing audits and attestation 
engagements in accordance with GAGAS should have a system of quality 
control that is designed to provide the audit organization with 
reasonable assurance that the organization and its personnel comply 
with professional standards and applicable legal and regulatory 
requirements, and have an external peer review at least once every 3 
years.[Footnote 25] 

DCAA officials advised us that going forward, DCAA will no longer rate 
an FAO's overall compliance with GAGAS and DOD policy. The officials 
told us that instead, DCAA headquarters plans to (1) report the 
detailed results of the audit quality reviews, (2) make recommendations 
to FAOs for any needed corrective actions, (3) conduct follow-up 
reviews for all FAOs with identified audit deficiencies to ensure that 
corrective actions are taken, and (4) provide training and policy 
guidance, as appropriate. If properly implemented, these procedures 
would help to assure an effective audit quality assurance program. 

In addition, the DOD IG reported an adequate ("clean") opinion on 
DCAA's most recent peer review results although the reported evidence 
indicated that numerous audits had serious deficiencies in audit 
quality.[Footnote 26] In conducting DOD's audit oversight review of 
DCAA audits, DOD IG audit oversight reviewers considered the same 
results of DCAA's internal audit quality assurance reviews that we 
analyzed and reviewed numerous additional audits, which also identified 
significant GAGAS noncompliance as evidenced by DOD IG peer review 
findings and recommendations. Although the DOD IG report contained 
evidence of significant, systemic noncompliance with professional 
standards throughout DCAA audits that OIG staff reviewed and the IG 
report included numerous findings and recommendations related to those 
issues, the DOD IG gave DCAA a "clean" peer review opinion,[Footnote 
27] concluding that for audits and attestation engagements performed 
during fiscal year 2006, "…the internal quality control system was 
operating effectively to provide reasonable assurance that DCAA 
personnel were following established policies, procedures, and 
applicable auditing standards..." 

The overall report conclusion in the DOD IG report is inconsistent with 
the detailed observations in the report, which indicate numerous 
significant deficiencies in DCAA's system of quality control. 
Furthermore, of the 80 audit reports that DCAA rescinded, 39 of the 
rescinded reports were issued during fiscal year 2006--the period 
covered by the last DOD IG peer review. Therefore, we have concluded 
that DCAA's quality control system for the period covered by the last 
DOD IG peer review was not effectively designed and implemented to 
provide assurance that DCAA and its personnel comply with professional 

DCAA Is Making Progress, but Sustained Leadership and Oversight Is 

Although DCAA has taken several positive steps, much more needs to be 
done to address widespread audit quality problems. DCAA's production- 
oriented culture is deeply imbedded and will likely take several years 
to change. Under DCAA's decentralized management environment, there had 
been little headquarters oversight of DCAA regions, as demonstrated by 
the nationwide audit quality problems. DCAA's mission focused primarily 
on producing reports to support procurement and contracting community 
decisions with no mention of quality audits that serve taxpayer 
interest. Further, DCAA's culture has focused on hiring at the entry 
level and promoting from within the agency and most training has been 
conducted by agency staff, which has led to an insular culture where 
there are limited perspectives on how to make effective organizational 

DCAA corrective actions. DCAA initiated a number of actions to address 
findings in our July 2008 report, the DOD Comptroller/CFO August 2008 
"tiger team" review, and the Defense Business Board study, which was 
officially released in January 2009. Examples of key DCAA actions to 
date include the following. 

* Eliminating production metrics and implementing new metrics intended 
to focus on achieving quality audits. 

* Establishing an anonymous Web site to address management and hotline 
issues. DCAA's Assistant Director for Operations has been proactive in 
handling internal DCAA Web site hotline complaints. 

* Revising policy guidance to address auditor independence, assure 
management involvement in key decisions, and address audit quality 
issues. DCAA also took action to halt auditor participation in nonaudit 
services that posed independence concerns. 

Further, DCAA has enlisted assistance from other agencies to develop a 
human capital strategic plan, assist in cultural transformation, and 
conduct a staffing study. In March 2009, the new DCAA Comptroller/CFO 
established a DCAA Oversight Committee to monitor and advise on DCAA 
corrective actions. 

While these are positive actions, other DCAA actions have focused on 
process improvements, and DCAA has not yet addressed the fundamental 
weaknesses in its mission, strategic plan, audit approach, and human 
capital practices. 

Although DCAA is making progress, we are concerned that DCAA actions to 
date evidence some of the past cultural problems that could limit their 
success. For example, DCAA identified the following six new performance 
metrics as focusing on the intended outcome-related goal of achieving 
quality audits that comply with GAGAS.[Footnote 28] 

1. Obtaining an unqualified DOD IG peer review opinion. 

2. DCAA's internal quality assurance program results show that 100 
percent of the audits reviewed reflected professional judgment. 

3. Checklist confirmation that issued reports did not include serious 

4. A goal that 45 percent of audit reports will have findings as an 
indication of the tangible value of the audit work performed. 

5. A goal that 15 percent of the audits will use quantitative methods 
to measure the extent to which advanced level audit techniques are 

6. A goal that auditors will meet 100 percent of their continuing 
professional education requirements on time. 

Given the problems with DOD IG peer review results and DCAA's 
ineffective quality assurance program, for these metrics to achieve the 
intended audit quality goal, significant changes will be needed. DCAA 
also retained three performance metrics that address issuing reports 
within specified times to support contract awards and closeouts, for 

1. A forward-pricing audit timeliness goal of 95 percent based on 
agreement with requesters. 

2. Incurred cost audit timeliness goals of 90 percent of corporate 
audits completed within 12 months, 90 percent of major contractor 
audits completed in 15 months, and 95 percent of non-major contractor 
audits completed in 24 months. 

3. An efficiency goal of cost per direct audit hour of less than 
$113.45 to be monitored at the agency level only. 

It is critical that agreements with the contracting community on 
timeliness goals for forward-pricing and incurred cost audits allow 
performance of sufficient audit procedures to help contracting officers 
ensure that prices paid by the government are fair and reasonable, and 
that contract costs comply with applicable laws, regulations, cost 
accounting standards, and contract terms. 

Risk-based audit approach. DCAA did not agree to develop a risk-based 
audit approach, as recommended by the Defense Business Board. DCAA 
lacks a risk-based audit approach to address how it will perform 
required audits with available audit resources, reassess the need to 
perform 30,000 or more audits annually and the appropriate level of 
audit resources, and establish priorities for performing quality audits 
that meet GAGAS within available resources. While resources are a key 
element of a risk-based planning approach, DCAA is performing the 
Defense Business Board recommended staffing study as a stand-alone 
effort rather than performing this study in concert with an effort to 
establish a risk-based planning process. 

DCAA policy guidance. DCAA's new policy guidance on adequate audit 
documentation and testing does not contain sufficient instruction to 
assure that auditors (1) adequately document significant decisions 
affecting the audit objectives, scope and methodology, findings, 
conclusions, and recommendations and (2) perform sufficient work to 
support decisions to approve contractors for direct-bill status. For 

* DCAA's new policy on "Workpaper Documentation of Judgmental 
Selections"--requires a description of the universe (population) from 
which items are selected for testing, identification of items and 
attributes to be tested, and an explanation to support that the 
judgmental selection will result in adequate audit coverage. 

Emphasizing the requirement that audit documentation include a 
description of the population used for sampling and identification of 
items and attributes to be tested is appropriate. However, the 
requirement for an explanation in the audit documentation that the 
judgmental selection will result in adequate audit coverage needs to be 
sufficiently justified. GAGAS and AICPA standards require that auditors 
document significant decisions affecting the audit objectives, scope 
and methodology, findings, conclusions, and recommendations resulting 
from professional judgment.[Footnote 29] 

* DCAA's new policy on "Audit Guidance for Annual Testing of Contractor 
Eligibility for Direct Bill" is intended to determine whether continued 
reliance can be placed on the contractor's procedures for preparation 
of interim vouchers. This policy change clarified and consolidated 
audit steps related to the contractor's compliance with contract 
provisions, added audit steps for reviewing vouchers under time-and- 
material and labor-hour contracts, and removed the requirement to 
verify that the contractor's Central Contractor Registration is 
current. The policy memorandum states that this scope of work performed 
does not constitute an audit or attestation engagement under GAGAS. 

While it is within DCAA's purview to determine whether these procedures 
constitute an audit, because direct-bill decisions present a risk of 
undetected improper contract payments, prudent decisions to continue a 
contractor's direct-bill authorization would necessarily be based on 
testing a statistical sample of invoices[Footnote 30] and include a 
review of supporting documentation, including documentation to confirm 
the government received goods and services noted on the billing 
invoice. We confirmed that Defense Finance and Accounting Service 
certifying officers rely on DCAA reviews and that they do not repeat 
review procedures they believe to be performed by DCAA. 

In addition, DCAA's policy to eliminate the "inadequate-in-part" 
opinion for contractor internal control systems audits does not 
recognize different levels of severity of control deficiencies and 
weaknesses and could unfairly penalize contractors whose systems have 
less severe deficiencies by giving them the same opinion--"inadequate"--
as contractors having material weaknesses or significant deficiencies 
that in combination would constitute a material weakness. DCAA would 
benefit from outside expertise to develop effective audit policy 
guidance and training on auditing standards. 

Legislative and Other Actions Could Further Improve DCAA: 

In addition to correcting the fundamental weaknesses in DCAA's mission 
and overall management environment, we believe certain legislative 
measures as well as other actions could enhance DCAA's effectiveness 
and independence. For example, granting DCAA certain authorities and 
protections--similar to those offered to presidentially appointed 
inspectors general (IG) under the IG Act[Footnote 31]--could enhance 
DCAA's independence. The IG Act contains provisions that enhance the 
independence of presidentially appointed IGs, including protections 
from removal without congressional notification, access to independent 
legal counsel, public reporting of audit results, rights to take 
statements from contractor and other personnel, and budget visibility. 
These provisions would enhance the important DCAA initiatives currently 
under way. In the longer term, Congress could consider changes in 
organizational placement after DCAA has had sufficient opportunity to 
effectively implement current reform efforts. However, moving DCAA as 
an organization would require careful analysis and planning before 
implementation. Continued monitoring and oversight will be essential to 
assuring the successful implementation of DCAA's management 

Our Recommendations and DOD's Response: 

Our report contains several recommendations to DOD as well as matters 
for congressional consideration intended to strengthen DCAA in 
fulfilling its contract audit responsibilities. Our report also 
discusses matters for congressional consideration that could enhance 
DCAA's effectiveness and independence. These recommendations and 
matters are discussed below. 

We made 17 recommendations to improve DCAA's management environment, 
audit quality, and oversight, including 15 recommendations to DOD and 2 
recommendations to the DOD IG regarding DCAA's last peer review. DOD 
fully agreed with 13 of the 15 recommendations, partially concurred on 
one recommendation and did not concur with one other recommendation. We 
view DOD comments as being generally responsive to the intent of our 

DOD partially concurred with our recommendation that DCAA consult with 
DOD stakeholders and engage outside experts to develop a risk-based 
contract audit approach that identifies resource requirements and 
focuses on performing quality audits that meet GAGAS. DOD stated that 
DCAA already has a risk-based contract audit approach that identifies 
resource requirements and focuses on performing quality audits that 
meet GAGAS. However, DOD stated that DCAA will coordinate with the 
Under Secretary of Defense for Acquisition, Technology, and Logistics 
(USD (AT&L)) to assess DCAA audit requirements.[Footnote 32] DOD 
expects to complete its assessment of stakeholder needs based on 
regulatory and statutory requirements by December 2010. 

We appreciate these steps; however, we remain concerned that DCAA's 
current approach of performing 30,000 to 35,000 audits and issuing over 
22,000 audit reports with 3,600 auditors substantially contributed to 
the widespread audit quality problems we identified. Generating that 
many reports and doing that many audits with 3,600 auditors leaves very 
little time to perform in-depth, complex audits of contractors. 

DOD did not concur on our recommendation to develop policies and 
procedures related to direct-billing decisions, stating that (1) the 
department believes that a review of the contractor's interim public 
vouchers is an integral function of DCAA's continued assessment of a 
contractor's billing system, (2) DCAA is in the best position to review 
and approve contract interim billings based on its thorough 
understanding of the contractor's system, (3) DOD believes that our 
concerns are mitigated based on comprehensive supervisory and audit 
manager reviews, and (4) DCAA does not believe that the approval of 
interim vouchers along with the approval for contractors to be on 
direct billing results in a lack of auditor objectivity. 

We continue to believe that DCAA's management (nonaudit) responsibility 
to perform prepayment reviews of contractor vouchers for DOD and the 
auditor's decision-making role of approving contractors for direct- 
billing privileges based on its audit conclusions about the strength of 
the contractor's system of internal controls, create audit objectivity 
issues. Under normal circumstances, DCAA auditors must review 
contractor vouchers prior to payment--a management support function for 
DOD. By obtaining direct-billing privileges, however, contractors can 
receive payment for goods and services without a voucher review by DCAA 
prior to payment. Because we found that this situation created an 
incentive for DCAA to reduce its workload by recommending that 
contractors are placed on direct billing, we recommended that DCAA 
develop new policies and procedures to ensure a separation between 
staff reviewing vouchers and staff making direct-bill decisions. DCAA 
did not explain the basis for its belief that DCAA administrative staff 
have a thorough understanding of the contractors' systems. Further, we 
disagree with DOD's statement that our concerns are mitigated based on 
the comprehensive supervisory and audit manager reviews because this is 
not supported by our findings. The fact that DCAA approvals of 
contractor direct-bill privileges were not based on sufficient audit 
procedures as demonstrated by our work and DCAA's removal of over 200 
contractors from the direct-bill program since our July 2008 report 
[Footnote 33] support our concern that the existence of such an 
incentive presents an objectivity impairment. 

With regard to our two recommendations to the DOD IG, the IG concurred 
on our recommendation to reconsider the overall conclusions in its May 
2007 peer review report on its audit of DCAA's system of quality 
control. However, the IG did not agree with our recommendation to 
determine whether the report should be rescinded or modified and did 
not take action to do so. The IG comments stated that the IG took 
alternative action that conformed to the intent of our recommendation, 
including notification of DCAA on August 24, 2009, that the May 2007 
"adequate" opinion on DCAA's system of quality control would expire on 
August 26, 2009. In addition, the IG stated, "We have determined that 
it is not prudent to allow the adequate opinion from our May 2007 
report to carry forward." However, peer review opinions neither 
"expire" nor "carry forward" beyond the period covered by the peer 
review. Based on the significant audit quality deficiencies identified 
in the IG peer review report, DCAA's decision to rescind 80 audit 
reports--39 of which relate to the period of the IG's peer review--and 
the findings in our audit, we concluded that DCAA's quality control 
system for the period covered by the DOD IG peer review was not 
effectively designed and implemented to provide assurance that DCAA and 
its personnel comply with professional standards. 

DOD also provided comments on our matters for congressional 
consideration. Although DOD disagreed with the matters we discussed, we 
continue to believe these are valid matters for congressional 
consideration. The IG Act provides many important authorities and 
protections for IG's that could enhance DCAA's independence and 
effectiveness. Further, if DCAA is unsuccessful in addressing our 
recommendations for resolving fundamental weaknesses in its mission and 
the overall management environment under the current organizational 
placement, additional options would need to be considered. 

Mr. Chairman and Members of the Committee, this concludes my statement. 
We would be pleased to answer any questions that you may have at this 

Contacts and Acknowledgments: 

For further information about this testimony, please contact Gregory D. 
Kutz at (202) 512-6722 or Contact points for our Offices 
of Congressional Relations and Public Affairs may be found on the last 
page of this testimony. Major contributors to our testimony include F. 
Abe Dymond, Assistant General Counsel; Richard Cambosos; Jeremiah 
Cockrum; Andrew McIntosh; and Lerone Reid. 

[End of section] 


[1] DCAA also performs audit services for other federal agencies on a 
fee-for-service basis. 

[2] GAO, DCAA Audits: Allegations That Certain Audits at Three 
Locations Did Not Meet Professional Standards Were Substantiated, 
[hyperlink,] (Washington, D.C.: 
July 22, 2008). 

[3] GAO, DCAA Audits: Widespread Problems with Audit Quality Require 
Significant Reform, [hyperlink,] 
(Washington, D.C.: Sept. 23, 2009). 

[4] DOD reviews included (1) an Under Secretary of Defense 
(Comptroller/Chief Financial Officer (CFO)) tiger team review and (2) a 
Defense Business Board Study. 

[5] GAO, Generally Accepted Government Auditing Standards, [hyperlink,] (Washington, D.C.: June 2003) 
and GAO-07-731G (Washington, D.C.: July 2007). 

[6] Although our selection of the seven offices and 37 internal control 
audits was not statistical, it represented about 9 percent of the total 
76 DCAA offices that issued audit reports on contractor internal 
controls and nearly 18 percent of the 40 offices that issued 8 or more 
reports on contractor internal controls during fiscal year 2006. Of the 
37 internal control audits we reviewed, 32 reports were issued with 
adequate opinions and 5 reports were issued with inadequate-in-part 
opinions. In the case of follow-up audits, we also reviewed the 
documentation for the previous audit to gain an understanding of the 
scope of work and deficiencies identified in the prior audit. These 
were the most recently completed fiscal years at the time we initiated 
our audit. 

[7] In selecting the seven DCAA offices, we considered a 2-year history 
of internal control audit results. The seven DCAA offices we selected 
reported adequate opinions on 89 percent or more of the internal 
control reports they issued during fiscal year 2006. During fiscal year 
2005, 4 of the 7 offices reported adequate opinions in 85 percent or 
more of the internal control reports they issued, and the other 3 
offices issued adequate opinions in 50 to 69 percent of the internal 
control audit reports they issued. 

[8] DCAA Contract Audit Manual (CAM) 5-1202.1a and Defense Federal 
Acquisition Regulation Supplement (DFARS) 215.407-5. 

[9] FAR §§ 16.104(h) and 16.301-3(a)(1). 

[10] FAR § 42.101 and DFARS § 242.803. 

[11] Contractor overpayments can occur as a result of errors made by 
paying offices, such as duplicate payments and payments in excess of 
amounts billed, and contractor billing errors, such as using the wrong 
overhead rate, failing to withhold designated amounts on progress 
payments, duplicate billings, or billing for unallowable cost. 
Recoveries of overpayments can be accomplished through refunds, 
subsequent billing offsets, or other adjustments to correct billing 

[12] Under Secretary of Defense--Comptroller, Memorandum for Director 
Defense Contract Audit Agency, Subject: Implementation of Corrective 
Actions (Washington, D.C.: Aug. 20, 2008). 

[13] Defense Business Board, Report to the Secretary of Defense: 
Independent Review Panel Report on the Defense Contract Audit Agency, 
October 2008. 

[14] Codified in an appendix to Title 5 of the United States Code 
(hereafter 5 U.S.C. App.). 

[15] GAO, Standards for Internal Control in the Federal Government, 
(Washington, D.C.: November 1999). 

[16] Of the 69 DCAA assignments we reviewed, 37 were audits of 
contractor systems and related internal controls and 32 were cost 
related audits and assignments. 

[17] See [hyperlink,], § 3.19, 
and [hyperlink,], § 3.10. 

[18] [hyperlink,], § 6.04b. 

[19] AICPA Statements on Auditing Standards, AU 350 and Audit and 
Accounting Guide: Audit Sampling, §§ 3.14, 3.29-3.34, 3.58, and 3.61. 

[20] [hyperlink,], § 4.15. 

[21] DCAA does not perform paid voucher reviews during the year that it 
performs an audit of the contractor's billing system internal controls. 

[22] CAM 6-1007. 

[23] DCAA, "Audit Program: Audit of Contractor Overpayments," (Activity 
Code 17310), April 2004, September 2007, and May 2008. 

[24] CAM 6-102. 

[25] [hyperlink,], §§ 3.50-

[26] All 10 categories of recommendations in the DOD IG's report 
related to GAGAS compliance problems. 

[27] DOD Inspector General, Oversight Review: Review of the Defense 
Contract Audit Agency Quality Control System, Report No. D-2007-6-006 
(Arlington, VA: May 1, 2007). 

[28] DCAA also established contracting officer sustention rates related 
to questioned cost and net savings as an informational goal to show 
return to the taxpayer. 

[29] [hyperlink,], § 3.38 and 
AU § 339.12. 

[30] Disbursing officers are authorized to make payments on the 
authority of a voucher certified by an authorized certifying officer, 
who is responsible for the legality, accuracy, and propriety of the 
payment. 31 U.S.C. §§ 3325, 3527(c). DOD 7000.14-R, Department of 
Defense Financial Management Regulation (DFMR), Vol. 5, Ch. 11 (March 
2009), paras. 110102, 110203. In general, certifying officers 
designated in writing by the agency are financially liable for any 
improper, illegal, or incorrect payment made, and each payment made 
must be audited (or "examined"). 31 U.S.C. §§ 3521(a), 3528(a). DFMR, 
Vol. 5, Ch. 33 (April 2005), para. 330303. However, 31 U.S.C. § 3521(b) 
authorizes heads of agencies to carry out a statistical sampling 
procedure, within certain parameters, to audit vouchers when the head 
of the agency determines that economies will result. Further, 31 U.S.C. 
§ 3521(c) provides that certifying and disbursing officials are not 
liable for payments that are not audited if they were made in good 
faith under a statistical sampling procedure. See 68 Comp. Gen. 618 
(1989); also see generally, GAO, Policy and Procedures Manual for 
Guidance of Federal Agencies, title 7, §§ 6.5, 7.4, and 7.5 
(Washington, D.C.: May 18, 1993). 

[31] Codified in an appendix to Title 5 of the United States Code. 

[32] The USD (AT&L) is responsible under 10 U.S.C. § 133 for 
establishing DOD policies related to the negotiation, award, and 
administration of contracts, such as those related to the use of 
contract audit services, and for coordinating contract audit activities 
within DOD. 

[33] [hyperlink,]. 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink,]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink,] 
and select "E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAO’s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO’s Web site, 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional 

To Report Fraud, Waste, and Abuse in Federal Programs: 


Web site: [hyperlink,]: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: