How Government Contractors Can Prepare for DCAA's New Focus on Business Systems

So, how will this impact government contractors? It is now clear that after several years, the importance of government contractor business system assessments is returning to center stage. To stay competitive, savvy government contractors will need to get ahead of this shift in focus.

The Section 809 Panel first signaled business system assessment importance in January 2018 as cited above, and more recently, in Volume 3 Part 2 of its report. The panel stressed the importance of the business system requirements, but it also wanted to see a shift towards control-based criterion as a baseline for assessment of the accounting system. The panel’s Professional Practice Guide (PPG) draft further defined risk assessment guidelines for the accounting system. In addition, in both the FY17 and FY18 National Defense Authorization Act (NDAA), Congress has pushed legislation to address the absence of business system assessments and the incurred cost audit backlog. The proposed Defense Federal Acquisition Regulation Supplement ruling to address the FY17 NDAA recommendations, which would allow for CPA firms to perform business system assessments without additional review by the DOD, has been postponed twice and is now estimated to be released in Q3 or Q4 of FY19. Industry commentary will be extremely important. Private CPA firms are the key to providing business system assessments within the required review frequency timeframe.

The GAO reports that the DCAA plans to perform 248 business system audits over the next four years. Although that is a dramatic improvement, it doesn’t even scratch the surface of business system reviews for all the contractors that need them or account for the systems’ triennial aging. The 248 system audits relate to accounting, estimating, and material management and accounting audits, for which the DCAA is responsible.

Why is achieving adequate business systems status so important? From the government’s point of view, it’s the first line of defense in preventing fraud, waste, and abuse. However, contractors look not only at the inherent benefits that effective internal controls provide an organization, but that adequate business systems can also win favor in certain proposal evaluations. In some cases, it’s necessary for contract award. Additionally, the Section 809 Panel draft PPG features new Incurred Cost audit risk assessment factors, whereby an adequate accounting system will decrease one’s chance to being subject to Incurred Cost audits.

The GAO reported that of the business systems assessments they reviewed, it took between 15 months to five years, with 50 percent taking longer than four years to go from initial finding to system approval. This history, coupled with the business system backlog, makes the prospect of having an initial assessment of business system deficiencies that stick around for quite some time a very real possibility. A contractor may have fixed instances of deficiencies relatively quickly but have a difficult time getting DCAA to return and review the corrective action. In other instances, a corrective action may need to run its course through the system for several months before a substantive sample can be generated for testing. Bottom line: having a system with deficiencies is potentially worse than having an unassessed system, and it can be a detrimental purgatory of an existence until deficiencies are remediated and retested.

Self-awareness is sound business practice: there is no reason to tempt fate when contractors can be proactive and perform business system readiness assessments to learn of any potential deficiencies before the government does. All business systems require care and feeding year over year to be compliant. Compliancy includes updating policies and procedures to current practices, required training, and self-assessment. In response to diminished oversight, many contractors have been lax in these annual duties around business systems. This is the time to re-engage in these responsibilities. In addition, DCAA also released new accounting and estimating system audit work programs with which many contractors are not yet familiar. A readiness assessment measures compliance with annual requirements as well as any new work program steps and guidance. Readiness assessments also allow for the time necessary to adopt corrective action plans and flow transactions and artifacts through the system before the government makes its sample selections.

Proactive compliance is generally less expensive than reactive compliance. CohnReznick sees a significantly higher first-time pass rate of contractors who perform readiness assessments versus those who do not. This is based on the experience of our clients as well as the business system audits we perform on behalf of civilian agencies. When auditing business systems under CohnReznick’s civilian agency contracts, one of the questions the firm asks in entrance conferences is whether a readiness assessment has been performed to gauge contractor sophistication and assess risk.

Take a proactive and savvy approach to this shift. Assess which business systems may be imminently subject to audit with our Business System Applicability Tool and start planning with these readiness assessments.

Kristen Soles, CPA, Partner and Government Contracting Industry Leader, (703) 847-4411