DCAA Post-ICAPS EnvironmentRecent Guidance Changes and
Contractor Challenges
Breakout Session #506
Presented by Tom Tagle and Noah Leiden
July 20, 2010
Session Schedule: 2:30 – 3:45
1
1
Background of ICAPS
•
Internal Control Audit Planning Summary (ICAPS) reviews are conducted by
DCAA to assess control risk and the impact risk has on related audit efforts
– Assessment helps establish annual audit plans and scope of audits
•
•
ICAPS reviews are focused on internal controls that may significantly impact
the pricing, administration, or settlement of Government contracts
A contractor's internal controls consist of five interrelated components:
– Control environment -- sets the tone of an organization, influencing the control
consciousness of its people
– Risk assessment-- the entity’s identification and analysis of relevant risks to
achievement of its objectives, forming a basis for determining how the risks
should be managed
– Control activities -- the policies and procedures that help ensure that
management directives are carried out
– Information and communication -- the identification, capture, and exchange of
information in a form and time frame that enable people to carry out their
responsibilities
– Monitoring -- the process that assesses the quality of internal control
performance overtime
2
Background of ICAPS
•
DCAA's policy that each relevant accounting or management system that has
a significant impact on Government contract costs be audited on a cyclical
basis, (i.e., every 2 - 4 years) based on a documented risk assessment
– If past experience is favorable and risk is considered to be low, an audit may
be performed on a less frequent basis
– When the contractor changes the system, the auditor should give a high priority
to the audit of the system change as a basis for relying on the system
•
•
•
Major vs. Non-Major
Pre-GAO reports, results of a system review resulted in an “adequate”,
“inadequate-in-part” or “inadequate” determination
Post-GAO reports, results of system reviews resulted in either an “adequate”
or “inadequate” determination
3
Importance of Internal
Controls
•
Strong internal controls tend to reduce DCAA’s audit efforts, while weak
internal controls tend to increase audit scrutiny
– Strong controls permit/increase reliance on cost representations
– Weak controls promote mischarging or misallocation and increase audit scope
•
When evaluating internal control systems, DCAA will consider:
– Amount of systems testing previously performed or currently planned
– Self-governance programs
•
The components of internal control and relevant control objectives identified
with accounting and management systems should be considered in the context
of the following:
–
–
–
–
–
Contractor’s size
Contractor’s organization and ownership characteristics
Nature of the contractor’s business
Diversity and complexity of the contractor’s operations
Contractor’s methods of transmitting, processing, maintaining, and accessing
information
– Applicable legal and regulatory requirements
4
Accounting and Management
Systems Subject to ICAPS
•
The ICAPS focus on ten accounting and management systems
–
–
–
–
–
–
–
–
–
–
•
•
Control Environment and Overall Accounting System
General IT System
Budget and Planning System
Purchasing System
Billing System
Labor System
Indirect and Other Direct Cost System
Estimating System
Material Management Accounting System
Compensation System
Several ICAPS tend to cross over and address related controls
Common controls across the ten systems include
–
–
–
–
–
Adequacy of current systems to meet controls expected of government contractors
Adequacy of written policies and procedures
Employee knowledge and compliance with policies and procedures
Consistent application of policies and procedures
Management reviews and remediation
5
Accounting and Management
Systems Subject to ICAPS
•
In determining the significance of a system, consider the relationship of the
system to Government contracts
–
–
•
If a contractor incurs a significant amount of labor costs which are assigned to
Government contracts, the contractor's compensation and labor systems would be
considered significant
If a contractor does not purchase significant amounts of materials for Government
contracts, the contractor's material systems might not be considered significant
Factors that impact ICAPS
–
–
–
–
–
–
–
–
–
–
–
Audit objectives
Types of audits
Known deficiencies
Direct Costs
Government business
Organizational structure
Indirect cost methodology
Financial management
Adequacy of systems, policies, procedures and controls
Technology and automation
Data flow
6
Why the Scope of the ICAPS
is Important
•
Scope of the ICAPS
–
–
–
–
–
•
Obtaining an Understanding of Contractor Accounting and Management Systems
Determining if Relevant Control Objectives and Related Control Activities Exist
Testing Controls
Assessing Control Risk
Internal Control Reporting
Audits directly influenced by ICAPS
–
–
–
–
–
Contract pricing
Defective pricing
Incurred costs
Contract billing and closeout
CAS
7
DCAA Guidance on Internal
Controls
•
Recent DCAA MRDs have addressed ICAPS and internal controls
–
•
•
•
•
•
Several of the MRDs have been in response to recent GAO audits
MRD 10-PAS-005(R), dated February 18, 2010 – “Audit Guidance on
Performing Internal Control Follow-up Audits and Limited Scope Audits”
MRD 08-PAS-041(R), dated December 19, 2008 - “Audit Guidance on Limited
Scope Audit Reports on Internal Controls”
MRD 09-PAS-021(R), dated October 22, 2009 - “Audit Guidance on the Status
of Contractor Systems of Internal Controls as Documented in the Contractor
Organization and Systems and Scope of Audit Sections of Audit Reports”
MRD 08-PAS-043(R), dated December 19, 2008 - “Audit Guidance on
Significant Deficiencies/Material Weaknesses and Audit Opinions on Internal
Control Systems”
MRD 08-PAS-011(R), dated March 3, 2008 - “Audit Guidance on Reporting
Internal Control Deficiencies”
8
Internal Controls in the FAR
•
•
FAR 3.10 requires federal contractors that have a Government contract of $5
million or more to have a written code of business ethics and conduct
FAR 52.203-13 generally requires that internal controls be established to:
–
–
–
–
–
–
–
Assign responsibility to an independent source when possible and allocate resources
to ensure ethics and compliance program effectiveness
Review company practices, procedures, and policies for compliance with the
program
Establish an internal reporting mechanism whereby employees can anonymously
report suspected instances of improper conduct
Deter, discover, and investigate criminal and unethical conduct in connection with
government contracts
Ensure corrective measures are promptly instituted and carried out with appropriate
disciplinary action
Disclose in writing and in a timely manner potential violations involving fraud,
conflicts of interest, bribery, or gratuity violations
Fully cooperate with Government agencies responsible for audits, investigations or
corrective actions
9
Current DFARS Guidance
•
Subpart 242.75—Contractor Accounting Systems and Related Controls
–
–
–
“Internal controls” - policies and procedures established by the contractor to:
• Comply with applicable laws and regulations
• Equitably allocate actual and estimated costs within the accounting system
Contractors with cost-type or progress payment contracts must maintain a system of internal
controls throughout contract performance that demonstrates, with reasonable assurance:
• Compliance with applicable laws and regulations
• Reliable accounting system and cost data
• Minimization of risk related to misallocations and mischarges
• Consistent cost allocation charges and invoice procedures
Process
• ACO receipt of an audit report identifying significant accounting system or related internal
control deficiencies
• Copy of the report provided to the contractor
• Contractor allowed 30 days, or a reasonable extension, to respond
• If the contractor agrees, the contractor is allowed 60 days from the date of initial notification to:
– Correct any identified deficiencies, or
– Submit a corrective action plan with milestones and actions to eliminate deficiencies
• If the contractor disagrees, the contractor should provide rationale in its written response
• The ACO can decide to suspend a percentage of progress payments or reimbursement of
costs proportionate to the estimated cost risk to the Government, until the deficiencies are
corrected
10
Proposed DFARS Rule
•
•
DFARS Case 2009–D038: Business Systems – Definition and Administration
Objective of the proposed rule is to establish a definition for contractor
business systems and implement compliance mechanisms to improve DoD
oversight of those systems
–
–
•
Withholding of payments could be
–
–
–
•
Proposed rule would add Subpart 242.70 – Business Systems and would define six
separate business systems
DoD is proposing to implement compliance enforcement mechanisms in the form of a
business systems clause which includes payment withholding that allows ACOs to withhold
a percentage of payments when a contractor’s business system contains deficiencies
Interim payments under
• Cost reimbursement contracts
• Incentive type contracts
• Time-and-materials contracts
Progress payments
Performance-based payments
Business clause contains a requirement for contractors to respond to initial
and final determinations of deficiencies
11
Proposed DFARS Rule
•
Six separate business systems that would be added to DFARS Subpart 242.70:
Business System
DCAA ICAPS and Other System Audits
Accounting System
Control Environment and Overall Accounting System
Controls
Indirect and Other Direct Cost Controls
Compensation System Controls
Billing System Controls
Labor System Controls
Pre-Award and Post-Award Accounting System Review
General Information and Technology System Controls
Purchasing System
Purchasing System Controls
Estimating System
Estimating System Controls
Budget and Planning System
Material Management and
Accounting System
Material Management and Accounting System Controls
Earned Value Management System
Earned Value Management System
12
What the Proposed Rule
Means
•
Contractor shall establish and maintain acceptable business systems in
accordance with the terms and conditions of the contract. If deficiencies are
identified in a system:
–
–
•
•
ACO will immediately withhold 10 percent of each of the contractors payments
Contractor will have 45 days to correct deficiencies or submit an acceptable
corrective action plan
–
–
•
•
Contractor shall respond in writing within 30 days to an initial determination of deficiencies
from the ACO
Final determination will be made by the ACO as to whether the business system contains
deficiencies (If deficiencies are determined, final determination will include a notice of a
decision to withhold payments)
If acceptable corrective plan has been submitted, but deficiencies are not fully corrected,
the ACO will reduce the withhold to 5%
Failure to follow corrective action plan, at any time, will increase withhold back to 10%
If more than one system has deficiencies identified, the cumulative percentage
of payments withheld shall not exceed 50 percent
If ACO determines there are one or more system deficiencies that are highly
likely to lead to improper contract payments being made or represent an
unacceptable risk of loss to the Government, the ACO will withhold up to 100
13
percent of payments
Impact of the “new”
Accounting System
•
An acceptable accounting system provides reasonable assurance that
–
–
–
–
•
Applicable laws and regulations are complied with
Accounting system and cost data are reliable
Risk of misallocations and mischarges are minimized
Contract allocations and charges are consistent with invoice procedures
Challenge is to comply with greater requirements within one review
Business System
DCAA ICAPS and Other System Audits
Accounting System
Control Environment and Overall Accounting System Controls
Indirect and Other Direct Cost Controls
Compensation System Controls
Billing System Controls
Labor System Controls
Pre-Award and Post-Award Accounting System Review
General Information and Technology System Controls
•
Although “new,” many of these proposed rule requirements are addressed as part of the
Preaward Survey of Prospective Contractor Accounting System (SF 1408), e.g.,
–
–
–
–
Segregation of direct and indirect costs
Cost accumulation under a controlled general ledger
Timekeeping system that allocates labor by cost objective
Segregation of unallowable costs
14
Scenarios
1. In an EVMS review under the proposed rule, any deficiency identified
(regardless of materiality) will subject the contractor to a 10% withhold on costtype contracts
–
•
•
This deficiency could be under any area of the EVMS system, and the 10% withhold
will be applied indiscriminately (e.g., it is highly unlikely that deficiency noted has
anything to do with the allowability of incurred costs)
Although the contractor is permitted to submit a plan to remedy the deficiency,
until the deficiency is actually eliminated, the 10% withhold will still be in effect
Once the contractor fixes the deficiency, the proposed rule does not contain
any language or incentive that requires a timetable for the ACO to pay the
withheld amounts
–
“the ACO shall notify the contractor ... [of] system approval and the ACO’s decision
...to reduce or discontinue the withholding of payments...”
2. In an Accounting System review under the proposed rule, a single deficiency
noted that affects the labor system for cost accumulation can also be a second
deficiency under an Estimating System review if the contractor uses that same
system for cost estimation
–
The potential result is a 20% withhold on cost-type contracts (i.e., 10% for the
Accounting System and 10% for the Estimating System)
15
What You Can Do Prior to
an Audit
•
Perform an internal assessment of the internal controls related to business
systems to identify potential internal control weaknesses
•
For each potential deficiency identified, develop a remediation plan and
timeline for completion
•
Based on the business risk and available resources of each area, prioritize and
begin to remediate identified internal control weaknesses using the
considerations discussed on the next slide
•
Proactively communicate with the cognizant auditor about upcoming audits
and steps the contractor can take to make the audit process as smooth as
possible
•
Further reading – Federal Contracts Report 93, FCR 352: “Contractor
Business Systems Oversight: A Debacle is Brewing”
16
Considerations for
Remediating Deficiencies
•
•
•
•
•
•
•
•
•
•
•
Are the deficiencies noted enterprise wide or isolated?
Are the deficiencies noted manual or automated controls?
What is the level of effort to remediate?
Is the deficiency a quick fix?
Can the deficiency be addressed with a scalable process?
Does the remediation require a new ERP?
Can an automated process replace a manual?
Is there a project plan for each remediation area?
Who will lead the remediation?
What resources, stakeholders and process owners should be included in
remediation effort?
At what point are deficient controls retested?
17
Questions/Comments
?
18
About Baker Tilly
-
Founded in 1931 as a certified public accounting firm
Currently operate in six states with over 1,400 professionals
Member of Baker Tilly International, the world’s 8th largest network of
accounting firms
Headquartered in Chicago
East Region is located in Washington, D.C. with over 275
professionals
East Region provides a range of professional services including:
-
Financial statement audit
Tax planning and compliance
Consulting services to private and publicly traded companies across many
industries
Government contract and grant consulting
Forensic and litigation services
Mergers and acquisitions
Technology management
19
Presenters
Tom Tagle, Partner
Tom has over 15 years of experience in government contract accounting, pricing, business
system and internal control oversight, and regulatory and federal contract compliance assisting
defense, manufacturing, construction and professional services clients. Tom earned his
Bachelor of Science in Business Administration and Accounting from Washington and Lee
University. He is a member of the American Institute of Certified Public Accountants, Virginia
Society of Certified Public Accountants, and National Contract Management Association. Prior
Baker Tilly, Tom worked for a major international public accounting firm and was at Navigant
Consulting for 7 years. Tom is a member of the Baker Tilly Government Contractor Advisory
Services practice in Vienna, Virginia.
Tel: (703) 923-8312, tom.tagle@bakertilly.com
20
Presenters
Noah Leiden, Director
Noah has over 20 years of experience in government contract accounting, pricing, business
system and internal control oversight, and regulatory and federal contract compliance assisting
defense, manufacturing, engineering, information and communications, higher education, and
non-profit clients. Noah earned his Bachelor of Science in Accounting from Pennsylvania State
University. He is a member of the American Institute of Certified Public Accountants, Greater
Washington Society of Certified Public Accountants, Maryland Association of Certified Public
Accountants, and National Contract Management Association. Prior Baker Tilly, Noah worked
for DCAA, KPMG, BearingPoint, and Navigant Consulting. Noah is a member of the Baker Tilly
Government Contractor Advisory Services practice in Vienna, Virginia.
Tel: (703) 923-8321, noah.leiden@bakertilly.com
21