DCAA ASSUMES ROLE OF EVALUATING CONTRACTORS ON “EXPECTED STANDARDS OF ETHICAL AND MORAL BEHAVIOR”

Smith Pachter McWhorter PLC
Government Contracts Update
Vol. V, No. 2    September, 2009

By Stephen D. Knight

Smith Pachter McWhorter constantly tracks current events, issues, and trends in Government Contracts to keep clients on the cutting edge of legal and policy developments. This e-letter highlights the most important issues, and the attached index provides weblinks to the source documents of these and more developments.

DCAA’s Claim to Permanent Office Space in Contractor Facilities

Previous editions of this newsletter have commented on DCAA’s increasingly aggressive tactics.  Now comes an even bolder step.  A number of companies have received letters from DCAA “requesting” permanent office space within company offices, “pursuant to FAR 52.215-2.”  DCAA’s letter states in part: “Implicit in [FAR 52.215-2, Audit and Records – Negotiation] is the requirement for a contractor to provide space at its office if audit work is of a sufficient magnitude to require a permanent DCAA presence.”  In one letter, DCAA even identified a specific conference room “as suitable for modification to provide a secure DCAA Local Area Network, internet access, keypad entry and other amenities necessary to house a DCAA supervisor and five auditors.  In addition to this space, DCAA will require electronic access to the accounting records by way of computer terminals, with training to permit auditors to view and download information necessary to promote efficient audits.”  DCAA noted: “Although we recognize the space is currently used as a training/conference room, we believe sufficient space is available in the building to reasonably relocate this function.” (Emphasis added.)

DCAA’s letter is without precedent and is unsupported.  The standard audit clause, FAR 52.215-2, provides no basis for DCAA’s assertion that it “implicitly” contains a requirement for contractors to provide permanent DCAA office space.  No case precedent even remotely suggests support for DCAA’s assertion.  Moreover, DCAA has no basis in law or contract to specify any room to be “modified”, or its “requirement” for electronic access to accounting records through computer terminals, along with an apparently unlimited amount of “training” to view and download information “necessary to promote efficient audits.”  This would provide DCAA real time unlimited immediate electronic access to company files.  Simply stated, DCAA has no good faith basis for its “request.”  Yet, there is more.

DCAA’s Audit Guidance on FAR 52.203-13

On July 23, 2009, DCAA issued audit guidance instructing its auditors on requirements for checking on contractor compliance with the new FAR 52.203-13.  Also, in recent letters to contractors, DCAA has articulated its formal request for information regarding Control Environment.  Through the audit guidance, DCAA has propelled itself into the role of monitoring whether contractors “conduct themselves with the highest degree of integrity and honesty.”  The guidance focuses on: (1) Code of Business Ethics and Conduct, (2) Training, (3) Periodic Reviews, (4) Internal Reporting Mechanism, (5) Disciplinary Action, (6) Disclosure of Improper Conduct, (7) Full Cooperation, and (8) Display of Hotline Posters.  The audit guidance will send DCAA’s auditors far beyond their audit responsibilities, and deeply into management judgment and decision-making. 

Code of Business Ethics and Conduct.  The audit guidance informs DCAA auditors: “Although FAR does not detail the specific areas that should be covered, the contractor’s written code of conduct should generally address ethical business practices and expected standards of ethical and moral behavior.”  DCAA thus assumes the responsibility of determining the “adequacy” of a contractor’s written code of business ethics and conduct, according to DCAA’s view of “expected standards of ethical and moral behavior.”  DCAA makes clear that a code of conduct “should cover dealings with customers, suppliers, employees, and other parties,” stating “considerations” for evaluation that DCAA acknowledges are not contained in FAR:

Conflicts of interest, illegal or other improper payments, anticompetitive guidelines, and insider trading;

Compliance with government contracting requirements for procurement integrity, classified information, and recruiting and employing current or former government personnel;

Periodic acknowledgement of codes by all employees;

Clear establishment of what behavior is acceptable or unacceptable, and what to do if employees encounter improper behavior;

Consequences for violations.

DCAA’s parameters are very broad – for example, establishing “what behavior is acceptable or unacceptable” – and provide DCAA with a wide platform to review and question contractor business practices and judgments.  DCAA has placed itself in the role of deciding whether contractors possess, in its view, sufficient ethical and moral standards. 

Ethics Awareness and Compliance Program. In this part of the audit guidance, DCAA focuses on “effective training” and “disseminating information appropriate to an individual’s respective roles and responsibilities.”  DCAA advises its auditors that FAR requires contractors to provide training to “principals and employees, as well as to the contractor’s agents and subcontractors, as appropriate.”  The audit guidance states that “auditors should evaluate the contractor’s … training materials to ensure it covers the contractor’s code of business ethics and conduct.”  DCAA auditors will also “test the implementation of the program by obtaining completed training documents to determine that the training was periodically provided to the appropriate individuals.”

So, in the first instance, DCAA determines whether a contractor’s code of business ethics and conduct is “adequate” by evaluating whether the contractor has clearly established acceptable and unacceptable behavior regarding “expected standards of ethical and moral behavior.”  Then, in the next instance, DCAA determines whether the contractor’s training materials contain the correct content and whether the contractor communicates this training to the “appropriate” individuals.  At the very least, contractors should re-evaluate their training programs to determine whether, and to what extent, to require subcontractors and agents to participate.  If contractors determine that subcontractors and agents need not participate in training, then they should have a reasoned basis for that determination.  DCAA’s guidance is clear that this is not “business as usual.”

Business Ethics Awareness and Compliance Internal Control System.  Here, DCAA zeroes in on “an effective system of internal controls and self-governance.”  DCAA states that “Management must continually communicate the importance of a strong internal control system”; and contractors “should have policies and procedures to facilitate timely discovery of improper conduct and ensure corrective measures are promptly instituted and carried out for any cases of improper conduct disclosed.”  DCAA’s focus on “improper conduct” is noteworthy because FAR 52.203-13 does not define that term, but does distinguish it from “violations” of criminal law and the civil False Claims Act.  “Violations” can be measured against the requirements of a law.  By contrast, “improper conduct,” like “expected standards of ethical and moral behavior,” is a vague and amorphous term.  Yet, that is the “standard” on which DCAA focuses.

DCAA states that internal controls must provide for, at a minimum:

1. Assignment of responsibility at a sufficiently high level to ensure effectiveness of the business ethics awareness and compliance program and internal control system.

DCAA states that the manager responsible for the ethics program “should report to a high level official such as the vice president or CFO.”

2. Procedures to ensure individuals that previously engaged in conduct that conflicts with the contractor’s code of conduct are not appointed as a principal of the company (e.g., officer, director, partner).

DCAA instructs its auditors to review contractor policies and procedures “and test the procedures to verify that they include steps for exercising due diligence in identifying such conduct (e.g., require background checks before appointing principals of the company) and that the steps have been taken when applicable.”  As with other provisions of the audit guidance, DCAA has now inserted itself into evaluating contractor employment practices.

3. Periodic evaluations (i.e., at least annually) of the effectiveness of the business ethics and awareness compliance program and internal control system.

DCAA directs its auditors to “review the results of these evaluations and determine the impact on any audits,” and to ascertain that the contractor “has taken the necessary corrective actions to address” weaknesses.  Implicit in this direction is the assertion of a broad power to second-guess (“review the results of these evaluations”) contractor compliance programs, internal control systems, and whether “weaknesses” exist, as well as to second-guess whether corrective actions were necessary and sufficient to address the “weakness.”

DCAA’s recent letter to contractors adds a disclosure element to this part of the DCAA review.  The letter states that DCAA must verify the performance of “periodic reviews of the company business practices, procedures, and internal controls for compliance with standards of conduct as stated in FAR 52.203-13(c)(2)(ii)(C) and the contractor provides appropriate disclosure to the government of information needed to fulfill its responsibilities.”  The cited paragraph from FAR 52.203-13 contains no disclosure requirement.  Moreover, DCAA’s letter states: “We define adequate disclosure as disclosure to DCAA and the ACO of all findings that significantly impact government contracts within 5-10 days of identification; disclosure of the corrective actions in process or planned by the company; and disclosure of adjustments to government contract costs and improvements to underlying business systems.”  The DCAA letter then requests “a list of violations to the code of conduct/ethics which occurred in the past 12 months.”  These are also requirements of DCAA’s invention. 

4. Disciplinary action for improper conduct, or failing to take reasonable steps to detect improper conduct.

According to this guidance, DCAA auditors will seek “evidence of the assessment performed to determine if disciplinary action taken was needed, and evidence of the disciplinary action taken .…”  If the contractor states no disciplinary action was needed, “the auditor should take steps to ensure that there were no reports of improper conduct by the contractor (such as those reported under the requirements [of mandatory disclosure to the Inspector General])”.  If the auditor finds that “there is a report of improper conduct and the contractor failed to take disciplinary action when it should have been taken, the auditor should cite the contractor for an internal control deficiency.”

This part of the audit guidance is particularly disturbing.  First, it sets up DCAA auditors to second-guess employee disciplinary actions, both in terms of whether “improper conduct” – as previously noted, an undefined term – occurred, and whether the disciplinary action, if any, was appropriate to the “improper conduct.”  Second, the guidance is clear that DCAA auditors will seek documents relating to employee disciplinary actions.  This will place DCAA squarely within a company’s Human Resources function (in addition to its Ethics and Compliance function), reviewing documents and making judgments about labor issues that could also be complicated by union agreements, employment contracts, along with confidentiality and privacy issues.

Third, the audit guidance appears to assume that every “report” of improper conduct should result in disciplinary action; the absence of a disciplinary action would result in a DCAA citation for an internal control deficiency.  Thus, a disagreement with DCAA over a Human Resources function – appropriate discipline to be imposed on an employee for “improper conduct” – may lead to a DCAA determination of an inadequate internal control system for government contract purposes.  Additionally, the audit guidance appears expansive in its use of the term “report.”  It cites a mandatory disclosure to the Inspector General under FAR 52.203-13 as just one example of a “report.”  The implication is that a “report” of improper conduct could come in any number of forms, written or oral.  There is no basis for DCAA to insinuate itself into a role of second-guessing traditional Human Resources types of activities.

5. An internal reporting mechanism, such as a hotline, by which employees may anonymously or confidentially report suspected instances of improper conduct, and instructions that encourage employees to make such reports.

Although the audit guidance does not discuss this requirement in detail, the requirement is logically related to the one preceding it. That is, the hotline is a source of “reports” of improper conduct.  Thus, DCAA may seek access to the hotline information as part of the “evidence” described above.

6. Timely disclosure in writing to the agency Office of Inspector General (OIG), with a copy to the contracting officer, when there is credible evidence of violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations, or a violation of the civil False Claims Act in connection with Government contracts.

The audit guidance instructs DCAA auditors to “ensure that the contractor’s policies and procedures include a reasonable definition of credible evidence and a reasonable timeframe for disclosure once credible evidence is obtained.”  This is a particularly troubling statement in the audit guidance.  While FAR 52.203-13 requires disclosure of “credible evidence” of certain violations, the regulation does not define the meaning of that term.  DCAA, though, will review contractor policies and require a definition.  Thus, DCAA can enforce the definition it favors on contractors by disapproving any contractor definition with which it disagrees (and determining the contractor’s internal control system “inadequate” at the same time), in the absence of a regulatory definition.

Significantly, DCAA’s letter to contractors uses the wrong standard for disclosures to the agency Inspector General.  In its letter, DCAA stated: “We will review policies and procedures and determine if they provide for timely reporting to appropriate Government officials of any suspected violation of law in connection with Government contracts or any other irregularities in connection with such contracts in accordance with FAR 52.203-13(b)(3) and FAR 52.203-13(c)(2)(ii)(F).”

Moreover, contractors may expect that DCAA’s view of a “reasonable timeframe for disclosure” will be unrealistically short, given the 5-10 day reporting requirement in DCAA’s letter to contractors.  In its Memorandum for Regional Directors dated December 19, 2008, DCAA asserted entitlement to virtually same-day audit access in certain situations.  That approach will likely apply here as well.

7. Full cooperation with any Government agencies responsible for audits, investigations, or corrective actions.

The audit guidance instructs DCAA auditors to cite contractors for deficiencies relating to their control environment “if there are known cases where the contractor has not cooperated with audits or investigations.”  DCAA auditors “should confirm that there are no outstanding access to records issues or subpoenas that would indicate the contractor’s lack of cooperation.”  DCAA’s position is that if a contractor has not complied with DCAA’s assumption of authority to demand access to records (see the December 19, 2008, Memorandum to Regional Directors, cited above), the contractor necessarily did not fulfill its “full cooperation” obligation.  DCAA fails to recognize that the “full cooperation” obligation in FAR 52.203-13 relates to instances of mandatory disclosure of “credible evidence” of certain violations to the agency Inspector General.  The definition of “full cooperation” makes that point – “disclosure to the Government of the information sufficient for law enforcement to identify the nature and extent of the offense and the individuals responsible for the conduct …”  Yet DCAA has insinuated itself into the process that requires reporting only to the Inspector General.

DCAA Audit Control Environment Program
The DCAA audit program (as distinct from the audit guidance) relating to FAR 52.203-13 contains a disturbing section on “Board of Directors/Audit Committee.”  That section focuses on the independence of the Board and Committee, and the “active role” that DCAA believes the Board and Committee should play in management of a company.  Specifically, the audit program instructs DCAA auditors to obtain a list of Board and Committee members, “and assess their independence.”  It further states:

2. Evaluate the minutes of the Board of Directors’ meeting and all communications with the Audit Committee, or body of similar authority to determine if the Board is taking an active role in significant management decisions.
3. Evaluate the minutes of the Audit Committee meetings to determine if the committee (and/or Board of Directors) is acting effectively on all audit matters, including internal and external audit recommendations.
4. Verify that the internal audit department is functionally and organizationally independent to achieve objectivity in the conduct of its audits.

DCAA clearly intends to insert itself directly into the management of the company.  First, DCAA views itself qualified to evaluate and judge the independence of the Board of Directors and Audit Committee.  Second, DCAA will demand Board of Directors and Audit Committee meeting minutes, and all communications between those two entities.  Third, DCAA will determine whether the Board “is taking an active role in significant management decisions,” and whether the Board and Committee are “acting effectively on all audit matters, including internal and external audit recommendations.”  This expansive assertion of power to review and evaluate the Board’s and Committee’s communications, decisions, and actions is unprecedented and unwise.  To say the least, DCAA is not well suited, much less authorized, to review and evaluate actions of a company’s Board of Directors and Audit Committee.

All of the signs consistently point to DCAA’s determination to use highly aggressive tactics against contractors.  Consequently, contractors must develop a response strategy to prepare in advance for any DCAA demand for review or for information.

More Overreaching for DCAA Proposed

On August 20, 2009, the FAR regulators published a proposed regulation, “FAR Case 2008-020, Contract Closeout,” which would change FAR 52.216-7 to mandate the submission of specific information as a requirement for “an adequate indirect cost rate proposal.”  74 Fed. Reg. 42044 (August 20, 2009).  The proposed regulation reads like a DCAA “wish list,” and would add new subsections (d)(2)(iii) and (iv):

(iii)       An adequate indirect cost rate proposal shall include the following data unless otherwise specified by the cognizant Federal agency official (CFAO):

1.   Summary of claimed indirect expense rates.
2. General and Administrative (G&A) expenses (final indirect cost pool).
3. Overhead expenses (final indirect cost pool).
4. Occupancy expenses (intermediate indirect cost pool).
5. Claimed allocation bases.
6. Facilities capital cost of money factors computation.
7. Reconciliation of books of account and claimed direct costs.
8. Schedule of direct costs by contract/subcontract and indirect expense applied at claimed rates, as well as Schedule H-1, Government participation percentages.
9. Schedule of cumulative direct and indirect costs claimed and billed.
10. Subcontract information.
11. Summary of hours and amounts on T&M/labor hour contracts.
12. Reconciliation of total payroll to total labor distribution.
13. Listing of decisions/agreements/approvals and description of accounting/organizational changes.
14. Certificate of final indirect costs.
15. Contract closing information for contracts completed in this fiscal year.

(iv)       The following supplemental information, which will be required during the audit process, may also be submitted with the contractor’s final indirect cost rate proposal:

1. Comparative analysis of indirect expense pools detailed by account with prior fiscal year and budgetary data.
2. General Organization and Executive compensation information for top five executives.
3. List of ACOs and PCOs for each flexibly priced contract.
4. Identification of and information on prime contracts under which the contractor performs flexibly priced effort as a subcontractor.
5. List of work sites and the number of employees assigned to each site (identify the number of direct and indirect employees).
6. Description of accounting system.
7. Procedures for identifying and handling unallowable costs.
8. Certified financial statements or other financial data (e.g., trial balance, compilation, review, etc.).
9. Management letter from outside CPAs concerning any internal control weaknesses.
10. Actions that have been and/or will be implemented to correct the weaknesses described in paragraph (d)(2)(iv)(I) of this section.
11. List of internal audit reports issued in this fiscal year.
12. Annual internal audit plan of scheduled audits to be performed in this fiscal year.
13. Federal and state income tax returns.
14. Securities and Exchange Commission 10-K annual report.
15. Minutes from board of directors meetings.
16. Listing of delay and disruptions and termination claims submitted which contain costs relating to the subject fiscal year.
17. Contract briefings.  Contract briefings generally include a synopsis of all pertinent contract provisions, such as: contract type, contract amount, product or service(s) to be provided, applicable Cost Principles, contract performance period, rate ceilings, advance approval requirements, pre-contract cost allowability limitations, and billing limitations.  A typical format for the briefings is shown at the end of this model.  A contractor need not use the example form if the information is already generated and available within its automated accounting or billing systems.

The proposed regulation would also add a new subsection (d)(2)(v) to require the contractor “to update the schedule of cumulative direct and indirect costs claimed and billed, as required in paragraph (d) above, within 60 days after settlement of final indirect cost rates.”  Finally, the proposed regulation would change FAR 52.216-8, -9, and -10, pertaining to fees, to permit the release of 75 percent of all fee withholds “after receipt of an adequate certified final indirect cost rate proposal.”

In short, this change would force contractors to do DCAA’s work, and compel them to provide access to records DCAA has never been entitled to examine.  While a detailed discussion of every proposed category of information is beyond the scope of this analysis, a few examples make the point.  For example, contractors have no obligation to reconcile books of account and claimed direct costs; to provide a schedule of cumulative direct and indirect costs claimed and billed; to reconcile total payroll to total labor distributions; or to provide a “listing of decisions/agreements/approvals and description of accounting/organizational changes.”  Indeed, one wonders what such a listing would really entail, or the reason that it would be required for an “adequate indirect cost rate proposal.”

Moreover, contractors have no obligation to provide a comparative analysis of indirect expense pools detailed by account with prior fiscal year and budgetary data.  And while contractors may be obliged to provide DCAA with access to “General Organization and Executive compensation information” – whatever the definition of such information – one wonders why it is a necessary component of an “adequate indirect cost rate proposal.”  The same is true for a list of ACOs and PCOs, a list of work sites, a description of the accounting system, and procedures for handling unallowable costs – are not these data already in the government’s possession and is not DCAA capable of assembling them as easily as contractors?

In addition to an attempt to enlarge its audit access to records, DCAA strains credulity by listing Board of Directors meeting minutes as essential to an “adequate indirect cost rate proposal.”  The same is true for “contract briefings,” which DCAA previously required its own auditors to perform some years ago.

In summary, the signs are unmistakable that DCAA is making a concerted effort to impose its “wish list” of audit and oversight requirements on contractors, and to force its way into contractor business judgment and decision-making.

Congress Requires Direct Government Involvement in Make/Buy, Subcontracts

Among the many laws, proposed and passed, that contractors need to read and follow is the “Weapons Systems Acquisition Reform Act of 2009,” Pub. L. No. 111-23 (enacted May 22, 2009).  Section 202 of that law requires the Defense Department to “ensure that the acquisition strategy for each major defense acquisition program includes … measures to ensure competition, or the option of competition, at both the prime contract level and the subcontract level … throughout the life-cycle of such program …”  Section 202(c) further requires the Defense Department “to ensure fair and objective ‘make-buy’ decisions by prime contractors … by – “

1. requiring prime contractors to give full and fair consideration to qualified sources other than the prime contractor for the development or construction of major subsystems and components of major weapon systems;
2. providing for government surveillance of the process by which prime contractors consider such sources and determine whether to conduct such development or construction in-house or through a subcontract; and
3. providing for the assessment of the extent to which a contractor has given full and fair consideration to qualified sources other than the contractor in sourcing decisions as a part of past performance evaluations.

In short, the government will specify requirements for prime contractors to give “full and fair consideration to qualified sources” for major subsystems and components.  Then, the government will conduct “surveillance of the process by which prime contractors consider such sources” and decide whether to “make” or “buy.”  Finally, the government will “assess” prime contractors on their processes and make that assessment a part of the prime contractors’ past performance evaluations.  Although the regulations implementing these provisions are not yet written, contractors can expect more government participation in their “make/buy” decisions and subcontracting practices.  Further, contractors can expect that DCAA will see this as a “natural” extension of its Contractor Purchasing System Reviews (CPSR).

Federal Circuit Severely Restricts Third-Party Litigation Cost Allowability

In Geren v. Tecom, Inc., No. 2008-1171 (Fed. Cir. May 19, 2009), the Federal Circuit reversed the Armed Services Board of Contract Appeals and held that legal costs incurred in defending third-party lawsuits, and costs incurred in settlement of such litigation, are unallowable unless the contractor obtains a determination from the contracting officer that the litigation had “very little likelihood of success.”  As discussed in detail in an article by several Smith Pachter McWhorter partners, no cost principle and no judicial precedent compelled this result, and the Federal Circuit’s decision is contrary to decades of legal precedent.  “Geren v. Tecom, Inc.: The Federal Circuit Creates a New FAR Cost Principle,” Vol. 4, Issue 4 at ¶ 27 (July 2009). (available at www.smithpachter.com)

* * * * *

If you wish to discuss these or any other government contract issues, please contact the following individuals or view the attorneys sections of our website to view additional attorney biographical information:

John S. Pachter 703 847 6260 jpachter@smithpachter.com	Stephen D. Knight 703 847 6284 sknight@smithpachter.com
Richard C. Johnson 703 847 6266 rjohnson@smithpachter.com	Jonathan D. Shaffer 703 847 6280 jshaffer@smithpachter.com
* * * * *	* * * * *
Edmund M. Amorosi 703 847 6268 eamorosi@smithpachter.com	Mary Pat Gregory 703 847 6303 mgregory@smithpachter.com

 

 

Print|Bookmark