Government contractors may be surprised to learn that the Defense Contract Audit Agency (DCAA) continues to receive criticism for, among other things, being too lenient on contractors. Apparently in response to such perceptions, DCAA has, over the last year, implemented a number of changes to its audit policies and procedures that raise significant concerns for contractors. Perhaps the most notable is DCAA's overreaching view of its role in auditing contractor ethics and compliance programs.
As we previously reported, DCAA implemented a series of changes to its audit policies and procedures beginning last Fall, apparently in response to a July 2008 report from the Government Accountability Office (GAO) (GAO-08-857, July 22, 2008) that criticized the DCAA for failing to comply with Generally Accepted Government Audit Standards and raised questions about DCAA's "independence" from contractors. These changes included the elimination of "inadequate in part" audit opinions on internal control systems and revised policies demanding greater and more immediate access to contractor records and personnel. Although a recent follow up report by GAO, (GAO-09-468, September 23, 2009, "DCAA Audits: Widespread Problems With Audit Quality Require Significant Reform") takes DCAA to task for eliminating the "inadequate in part" opinion, because "the new policy does not recognize different levels of severity and could unfairly penalize contractors," it still identifies concerns about DCAA's independence and cites examples of what it views as inappropriate favorable treatment of contractors.
Lawmakers' reactions to this report were vitriolic. For example, The Washington Times reports that Senator Susan M. Collins (R-ME) said the flaws identified in the GAO report "allow contractors to overbill the government in some cases for millions of dollars." Senator Tom Coburn (R-OK) said, "I read a summary of the GAO report last night and quite frankly got sick." With DCAA continuing to address these perceptions of its lack of independence, contractors should anticipate more difficulties in the audit process. One of the most problematic areas of change is DCAA's evolving approach to auditing contractor ethics and compliance programs. On July 23, 2009, DCAA revised its audit program (Activity 11070) and DCAA Contract Audit Manual (DCAM) § 5.306 related to "Integrity and Ethical Values," see MRD PAS 730.3.B.2, to include measures to verify a contractor's compliance with the requirements of FAR § 52.203-13 related to business ethics and mandatory disclosure of certain violations of law for which contractors have "credible evidence." Beyond simple verification of the existence of a written code of conduct made available to all employees and of an ethics training program, these measures include:
- Review of any matters in which disciplinary action was or was not taken in response to a report of improper conduct—if the auditor determines that disciplinary action should have been taken, but was not, the contractor should be cited for an internal control deficiency;
- Confirmation that there is no outstanding access to records, issues or subpoenas that may indicate a lack of cooperation with Government agencies responsible for audits, investigations or corrective actions; and
- Review of all disclosures made under FAR § 52.203-13 and an assessment of (a) whether the disclosure was "timely" and (b) whether the contractor has taken the "necessary corrective actions to protect the Government's interests"—if, in the judgment of the DCAA auditor the disclosure was not made in a timely manner or the contractor has not taken the appropriate corrective action, the contractor should be cited for an internal control deficiency.
The revised DCAM further provides that "[a]uditors should ensure that the contractor's policies and procedures include a reasonable definition of "credible evidence" [a standard which even the drafters of the mandatory disclosure rule could not clearly define], and a reasonable timeframe for disclosure once credible evidence is obtained." DCAM § 5.306-3(6).
In short, DCAA appears to have anointed itself the arbiter of the adequacy of contractor "standards of ethical and moral behavior," compliance with the mandatory disclosure requirements, and the appropriateness of contractor corrective actions. Perhaps even more disturbing are contractor reports of DCAA information requests that call for a list of all "current open investigations" and "violations [of] the code of conduct/ethics which occurred in the past 12 months," and that define "adequate disclosure" under FAR § 52.203-13 as "disclosure to DCAA and the ACO of all findings that significantly impact government contracts within 5-10 days of identification; [and] disclosure of the corrective actions in process or planned by the company . . ." These requests and standards would impose additional disclosure and timing requirements beyond those mandated by the FAR. More important, such standards could involve demands for information that is protected by privacy laws and the attorney-client and/or work product privileges, contrary to the provisions of FAR § 52.203-13(a)(2)(i), which expressly acknowledges that contractors are not required to waive such privileges.
These recent developments will require contractors to focus special attention on their interactions with DCAA. Wherever possible, companies should seek to reduce unnecessary delays in responding to DCAA record requests. Equally important, companies should have a clear understanding of their rights under the FAR, and the true limits of DCAA authority. Where appropriate, and based on such understanding, companies should consider asserting their rights, and ensuring that their contracting officers are made aware of what is happening. Contractors faced with such demands will need to proceed with caution and may wish to engage counsel in developing appropriate responses.