On December 19, 2008, the Defense Contract Audit Agency (DCAA) issued revised audit guidance regarding access to contractor records (MRD 08-PAS-042(R)) and internal control systems audit opinions (MRD 08-PAS-043(R)). The revised guidance exposes contractors to greater risk of "inadequate" internal control systems audit findings and suspension of costs for failure to provide "timely" access to contractor documents and personnel.
Internal Control Systems Audit Opinions
As reported in our December 30, 2008, Client Alert (www.wileyrein.com/dcaa_compensation_reviews) auditors have been instructed to report any internal control deficiency as a significant deficiency/material weakness and to issue an opinion that the system is inadequate. DCAA will no longer report "inadequate in part opinions," because the "[f]ailure to accomplish any applicable control objective could result in [a] material weakness," and by opining that the system is inadequate, as opposed to inadequate in part, it "will make it more likely that the contracting officer will take appropriate action" (i.e., disapprove the system—if applicable—and pursue suspension of a percentage of progress payments or reimbursement of costs). In addition, DCAA audit reports will no longer include suggestions to improve the system.
"Timely" Access to Records & Personnel
DCAA also revised its policies regarding access to contractor records and the actions to be taken if the contractor fails to provide requested documents or access to personnel in a "timely manner." MRD 08-PAS-042(R). While the revised audit guidance does not prescribe specific time limits that should be imposed, and indicates that contractors "should be provided a reasonable time period to provide the data given the specific circumstances," it suggests that in most cases data should be provided "upon request." The revised audit guidance further provides that auditors "should generally obtain supporting documentation directly from the person responsible for the information" and that the "use of a liaison for requests from DCAA should not result in delays in providing the requested documentation or inhibit the auditor's access to contractor personnel needed to conduct the audit." Id. (emphasis added).
The revised policy, with its particular focus on access to personnel, renews concerns with the agency's position regarding its right to seek access to contractor personnel and what constitutes a "denial" of access to records. Additionally, to the extent that the revised policy seeks to impose specific time frames for providing access to records, it arguably exceeds the DCAA's statutory and regulatory authority.
What Is "Timely" access?
Under the existing DCAA Contract Audit Manual (CAM), when confronted with a denial of access to records or "unreasonable delay," auditors are instructed to initially make a "reasonable effort . . . to resolve the issue in a timely manner at the lowest possible DCAA and contractor management level." CAM ¶ 1.504.5, dated November 4, 2008. The revised audit guidance, however, provides stricter guidelines regarding the timeliness of contractor responses and the consequences for purported delays. Under the new policy, auditors are advised that unless the request for access requires "analysis by the contractor or there are extenuating circumstances (e.g., the requirement is for a voluminous amount of data or for data stored at an off-site location), the contractor should provide the documentation upon request." If the contractor fails to provide the information by the given due date without an "appropriate explanation for delay," the Field Audit Office (FAO) is to prepare a "formal written request to the appropriate high-level contractor management (i.e., at a level no lower than the business segment vice-president or chief financial officer) stating that the information must be provided by a specific due date (not to exceed one week) with a copy to the contracting officer." This request is to be initiated as soon as the "due date is missed and no later than five days after the due date." If the information or an appropriate explanation is not subsequently provided within one week, then DCAA should take additional steps, including:
- Notify the contractor that a formal denial of access to records exists and initiate a Form 1 to suspend and/or withhold the unsupported costs;
- Request assistance from the Administrative Contracting Officer (ACO) and, if applicable, the Contract Audit Coordinator; and
- Submit a Denial of Access to Contractor Records Form to the regional office (to be forwarded to DCAA Headquarters).
Where the ACO does not agree with DCAA's request for data, the matter should be referred promptly to the regional office for resolution. Ultimately, a subpoena may be requested and issued to obtain access. Moreover, if the contractor fails to provide the requested information on a "timely basis," the FAO should "consider whether an internal control deficiency exists." If so, the condition should be cited as a significant deficiency/material weakness, resulting potentially in an "inadequate" systems finding, as noted above.
DCAA's apparent expectation that requested records should be made available upon request appears to be in tension with the clause at FAR 52.215-2(b), which limits the Government's right of inspection to "reasonable times." See also FAR 52.215-2(f) (records to be available at "reasonable times"). Thus, to the extent that the revised guidance seeks to impose specific time frames for responding to DCAA requests for documents, DCAA has arguably exceeded its authority. Because DCAA's policy recognizes, however, that the "contractor should be provided a reasonable time period to provide the data," and the FAR clause is the relevant controlling authority, contractors and DCAA should be able to continue to arrange for the production of documents at times reasonable to the contractor under the particular circumstances. Nevertheless, contractors should be prepared to provide timely responses to requests for information and to demonstrate to the ACO and/or DCAA management that they made records available to DCAA at reasonable times.
If the contractor alleges that records have been lost, destroyed or stolen, the revised policy instructs auditors to obtain a written statement from "appropriate high-level contractor management (i.e., at a level no lower than the business segment vice president or chief financial officer) to that effect with a detailed explanation of the circumstances." Although DCAA should not claim denial of access to records in these circumstances, the auditor is nevertheless instructed to notify the contracting officer and include appropriate comments in the audit report on the facts and any necessary disclaimer, adverse opinion, qualification or explanation of questioned costs as a result of the lack of support.
DCAA's Access to Records Authority Does Not Extend to People
DCAA has long maintained that its authority to access contractor records extends to access to personnel. See, e.g., CAM ¶1.504-1 ("In addition to access to specific cost records, access to records refers to . . . personnel"). However, there is no statutory, regulatory or contractual authority in support of DCAA's position. See 10 U.S.C. § 2313 ("The head agency, acting through an authorized representative, is authorized to inspect the plant and audit the records [of a contractor]"; "the [DCAA] may require by subpoena the production of any records of a contractor that the Secretary of Defense is authorized to audit or examine under subsection"); FAR 52.215-2 ("'records' includes books, documents, accounting procedures and practices, and other data . . . ") (emphasis added); see also United States v. Iannone, 610 F.2d 943, 946 (D.C. Cir. 1979) (subpoena power for records does not extend to oral testimony where statute does not expressly provide authority to compel testimony).
Notwithstanding the apparent lack of authority, there are often legitimate practical reasons for contractors to voluntarily provide DCAA access to its employees in support of an audit, including to improve the efficiency of the audit, and contractors and DCAA are usually able to reach a reasonable compromise. However, the revised audit guidance's emphasis on obtaining direct access to contractor personnel, and its implicit criticism of the use of a DCAA liaison to control contractor communications with DCAA, suggests that DCAA may begin to take a more aggressive position regarding access to personnel than in the past. Additionally, even though a contractor may have provided access to all requested books and records, if the contractor declines DCAA's request for access to personnel, the audit guidance suggests that auditors should treat the matter as a denial of access to records, which could result in costs being suspended or withheld.
Given the heightened risks to contractors as a result of these changes in DCAA policy, contractors may wish to review their internal policies and procedures for supporting DCAA audits and ensure that relevant company personnel are aware of those policies. Although DCAA apparently views contractor liaisons with the agency as potentially "interfering" with DCAA's ability to timely conduct audits, liaisons serve an important function by ensuring that auditors are provided access to audit trail documents in a manner consistent with applicable laws and regulations, company policies and the scope and objectives of the audit. Moreover, the liaison is often in the best position to determine whether, and to what extent, the company should make personnel available to the auditors and who the appropriate people are to address the issues raised by the audit.
Contractors should further be prepared to respond to DCAA requests in a timely manner and ultimately demonstrate compliance with the FAR and contract requirements to make relevant records available at "all reasonable times." Contractors should also be prepared to engage the ACO or DCAA management if the auditor has imposed what the contractors believe to be unreasonable time frames for responding or has requested access to records or personnel they believe to be outside the scope of DCAA's authority.