Preparing for DCAA audits And how to leverage Costpoint ... · Agenda • Background on Government...

CP-104:Preparing for DCAA Audits and How to Leverage Costpoint for Success

Giacomo Apadula, Darlene MihalyBDO

Deltek Insight 2

DARLENE MIHALYSenior Manager, Enterprise Resource

Planning Practice

[email protected]

Direct: +703-770-9045

Mobile: +937-572-4580

GIACOMO APADULAManaging Director, Business

Information Systems and Technology

[email protected]

Direct: +703-336-1646

Mobile:+609-617-4191

Introductions

Deltek Insight 3

Agenda

• Background on Government Contract Oversight

• DCAA Audits

• Incurred Cost Audits

• Overview of Accounting System Requirements

• Process of Developing and Maintaining Compliant Business Systems

4

Background on Government Contract Oversight

5

Contract Life Cycle

Identify

Opportunity

Review Solicitation /

RFP

Proposal Preparation

and Submission

Contract

Negotiations

Contract

Award

Contract

Briefing

Project

Set-up

Contract

Delivery

Project Accounting

Project Billing /

Financing

Contract Modification

/ Change Orders

Contract

Closeout

Pre-

Award

Award

Acct

Business

Systems

GO

VE

RN

ME

NT

AU

DIT

OV

ER

SIG

HT

GOVERNMENT AUDIT OVERSIGHT

6

Audit Authority

Regulatory clauses specifically grant the Government the right to audit a contractor’s books and records

(FAR 52.215-2)

Generally, audit rights extend up to 3 years after final payment of the contract

Records include books, documents, accounting procedures and practices, and other data

7

The Participants

Contracting Officers (COs): decide

Auditors: advise

The Defense Contract Audit Agency

Other Agency Auditors

Office of Inspector General (OIG)

8

Method & Type of Procurement

The level of audit oversight is dependent upon:

Contract Type

FFP/T&M = Low risk, low audit risk

Cost-Reimbursable = Higher risk, high audit risk

Method of Procurement

Competition = fewer audit requirements

Negotiated = increased audit oversight

Commercial Item = lowest degree of audit risk

9

Risk Factors

Contractors with high risk profile have a increased potential of:

Increased scope of audits

Limited scope audits

Circumstances which elevate audit risk profile

Lack of prior audit oversight

Sudden increase in dollar volume of cost or T&M contracts

Adverse prior audit findings

Inadequate system ratings

Delays in timely submission

Mandatory Disclosures

10

Compliance Risk and Contract Complexity

Contract Complexity

Com

plia

nce R

isk

Contractor ACommercial services

sold to various agencies

GSA Federal Supply Schedule

Focus on GSA requirements

Unless bidding on IDIQ RFP,

there are no business system

compliance requirements

Contractor BLarge company with Firm

Fixed Price contracts

Although DFARS clause for

Business Systems in the

contract, mandatory withholds

do not apply as Contractor B is

not CAS covered

Go through False Claims

assessment

Review DCAA audit program

associated with Ethics

Establish Mandatory Disclosure

and Ethics internal controls via

policies & procedures

Contractor CMajor contractor with cost

reimbursable contracts

Ensure proper internal controls

are in place to adhere to all

500+ pages of the DCAA Acct

System Audit Program

Full compliance with DFARS

252.242.7006

Contractor B checklist plus:

Determine level of effort and

risk profile in setting up proper

internal controls (questions to

consider: what are the odds of

audit and which audit program

will DCAA utilize to determine

adequacy of Bus. System?

11

DCAA Audits

12

DCAA Audit Objectives

Evaluate adequacy and compliance

Obtain sufficient understanding of audit area

Examine and document sufficient evidence to support opinion

Costs Incurred and Claimed:

Reasonable and Allocable

GAAP Compliant

Contract or regulatory limitations or exclusions

Assess risks as a basis for the design tests

Document findings in working papers and permanent files

Report on the audit findings

Present adequacy determination

13

Scope of Government Audits

Audits can occur within the entire contract lifecycle

Proposal Audits (Pre and post award)

Incurred Cost

Business Systems

Forward Pricing/Estimating

CAS Compliance

Defective Pricing (TINA)

Capabilities

14

DCAA Audit Guidance

DCAA Audit Programs

60+ audit programs in DCAA public directory

Defense Contract Audit Manual (DCAM) detailing topics including:

Risk Assessments

Audit Planning

Scope, Nature and Documentation of Audit

Audit Programs and steps

15

Events That Can Trigger Additional Audits

Inability to provide document traceability

Allocations are not posted to Contract or unavailable in standard report

Failure to follow Timekeeping Policies

Incompatibility of records, often from inclusion of unallowable costs

Lack of internal controls surrounding the firms business systems

Lack of corrective action plans addressing previous audit findings

Overall inconsistency of documentation, data and balance of funds

16

Manage the Audit

Prepare Document

Communicate Negotiate/Dispute

Audit

17

Prepare

Obtain an audit plan from your auditor / ACO

Manage communication, activities and negotiations of the audit throughout the audit lifecycle

Proactively identify and address any apparent limitations/deficiencies

Perform a Gap Analysis of where you are to what you will be audited against

Leverage the audit steps, requirements and sampling protocol that the auditors use

18

Communicate

Interface with auditors before, during and upon conclusion of audits

Contractors should strive to stay in constant communication with their auditors

regarding

Audit plans and schedules

The status of individual audits

Communication of any potential audit findings

For each audit, insist on formal kick-off and exit meetings - required by GAGAS

Audit requests & responses should be communicated in writing and documented

Request Draft Audit Reports and the opportunity to respond before they are

Final

Ensure that you have the opportunity to respond to findings before the audit is

finalized

Request to submit additional data in response to proposed findings

Ensure any responses to audit findings are incorporated into the Final Report

(required by GAGAS)

19

Documentation of Audit

Document communications with auditors

Retain copies of all documents provided

Critical to also show timeliness and responsiveness with respect to providing access to records

Ensure that all requests are documented in writing

Documenting the audit and audit requests serves to protect the contractor

Common Tools Used by Contractors:

Dedicated email accounts for Audit Requests and Responses

Utilization of SharePoint, databases and order management applications to track audit requests / responses

20

Negotiations/Dispute After an Audit

Ensure that you have the opportunity to respond to findings before the audit is finalized

Request to submit additional data in response to proposed findings

Ensure any responses to audit findings are incorporated into the Final Report (required by GAGAS)

21

Incurred Cost Audits

22


Why is an ICS Significant?

Adjusts provisional or interim billing rates as necessary to establish the

final indirect cost rates post year end.

Final indirect cost rates shall be used in negotiating the final price of

federal contracts and in other situations requiring that indirect costs be

settled before contract prices are established.

Provides for a timely settlement of costs under cost-reimbursement

contracts.

The establishment of final rates shall be used for contract closeout unless

quick-closeout procedures are used.

Post negotiation and the settlement of rates, an ICS provides a historical

basis for the determination of final rates; which can be used to forecast

provisional rates.

23


Why is an ICS Significant? – cont’d

The ICS is the contractor’s final opportunity to voluntarily disallow costs

(pre-audit) that could be perceived or determined to be unallowable.

Contractors must update billings on all contracts to reflect the final

indirect cost rates and update the schedule of cumulative direct and

indirect costs claimed and billed within 60 days after settling final rates.

Concluding the audit of an ICS, the contractor and contracting officer will

execute a written understanding specifying the terms and finalization of

indirect rates

The written agreement does not change any monetary ceiling, contract

obligation, or specific cost allowance or disallowance provided for in the

contract.

24

Penalties for Unallowable Costs – FAR 42.709-1/52.243-2

Following penalties may apply for including unallowable costs in billings,

claims, or proposals:

Disallowance of cost plus the amount equal to disallowance [penalty]

Interest on the paid portion, if any, of the disallowance

If the indirect cost was determined to be unallowable for that contractor

prior to the submission of Incurred Cost Proposal, the penalty is 2x the

disallowed amount.

The unallowable costs do not have to have been paid in order to assess a

penalty

25


What DCAA Looks for

An adequate incurred cost submission: use of the ICE Model (ICE Model), or

similar format.

Schedule N is signed by an authorized party (usually CFO or above).

A contractor’s submission of all claimed costs incurred for cost type and/or

T&M reimbursable government contracts, including adjustments and

explanatory notes.

Identification of unallowable costs (voluntary deletions) and expressly

unallowable costs with notes accompanying adjustments.

Identification, by contract, of awards containing FAR 52.242-3 - Penalties

for Unallowable Costs (penalty clause).

If costs are reasonable, allocable, and allowable in accordance with GAAP,

CAS, FAR, and contract provisions.

https://www.dcaa.mil/Home/ICEmodel?title=ICE%20(Incurred%20Cost%20Electronically)%20Model

26

Best Practice: Use the DCAA Incurred Cost Submission Adequacy Checklist

as an basis for internally reviewing the submission prior to forwarding it to

the Contracting Officer and auditor. It can be found at:

http://www.dcaa.mil/Guide_for_Determining_Adequacy_of_Contractor_In

curred_Cost_Proposal.pdf


Adequacy Checklist

http://www.dcaa.mil/Guide_for_Determining_Adequacy_of_Contractor_Incurred_Cost_Proposal.pdf

27


What DCAA Looks for – cont’d

Certain “trigger” accounts that may contain unallowable costs. The

process for identifying accounts with a higher probability of being selected

for testing consists of; but is not limited to: If there have been any changes to the indirect cost rate structure between

the last audited fiscal year and the year in review. Both direct and indirect

costs will be evaluated

The results of performing a comparative analysis between the CFY and prior

fiscal year pool expenses and direct costs (YoY comparison)

New accounts

Prior years incurred cost audit or other audit findings

Fraud Risk Indicators

Audit history/experience with the government contractor

Auditor judgment

28


New Materiality Guidance

DCAA recently issued MRD“Guidance on Using Materiality in Incurred Cost Audits”

BackgroundEssentially DCAA’s respond to Section 803 of FY2018 NDAA which required them to adopt commercially

accepted standards of materiality for incurred cost audits

Highlights Incorporates use of quantified materiality threshold to facilitate a consistent approach in

determining the nature, timing, and extent of audit procedures on cost elements and accounts

that are significant to audit opinion

Provides calculation/formula for determining materiality-If Subject Matter from $1 to $1,000,000,000 use the following formula:

Materiality Threshold = $5,000 x ((Total Subject Matter / $100,000) .75)

- If Subject Matter greater than $1,000,000,000 use the following formula:

Materiality Threshold percentage of 0.50 percent

29

Incurred Costs Audits

DCAA Audit Guide

Audit Program for Incurred Costs - Post Year End Audit (Activity Code

10100) https://www.dcaa.mil/Content/Documents/sap/10100_AP_Post_Year_End_Inc

urred_Cost_Audit.pdf

https://www.dcaa.mil/Content/Documents/sap/10100_AP_Post_Year_End_Incurred_Cost_Audit.pdf

30

The sources below may help address any outstanding questions before

submission to the client

Furthermore, the sources should be used as guidance during the

preparation of the ICS Audit Program for Incurred Costs - Post Year End Audit (Activity Code 10100)

FAR 42.7, DFARS 242.7

FAR 31.2, DFARS 231.2

CAM 1-504, Access to Contractor Records

CAM 3-3S1 Special Considerations Audits of Selected Contract Types

CAM 4-400, Audit working Papers

CAM Chapter 6, Incurred Costs Audit Procedures

CAM 10-200 Audit Reports Format and Contents - General


Additional References

31


How can Costpoint help?

Out of the box and/or customized Accounting reports (i.e., Costpoint

Enterprise Reporting (CER), formerly known as Cognos) to prepare incurred cost

submissions and reconcile it to financial and project records

32


How can Costpoint help? - cont’d

Project set up and roll-up capabilities with a detailed Work Breakdown Structure (WBS) for any project level

33


How can Costpoint help? – cont’d

Systematic controls over cost accumulation (e.g., general ledger, job cost

ledgers)

Access

Processing

System modification

Monitoring

Best Practice

Dry run Reports before June to ensure full universe is captured and schedule

reconciles!

34

Overview of Accounting System Requirements

35

Accounting System Review

Types of Accounting System Reviews

Accounting System Audits performed in accordance with Audit programs 11070

or 17741 (Non-Major Contractors)

Audit Program 11070

Used when a company is subject to DFARS criteria

Opines on compliance with criteria as prescribed in the DFARS

Denotes significant deficiencies

CO determines adequacy of the system

Audit program: https://www.dcaa.mil/Content/Documents/sap/11070_AP_NA.pdf

Audit Program 17741

Used on Non-major contractors not normally subject to DFARS

Provides assurance on the adequacy and suitability of a non-major contractor’s accounting

systems for accumulating and billing costs under Gov’t Contracts

The audit program was revised to align more with the DFARS criteria; however, it does not test

nor opine on compliance with the criteria

Audit program:

https://www.dcaa.mil/Content/Documents/sap/17741_AP_Post_Award_Acct_Sys.pdf

Audit programs are post-award and not to be confused with Pre-award Survey’s

(SF 1408)

https://www.dcaa.mil/Content/Documents/sap/11070_AP_NA.pdfhttps://www.dcaa.mil/Content/Documents/sap/17741_AP_Post_Award_Acct_Sys.pdf

36

Accounting System Review

Overview

37

Accounting System Requirements

1. A sound internal control environment, accounting framework, and

organizational structure;

2. Proper segregation of direct costs from indirect costs;

3. Identification and accumulation of direct costs by contract;

4. A logical and consistent method for the accumulation and allocation of

indirect costs to intermediate and final cost objectives;

5. Accumulation of costs under general ledger control;

6. Reconciliation of subsidiary cost ledgers and cost objectives to GL;

7. Approval and documentation of adjusting entries;

8. Management reviews or internal audits of the system to ensure compliance

with the Contractor’s established policies, procedures, and accounting

practices;

9. A timekeeping system that identifies employees’ labor by intermediate or

final cost objectives;

10. A labor distribution system that charges direct and indirect labor to the

appropriate cost objectives;

11. Interim (at least monthly) determination of costs charged to a contract

through routine posting of books of account;

12. Exclusion from costs charged to Government contracts of amounts which

are not allowable in terms of Federal Acquisition Regulation (FAR) part 31,

Contract Cost Principles and Procedures, and other contract provisions;

13. Identification of costs by contract line item and by units (as if each unit or

line item were a separate contract), if required by the contract;

14. Segregation of preproduction costs from production costs, as applicable;

15. Cost accounting information required by 52.232-20, 52.232-22, or 52.216-7;

and readily calculate indirect cost rates from books of account

16. Billings that can be reconciled to the cost accounts for both current and

cumulative amounts claimed and comply with contract terms;

17. Adequate, reliable data for use in pricing follow-on acquisitions; and

18. Accounting practices in accordance with CAS, if applicable, otherwise,

GAAP.

38

Accounting System Requirements – cont’d

Common Accounting System Requirements/Expectations

The Accounting System is more than just the software!

Policies and Procedures

Defines roles & responsibilities

Identifies people, processes, and technology used in the business system

Provides guidance on compliance with company policies, contract requirements

Training

Educates personnel on their job responsibilities

Ensures awareness of policy & procedure information

Sound Organizational Structure

Ensures proper segregation of duties

Management Oversight & Review

Provides management with insight into system performance and compliance

39

Accounting System Disapprovals

Common Themes

CAS non-compliances (logical and consistent method for the accumulation and

allocation of indirect costs)

Questioned costs (Incurred Cost Audit)

Billings not reconciled to the cost accounts for both current and cumulative

amounts claimed and comply with contract terms

Lack of Contract Briefs

Inadequate Timekeeping practices

Cost accounting: By contract clause if required (Limitation of Cost or Funds,

Allowable Cost & Payment), Readily calculate indirect cost rates from books

Lack of P&Ps/Lack of Training

40

System Disapprovals

Consequences of System Deficiencies

Billing Withholds Imposed (where applicable)

Disclosure of deficient system status:

Results in greater audit oversight

Complicates negotiations, calls into question accuracy of proposed costs

Potential for USG to attach issues to other Business Systems

i.e., Purchasing System issue can lead to questioning Accounting System

All roads lead to Accounting System

Accounting System Inadequacy: USG prohibited from awarding Flexibly-Priced

Contracts

FAR 16.301-3 Limitations: A cost-reimbursement contract may be used only when the

contractor’s accounting system is adequate for determining costs applicable to the

contract or order

Resource drain to address inadequacies

41

Lessons Learned from System Disapprovals

Act Quickly: Potential to remediate issues before withholds are in place

Work closely with ACO

Communicate, brief them on CAP, give them a level of comfort that you are

taking the issue seriously (a good relationship helps)

Most won’t challenge DCAA on deficiency recommendations, but many willing

to work with contractor

Approved CAP can lower withholds from 5% to 2%

Follow through with CAP actions, provide ACO with progress briefings

Withhold can be increased from 2% back to 5% if CAP actions no longer

adequate

42

•Initial determination letter (10 days)

Contract Requirement

USG Audit Source

•Business System Audit

•DCAA SOCAR

DCAA Recommendation

•System Inadequacy

ACO Initial Determination

(10 Days)

Potential Significant Deficiencies?

•DoD contract, BSR Clause (1)

Contractor submits response and/or CAP

(30 Days)

Adequate No Billing Withholds

Inadequate but CAP acceptable

2-5% Withhold per system

Inadequate/CAP not acceptable

5% Withhold per system

ACO evaluates response/CAP

(30 Days)

ACO Final Determination

(1) If no BSR Clause, no withholds but system(s) can still be disapproved.

DFARS Business System Rule – Process Flow

YES NO

No Further

Action

43

Accounting System Reviews

How Costpoint helps

Widely used/DCAA is comfortable reviewing reports

Out of the box capabilities to meet cost recording, tracking, allocation, billing,

and internal control requirements

Tie in between T&E and GL module

Statement of indirects and real time monitoring

All functionality required for government contract accounting compliance is built into Costpoint. If

configured properly, it’s difficult to “break” Costpoint.

44


Costpoint Modules

45


Costpoint Modules – cont’d

46


Criteria: 2. Segregation of Direct/Indirect Costs – cont’d

47


Criteria: 3. Accum. of Direct Costs by Contract – cont’d

48


Criteria: 4. Allocation of Indirect Costs – cont’d

49


Criteria: 7. Approval and Doc. of Adj. Entries – cont’d

50


Criteria: 9. Timekeeping System that Identifies Labor by Cost Objective

Verify that labor is charged to intermediate and final cost objectives based on timekeeping records

Completed and certified by employees

Approved by employees’ supervisors

Verify segregation of duties and responsibilities within timekeeping system

51


Criteria: 14. Segregation of Pre-production Costs from Production Costs

Verify that pre-production costs (i.e., B&P) are routinely segregated from production costs (as applicable)

to assist in re-pricing or follow-on contract pricing

Pool design will determine how B&P costs are allocated

52

Process of Developing and Maintaining Compliant Business Systems

53

What Can You Do?

Key Takeaway: Policies & Procedures in place, Behaviors are consistent with

those P&Ps

Maintain a positive working relationship with DCAA and DCMA is essential

Be proactive in your compliance program – don’t wait until the USG schedules

an audit

Know what business systems require Government approval and how DCAA/DCMA will

likely audit or review

Map your controls to the DFARS evaluation criteria in advance

Identify system gaps based on DFARS/FAR evaluation criteria, the DCAA Audit

Program/ICM and your business system controls

Consider establishing an on-going compliance management planning process to

identify and periodically review control risks and mitigation plans to ensure you’re

on-track

54

Building Documentation for Maintaining Compliance

Developing Policies and Procedures

Along with remediating design gaps consider the following:

Are policies and procedures consistent across the organization

Policy vs. Procedure vs. Manual, etc.

Documented roles & responsibilities

Don’t write policies for compliance; write them for the business and

incorporate compliance components

55

Building Documentation for Maintaining Compliance

Other Key Documentation

An internal control matrix that serves as a data base for internal controls and

identifies

Control objectives, risks, and owners

Location in policies, procedures, and process flows

Process flowcharts:

Document the work flow and highlight internal controls

Process flowcharts and internal controls’ matrix that demonstrate compliance

Use these documents during system walkthroughs with auditors/reviewers to

help them gain an understanding

56

Process of Developing and Maintaining Compliant Business Systems

4 Key Steps

1. Assess System Adequacy

Assess processes and controls against DCAA/DCMA requirements

2. Remediate Deficiencies

Address any gaps

3. Prepare Compliance Documentation

Process Flows

Policy & Procedure Development

4. Establish Monitoring and Maintenance Plan

Develop and implement Controls Testing Plan

Develop and implement Training Plan

Policy & Procedure Review Plan

57

Questions?

Contact Info

Giacomo Apadula

[email protected]

(609) 617-4191

Darlene Mihaly

[email protected]

(937) 572-4580

mailto:[email protected]:[email protected]

Preparing for DCAA audits And how to leverage Costpoint ... · Agenda • Background on Government...

Documents

Transcript of Preparing for DCAA audits And how to leverage Costpoint ... · Agenda • Background on Government...