On July 15, 2014, the Defense Procurement and Acquisition Policy (DPAP) issued DFARS Case 2012-D042, a proposed rule adding new requirements for applicable contractors to annually self-assess their estimating systems, accounting systems, and material management accounting systems (MMAS) in accordance with DFARS 252.215-7002, 252.242-7006, and 252.242-7004, respectively.
The proposed rule also added the requirement to triennially have the estimating, accounting, and MMAS systems reviewed by an independent certified public accountant of the contractor’s choosing.
Under the proposed rule, requirements for annual self-assessment and triennial CPA reviews would apply to estimating systems for contractors that have received contracts or subcontracts totaling $100 million or more for which certified cost and pricing data were required. For accounting systems, the assertion and review requirements would only be applicable to contractors that have received a contract in the contractor’s previous fiscal year where the Cost Accounting Standards (CAS) is applicable. For MMAS, the requirements would only be applicable to contractors that are considered to be a large business and have $50 million of sales subject to certified cost or pricing data annually. None of the requirements of the proposed rule would apply to small businesses.
Under the proposed rule, the self-assessment requirements state that the contractor would have to submit to the contracting officer and Government auditor an annual statement that would include:
The contractor’s evaluation of the business system’s compliance with system criteria per the applicable DFAR business system requirements
The contractor’s assessment of the business system’s compliance and whether or not the system complies in all material respects with the respective system requirements
Disclosure of any significant deficiencies with sufficient information for the Government to understand these deficiencies
A status of any significant deficiencies, including a corrective action plan with milestones and actions
The annual self-assessment report would be due to the contracting officer and Government auditor six months after the end of the contractor’s fiscal year. The contractor’s report would require a signature by a contractor representative no lower than a vice president or chief financial officer of the reporting business segment.
Under the proposed rule, applicable contractors would need to have an examination of the business system by an independent CPA the first year the requirement is applicable and every three years thereafter, or more frequently if directed by the contracting officer. The examination is to be performed in accordance with Generally Accepted Government Accounting Standards (GAGAS) for examination attestation engagements. It is the contractor’s responsibility to ensure that the CPA firm is independent and objective throughout the examination.
The contractor would be required to submit the CPA’s audit strategy, risk assessment, and audit plan if the contractor has received Department of Defense (DoD) prime contracts or subcontracts totaling $100 million or more. Otherwise, the contracting officer may request this data in consultation with the Government auditor.
Upon receipt of the contractor’s CPA examination report, the contracting officer would request that the Defense Contract Audit Agency (DCAA) assess the report and related documentation. The contractor is required to make available to the Government any documentation supporting the system report.
Failure for a contractor to comply with these requirements will result in withholding of funds such as when a business system if found to have significant deficiencies.
Initial concerns around the proposed include:
Additional cost borne by contractors
Qualifications of CPA firms to perform the business system examinations
Extent to which independence of the CPA firms will be determined
Effectiveness of CPA firm examination in the eyes of a follow-on DCAA assessment
Liability borne by both the CPA firm and the contractor if a system found to have no deficiencies by the CPA is later determined to have deficiencies based on subjective criteria
Potential exposure to contractor internal audit reports about business system controls, which may be used as a basis for making the annual self-assertions
Additionally, the proposed rule is ambiguous as to the Government’s expectations related to the company official’s assertions implied by signing the report. However, preliminary concerns have been expressed regarding increased exposure to allegations of False Claims or False Statements.
The proposed rule has a standard public comment period of 60 days. A public meeting to discuss the proposed rule will be held on August 18, 2014, at the Mark Center Auditorium in Alexandria, Virginia.