	The Contracting Cycle and Internal Controls

The contracting cycle consists of activities throughout the acquisition  process, including preaward and award, contract administration and  management, and ultimately the contract closeout. Effective contract oversight  includes effective internal control throughout the contracting process. Standards for Internal Control provides that to be effective, an entity’s  management should establish both a supportive overall control  environment and specific control activities directed at carrying out its  objectives. Preventive controls—such as invoice review prior to payment—are  controls designed to prevent improper payments (errors and fraud),  waste, and mismanagement, while detective controls—such as incurred  cost audits—are designed to identify errors or improper payments after  the payment is made. A sound system of internal control contains a  balance of both preventive and detective controls that is appropriate for  the agency’s operations. While detective controls are beneficial in that  they identify funds that may have been inappropriately paid and should be  returned to the government, preventive controls such as accounting  system reviews and invoice reviews help to reduce the risk of improper  payments or waste before they occur. As discussed in more detail later in this statement, most contract audit  activity is focused on cost-reimbursable and other nonfixed-price  contracts, due to the higher risks to the federal government. Contractors and government personnel recognized the need for  consistency in both contract administration and audit. At that time, DCAA’s  mission was to perform all necessary contract audits for DOD and provide  accounting and financial advisory services regarding contracts and  subcontracts to all DOD components responsible for procurement and  contract administration. Other audit organizations, including the DOD and other federal agency  Inspectors General (IG), the Special IGs for Iraq and Afghanistan, and the  military service audit agencies also have a role in the oversight of federal  contracts. DCAA audits of  contractor business systems and related internal controls support  decisions on pricing, contract awards, and billing. Risks of Ineffective Contract Controls and Auditing

Agencies across the government are increasingly reliant on contractors to  execute their missions. As illustrated in figure 2, the sheer size of federal contract  spending poses significant risk if effective processes, controls, and  oversight are not in place. DOD accounts for approximately 70 percent of  the federal government’s FPDS-NG reported annual contract spending— $367 billion in fiscal year 2010—and other federal agencies accounted for  $168 billion in contract spending. With hundreds of billions in taxpayer  dollars spent on government contracts, strong contract oversight is  essential. These challenges have contributed to GAO’s designating contract  management as a high-risk area at DOD, the Department of Energy, and  the National Aeronautical and Space Administration. Contracting Control Weaknesses GAO Work

Our work has identified significant contract management weaknesses,  problems with federal agency controls over contract payments , as we weaknesses in contract auditing. These weaknesses and deficiencies increase the risk of improper  payments, and fraud, waste, abuse, and mismanagement. DOE officials advised us that they have completed action on all 11  recommendations. We are currently following up to confirm DOE’s  actions. Centers for Medicare and Medicaid Services (CMS). The  internal control deficiencies occurred throughout the contracting process  phases. CMS officials told us they expect to complete  actions on all but one of our recommendations by March 31, 2011. Ineffective Contract Auditing

In 2009, we reported on audit quality problems at DCAA offices  nationwide, including compromise of auditor independence, insufficient  audit testing, and inadequate planning and supervision. DOD and DCAA have taken a  number of actions on our recommendations, including revising DCAA’s  mission statement, appointing a new DCAA Director and a Western Region  Director, establishing an internal review office to perform periodic  internal evaluations and address hotline complaints, initiating outside  hiring, expanding its audit quality review function, and providing training  on auditing standards. DOD IG has expanded  its oversight of DCAA’s audit quality control process. Funding. This is a work of the U.S. government and is not subject to copyright protection in the  United States.
Why GAO Did This Study

Agencies across the government are increasingly reliant on contractors to execute their missions. With hundreds of billions of taxpayer dollars at stake, the government needs strong controls to provide reasonable assurance that these contract funds are not being lost to improper payments (fraud and errors), waste, and mismanagement. Effective contract oversight, which includes effective internal controls throughout the contracting process, is essential to protecting government and taxpayer interests. Standards for Internal Control in the Federal Government provides the overall framework for internal control, which includes the control environment, risk assessment, control activities, information and communication, and monitoring. Contract auditing is a control mechanism intended to provide those responsible for government procurement with financial information and advice relating to contractual matters and the effectiveness, efficiency, and economy of contractors' operations. Today's testimony describes the (1) contracting cycle and related internal controls, (2) Defense Contract Audit Agency (DCAA) and its role in performing contract audits for the Department of Defense (DOD) and other federal agencies, and (3) risks associated with ineffective contract controls and auditing. GAO's testimony is based on prior reports and testimonies, as listed at the end of this statement.

What GAO Found

The contracting cycle consists of activities throughout the acquisition process, including preaward and award, contract administration and management, and ultimately the contract closeout. Strong internal controls contain a balance of preventive and detective controls appropriate for the agency's operation and help ensure an effective contract oversight process. Preventive controls--such as invoice review prior to payment--are controls designed to prevent improper payments, waste, and mismanagement, while detective controls--such as incurred cost audits--are designed to identify improper payments after the payment is made. While detective controls identify funds that may have been inappropriately paid and should be returned to the government, preventive controls help to reduce the risk of improper payments or waste before they occur. DOD accounts for the largest share of federal contract spending. DCAA was established in 1965 in response to studies which identified the need for consistency in contract audits at DOD. DCAA serves a critical role in DOD and other federal agency contractor oversight by providing auditing, accounting, and financial advisory services in connection with the negotiation, administration, and closeout of contracts and subcontracts. The majority of DCAA audits focus on cost-reimbursable and other nonfixed-price contracts, which pose the highest risk to the government. Reported federal contract obligations--which have increased by $100 billion in real terms since fiscal year 2005, from $435 billion to $535 billion in fiscal year 2010--poses significant risk if effective contract oversight is not in place. GAO's work has identified contract management weaknesses, significant problems with federal agency controls over contract payments, and internal control deficiencies throughout the contracting process, including contract auditing. GAO also found audit quality problems at DCAA offices nationwide, including compromise of auditor independence, insufficient audit testing, and inadequate planning and supervision. DCAA and the other federal agencies mentioned in GAO's testimony have completed some actions and have actions under way to address GAO's recommendations. GAO made17 recommendations to DOD and the DOD Inspector General (IG) to address the weaknesses it identified at DCAA. DOD and DCAA have taken a number of actions on these recommendations, including revising DCAA's mission statement, appointing a new DCAA Director and a Western Region Director, establishing an internal review office to perform periodic internal evaluations and address hotline complaints, initiating outside hiring, strengthening its audit quality review function, and providing training on auditing standards. DCAA has actions under way on other recommendations. DOD IG has expanded its oversight of DCAA's audit quality control process. In addition, the Centers for Medicare and Medicaid Services (CMS) have completed actions on two recommendations and expect to complete actions on all but one of the remaining 16 recommendations by March 31, 2011. Department of Energy official's stated that actions have been complete on all 11 GAO recommendations. GAO is following up to confirm.