	Widespread Management Environment and Audit Quality Problems

We found audit quality problems at DCAA offices nationwide. Because the  conclusions and opinions in the rescinded reports were used to assess risk  in planning subsequent audits, they impact the reliability of hundreds of  other audits and contracting decisions covering billions of dollars in DOD  expenditures. A management environment and agency culture that focused on  facilitating the award of contracts and an ineffective audit quality  assurance structure are at the root of the agencywide audit failures we  identified. DCAA’s focus on a production-oriented mission led DCAA  management to establish policies, procedures, and training that  emphasized performing a large quantity of audits to support contracting  decisions and gave inadequate attention to performing quality audits. An  ineffective quality assurance structure, whereby DCAA gave passing  scores to deficient audits compounded this problem. Thirty-three of 37 internal control audits did not  include sufficient testing of internal controls to support auditor  conclusions and opinions. Instead, these audits focus on a review of the  adequacy of contractor policies and procedures. Production environment and audit quality issues. Although the DOD IG report contained evidence of significant, systemic  noncompliance with professional standards throughout DCAA audits that  OIG staff reviewed and the IG report included numerous findings and  recommendations related to those issues, the DOD IG gave DCAA a  “clean” peer review opinion, concluding that for audits and attestation  engagements performed during fiscal year 2006, “…the internal quality  control system was operating effectively to provide reasonable assurance  that DCAA personnel were following established policies, procedures, and  applicable auditing standards….”
The overall report conclusion in the DOD IG report is inconsistent with  the detailed observations in the report, which indicate numerous  significant deficiencies in DCAA’s system of quality control. DCAA corrective actions. DCAA initiated a number of actions to address  findings in our July 2008 report, the DOD Comptroller/CFO August 2008  “tiger team” review, and the Defense Business Board study, which was  officially released in January 2009. Examples of key DCAA actions to date  include the following. Eliminating production metrics and implementing new metrics  intended to focus on achieving quality audits. Establishing an anonymous Web site to address management and  hotline issues. DCAA’s Assistant Director for Operations has been  proactive in handling internal DCAA Web site hotline complaints. Revising policy guidance to address auditor independence, assure  management involvement in key decisions, and address audit quality  issues. DCAA also took action to halt auditor participation in nonaudit  services that posed independence concerns. 1. 2. 3. 2. 3. Legislative and Other Actions Could Further Improve DCAA

In addition to correcting the fundamental weaknesses in DCAA’s mission  and overall management environment, we believe certain legislative  measures as well as other actions could enhance DCAA’s effectiveness and  independence. For example, granting DCAA certain authorities and  protections—similar to those offered to presidentially appointed  inspectors general (IG) under the IG Act—could enhance DCAA’s  independence. In the  longer term, Congress could consider changes in organizational placement  after DCAA has had sufficient opportunity to effectively implement  current reform efforts. Our report also discusses matters for  congressional consideration that could enhance DCAA’s effectiveness and  independence.
Why GAO Did This Study

This testimony discusses our recent audit of the Defense Contract Audit Agency's (DCAA) overall management environment and quality assurance structure. DCAA is charged with a critical role in Department of Defense (DOD) contractor oversight by providing auditing, accounting, and financial advisory services in connection with the negotiation, administration, and settlement of contracts and subcontracts. DCAA's mission encompasses both audit and nonaudit services in support of DOD contracting and contract payment functions. DCAA audits of contractor internal controls in accounting, billing, estimating, and other key systems support decisions on pricing and contract awards. Internal control audits also impact the planning and reliability of other DCAA audits because DCAA uses the results of these audits to assess risk and plan the nature, extent, and timing of tests for other contractor audits and assignments. Last year, we reported the results of our investigation of allegations about certain DCAA audits at three locations in California, which substantiated claims that (1) audit documentation did not support the reported opinions; (2) DCAA supervisors dropped findings and changed audit opinions without adequate audit evidence for their changes; and (3) sufficient work was not performed to support the audit opinions and conclusions. At that time we were conducting a broader audit of DCAA's overall organizational environment and quality control system. Given the evidence presented at the Committee's September 2008 hearing, you requested that we expand our ongoing assessment. Our current report, which the Committee is releasing today, presents the results of our DCAA-wide audit, including (1) an assessment of DCAA's management environment and quality assurance structure; (2) an analysis of DCAA's corrective actions in response to our July 2008 report and two DOD reviews, and (3) potential legislative and other actions that could improve DCAA's effectiveness and independence.

What GAO Found

A management environment and agency culture that focused on facilitating the award of contracts and an ineffective audit quality assurance structure are at the root of the agencywide audit failures we identified. DCAA's focus on a production-oriented mission led DCAA management to establish policies, procedures, and training that emphasized performing a large quantity of audits to support contracting decisions and gave inadequate attention to performing quality audits. An ineffective quality assurance structure, whereby DCAA gave passing scores to deficient audits compounded this problem. DCAA initiated a number of actions to address findings in our July 2008 report, the DOD Comptroller/CFO August 2008 "tiger team" review, and the Defense Business Board study, which was officially released in January 2009. Examples of key DCAA actions to date include the following. (1) Eliminating production metrics and implementing new metrics intended to focus on achieving quality audits. (2) Establishing an anonymous Web site to address management and hotline issues. DCAA's Assistant Director for Operations has been proactive in handling internal DCAA Web site hotline complaints. (3) Revising policy guidance to address auditor independence, assure management involvement in key decisions, and address audit quality issues. DCAA also took action to halt auditor participation in nonaudit services that posed independence concerns. In addition to correcting the fundamental weaknesses in DCAA's mission and overall management environment, we believe certain legislative measures as well as other actions could enhance DCAA's effectiveness and independence. For example, granting DCAA certain authorities and protections--similar to those offered to presidentially appointed inspectors general (IG) under the IG Act--could enhance DCAA's independence. In the longer term, Congress could consider changes in organizational placement after DCAA has had sufficient opportunity to effectively implement current reform efforts.