DOD’s acquisition  regulation establishes criteria for each of the six types of contractor  business systems, which are implemented by the inclusion of certain  contract clauses. The NDAA required that this program, among other things, establish  requirements for each system and a process for identifying significant  deficiencies within systems. DOD Revised Its Policies and Procedures Related to the Contractor Business System Review Process

Since 2011, DOD has taken actions to (1) clarify the roles and  responsibilities of DCMA and DCAA in conducting CBS reviews and  consolidate the number of reviews to be performed; (2) clarify how often  DOD should conduct CBS reviews; (3) establish what criteria are used to  evaluate a contractor’s business system; (4) establish timeframes by  which ACOs are to make a determination on the adequacy of the  contractors’ business systems; and (5) implement the use of payment  withholds for contractors that are found to have significant deficiencies in  their contractor business systems. Under these revised processes, DCMA now has responsibility for  reviewing three contractor business systems and DCAA is responsible for  the other three. These were the cost estimating, material management and accounting,  and purchasing systems. DOD Does Not Have a Mechanism to Monitor and Ensure That Contractor Business System Reviews and Audits Are Conducted in a Timely Manner

DCMA and DCAA do not have a mechanism to monitor and ensure that  CBS reviews and audits are conducted in a timely manner. Looking to the future, DCAA has developed plans for the  number of CBS audits it intends to perform over the next 3 years and  expects that it will be caught up in conducting the audits for which it is  responsible by fiscal year 2022. Successfully executing its plan is  dependent on several factors, including the ability to shift resources from  conducting incurred cost audits to business systems audits, the use of  public accounting firms to perform a portion of the incurred cost audits,  and the ability of DCAA auditors to use new audit plans and complete the  required audits in a timely manner. For its part, DCMA relies on the  offices that perform the reviews of the three systems to maintain the  information on the reviews completed and to plan for future reviews, but  DCMA headquarters does not centrally track its reviews or whether audits  conducted by DCAA are being completed within the timeframes described  in policy. This is because DOD currently lacks a  mechanism based on relevant and reliable information, such as the  number of CBS reviews that are outstanding, the risk level assigned to  those systems, and the resources available to conduct such reviews, to  ensure CBS reviews are being completed in a timely fashion. Such  information could help inform more strategic oversight to determine  whether the current CBS review process is achieving intended results, or  whether additional changes to the timing of or criteria for conducting CBS  reviews are needed. As each  agency is responsible for executing its mission and managing its  resources, however, this effort should be conducted in collaboration with  DCAA. (Recommendation 1)

	Agency Comments

DOD agreed with the recommendation. Appendix I: Comments from the Department of Defense
Why GAO Did This Study

Contractor business systems produce critical data that contracting officers use to help negotiate and manage defense contracts. These systems and their related internal controls act as important safeguards against fraud, waste, and abuse of federal funding. Federal and defense acquisition regulations and DOD policies require that DOD take steps to review the adequacy of certain business systems, but GAO and other oversight entities have raised questions about the sufficiency and consistency of DOD's review process.
The National Defense Authorization Act for Fiscal Year 2018 contained a provision for GAO to evaluate how DOD implemented legislation intended to improve its business system review process. Among other things, this report examines (1) the changes DOD made to its review process and (2) the extent to which DOD is ensuring timely business system reviews.
GAO analyzed DOD acquisition regulations, policies, and procedures for conducting contractor business system reviews and analyzed data on reviews conducted between fiscal years 2013 and 2018.

What GAO Found

Since 2011, the Department of Defense (DOD) has implemented several changes to its processes for reviewing contractor business systems—which include systems such as accounting, estimating, and purchasing. Among other changes, DOD
clarified the roles and responsibilities of the Defense Contract Management Agency (DCMA) and the Defense Contract Audit Agency (DCAA)—the two agencies that are responsible for conducting the reviews;
clarified timeframes for business system reviews and established criteria for business systems; and
withheld payments from contractors that were found to have significant deficiencies in their business systems.
DOD does not have a mechanism to monitor and ensure that these reviews are being conducted in a timely manner. For its part, DCAA has conducted few business system audits since 2013, as it focused its efforts on other types of audits. DCAA plans to significantly increase the number of business system audits over the next 4 years, but its success in doing so depends on its ability to shift resources from other audits; to use public accounting firms to conduct other, non-business system audits; and DCAA staff's ability to execute new audit plans in a timely manner.
DCMA relies on the three offices responsible for conducting DCMA-led reviews to manage the reviews, but DCMA does not formally monitor whether these reviews are being conducted consistent with policy nor does it monitor DCAA's efforts to complete the audits for which it is responsible. DCMA is ultimately responsible for approving a contractor's business systems. DCMA currently lacks a mechanism based on relevant and reliable information, such as the number of reviews that are outstanding and the resources available to conduct such reviews, to ensure reviews are being completed in a timely fashion. Such information could help inform more strategic oversight on whether the current review process is achieving its intended results, or whether additional changes to the timing of or criteria for conducting reviews are needed.

What GAO Recommends

GAO recommends that DCMA, in collaboration with DCAA, develop a mechanism to monitor and ensure contractor business system reviews are conducted in a timely fashion. DOD concurred with the recommendation.