1. DCAA Post-ICAPS Environment-Recent Guidance Changes and Contractor Challenges
Breakout Session #506
Presented by Tom Tagle and Noah Leiden
July 20, 2010
Session Schedule: 2:30 – 3:45 1

2. Background of ICAPS
Internal Control Audit Planning Summary (ICAPS) reviews are conducted by DCAA to assess control risk and the impact risk has on related audit efforts
Assessment helps establish annual audit plans and scope of audits
ICAPS reviews are focused on internal controls that may significantly impact the pricing, administration, or settlement of Government contracts
A contractor's internal controls consist of five interrelated components:
Control environment -- sets the tone of an organization, influencing the control consciousness of its people
Risk assessment-- the entity’s identification and analysis of relevant risks to achievement of its objectives, forming a basis for determining how the risks should be managed
Control activities -- the policies and procedures that help ensure that management directives are carried out
Information and communication -- the identification, capture, and exchange of information in a form and time frame that enable people to carry out their responsibilities
Monitoring -- the process that assesses the quality of internal control performance overtime

3. Background of ICAPS
DCAA's policy that each relevant accounting or management system that has a significant impact on Government contract costs be audited on a cyclical basis, (i.e., every years) based on a documented risk assessment
If past experience is favorable and risk is considered to be low, an audit may be performed on a less frequent basis
When the contractor changes the system, the auditor should give a high priority to the audit of the system change as a basis for relying on the system
Major vs. Non-Major
Pre-GAO reports, results of a system review resulted in an “adequate”, “inadequate-in-part” or “inadequate” determination
Post-GAO reports, results of system reviews resulted in either an “adequate” or “inadequate” determination

4. Importance of Internal Controls
Strong internal controls tend to reduce DCAA’s audit efforts, while weak internal controls tend to increase audit scrutiny
Strong controls permit/increase reliance on cost representations
Weak controls promote mischarging or misallocation and increase audit scope
When evaluating internal control systems, DCAA will consider:
Amount of systems testing previously performed or currently planned
Self-governance programs
The components of internal control and relevant control objectives identified with accounting and management systems should be considered in the context of the following:
Contractor’s size
Contractor’s organization and ownership characteristics
Nature of the contractor’s business
Diversity and complexity of the contractor’s operations
Contractor’s methods of transmitting, processing, maintaining, and accessing information
Applicable legal and regulatory requirements

5. Accounting and Management Systems Subject to ICAPS
The ICAPS focus on ten accounting and management systems
Control Environment and Overall Accounting System
General IT System
Budget and Planning System
Purchasing System
Billing System
Labor System
Indirect and Other Direct Cost System
Estimating System
Material Management Accounting System
Compensation System
Several ICAPS tend to cross over and address related controls
Common controls across the ten systems include
Adequacy of current systems to meet controls expected of government contractors
Adequacy of written policies and procedures
Employee knowledge and compliance with policies and procedures
Consistent application of policies and procedures
Management reviews and remediation

6. Accounting and Management Systems Subject to ICAPS
In determining the significance of a system, consider the relationship of the system to Government contracts
If a contractor incurs a significant amount of labor costs which are assigned to Government contracts, the contractor's compensation and labor systems would be considered significant
If a contractor does not purchase significant amounts of materials for Government contracts, the contractor's material systems might not be considered significant
Factors that impact ICAPS
Audit objectives
Types of audits
Known deficiencies
Direct Costs
Government business
Organizational structure
Indirect cost methodology
Financial management
Adequacy of systems, policies, procedures and controls
Technology and automation
Data flow

7. Why the Scope of the ICAPS is Important
Obtaining an Understanding of Contractor Accounting and Management Systems
Determining if Relevant Control Objectives and Related Control Activities Exist
Testing Controls
Assessing Control Risk
Internal Control Reporting
Audits directly influenced by ICAPS
Contract pricing
Defective pricing
Incurred costs
Contract billing and closeout
CAS

8. DCAA Guidance on Internal Controls
Recent DCAA MRDs have addressed ICAPS and internal controls
Several of the MRDs have been in response to recent GAO audits
MRD 10-PAS-005(R), dated February 18, 2010 – “Audit Guidance on Performing Internal Control Follow-up Audits and Limited Scope Audits”
MRD 08-PAS-041(R), dated December 19, “Audit Guidance on Limited Scope Audit Reports on Internal Controls”
MRD 09-PAS-021(R), dated October 22, “Audit Guidance on the Status of Contractor Systems of Internal Controls as Documented in the Contractor Organization and Systems and Scope of Audit Sections of Audit Reports”
MRD 08-PAS-043(R), dated December 19, “Audit Guidance on Significant Deficiencies/Material Weaknesses and Audit Opinions on Internal Control Systems”
MRD 08-PAS-011(R), dated March 3, “Audit Guidance on Reporting Internal Control Deficiencies”

9. Internal Controls in the FAR
FAR 3.10 requires federal contractors that have a Government contract of $5 million or more to have a written code of business ethics and conduct
FAR generally requires that internal controls be established to:
Assign responsibility to an independent source when possible and allocate resources to ensure ethics and compliance program effectiveness
Review company practices, procedures, and policies for compliance with the program
Establish an internal reporting mechanism whereby employees can anonymously report suspected instances of improper conduct
Deter, discover, and investigate criminal and unethical conduct in connection with government contracts
Ensure corrective measures are promptly instituted and carried out with appropriate disciplinary action
Disclose in writing and in a timely manner potential violations involving fraud, conflicts of interest, bribery, or gratuity violations
Fully cooperate with Government agencies responsible for audits, investigations or corrective actions

10. Current DFARS Guidance
Subpart —Contractor Accounting Systems and Related Controls
“Internal controls” - policies and procedures established by the contractor to:
Comply with applicable laws and regulations
Equitably allocate actual and estimated costs within the accounting system
Contractors with cost-type or progress payment contracts must maintain a system of internal controls throughout contract performance that demonstrates, with reasonable assurance:
Compliance with applicable laws and regulations
Reliable accounting system and cost data
Minimization of risk related to misallocations and mischarges
Consistent cost allocation charges and invoice procedures
Process
ACO receipt of an audit report identifying significant accounting system or related internal control deficiencies
Copy of the report provided to the contractor
Contractor allowed 30 days, or a reasonable extension, to respond
If the contractor agrees, the contractor is allowed 60 days from the date of initial notification to:
Correct any identified deficiencies, or
Submit a corrective action plan with milestones and actions to eliminate deficiencies
If the contractor disagrees, the contractor should provide rationale in its written response
The ACO can decide to suspend a percentage of progress payments or reimbursement of costs proportionate to the estimated cost risk to the Government, until the deficiencies are corrected

11. Proposed DFARS Rule
DFARS Case 2009–D038: Business Systems – Definition and Administration
Objective of the proposed rule is to establish a definition for contractor business systems and implement compliance mechanisms to improve DoD oversight of those systems
Proposed rule would add Subpart – Business Systems and would define six separate business systems
DoD is proposing to implement compliance enforcement mechanisms in the form of a business systems clause which includes payment withholding that allows ACOs to withhold a percentage of payments when a contractor’s business system contains deficiencies
Withholding of payments could be
Interim payments under
Cost reimbursement contracts
Incentive type contracts
Time-and-materials contracts
Progress payments
Performance-based payments
Business clause contains a requirement for contractors to respond to initial and final determinations of deficiencies

12. Proposed DFARS Rule
Six separate business systems that would be added to DFARS Subpart :
Business System
DCAA ICAPS and Other System Audits
Accounting System
Control Environment and Overall Accounting System Controls
Indirect and Other Direct Cost Controls
Compensation System Controls
Billing System Controls
Labor System Controls
Pre-Award and Post-Award Accounting System Review
General Information and Technology System Controls
Purchasing System
Purchasing System Controls
Estimating System
Estimating System Controls
Budget and Planning System
Material Management and Accounting System
Material Management and Accounting System Controls
Earned Value Management System

13. What the Proposed Rule Means
Contractor shall establish and maintain acceptable business systems in accordance with the terms and conditions of the contract. If deficiencies are identified in a system:
Contractor shall respond in writing within 30 days to an initial determination of deficiencies from the ACO
Final determination will be made by the ACO as to whether the business system contains deficiencies (If deficiencies are determined, final determination will include a notice of a decision to withhold payments)
ACO will immediately withhold 10 percent of each of the contractors payments
Contractor will have 45 days to correct deficiencies or submit an acceptable corrective action plan
If acceptable corrective plan has been submitted, but deficiencies are not fully corrected, the ACO will reduce the withhold to 5%
Failure to follow corrective action plan, at any time, will increase withhold back to 10%
If more than one system has deficiencies identified, the cumulative percentage of payments withheld shall not exceed 50 percent
If ACO determines there are one or more system deficiencies that are highly likely to lead to improper contract payments being made or represent an unacceptable risk of loss to the Government, the ACO will withhold up to 100 percent of payments

14. Impact of the “new” Accounting System
An acceptable accounting system provides reasonable assurance that
Applicable laws and regulations are complied with
Accounting system and cost data are reliable
Risk of misallocations and mischarges are minimized
Contract allocations and charges are consistent with invoice procedures
Challenge is to comply with greater requirements within one review
Although “new,” many of these proposed rule requirements are addressed as part of the Preaward Survey of Prospective Contractor Accounting System (SF 1408), e.g.,
Segregation of direct and indirect costs
Cost accumulation under a controlled general ledger
Timekeeping system that allocates labor by cost objective
Segregation of unallowable costs
Business System
DCAA ICAPS and Other System Audits
Accounting System
Control Environment and Overall Accounting System Controls
Indirect and Other Direct Cost Controls
Compensation System Controls
Billing System Controls
Labor System Controls
Pre-Award and Post-Award Accounting System Review
General Information and Technology System Controls

15. Scenarios
In an EVMS review under the proposed rule, any deficiency identified (regardless of materiality) will subject the contractor to a 10% withhold on cost-type contracts
This deficiency could be under any area of the EVMS system, and the 10% withhold will be applied indiscriminately (e.g., it is highly unlikely that deficiency noted has anything to do with the allowability of incurred costs)
Although the contractor is permitted to submit a plan to remedy the deficiency, until the deficiency is actually eliminated, the 10% withhold will still be in effect
Once the contractor fixes the deficiency, the proposed rule does not contain any language or incentive that requires a timetable for the ACO to pay the withheld amounts
“the ACO shall notify the contractor ... [of] system approval and the ACO’s decision ...to reduce or discontinue the withholding of payments...”
In an Accounting System review under the proposed rule, a single deficiency noted that affects the labor system for cost accumulation can also be a second deficiency under an Estimating System review if the contractor uses that same system for cost estimation
The potential result is a 20% withhold on cost-type contracts (i.e., 10% for the Accounting System and 10% for the Estimating System)

16. What You Can Do Prior to an Audit
Perform an internal assessment of the internal controls related to business systems to identify potential internal control weaknesses
For each potential deficiency identified, develop a remediation plan and timeline for completion
Based on the business risk and available resources of each area, prioritize and begin to remediate identified internal control weaknesses using the considerations discussed on the next slide
Proactively communicate with the cognizant auditor about upcoming audits and steps the contractor can take to make the audit process as smooth as possible
Further reading – Federal Contracts Report 93, FCR 352: “Contractor Business Systems Oversight: A Debacle is Brewing”

17. Considerations for Remediating Deficiencies
Are the deficiencies noted enterprise wide or isolated?
Are the deficiencies noted manual or automated controls?
What is the level of effort to remediate?
Is the deficiency a quick fix?
Can the deficiency be addressed with a scalable process?
Does the remediation require a new ERP?
Can an automated process replace a manual?
Is there a project plan for each remediation area?
Who will lead the remediation?
What resources, stakeholders and process owners should be included in remediation effort?
At what point are deficient controls retested?

18. Questions/Comments ?

19. About Baker Tilly
Founded in 1931 as a certified public accounting firm
Currently operate in six states with over 1,400 professionals
Member of Baker Tilly International, the world’s 8th largest network of accounting firms
Headquartered in Chicago
East Region is located in Washington, D.C. with over 275 professionals
East Region provides a range of professional services including:
Financial statement audit
Tax planning and compliance
Consulting services to private and publicly traded companies across many industries
Government contract and grant consulting
Forensic and litigation services
Mergers and acquisitions
Technology management

20. Presenters Tom Tagle, Partner
Tom has over 15 years of experience in government contract accounting, pricing, business system and internal control oversight, and regulatory and federal contract compliance assisting defense, manufacturing, construction and professional services clients. Tom earned his Bachelor of Science in Business Administration and Accounting from Washington and Lee University. He is a member of the American Institute of Certified Public Accountants, Virginia Society of Certified Public Accountants, and National Contract Management Association. Prior Baker Tilly, Tom worked for a major international public accounting firm and was at Navigant Consulting for 7 years. Tom is a member of the Baker Tilly Government Contractor Advisory Services practice in Vienna, Virginia.
Tel: (703) ,

21. Presenters Noah Leiden, Director
Noah has over 20 years of experience in government contract accounting, pricing, business system and internal control oversight, and regulatory and federal contract compliance assisting defense, manufacturing, engineering, information and communications, higher education, and non-profit clients. Noah earned his Bachelor of Science in Accounting from Pennsylvania State University. He is a member of the American Institute of Certified Public Accountants, Greater Washington Society of Certified Public Accountants, Maryland Association of Certified Public Accountants, and National Contract Management Association. Prior Baker Tilly, Noah worked for DCAA, KPMG, BearingPoint, and Navigant Consulting. Noah is a member of the Baker Tilly Government Contractor Advisory Services practice in Vienna, Virginia.
Tel: (703) ,