DCAA Post-ICAPS Environment-Recent Guidance Changes and Contractor Challenges

2. DCAA Post-ICAPS Environment-Recent Guidance Changes and Contractor Challenges Breakout Session #506 Presented by Tom Tagle and Noah Leiden July 20, 2010 Session Schedule: 2:30 – 3:45 1

3. Background of ICAPS Internal Control Audit Planning Summary (ICAPS) reviews are conducted by DCAA to assess control risk and the impact risk has on related audit efforts Assessment helps establish annual audit plans and scope of audits ICAPS reviews are focused on internal controls that may significantly impact the pricing, administration, or settlement of Government contracts A contractor's internal controls consist of five interrelated components: Control environment -- sets the tone of an organization, influencing the control consciousness of its people Risk assessment-- the entity’s identification and analysis of relevant risks to achievement of its objectives, forming a basis for determining how the risks should be managed Control activities -- the policies and procedures that help ensure that management directives are carried out Information and communication -- the identification, capture, and exchange of information in a form and time frame that enable people to carry out their responsibilities Monitoring -- the process that assesses the quality of internal control performance overtime

4. Background of ICAPS DCAA's policy that each relevant accounting or management system that has a significant impact on Government contract costs be audited on a cyclical basis, (i.e., every 2 - 4 years) based on a documented risk assessment If past experience is favorable and risk is considered to be low, an audit may be performed on a less frequent basis When the contractor changes the system, the auditor should give a high priority to the audit of the system change as a basis for relying on the system Major vs. Non-Major Pre-GAO reports, results of a system review resulted in an “adequate”, “inadequate-in-part” or “inadequate” determination Post-GAO reports, results of system reviews resulted in either an “adequate” or “inadequate” determination

5. Importance of Internal Controls Strong internal controls tend to reduce DCAA’s audit efforts, while weak internal controls tend to increase audit scrutiny Strong controls permit/increase reliance on cost representations Weak controls promote mischarging or misallocation and increase audit scope When evaluating internal control systems, DCAA will consider: Amount of systems testing previously performed or currently planned Self-governance programs The components of internal control and relevant control objectives identified with accounting and management systems should be considered in the context of the following: Contractor’s size Contractor’s organization and ownership characteristics Nature of the contractor’s business Diversity and complexity of the contractor’s operations Contractor’s methods of transmitting, processing, maintaining, and accessing information Applicable legal and regulatory requirements

6. Accounting and Management Systems Subject to ICAPS The ICAPS focus on ten accounting and management systems Control Environment and Overall Accounting System General IT System Budget and Planning System Purchasing System Billing System Labor System Indirect and Other Direct Cost System Estimating System Material Management Accounting System Compensation System Several ICAPS tend to cross over and address related controls Common controls across the ten systems include Adequacy of current systems to meet controls expected of government contractors Adequacy of written policies and procedures Employee knowledge and compliance with policies and procedures Consistent application of policies and procedures Management reviews and remediation

7. Accounting and Management Systems Subject to ICAPS In determining the significance of a system, consider the relationship of the system to Government contracts If a contractor incurs a significant amount of labor costs which are assigned to Government contracts, the contractor's compensation and labor systems would be considered significant If a contractor does not purchase significant amounts of materials for Government contracts, the contractor's material systems might not be considered significant Factors that impact ICAPS Audit objectives Types of audits Known deficiencies Direct Costs Government business Organizational structure Indirect cost methodology Financial management Adequacy of systems, policies, procedures and controls Technology and automation Data flow

8. Why the Scope of the ICAPS is Important Scope of the ICAPS Obtaining an Understanding of Contractor Accounting and Management Systems Determining if Relevant Control Objectives and Related Control Activities Exist Testing Controls Assessing Control Risk Internal Control Reporting Audits directly influenced by ICAPS Contract pricing Defective pricing Incurred costs Contract billing and closeout CAS

9. DCAA Guidance on Internal Controls Recent DCAA MRDs have addressed ICAPS and internal controls Several of the MRDs have been in response to recent GAO audits MRD 10-PAS-005(R), dated February 18, 2010 – “Audit Guidance on Performing Internal Control Follow-up Audits and Limited Scope Audits” MRD 08-PAS-041(R), dated December 19, 2008 - “Audit Guidance on Limited Scope Audit Reports on Internal Controls” MRD 09-PAS-021(R), dated October 22, 2009 - “Audit Guidance on the Status of Contractor Systems of Internal Controls as Documented in the Contractor Organization and Systems and Scope of Audit Sections of Audit Reports” MRD 08-PAS-043(R), dated December 19, 2008 - “Audit Guidance on Significant Deficiencies/Material Weaknesses and Audit Opinions on Internal Control Systems” MRD 08-PAS-011(R), dated March 3, 2008 - “Audit Guidance on Reporting Internal Control Deficiencies”

10. Internal Controls in the FAR FAR 3.10 requires federal contractors that have a Government contract of $5 million or more to have a written code of business ethics and conduct FAR 52.203-13 generally requires that internal controls be established to: Assign responsibility to an independent source when possible and allocate resources to ensure ethics and compliance program effectiveness Review company practices, procedures, and policies for compliance with the program Establish an internal reporting mechanism whereby employees can anonymously report suspected instances of improper conduct Deter, discover, and investigate criminal and unethical conduct in connection with government contracts Ensure corrective measures are promptly instituted and carried out with appropriate disciplinary action Disclose in writing and in a timely manner potential violations involving fraud, conflicts of interest, bribery, or gratuity violations Fully cooperate with Government agencies responsible for audits, investigations or corrective actions

11. Current DFARS Guidance Subpart 242.75—Contractor Accounting Systems and Related Controls “Internal controls” - policies and procedures established by the contractor to: Comply with applicable laws and regulations Equitably allocate actual and estimated costs within the accounting system Contractors with cost-type or progress payment contracts must maintain a system of internal controls throughout contract performance that demonstrates, with reasonable assurance: Compliance with applicable laws and regulations Reliable accounting system and cost data Minimization of risk related to misallocations and mischarges Consistent cost allocation charges and invoice procedures Process ACO receipt of an audit report identifying significant accounting system or related internal control deficiencies Copy of the report provided to the contractor Contractor allowed 30 days, or a reasonable extension, to respond If the contractor agrees, the contractor is allowed 60 days from the date of initial notification to: Correct any identified deficiencies, or Submit a corrective action plan with milestones and actions to eliminate deficiencies If the contractor disagrees, the contractor should provide rationale in its written response The ACO can decide to suspend a percentage of progress payments or reimbursement of costs proportionate to the estimated cost risk to the Government, until the deficiencies are corrected

12. Proposed DFARS Rule DFARS Case 2009–D038: Business Systems – Definition and Administration Objective of the proposed rule is to establish a definition for contractor business systems and implement compliance mechanisms to improve DoD oversight of those systems Proposed rule would add Subpart 242.70 – Business Systems and would define six separate business systems DoD is proposing to implement compliance enforcement mechanisms in the form of a business systems clause which includes payment withholding that allows ACOs to withhold a percentage of payments when a contractor’s business system contains deficiencies Withholding of payments could be Interim payments under Cost reimbursement contracts Incentive type contracts Time-and-materials contracts Progress payments Performance-based payments Business clause contains a requirement for contractors to respond to initial and final determinations of deficiencies

13. Proposed DFARS Rule Six separate business systems that would be added to DFARS Subpart 242.70:

14. What the Proposed Rule Means Contractor shall establish and maintain acceptable business systems in accordance with the terms and conditions of the contract. If deficiencies are identified in a system: Contractor shall respond in writing within 30 days to an initial determination of deficiencies from the ACO Final determination will be made by the ACO as to whether the business system contains deficiencies (If deficiencies are determined, final determination will include a notice of a decision to withhold payments) ACO will immediately withhold 10 percent of each of the contractors payments Contractor will have 45 days to correct deficiencies or submit an acceptable corrective action plan If acceptable corrective plan has been submitted, but deficiencies are not fully corrected, the ACO will reduce the withhold to 5% Failure to follow corrective action plan, at any time, will increase withhold back to 10% If more than one system has deficiencies identified, the cumulative percentage of payments withheld shall not exceed 50 percent If ACO determines there are one or more system deficiencies that are highly likely to lead to improper contract payments being made or represent an unacceptable risk of loss to the Government, the ACO will withhold up to 100 percent of payments

15. Impact of the “new” Accounting System An acceptable accounting system provides reasonable assurance that Applicable laws and regulations are complied with Accounting system and cost data are reliable Risk of misallocations and mischarges are minimized Contract allocations and charges are consistent with invoice procedures Challenge is to comply with greater requirements within one review Although “new,” many of these proposed rule requirements are addressed as part of the Preaward Survey of Prospective Contractor Accounting System (SF 1408), e.g., Segregation of direct and indirect costs Cost accumulation under a controlled general ledger Timekeeping system that allocates labor by cost objective Segregation of unallowable costs

16. Scenarios • In an EVMS review under the proposed rule, any deficiency identified (regardless of materiality) will subject the contractor to a 10% withhold on cost-type contracts • This deficiency could be under any area of the EVMS system, and the 10% withhold will be applied indiscriminately (e.g., it is highly unlikely that deficiency noted has anything to do with the allowability of incurred costs) • Although the contractor is permitted to submit a plan to remedy the deficiency, until the deficiency is actually eliminated, the 10% withhold will still be in effect • Once the contractor fixes the deficiency, the proposed rule does not contain any language or incentive that requires a timetable for the ACO to pay the withheld amounts • “the ACO shall notify the contractor ... [of] system approval and the ACO’s decision ...to reduce or discontinue the withholding of payments...” • In an Accounting System review under the proposed rule, a single deficiency noted that affects the labor system for cost accumulation can also be a second deficiency under an Estimating System review if the contractor uses that same system for cost estimation • The potential result is a 20% withhold on cost-type contracts (i.e., 10% for the Accounting System and 10% for the Estimating System)

17. What You Can Do Prior to an Audit Perform an internal assessment of the internal controls related to business systems to identify potential internal control weaknesses For each potential deficiency identified, develop a remediation plan and timeline for completion Based on the business risk and available resources of each area, prioritize and begin to remediate identified internal control weaknesses using the considerations discussed on the next slide Proactively communicate with the cognizant auditor about upcoming audits and steps the contractor can take to make the audit process as smooth as possible Further reading – Federal Contracts Report 93, FCR 352: “Contractor Business Systems Oversight: A Debacle is Brewing”

18. Considerations for Remediating Deficiencies Are the deficiencies noted enterprise wide or isolated? Are the deficiencies noted manual or automated controls? What is the level of effort to remediate? Is the deficiency a quick fix? Can the deficiency be addressed with a scalable process? Does the remediation require a new ERP? Can an automated process replace a manual? Is there a project plan for each remediation area? Who will lead the remediation? What resources, stakeholders and process owners should be included in remediation effort? At what point are deficient controls retested?

19. Questions/Comments ?

20. About Baker Tilly Founded in 1931 as a certified public accounting firm Currently operate in six states with over 1,400 professionals Member of Baker Tilly International, the world’s 8th largest network of accounting firms Headquartered in Chicago East Region is located in Washington, D.C. with over 275 professionals East Region provides a range of professional services including: Financial statement audit Tax planning and compliance Consulting services to private and publicly traded companies across many industries Government contract and grant consulting Forensic and litigation services Mergers and acquisitions Technology management

21. Presenters Tom Tagle, Partner Tom has over 15 years of experience in government contract accounting, pricing, business system and internal control oversight, and regulatory and federal contract compliance assisting defense, manufacturing, construction and professional services clients. Tom earned his Bachelor of Science in Business Administration and Accounting from Washington and Lee University. He is a member of the American Institute of Certified Public Accountants, Virginia Society of Certified Public Accountants, and National Contract Management Association. Prior Baker Tilly, Tom worked for a major international public accounting firm and was at Navigant Consulting for 7 years. Tom is a member of the Baker Tilly Government Contractor Advisory Services practice in Vienna, Virginia. Tel: (703) 923-8312, tom.tagle@bakertilly.com

22. Presenters Noah Leiden, Director Noah has over 20 years of experience in government contract accounting, pricing, business system and internal control oversight, and regulatory and federal contract compliance assisting defense, manufacturing, engineering, information and communications, higher education, and non-profit clients. Noah earned his Bachelor of Science in Accounting from Pennsylvania State University. He is a member of the American Institute of Certified Public Accountants, Greater Washington Society of Certified Public Accountants, Maryland Association of Certified Public Accountants, and National Contract Management Association. Prior Baker Tilly, Noah worked for DCAA, KPMG, BearingPoint, and Navigant Consulting. Noah is a member of the Baker Tilly Government Contractor Advisory Services practice in Vienna, Virginia. Tel: (703) 923-8321, noah.leiden@bakertilly.com