WIXLIB

Managing Business System Auditsand Key System Compliance IssuesPhillip R. SeckmanMichael J. McGuinnJune 23, 2015mckennalong.com

Agenda Overview of the DFARS Business Systems RuleManaging system auditsKey system compliance issuesFuture business system developments2

Overview of the Rule – Withholding Disapproved system results in withholding from:– Progress payments– Performance based payments– Interim payments under cost, T&M, and labor-hour contracts Applies to any contract that contains DFARS § 252.2427005 and the applicable system clause(s), at CO discretion 5% for one disapproved system, up to 10% for two or moredisapproved systems– Reduced to 2% (prospectively only) upon submission of anacceptable corrective action plan– Possible reduction of existing withhold by 50 percent if CO failsto render a determination within 90 days after contractornotification of completed corrective action3

Overview of the Rule – Opportunities andRisks Opportunities: approved systems protect/enhancecompetitive positioning and cash flows– Receipt of cost reimbursement contracts and progress payments(FAR 9.104-1(e); FAR 32.503-3; DFARS Subpt. 242.75;Sygnetics, 2011 CPD ¶ 164 (Aug 2011))– Permit compliance with evaluation factors– Limits bid protests– May reduce number and scope of audits– Precludes withholds under the Rule Risks: disapproved systems create mirror imagecompetitive and financial disadvantages4

Overview of the Rule – Process System review: DCMA/DCAA perform audit; exit conference Initial ACO determination: ACO provides written initialdetermination detailing any “significant deficiencies” Contractor response: Within 30 days of receipt of initial ACOdetermination, contractor responds in writing to ACO– Extension of time to respond possible Final ACO determination: ACO evaluates contractor’s responseand will issue a final written determination and begin withholding,if significant deficiency exists Contractor corrective action: Within 45 days of receipt of finaldetermination, contractor must correct deficiencies or submit anacceptable corrective action plan5

System Assessments – Results System reviews with no significant deficiencies rare– Multiple contractor systems (purchasing, accounting, estimating,EVMS) subject of ACO initial determination– Withholding can last for extended durations of more than a year Clients have had success responding to system issuesbefore withholding– Addressing issues during system reviews and/or exit conference– Providing comprehensive and detailed response to initialdetermination6

System Assessments – Audits Prepare for system audits– Done periodically (e.g., triennial CPSRs), make use of time toprepare– Address all prior system findings Push back on non-system audits (ICS, timekeeping, FPRP)resulting in broader system findings Make sure auditors understand system, explain frameworkof policies and procedures– System POC is important– Respond to factual misunderstandings immediately7

System Assessments – Audits (cont.) Have documents readily available– Carefully assess requests for internal audits Documentation of issues from system reviews/exitconference often critical to understand basis forsubsequent vague deficiency findings– Log all auditor requests, questions and issues identified– Document contractor responses and information provided– Closely document entrance and exit conferences8

System Assessments – Contractor Responsesto Initial Determination Contractor responses to initial determination––––Refute facts supporting deficiencyExplain why deficiency is not significantChallenge applicability of system requirementDescribe corrective actions Updates to policies and proceduresTrainingAddress all deficiencies and identified areas for improvementBest practice to have CAP in place immediately, ideally beforeresponse deadline Effort to respond to initial determination intensive– Contractors conducting self-assessments pre-review have beenin best position to respond timely– Failure to respond likely to be treated as agreement9

System Assessments – Contractor Responsesto Initial Determination (cont.) “Significance” of deficiencies– Number of occurrences (e.g., bad statistical sample (J.F. Taylor)isolated deviations)– Amount involved– Issue obsolescence (system changes, system control andcorrection) Inapplicability of requirements– Imposing government requirements on prime contractors Request opportunity to discuss with CO– Request review from CBS review panelSupported contractor positions in combinationwith detailed CAP have had significant success10

Specific System Compliance Issues – AccountingSystems Comprehensive and easy-to-follow policies and procedures– Conflicting guidance problematic Cost accounting– CAS compliance for contract element cost allocations (amongCLINs, sub-CLINS or units, etc.)– Consistent and compliant indirect cost allocation Cost allowability Professional and legal services costs, subcontract costs Contemporaneous documentation required Proper internal controls– Appropriate approval authority for labor hours– Error correction (timely and accurate)– Robust internal audit, corrective action, follow-up11

Specific System Compliance Issues – PurchasingSystems Potential Public Law violations– TINA, CAS, Anti-Lobbying, Small Business Subcontracting Plans Subcontractor responsibility– Current and complete reps and certs on file before award Timely and adequate cost and price analysis– Particularly for non-competitive procurements Contemporaneous justification for lack of competition Proper flowdowns (procurement type, limited deviations)– “Self-deleting” clauses Timely definitization of letter subcontracts Proper documentation of system policies and PO files12

Specific System Compliance Issues – EstimatingSystems Detailed policies and procedures Records of all proposals submitted Calculation of estimated labor rates– Appropriate grouping of labor categories– Reasonable basis for rate escalations– Reliance on historical experience Periodic internal reviews of estimates– Monitoring and tracking estimates against actual costs Integration of purchasing and accounting system data withestimating systems13

Specific System Compliance Issues – EVMS Detailed policies and procedures– Proper delineation of authority– System documentation alignment with established process– Proper training of EVMS team Cost and schedule integration– Automation and integration of accounting data Periodic and reliable updates to performance measurementbaseline to recognize program changes Consistent and appropriate use of management reserves14

Specific System Compliance Issues – MMAS Comprehensive policies and procedures Excess material issues––––Evidence of requirement planning issuesImproper safety stock calculationsLong lead material procurement triggersTimely disposition Physical reconciliation to recorded inventory– Retained on floor material accuracy– Adjustments for differences Periodic compliance tracking through metrics (BOMaccuracy, MPS accuracy)15

Specific System Compliance Issues – GovernmentProperty Systems Comprehensive policies and proceduresDesignation, marking and traceability of GPClear delineation of responsibility for GPProper communication with government personnel re:GP issues Handling disposition of GP Subcontractor use of GP16

Future Developments – Proposed BusinessSystem Self-Assessment Requirements Proposed rule released July 15, 2014 (79 FR 41172)– Intended to alleviate DCAA backlog Would apply to accounting, estimating, and MMAS systems– Report for accounting and estimating systems would be madeannually, beginning with first fiscal year after the effective date– Report for MMAS would be required when government conductsMMAS review Contractors would be required to provide a report onsystem compliance within six months after the end of thecontractor’s fiscal year– Also requires independent CPA assessment Case closed without further action, potential to be reopened17

Future Developments – DOE BusinessSystems Rule DOE adopted its own version of business systems rule(DOE Acq. Letter 2013-11 (Aug. 2013), 79 FR 18416(April 1, 2014)– Applies to contracts for capital asset projects or for non-capitalasset projects– Does not apply to M&O contracts, small business contracts, orcertain service contracts Requires compliance with five of six DOD systems Within 60 days of award, DOE contractor required toprovide CO with written documentation that businesssystem meets the relevant system criteria DEAR update pending, M&O rule being considered18

Future Developments – Cybersecurity Cybersecurity is area of significant focus throughgovernment– Security safeguarding requirements being imposed throughoutDOD, including as part of UCTI clause– Additional requirements being developed for use throughoutgovernment Government likely seeking ways to enforce cybersecurityrequirements in system context– GSA/DOD Joint Working Group Recommendations includeincreasing government accountability19

Questions Phillip R. Seckman– pseckman@mckennalong.com– 303.634.4338 Michael J. McGuinn– mjmcguinn@mckennalong.com– 303.634.433320

Disapproved system results in withholding from: -Progress payments -Performance based payments -Interim payments under cost, T&M, and labor-hour contracts Applies to any contract that contains DFARS §252.242-7005 and the applicable system clause(s), at CO discretion 5% for one disapproved system, up to 10% for two or more