WIXLIB

CONTRACT TERMS AND CONDITIONSexample, in 2008, German company Siemens paidan 800 million fine to settle bribery and corruptioncharges—an amount that not does account for thecosts of the investigation, the costs associated withongoing monitoring required by the U.S.government, or the loss in stockholder value.OVER-RELIANCE ON THE CONTRACTThe first response to the suggestion of vendor auditsis often that they are unnecessary because contractsare in place to safeguard the organization in theevent of fraud. While having a contract in place isgood practice, there are opportunities for fraud inthe development, issuance, and management ofcontracts, such as: Management often does not review contractsbefore they are issued to look for weaknessesthat could allow fraud. Developers might already be corrupt when theybegin writing contracts. Corrupt employees can amend contracts or giveverbal exceptions to them.THE HIGH COST OF AFTER-THE-FACT AUDITS,INVESTIGATIONS, AND LEGAL INVOLVEMENTUnfortunately, once funds have been paid to anunscrupulous vendor, it can be extremely difficultand costly to get them back, even with a contract inplace. Further, waiting until an issue materializescan be more costly than the actual errors or fraud.Indirect costs can involve: Recovery constraints Operational costs Audit and investigation costs Legal costsPlanning and Conducting Vendor Audits 20123

CONTRACT TERMS AND CONDITIONSFraud prevention strategies and ongoing, proactivevendor audits can significantly reduce anorganization’s fraud risk and general overbillingissues. A continuous, well-communicated programcan also improve vendor and supplier relationshipsand help them understand what managementexpects from their billings and supportingdocumentation.The Importance of Effective Contract Language andHow It Supports Future AuditsDrafting sound contracts is best left to procurement andlegal experts who have the expertise. However, auditorsand investigators should have a role in crafting andreviewing the language before contracts are issued. Afterall, auditors and investigators are called upon to use thecontracts to verify compliance and recover funds ifnecessary. The contract terms, conditions, and expectationsaffect the planning, execution, and resolution of aconsequent vendor audit. In some instances, what is notincluded in the contract can be as just as important andcontentious as what is included.How Contract Language and Expectations CanActually Facilitate OverbillingMost contracts are written and implemented byattorneys and procurement professionals. Operations ormanagement might also play a part by setting scope,price, and other conditions. When multiple people withvastly different responsibilities and agendas areinvolved in crafting a contract, it is easy for gaps andholes to find their way into the language, which canfacilitate overbilling. Most personnel involved incontract development do not think about fraud or thedifficulties of auditing the vendor at a later date.Planning and Conducting Vendor Audits 20124

CONTRACT TERMS AND CONDITIONSTake, for example, a per diem paid to contractemployees. The contract stated: “Per diem will be paidat a sum of 70 per employee.” This was the onlylanguage in the contract regarding per diems. Theobvious expectation was that each contract employeewho puts in a full day’s work received 70 a day to payfor meals, lodging, and so forth. But did the contractlanguage actually say that?An audit of the vendor’s payroll revealed thatemployees only earned 45 per diem, allowing thevendor to make an extra 25 per day, per employee aspure profit. What rights would the organization have inrecovering the additional 25 per employee per day?What recourse would it have when employees whoworked less than a full day were also granted per diemcosts?Another example is travel time. One contract stated,“Travel time will only be paid for travel from thestaging area to the jobsite, which shall not be fartherthan 15 miles from one another.” Yet nowhere in thecontract were the jobsite or staging area locationsidentified. There was no language requiring theinclusion of staging and jobsite locations on timesheets,and—even worse—the billing clerk who received theinvoices and timesheets was unaware of the travel-timerequirement. The vendor company’s management wasnot held to the contract requirements, so they had theemployees and equipment return to the office eachnight, resulting in two hours of travel time (one houreach way).A final example of this premise involves meals andbreak times. The expectation is that, for the most part,workers will take a break or a meal break during thePlanning and Conducting Vendor Audits 20125

CONTRACT TERMS AND CONDITIONScourse of a day. But a contract simply stipulated that“time taken for meals or breaks will be deemed asunproductive time and un-billable.” The language didnot say that breaks or meals had to be taken, or for howlong. On the submitted timesheets, all the employeesand pieces of equipment were listed as in service from 8a.m. to 6 p.m., resulting in ten hours of billable time.When management asked why there were no meals orbreaks, the foreman said the crew opted to take theirmeals and breaks at the end of the shift.The auditor for the contracting organization had toprove if lunches and breaks were taken at the end of theday, or if the vendor’s employees actually took breaksbut coded them as productive time.These three examples highlight how assumptions andpoorly defined contract terms can leave situations openfor interpretation, to the point of facilitating overbilling.Assessing If Vendor Audits Are a Viable OptionOne of the biggest mistakes management can make is tobegin conducting a vendor audit before assessing whether itis even a viable option. Just because a contract exists doesnot mean that conducting an audit is appropriate. Considerthe following to determine the viability of a vendor audit: Are the signed and executed contracts available? Are there any change orders or verbal addendums? Ifso, what do they say? Does management have its supporting documentation? Does an adequate audit clause exist?Crafting an Effective Audit ClauseNot all audit clauses are created equal. And just because acontract contains a few sentences in section titled “Right toAudit” does not mean that the related vendor audit will bePlanning and Conducting Vendor Audits 20126

CONTRACT TERMS AND CONDITIONSstraightforward—or effective. The following considerationsshould be fully explored and incorporated, whereappropriate, for each vendor contract and audit clausebefore the contract is issued.Boilerplate or Dynamic Audit Clause LanguageBoilerplate contract language was designed byattorneys and procurement professionals to set standardcontract terms and speed up the contracting process forprocurement personnel. The problem is that auditingand investigating fraud, waste, and abuse is adynamic—and very rarely standard—process. Yet inmany organizations, boilerplate audit clauses areattached to every contract, indiscriminate of the goodsor services being delivered.Take, for example, a concrete supplier and fabricatorwith two contracts with a large IT infrastructurecompany. The first contract is for 15,000 foroverlaying a parking lot. The second contract is for 10million of hardened concrete as part of a disasterrecovery facility. These two contracts, while bothinvolving the same concrete supplier, are worlds apartwhen it comes to the services, dollar amounts, risk, andpotential liabilities. And because they are different andhave their own unique challenges and expectations, theaudit clauses for each contract should reflect thespecifics of the agreement. Applying the sameboilerplate audit clause used in the smaller contract tothe larger contract could severely derail certain auditinitiatives if the disaster recovery facility were toballoon in cost to 20 million or suffer catastrophicleaks due to faulty concrete fabrication.In contrast, dynamic audit clauses are designed basedon the various conditions of individual contracts (e.g.,Planning and Conducting Vendor Audits 20127

CONTRACT TERMS AND CONDITIONScontract type, contract amount, geography, timeconstraints, the use of inferior substitute materials, thepercentage involvement of subcontractors, etc.). Theinclusion or exclusion of such conditions affectsmanagement’s right to exercise an audit at a later date.This does not mean that every audit clause in everycontract must be built from the ground up (a practicethat would be cost prohibitive and inefficient).However, implementing a process with a dynamicnature allows the proper internal personnel (internalaudit, compliance, investigations, etc.) to evaluateboilerplate language against the draft contract terms,and anti-fraud experts can adjust the language toaddress considerations such as: Where could fraud, waste, and abuse occur in thisagreement given the contract variables andconditions? What additional documentation and expectationsshould be required of the vendor? Where could the vendor employ delay or confusiontactics and resist or cloud the audit?Does the current audit clause address all ofmanagement’s concerns?What improvements can be made to the audit clauselanguage to strengthen company rights?Term DefinitionsContracts are supposed to standardize the agreementsand expectations of the involved parties. However, inreality, the contracting organization’s definition of aword might be completely different than the vendor’s.The audit clause is such an important piece of thecontract language, it is surprising that many auditclause stipulations and expectations are not properlydefined. This leaves an enormous amount of room forboth parties to define terms in ways benefit them. ForPlanning and Conducting Vendor Audits 20128

CONTRACT TERMS AND CONDITIONSexample, many audit clauses use the words audit,inspect, examine, review, and analyze interchangeably.But these terms do not convey the same meanings orexpectations. A vendor trying to avoid an audit can usevague wording in a contract to fight the organization’sability to enforce the clause.Audit PeriodOne of the most important rights asserted under theaudit clause is the amount of time that the contractingorganization can go back and audit the billings. Manyboilerplate audit clauses have a fixed period of one tothree years, but this timeframe is not suited to allcontracts.Take, for example, the expansion of a major airport.Construction costs might exceed several hundreds ofmillions of dollars and the construction time couldexceed five to seven years. If a one-year audit period isincluded in the primary contract, the airport hasessentially given up a large majority of its auditingrights unless it routinely conducts audits of all of thevendors every year throughout construction. Typically,vendors will not be audited until allegations arise orconstruction costs and delays increase significantly. Inthis scenario, a one-year time limit might not be longenough for the airport to fully investigate theirconcerns.However, the contract can be amended to extend theright to audit and place more emphasis on the higherrisk areas. A stratified system of audit periods can bedesigned based on estimates of how much eachcontractor will spend. For example, vendors accountingfor the lowest level of cost could have one-year auditclauses, while the vendors with the highest billingsPlanning and Conducting Vendor Audits 20129

CONTRACT TERMS AND CONDITIONSmight have audit periods that cover the full contractengagement. Regardless of the strategy ormethodology, an arbitrary audit period might look goodon paper, but it does not fully protect the rights of thehiring organization.Audit NotificationDuring the contract-writing phase, it can be difficult toenvision how an audit clause will be executed in thefuture. Some audit clauses stipulate that the vendor willbe notified in advance of an audit. Other clausescompletely omit notification requirements, which causeboth parties to make assumptions. Some contracts statethat surprise audits are permitted or that no notificationis needed for staff to visit the site. The inclusion orexclusion of notification language affects the auditprocess.PLANNED AUDITSIt could be necessary to include language stipulatinga wait period between the notification and the onsite audit. The contracting organization might needto review receipts or travel to the site, the vendormight have periods where it is unavailable for anaudit, or a two-week notice might be insertedsimply to maintain good vendor relations. A waitingperiod should not cause concern regarding mostvendors; however, a vendor that is falsifyinginvoices or bribing a procurement employee can usethis notification period to conceal, destroy, orfabricate supporting documentation.SURPRISE AUDITSSurprise audits are excellent for identifying andassessing processes. Such audits do not allow timeto prepare employees; alter documentation; orPlanning and Conducting Vendor Audits 201210

CONTRACT TERMS AND CONDITIONSfabricate, destroy, or conceal other evidence ofwrongdoing. Unfortunately, some vendors willobject to allowing surprise audits in contracts.If there have been significant problems withvendors in the past, their contracts must includelanguage allowing surprise audits. If the vendorwants the organization’s business bad enough, itwill have no other option than to comply.Additionally, if the surprise audits are included inthe audit clause, they must be performed. Thisshows that the organization’s management iswilling to exercise the audit clause, and it makesvendors more hesitant to deviate in services orfalsify billings.Terms of Invoice and Payment ReviewsOne of the core items of the audit clause is thatmanagement reserves the right to review all billingsagainst the contract terms and conditions. But in theterms of the audit clause, who is management? Is it thefrontline supervisor, the regional manager, or theinternal audit director? This is a very importantdistinction that must be made and communicatedinternally. Organizations can find themselves in stickysituations when a diligent frontline manager routinelyrefers to his review of the invoices as an audit or,worse, as exercising the audit rights of the contract.This can complicate matters when internal audit iscalled on at a later date to perform a true audit of thebillings, only to be told by the vendor that they werealready audited.Language that attempts to couch a frontlinemanagement review as an audit, or that indicates thatPlanning and Conducting Vendor Audits 201211

CONTRACT TERMS AND CONDITIONSthe field review constitutes final approval of theaccuracy of the invoices, should be discouraged andadditional compensating contract language should beconsidered.EXAMPLEField review, approval, and payment will notlegitimize obvious errors or omissions in billings orinvoices. Such discrepancies, if identified, whetherafter payment or during an audit, will be held to thecontract terms and expectations as they are writtenor understood.TIME PERMITTED TO REVIEW INVOICESLimiting the contracting organization’s time toreview statements might be an attempt by vendorsto circumvent the audit process, or at least to givethemselves an out if audited. Such languagetypically states, “The owner has 15 days to reviewand dispute any charges or items on the invoice.After such time, the invoice is considered accurateand approved.” This restriction is a fallback positiontaken by a vendor who is confronted with a billingissue or a request to audit and could be the firsthurdle an organization’s management has toovercome without involving legal counsel and filingsuit. It is important that statements referring totimely review and payment stick to just that—review and payment. It should be made clear thatreview and payment does not forgo audit rights orlimit recovery for billings and errors that arecontrary to the nature and spirit of the contractterms.Planning and Conducting Vendor Audits 201212

CONTRACT TERMS AND CONDITIONSTerms Regarding Supporting Records andDocumentationFORMAT OF RECORDSAre supporting records kept in paper or plastic(digital media) format? A paper-based audit can beextremely time consuming and costly.Unscrupulous vendors know that it is more difficultto identify errors and discrepancies in boxes andboxes of records than in an automated system. Asignificantly large paper-based audit might deter anaudit altogether.If the contract requires the vendor to maintainelectronic documents, the terms need to be clearlydefined. For example, there is a huge differencebetween having payroll data in an Excel file andhaving 10,000 poorly scanned PDFs. Both aretechnically in an electronic format, but the latterwill be time consuming and possibly inadequate.Additionally, proprietary accounting systems,outdated storage media, and software programs thatno one knows how to use can limit access toelectronic files. Some data systems were designedto allow exports only by the firm that designed theprograms; the vendor can run some canned reportsbut not fully access the data. On the extreme end,so

Association of Certified Fraud Examiners 23RD ANNUAL ACFE FRAUD PRE-CONFERENCE PLANNING AND CONDUCTING VENDOR AUDITS JUNE 17, 2012 ORLANDO, FL 11:00 a.m. - 1:00 p.m. Registration: City Hall Lobby Room Name: Sun Ballroom C 1:00 p.m. - 2:10 p.m. Contract Terms and Conditions: The Foundation for Good Vendor Audits 2:10 p.m. - 2:25 p.m. Break