DEFENSE CONTRACT AUDIT AGENCY

Formal Assessment Needed to Determine Future Use of Independent Public Accountants

Report to Congressional Committees

May 2025

GAO-25-107558

United States Government Accountability Office

For more information, contact Mona Sehgal at sehgalm@gao.gov.

Highlights of GAO-25-107558, a report to congressional committees

May 2025

Defense Contract AUDIT AGENCY

Formal Assessment Needed to Determine Future Use of Independent Public Accountants

Why GAO Did This Study

GAO’s prior work found that DCAA faced challenges in conducting incurred cost audits in a timely manner. This led to a backlog and exposed the government to financial risk.

Section 803 of the National Defense Authorization Act for Fiscal Year 2018 directed DOD to use independent public accountants and DCAA to eliminate its backlog of incurred cost audits and maintain an appropriate mix of government and private sector capacity, among other things.

The act includes a provision for GAO to evaluate DCAA’s use of independent public accountants for incurred cost audits from fiscal years 2020 through 2023. This report assesses (1) the effect DCAA’s use of independent public accountants has had on its ability to eliminate its backlog of incurred cost audits and conduct other types of audits; (2) the extent to which DCAA has planned for their future use; and (3) how DCAA provides oversight and assesses performance. To do this work, GAO interviewed DCAA officials and independent public accountants, analyzed agency data, and reviewed a nongeneralizable sample of 10 task orders covering 57 incurred cost audits.

What GAO Recommends

GAO recommends that DCAA formally assesses the future use of independent public accountants and communicates its plans to Congress.  DOD concurred with the recommendation. DOD stated that it will conduct an evaluation and present a plan to Congress by April 30, 2026.

What GAO Found

Before certain Department of Defense (DOD) contracts can be closed, the Defense Contract Audit Agency (DCAA) audits contractors’ incurred costs to ensure they are permissible under government regulations. Since fiscal year 2020, DCAA has used independent public accountants to perform certain incurred cost audits. However, DCAA largely eliminated its backlog of incurred cost audits by the end of fiscal year 2018, before using independent public accountants. This freed up resources for DCAA auditors to focus on other complex and higher risk audits—e.g., business system audits (see figure). DCAA officials attribute the elimination of DCAA’s backlog to, in large part, its use of its risk-based sampling methodology, which reduced the number of audits required.

In an October 2018 report to Congress, DCAA outlined its plan for using independent public accountants, though actual use has been less than intended. According to DCAA officials, the number of audits available to independent public accountants declined after DCAA revised its criteria for assigning audits to independent public accountants, and its risk-based sampling methodology in 2020. However, DCAA has not formally assessed its future use of independent public accountants, nor communicated its plans to Congress. This would help DCAA ensure it maintains an appropriate mix of DCAA auditors and independent public accountants—as called for in statute—and avoid future backlogs. Communicating its plan would help facilitate Congress’s oversight role.

GAO found that for a sample of 10 task orders, the award process helped ensure that independent public accountants met federal qualification requirements. DCAA also reviewed their work in accordance with quality assurance plans. However, DOD’s Inspector General recently raised concerns about the quality and completeness of the independent public accountants’ work products in its review. DCAA disagreed with the recommendations and said that the audits were based on sufficient evidence. GAO did not independently assess the Inspector General’s findings or independent public accountants’ audit work products.

 

 

 

 

 

 

 

 

Abbreviations
COR	Contracting Officer’s Representative
DCAA	Defense Contract Audit Agency
DLA	Defense Logistics Agency
DOD	Department of Defense
DOD IG	DOD’s Office of the Inspector General
FAR	Federal Acquisition Regulation
GAGAS	generally accepted government auditing standards
NDAA	National Defense Authorization Act

May 19, 2025

Congressional Committees

In fiscal year 2023, the Department of Defense (DOD) obligated about $456 billion on contracts to acquire goods and services needed to support its mission. Once performance is complete, contracts must be closed as the final step in the acquisition process. Closing contracts within expected time frames can help limit the government’s exposure to certain financial risks by identifying and recovering improper payments and avoiding paying interest when the government does not pay contractors on time. The Defense Contract Audit Agency (DCAA) conducts incurred cost audits for DOD to identify whether costs incurred on certain contracts are permissible under government regulations—information that contracting officers need to close contracts. However, our prior work found that DCAA experienced longstanding challenges in conducting incurred cost audits in a timely fashion, affecting DOD’s ability to close out contracts and DCAA’s ability to conduct other types of audits.[1] This increased the government’s exposure to financial risk and contributed to a backlog.

Section 803 of the National Defense Authorization Act (NDAA) for Fiscal Year 2018 directed DOD to use independent public accountants to eliminate the backlog, ensure these audits are completed in a timely manner, and maintain an appropriate mix of government and private sector capacity to meet DOD’s current and future needs.[2] It also included a provision for GAO to evaluate DCAA’s use of independent public accountants—referred to as ‘qualified private auditors’ in the NDAA—for incurred cost audits conducted from fiscal years 2020 through 2023.[3] This report assesses (1) the effect that DCAA’s use of independent public accountants has had on its ability to eliminate its incurred cost backlog and to conduct other types of audits; (2) how DCAA provides oversight of independent public accountants and assesses performance; and (3) the extent to which DCAA has planned for the future use of independent public accountants.

To address all of our objectives, we analyzed DCAA’s Management Information System and programmatic data, from fiscal years 2020 through 2023, used to track progress on audits completed by DCAA auditors and independent public accountants. To determine the reliability of these data, we interviewed knowledgeable DCAA officials, reviewed related documentation, and corroborated information against other data sources, such as the Federal Procurement Data System. We found these data to be sufficiently reliable for the purposes of completing descriptive analyses of DCAA- and independent public accountant-led incurred cost audits described below (e.g., cost, timeliness, and return on investment), and analyzing DCAA oversight and performance assessment in a selection of task orders.

To determine the effect that DCAA’s use of independent public accountants has had on its ability to eliminate its incurred cost audit backlog and to conduct other types of audits, we analyzed DCAA’s annual reports to Congress and DCAA’s Management Information System data. This allowed us to identify the total number of incurred cost and other audits conducted by DCAA and independent public accountants. We expanded our scope to include data from fiscal years 2018 through 2023 to enable us to compare the number of DCAA audits completed before and after the start of the independent public accountant program. We reviewed relevant laws, policies, and guidance related to DCAA’s independent public accountant program, such as the NDAA for Fiscal Year 2018 and DCAA Policy and Procedures for Risk-Based Sampling of Incurred Cost Proposals, as well as program management documentation, to understand how DCAA plans for and selects audits to be performed by independent public accountants and by DCAA auditors. We also interviewed DCAA program officials and representatives from independent public accountants.

To determine how DCAA provides oversight of independent public accountants and assesses performance, we selected a nongeneralizable sample of 10 task orders awarded to five independent public accountants from fiscal years 2020 through 2023, covering 57 incurred cost audits. From fiscal years 2020 through 2023, DCAA awarded a total of 91 task orders to nine independent public accountants. To select the task orders for our review, we first identified the five independent public accountants with the highest amount of auditable dollar value.[4] For each of these independent public accountants, we then selected the two task orders that accounted for the largest amount of contract dollars from fiscal years 2020 through 2023 for in-depth review. This sample allowed us to review task orders associated with one or more incurred cost audits. For instance, one task order included a single incurred cost audit of a higher dollar amount that was high risk, while other task orders included several incurred cost audits that covered lower dollar amounts and were low risk. Additionally, our sample task orders included both small and large independent public accountants, and audits conducted during fiscal years covered by the sample period.

We compared the content of the solicitations, selected source selection information, and award documentation, such as technical evaluations, for our sample task orders against NDAA requirements to identify how these requirements were incorporated into the task order award process. To determine the methods DCAA used to oversee the performance of independent public accountants, we analyzed contracting officer’s representatives (COR) ratings in quality assurance surveillance plan checklists and other documentation used to monitor transfer of deliverables to the government and DCAA’s assessment for quality and timeliness. Before we initiated the work, DOD’s Office of the Inspector General (DOD IG) initiated a review to assess whether the independent public accountants’ deliverables, including audit reports, complied with generally accepted government auditing standards (GAGAS).[5] We discuss the results of the DOD IG review later in the report. It was not in the scope of our review to assess the independent public accountants’ work products or DOD IG’s findings. We focused our work on how DCAA evaluated the qualifications of independent public accountants, its oversight of their work, and steps to ensure the timeliness of their audits. We interviewed the Defense Logistics Agency (DLA) contracting officer responsible for awarding task orders on behalf of DCAA, DCAA CORs tasked to perform oversight, and representatives from independent public accountants.

To determine the extent to which DCAA has planned for the future use of independent public accountants, we reviewed relevant laws, policies, and program management documentation to understand how DCAA plans for and selects audits to be performed by independent public accountants and by DCAA auditors. We reviewed acquisition planning requirements established in the NDAA for Fiscal Year 2018 as well as DCAA’s October 2018 Plan to Congress, which outlines the program’s acquisition planning efforts.[6] We also reviewed DCAA’s efforts against our Standards for Internal Control in the Federal Government related to monitoring and control activities and communicating quality information.[7]

We conducted this performance audit from May 2024 to May 2025 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Background

DCAA’s Roles and Responsibilities

DCAA was established in 1965 to provide more efficient and consistent audit support by centralizing these duties in a single defense organization. It performs contract audits for DOD and provides accounting and financial advisory services regarding contracts and subcontracts to DOD components. The Director of DCAA reports to the Under Secretary of Defense (Comptroller).

DCAA has the primary responsibility for auditing contractors doing business with DOD.[8] Its contract audit services are intended to be a key control to help ensure that prices paid by the government for goods and services are fair and reasonable, and that contractors charge the government in accordance with applicable laws, regulations, and contract terms.[9] DCAA conducts six general types of audits, as shown in table 1.

Audit type	Description
Incurred cost	DCAA conducts incurred cost audits to identify whether costs incurred on flexibly-priced contracts are allowable, allocable, and reasonable—information that contracting officers need to close the contracts.a Incurred cost audits allow the contracting officer to recover costs that are not allowable, allocable, and reasonable before the contract is officially closed out, preventing excess payments by the government.
Forward pricing	DCAA conducts forward pricing audits to evaluate a contractor’s estimate of how much it will cost the contractor to provide goods or services to the government and whether these costs are fair, reasonable, and comply with federal regulations. Forward pricing audits are generally completed before contract award.
Business systems	DCAA conducts business systems audits to gather sufficient evidence to express an opinion on the contractor’s compliance with applicable business systems criteria, such as contract terms, applicable laws, and federal regulations, and to support the contracting officer’s compliance determination. DCAA Manual No. 7641.90, Information for Contractors notes that business systems are DCAA’s top area of emphasis, and a priority identified in DCAA’s Report to Congress on Fiscal Year 2023 Activities.
Truthful Cost or Pricing Data Statute (otherwise known as Truth in Negotiations Act)b	DCAA conducts Truthful Cost or Pricing Data Statute audits to determine if the negotiated contract price was increased by a significant amount because the contractor did not submit or disclose accurate, complete, and current certified cost or pricing data.
Cost accounting standards	DCAA conducts cost accounting standards audits to ascertain whether the disclosed or established practices are in compliance with the Cost Accounting Standards Board rules, regulations, and standards, as well as appropriate acquisition regulations.
Claims and terminations	DCAA conducts claims and terminations audits in circumstances where contracts are adjusted for changes or are partially or fully terminated before completion, which can result in complex and high-risk audits. DCAA evaluates the cost of the original contract work and compares it to the changed scope of work.

Source: GAO analysis of Defense Contract Audit Agency (DCAA) information.  |  GAO‑25‑107558

^aA cost is allowable if it complies with, among other things, the terms of the contract, allocability, and reasonableness as outlined in Federal Acquisition Regulation (FAR) 31.201-2. A cost is allocable if it is assignable or chargeable and (1) is incurred specifically for the contract; (2) benefits both the contract and other work and can be equitably distributed; and (3) is necessary for the overall operation of the business and is assignable in accordance with principles in FAR 31.201-4. A cost is reasonable if, in its nature and amount, it does not exceed that which would be incurred by a prudent person in the conduct of competitive business, as stated in FAR 31.201-3.

^b10 U.S.C.  3701-3708; and 41 U.S.C.  3501-3509.

To reduce the financial risks to the government associated with flexibly-priced contracts, the Federal Acquisition Regulation (FAR) requires contractors to submit incurred cost proposals that include information on all their flexibly-priced contracts in a fiscal year.[10] Such contracts include cost-type contracts and orders where final payment is based on actual costs incurred by the contractor. Before the contracting officer can close out a flexibly-priced contract, DCAA assesses whether the contractor’s claims for final annual incurred costs during contract performance are allowable under the terms of the contract, can be allocated to the contract, and are reasonable. These steps are needed to determine the contractor’s final payment and ensure that no excess costs were charged.

Prior GAO Work

Our prior work has highlighted longstanding challenges that DCAA faced with conducting incurred cost audits in a timely manner, which led to a backlog. This backlog affected DOD’s ability to close out contracts and limited DCAA’s ability to conduct other types of audits. For example,

·       In September 2011, we reported that DOD faced a number of challenges in closing out its large, cost-based contracts that it employed in Iraq and Afghanistan. We found that DOD’s efforts to close these contracts were hindered by staffing shortages at DCAA and unresolved issues with contractors’ cost accounting practices.[11] Among other things, we recommended that senior contracting officers monitor and assess the progress of contract closeout activities throughout the process so steps may be taken if a backlog emerges. DOD agreed with the recommendation and amended the Defense Federal Acquisition Regulation Supplement to begin requiring such monitoring and assessments.

·       In December 2012, we reported that DCAA had a backlog of more than 20,000 incurred cost audits as of the end of fiscal year 2011.[12] Some of the incurred cost proposals dated as far back as 1996, representing hundreds of billions of dollars in unsettled costs. We found that DCAA was seeking to reduce the backlog by implementing a risk-based approach to focus more resources on incurred cost audits involving high-dollar value and high-risk proposals. DCAA significantly reduced the number of low-risk audits that would be randomly sampled and require an audit. DCAA also began conducting multiyear audits, in which multiple incurred cost proposals are incorporated into a single audit. To improve DCAA’s ability to determine whether its incurred cost backlog initiative was achieving its objectives, we recommended that DCAA develop a plan to assess progress toward achieving its objectives of reducing the backlog. In response, DCAA developed a monitoring plan in 2013 that included measures to assess its progress.

·       In September 2017, we found that despite these efforts, the agency had not been able to meet its goal to eliminate its backlog by fiscal year 2016 and that it was unlikely to meet a revised goal of fiscal year 2018.[13] To manage its incurred cost inventory, we recommended that DCAA assess and implement options for reducing the length of time to begin incurred cost audit work and establish related performance measures. DCAA agreed with this recommendation and took actions to implement it. For example, DCAA implemented requirements established in the NDAA for Fiscal Year 2018 to notify a contractor whether its incurred cost proposal is adequate within 60 days of receipt and that audit findings shall be issued no later than 1 year after the date of receipt of all adequate incurred cost proposals.

·       In February 2019, we found that DCAA’s successful execution of a plan to increase business systems reviews would depend on its ability to shift resources from conducting incurred cost audits, the use of independent public accountants to perform a portion of incurred cost audits, and DCAA auditors’ use of new audit plans to complete business system audits in a timely manner.[14]

Congressional Actions to Address the Backlog

Congress enacted two pieces of legislation specifically intended to address the incurred cost audit backlog. The NDAA for Fiscal Year 2016 included a provision that prohibited DCAA from conducting incurred cost audits for non-defense agencies until DCAA cleared its backlog of incurred cost audits older than 18 months.[15]

Subsequently, the NDAA Fiscal Year 2018 included a provision that directed DOD to use qualified independent public accountants to support DOD’s need for timely and effective incurred cost audits and to ensure that DCAA allocates resources to higher-risk and more complex audits.[16] Specifically, the act required DOD to use qualified independent public accountants to perform enough incurred cost audits of DOD contracts to:

·       eliminate DCAA’s backlog of incurred cost audits by October 1, 2020;

·       maintain an appropriate mix of government and private sector capacity to meet current and future DOD needs for the performance of incurred cost audits;

·       ensure that independent public accountants perform incurred cost audits on an ongoing basis to improve the efficiency and effectiveness of the performance of incurred cost audits;

·       complete incurred cost audits within 12 months of an adequate incurred cost proposal; and

·       limit the use of multiyear auditing.

The NDAA for Fiscal Year 2018 also established minimum requirements for contracting with independent public accountants. They must:

·       have no conflict of interest in performing incurred cost audits, as defined by GAGAS;

·       possess the necessary independence to conduct incurred cost audits, as defined by GAGAS;

·       sign nondisclosure agreements, as appropriate, to protect proprietary or nonpublic data;

·       access and use proprietary or nonpublic data furnished to them only for the purposes stated in the contract;

·       take all reasonable steps to protect proprietary and nonpublic data furnished during the audit;

·       not use proprietary or nonpublic data provided to them to compete for government or nongovernment contracts;

·       conduct incurred cost audits in accordance with GAGAS; and

·       develop and maintain complete and accurate working papers that will become the property of DOD.

In response, DCAA submitted a plan to Congress in October 2018 identifying the types of incurred cost proposals best suited for independent public accountants as well as the number and auditable dollar value of these audits. DCAA selected DLA to serve as the contracting organization since DCAA does not have its own contracting authority. Under this arrangement, DLA awards the task orders and DCAA leads the program office, evaluates vendor technical quotes for task orders, and oversees audit performance through DCAA CORs. DCAA stated that it worked with DLA to develop an acquisition plan, which included awarding task orders off the General Services Administration’s Federal Supply Schedule to allow for competition and enable the program to award task orders by April 2019, as required by the act.[17] DLA awarded the first task orders to independent public accountants in March 2019.

Use of Independent Public Accountants Is Among Factors that Enabled DCAA to Direct Resources to Other Audits

DCAA’s use of independent public accountants is one factor that enabled it to direct more resources to higher-risk and more complex audits. DCAA’s data show that independent public accountants conducted 20 percent of the total number of incurred cost audits completed from fiscal years 2020 through 2023. However, DCAA had largely eliminated its backlog of incurred cost audits by the end of fiscal year 2018, prior to the start of using independent public accountants, which reduced the number of incurred cost proposals for audit and freed up resources for DCAA auditors to focus on other work. DCAA officials attribute the elimination of the backlog to, in large part, its use of its risk-based sampling methodology for selecting incurred cost proposals for audit.

According to DCAA officials, the independent public accountant program has enabled DCAA to focus its resources on higher-risk audits. They also noted that in the absence of the independent public accountant program, DCAA auditors would have to assume additional workload, possibly affecting DCAA’s ability to conduct other audits. From fiscal years 2020 through 2023, independent public accountants completed between 99 and 136 incurred cost audits per year. Overall, they completed 485 of 2,408, or 20 percent of DCAA’s total incurred cost audits. Figure 1 shows the number of incurred cost and other audits completed by DCAA auditors and independent public accountants from fiscal years 2018 through 2023.

As noted above, DCAA had largely eliminated its backlog of incurred cost audits prior to its use of independent public accountants. DCAA officials stated that the implementation of its risk-based sampling methodology was a key factor contributing to the elimination of the backlog because it reduced the number of incurred cost proposals subject to audit. Under its risk-based sampling approach, DCAA officials assign a risk level, such as low, medium, or high, to each submitted incurred cost proposal based on certain factors. For example, DCAA considers the auditable dollar value and whether a specific risk was identified by an external source—such as a contracting officer—or if the audit team identified a specific risk that has a material impact on the proposal being assessed. Factors may also include business system deficiencies—weaknesses in a contractor’s internal controls or processes that affect the reliability of cost data—and prior audit experience with the contractor.

Once a risk level is assigned, DCAA applies a sampling methodology to select incurred cost proposals for audit based on the auditable dollar value. For example, all high-risk incurred cost proposals that exceed an auditable dollar value of $1 billion are audited annually, while low-risk proposals with an auditable dollar value ranging from less than $5 million to up to $99 million are selected for audit based on sampling percentages that range from 0.5 to 10 percent. When low-risk proposals are not selected for audit, DCAA issues a memorandum to the contracting officer stating that the submission was not selected for an audit. In January 2020, DCAA changed, among other things, the threshold for high-risk proposals requiring annual audit, increasing it from more than $250 million to $1 billion or more. DCAA officials reported that this further reduced the number of incurred cost proposals subject to audit. Figure 2 depicts key steps in the incurred cost audit selection process and DCAA’s sampling methodology.

^aDCAA uses a checklist to assess the adequacy of contractors’ incurred cost submissions. DCAA may determine that a contractor’s incurred cost proposal is inadequate for a variety of reasons, such as incomplete or inaccurate information, and request that the contractor revise and resubmit the incurred cost proposal. This process may take several iterations before the proposal is deemed adequate, at which point DCAA applies its risk-based sampling methodology to determine which proposals will be subject to audit.

These factors, along with DCAA directing more resources to higher-risk, more complex, and more resource intensive audits, also contributed to a decline in the total number of audits that DCAA completed annually. For example, DCAA’s completion of business systems, cost accounting standards, and Truthful Cost or Pricing Data Statute audits increased from fewer than 300 in fiscal years 2018 and 2019 to a high of 650 in fiscal year 2022 even though the total number of audits decreased.[18] DCAA reported that these other audits took an average of 259 days to complete in fiscal year 2023, compared with 188 days for incurred cost audits. According to DCAA officials, business system audits are high-value and time-intensive audits that require more resources and can result in fewer completed reports. Further, DCAA officials stated they were able to increase the advisory services they provide to contracting officers.[19] For example, DCAA officials said they issued four advisory services memorandums in fiscal year 2018 covering about $10.6 million of contract dollars, which increased to 47 memorandums in fiscal year 2023 encompassing approximately $1.9 billion.

DCAA officials noted that the use of independent public accountants contributed to their ability to conduct these types of audits at a time when DCAA’s auditor workforce decreased. DCAA’s auditor workforce decreased from 4,148 in fiscal year 2018 to 3,504 in fiscal year 2023, in part due to budget reductions since fiscal year 2020.

DOD Process Helped Ensure that Independent Public Accountants Were Qualified to Conduct Audits; DOD IG Found Limitations in Quality of Work Products

DLA’s process to solicit quotes and award task orders helped ensure that NDAA requirements related to qualifications were met for the task orders in our sample. In addition, DCAA’s technical evaluations of these independent public accountants helped ensure they were qualified to conduct incurred cost audits for DOD. DCAA CORs on the task orders in our sample determined that independent public accountants met most performance goals included in the quality assurance surveillance plans of sample task orders. Meanwhile, DOD IG recently raised concerns about the quality and completeness of the independent public accountants’ work products. It was not within the scope of our review to independently assess the work products or DOD IG’s findings.

DCAA and DLA Had a Process to Ensure that Independent Public Accountants Met Requirements for Sample Task Orders

We found that DCAA, working with DLA, used the requirements outlined in the NDAA for Fiscal Year 2018 in the solicitations for awarding the 10 task orders in our sample to independent public accountants. For example, the solicitations we reviewed defined a qualified vendor consistent with the requirements identified in the NDAA and specified that awardees will need to conduct audit work to be in compliance with GAGAS. Further, the solicitations noted that vendors must have a current external peer review with a “pass” rating and be free of any conflicts of interest related to the subject matter or the audit.[20]

Additionally, a key part of DCAA’s technical evaluation process, according to the contract file documentation we reviewed, was the review of a work product from a previously completed GAGAS-compliant audit. This is done to confirm the independent public accountants’ ability to perform audits in accordance with required standards. Of the 50 quotes submitted for the 10 task orders we reviewed, nine were disqualified from further consideration once the government determined that the GAGAS-compliant sample product was inadequate. Further, contract file documents showed that DCAA considered GAGAS experience when reviewing past performance summaries or previous work performed for DCAA by the independent public accountants.[21] For example, we found that all five of the independent public accountants included in our sample had experience performing incurred cost audits for other federal agencies, such as the National Aeronautics and Space Administration.

Finally, in all 10 of the contract files for our sample task orders, we found that DCAA received deliverables that addressed NDAA requirements as required by the performance work statement. For example, contract files documented that DCAA received quality control and audit plans that, among other things, could be used to ensure that the independent public accountants adhered to NDAA requirements while completing incurred cost audits. According to the documentation we reviewed, the government also received nondisclosure agreements from the independent public accountants and monitored for organizational conflicts of interest. Table 2 notes examples of how DCAA and DLA incorporated requirements from the NDAA for Fiscal Year 2018 into their processes for awarding all 10 sample task orders we reviewed.

Procurement phase	Examples of DCAA’s incorporation of NDAA for Fiscal Year 2018 Qualifications and Requirements (number of sample task orders where requirements were addressed)
Solicitation of quotes	The performance work statements included in the solicitations defined the scope of work and expected deliverables for each task order, and addressed NDAA requirements by requiring independent public accountants awarded task orders to: ·        perform generally accepted government auditing standards (GAGAS)-compliant audits and have a current external peer review with a “pass” rating; ·        have no conflicts of interest when performing the work and that firms awarded a task order must continue monitoring for organizational conflicts of interest; ·        sign a nondisclosure agreement after task order award prior to initiating work; and ·        deliver final working papers package to the government. (10 of 10 sample task orders)
Quotation documentation requirements	Solicitation requirements directly linked to NDAA requirements that prospective independent public accountants were to provide with their quote: ·        a sample work product from a previous GAGAS-compliant/incurred cost audit completed within the past 3 years. If the submitted sample fails to address or comply with the requirements in the solicitation, it will be removed from consideration for award without further review; ·        review of up to five past audits that may be relevant to the incurred cost audit requirements; and ·        evidence of professional qualifications to include a recent peer review. (10 of 10 sample task orders)
Task order administration	Task order required independent public accountant to deliver the following, which provide information to assess whether NDAA requirements have been met: ·        complete nondisclosure agreements; ·        a quality control plan that describes how the firm will ensure that its work meets or exceeds the requirements of the task order as well as how it will maintain GAGAS compliance and keep records received from the government and auditees; and ·        an audit plan for each incurred cost audit performed under a task order that describes the methods and procedures they will apply when conducting the work and the dollar amount under review. DCAA assesses these plans to ensure that procedures for completing the GAGAS audit are reasonably detailed. (10 of 10 sample task orders)

Source: Defense Logistics Agency documentation for task orders awarded on behalf of Defense Contract Audit Agency (DCAA).  |  GAO‑25‑107558

DCAA Determined that Independent Public Accountants Generally Met Quality and Timeliness Goals for Audits Under Sample Task Orders

To oversee contractor performance, DCAA assigned CORs, as required by the performance work statement, which also mandated the use of quality assurance surveillance plans.[22] DCAA CORs act as an intermediary between independent public accountants and the DLA contracting officer and provide updates to the contracting officer. Additionally, they oversee and assess independent public accountants’ work against quality and timeliness requirements outlined in performance work statements, audit plans, and quality assurance surveillance plans. The COR is also responsible for the inspection, approval, and acceptance of five deliverables: the audit plan, draft and final audit reports, final audit workpapers, and, as applicable, a summary memorandum when the independent public accountant is asked to provide negotiation support for finalizing contract close out. If the COR finds that performance in completing these five deliverables is marginal or unsatisfactory, the contracting officer may apply a 5 to 15 percent reduction to associated payment amounts.

For the 57 incurred cost audits performed by independent public accountants in our 10 sample task orders, documentation indicates that DCAA CORs determined they met most performance goals included in the quality assurance surveillance plans. The quality assurance surveillance plans we reviewed included checklists that broke down deliverables or other performance work statement tasks into 91 or more specific quality requirements. For example, these checklists asked CORs to assess if draft and final reports included expected elements of an audit, were free of mathematical, clerical, and grammatical errors, and have adequate distribution information. In 23 of the 57 audits in our sample, documentation shows that the CORs determined that independent public accountants met all requirements. For each of the remaining 34 incurred cost audits, at least one requirement was assessed as unmet; the lowest ratings among these was 96 percent. Among the issues cited by DCAA in its assessments of these 34 incurred cost audits were administrative items, such as failing to mark workpapers as “For Official Use Only,” and mathematical errors in the draft report that would be corrected later. In one instance, an independent public accountant failed to submit a draft report to the government on time. The COR communicated this delay through a monthly surveillance report to the DLA contracting officer, who in turn issued a written warning to the independent public accountant.

According to DCAA officials, only one task order over the life of the independent public accountant program has been terminated as result of performance issues. In this case, the independent public accountant was unable to produce adequate audit plans for most of the incurred cost audits it was meant to complete. According to documentation, the COR reported that delays to the start of work made it unlikely that the incurred cost audits would be completed within NDAA-required time frames. After the COR, contracting officers, and program manager discussed the independent public accountant’s performance, DLA terminated the task order. DCAA then assigned the audit to government auditors, who completed it within required time frames.

Overall, each incurred cost audit completed by independent public accountants from fiscal years 2020 through 2023 was completed within the 12-month time frame established in the NDAA for fiscal year 2018 or received a waiver to the 1-year reporting completion requirement.[23] DCAA recommended and the Under Secretary of Defense (Comptroller) granted waivers for 12 of the 485 audits completed by independent public accountants.[24] Among these was one incurred cost audit from our sample. In this instance, the audited contractor submitted a request for a waiver to DCAA when the COVID-19 pandemic reduced staff availability and personnel changes delayed data gathering for the audit.

The final reports for all 57 of the incurred cost audits we reviewed were delivered within agreed upon time frames. However, according to contract file documentation, each of the independent public accountants responsible for completing these incurred cost audits requested extensions at least once to meet milestones. Independent public accountant representatives and COR officials told us that some audited contractors are reluctant to provide data for independent public accountant-led audits. In addition, some independent public accountants described challenges in meeting reporting deadlines. One independent public accountant noted that it found the number of concurrent audits to be challenging. Independent public accountants stated that delays were reported to CORs who then approved changes to audit plan target dates.

According to DCAA officials, DCAA has changed how it packages audits for task orders because of some of these observed issues. For example, DCAA officials stated that they, on average, have decreased the number of audits included in task orders awarded to independent public accountants. In 2019, DCAA awarded as many as 13 incurred cost audits under a single task order to an independent public accountant. DCAA officials stated that, over time, the program developed a better understanding about the number of audits independent public accountants could accomplish under a single task order. According to a DCAA official, they now generally award between five and seven audits per task order.

Recent DOD IG Report Identified Concerns with the Quality and Completeness of Independent Public Accountants’ Work Products

In January 2025, DOD IG reported that it found instances of noncompliance among incurred cost audits completed by independent public accountants.[25] Specifically, DOD IG reviewed 16 audits completed by independent public accountants and found that 11 did not fully comply with government auditing standards. For these 11 audits, the independent public accountants did not obtain evidence to fully support conclusions, use a sufficient sample methodology to support conclusions, sufficiently document their work, or make required inquiries with contractor management.[26] DOD IG recommended that DCAA improve oversight of independent public accountants’ work by:

·       taking steps to ensure task orders provide CORs with the necessary authority to review the work of independent public accountants for compliance with government accounting standards;

·       ensuring particular government auditing standards are addressed in quality control plans and quality assurance surveillance checklists;

·       requiring independent public accountants to submit sample plans for review before they complete fieldwork or deliver reports; and

·       determining whether eight audit reports should be rescinded or revised due to insufficient evidence.

DCAA disagreed with the recommendations, stating that DOD IG had not proven that a systemic, material deficiency exists to warrant them. It also stated that the recommendations are excessive based on the low risk of the audits performed by independent public accountants and would result in increased costs, audit delays, and reduced participation by small businesses in the independent public accountant program. DCAA also disagreed with DOD IG’s assessment that eight audit reports were based on insufficient evidence. DCAA acknowledged, however, that documentation could have been better in some cases, but that it still considered the evidence sufficient.

DCAA Has Not Formally Planned for Future Use of Independent Public Accountants Despite Changes in Workload and Auditor Workforce

DCAA has not formally planned for the future use of independent public accountants or communicated its plans to Congress. In its October 2018 report to Congress, DCAA identified a phased approach to contracting with independent public accountants. Under this approach, the number of incurred cost audits conducted by independent public accountants would increase from 100 per year in fiscal years 2019 and 2020 to 200 per year in fiscal years 2021 through 2025. The audits in fiscal year 2019 and 2020 were to cover an estimated $8.25 billion in auditable dollar value annually, while those in fiscal years 2021 through 2025 were to cover an estimated $16.5 billion in auditable dollar value annually. DCAA determined this number of audits and dollar value would be significant enough to build and maintain an appropriate mix of government and private sector capacity to meet DOD’s current and future need. However, DCAA’s use of independent public accountants has fallen short of this plan. As noted earlier, from fiscal years 2020 through 2023, independent public accountants completed between 99 and 136 incurred cost audits per fiscal year covering approximately $6 billion to $10.7 billion in auditable dollar value annually.

In November 2021, DCAA considered the pros and cons of increasing the use of independent public accountants. According to DCAA officials, DCAA had updated its risk-based sampling policy and revised the criteria it uses to determine which audits are suitable for independent public accountants. These changes reduced both the number of incurred cost proposals requiring audit and the number of audits available to independent public accountants. DCAA determined that it could use independent public accountants to produce an additional 25 to 80 incurred cost audits per fiscal year by assigning them more audits from its regional offices.[27] DCAA officials ultimately decided to maintain rather than increase the use of independent public accountants. This was done, in part, to ensure that DCAA’s regional field offices—which direct and administer the DCAA audit mission at locations near contractors—maintain a knowledge base. Since that time, however, DCAA’s workforce has continued to decrease, falling by about 3 percent to 3,504 auditors from 2021 to 2023.

DCAA officials noted that due to the differences in the types of audits assigned to independent public accountants compared to those conducted by DCAA auditors, it is difficult to compare the value of the work performed by each group. For example, DCAA estimated that it spent an average of about $214 million from fiscal years 2020 through 2023 conducting incurred cost audits, which reflected more than a third of the agency’s annual budget. Of this amount, the costs of using independent public accountants averaged about $5 million per year. The audits conducted by independent public accountants were generally less complex by design, and therefore less costly on average than those conducted by DCAA auditors. See appendix I for DCAA’s estimates of cost, timeliness, and return on investment for incurred cost audits.[28]

Despite significant changes to DCAA’s incurred cost audit workload, and a decline in its auditor workforce, DCAA has not formally assessed its future use of independent public accountants nor communicated changes to Congress. The NDAA for Fiscal Year 2018 required DCAA to submit a plan to Congress that includes a description of the audits appropriate for independent public accountants and an estimate of the number and value of incurred cost audits they were to conduct from fiscal years 2019 through 2025.[29] DCAA submitted the plan to Congress in October 2018. However, the act includes an ongoing requirement that DCAA must maintain an appropriate mix of government and private sector capacity to meet current and future DOD needs for the performance of incurred cost audits. DCAA does not know if it has an appropriate mix of government and private sector capacity because it has not assessed its future use of independent public accountants, particularly in light of changing factors since its initial plan in 2018.

Standards for Internal Control in the Federal Government also states that management should establish and monitor activities and design control activities to achieve objectives and communicate quality information to decision-makers, including external stakeholders, so they can manage risks.[30] By formally assessing the future use of independent public accountants, DCAA can identify how to best use independent public accountants to maintain an appropriate mix of government and private sector capacity to meet current and future DOD needs for incurred cost audits to help avoid future backlogs. Additionally, such an assessment would allow DCAA to provide congressional decision-makers with a complete picture of how DCAA intends to use these auditors in the future to help facilitate Congress’s oversight role.

Conclusions

DCAA has made efforts to establish an independent public accountant program that meets the provisions outlined in the NDAA for Fiscal Year 2018. In addition, DCAA’s efforts over the years have enabled the agency to eliminate its incurred cost audit backlog and establish a cadre of independent public accountants to close contracts within expected time frames, helping to limit DOD’s exposure to financial risks. Since the program’s inception, DCAA has made changes to how it selects incurred cost audits for review and the types of audits available for independent public accountants—which has limited the pool of potential audits. Given the elimination of DCAA’s backlog of incurred cost audits, its experiences in using independent public accountants, and decreases in the DCAA audit workforce, DCAA would benefit from a formal assessment of the program to inform its future direction. In the absence of a formal assessment, DCAA may not be able to identify the appropriate mix of DCAA auditors and independent public accountants to meet future DOD needs and to help avoid future backlogs. Communicating this plan to Congress would provide it the information needed to conduct its oversight in light of changing factors since its initial plan for the program.

Recommendation for Executive Action

The Secretary of Defense should ensure that the Defense Contract Audit Agency formally assesses the future use of independent public accountants and communicates its plans to Congress. (Recommendation 1)

Agency Comments

We provided a draft of this report to DOD for review and comment. In its written comments (reproduced in app. II), DOD concurred with our recommendation and stated that it will conduct a thorough evaluation to formally assess the future use of independent public accountants and present the plan to Congress by April 30, 2026. DOD also provided technical comments, which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional committees and the Secretary of Defense. In addition, the report is available at no charge on the GAO website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact me at sehgalm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III.

Mona Sehgal
Director, Contracting and National Security Acquisitions

List of Committees

The Honorable Roger Wicker
Chairman
The Honorable Jack Reed
Ranking Member
Committee on Armed Services
United States Senate

The Honorable Mitch McConnell
Chair
The Honorable Christopher Coons
Ranking Member
Subcommittee on Defense
Committee on Appropriations
United States Senate

The Honorable Mike Rogers
Chairman
The Honorable Adam Smith
Ranking Member
Committee on Armed Services
House of Representatives

The Honorable Ken Calvert
Chairman
The Honorable Betty McCollum
Ranking Member
Subcommittee on Defense
Committee on Appropriations
House of Representatives

In response to our work, the Defense Contract Audit Agency (DCAA) developed estimates based on average costs and return on investment for DCAA- and independent public accountant-led incurred cost audits. We assessed DCAA’s sources and methods for developing these estimates and found them to be reliable and reasonable with the caveat that estimates for DCAA auditors are not comparable to audits by independent public accounts because the scope and complexity of the work they perform varies considerably. For example, DCAA auditors generally work on higher risk and more complex incurred cost audits, such as audits of major defense contractors where DCAA maintains an on-site presence. According to DCAA officials, costs associated with DCAA also include work to assess the adequacy of incurred cost proposals, determining the risk-level for audit selection, and closing low risk proposals with memorandums. Independent public accountants are solely responsible for executing the audits for which they were contracted.

·       Cost. DCAA estimated that approximately $214 million of its $615 million average annual budget represented the costs associated with conducting incurred cost audits from fiscal years 2020 through 2023. DCAA estimated that about $209 million, or about 97.7 percent, was directed to DCAA-led incurred cost audits and related activities. About $5 million, or about 2.3 percent, of the $214 million went toward incurred cost audits conducted by independent public accountants from fiscal years 2020 through 2023. DCAA used these costs as the basis for calculating the average cost per audit.[31]

·       Timeliness. DCAA assesses the timeliness of incurred cost audits against the requirement established in the National Defense Authorization Act (NDAA) for Fiscal Year 2018 that incurred cost audits be completed within 12 months of receiving a qualified incurred cost proposal. According to DCAA officials, exceptions include proposals received prior to enactment of the NDAA requirement, corporate office, and those with approved waivers.

·       Return on investment. DCAA calculates return on investment based on savings that result from contract actions taken by contracting officials in response to audit findings. For example, DCAA officials noted that audit teams may question costs claimed by contractors on the basis that they are not in accordance with the contract terms or regulation. According to DCAA officials, excess costs agreed upon by the government and the contractor are reported by DCAA as savings. DCAA estimated the average return on investment for incurred cost audits by dividing the net savings by the aggregate costs of performing incurred cost audits for each fiscal year.

Table 3 shows the estimated costs, timeliness, and return on investment of DCAA- and independent public accountant-led incurred cost audits.

Fiscal year	Estimated cost per audit	Number of audits	Number of audits subject to NDAA timeliness requirementsa,b	Number of audits completed on time	Estimated return on investmentc
DCAA-led Incurred Cost Audits
2020	$338,001	611	467	467	$1.27
2021	$390,543	461	323	323	$2.03
2022	$414,191	385	285	284	$1.94
2023	$396,191	466	352	352	$4.27
Average	$384,731	481	357	357	$2.38
Independent Public Accountant-led Incurred Cost Audits
2020	$45,591	99	96	96	$0.04
2021	$44,497	133	126	126	$0.10
2022	$44,043	136	134	134	$0.46
2023	$46,897	117	114	114	$0.83
Average	$45,257	121	118	118	$0.35

Source: GAO analysis of Defense Contract Audit Agency (DCAA) data.  |  GAO‑25‑107558

Notes: The National Defense Authorization Act (NDAA) for Fiscal Year 2018 includes a provision that DCAA is to complete incurred cost audits not later than 1 year after the date of a qualified incurred cost proposal. DCAA defines a qualified, or adequate, incurred cost proposal as a submission by a contractor of costs incurred under a flexibly-priced contract that has been qualified by the Department of Defense as sufficient to conduct an incurred cost audit. According to DCAA officials, certain incurred cost proposals are not subject to NDAA requirements because they do not meet the definition of a qualified incurred cost proposal. Incurred cost proposals not subject to NDAA timeliness requirements include proposals received prior to the enactment of the NDAA for Fiscal Year 2018, proposals obtaining a waiver (such as those proposals with limited contractor resources or subject to cease-and-desist orders), and corporate or intermediate home offices, among others. Obligation amounts were not adjusted for inflation and totals may be affected by rounding.

^aOn average, for DCAA-led incurred cost audits, corporate or intermediate home offices represent about half of the proposals not subject to timeliness requirements. The remaining are largely those proposals for subcontracts only, fully reimbursable contracts, or those proposals that have obtained a waiver. About 5 percent of these proposals were not subject to timeliness requirements because they were received prior to the enactment of the NDAA for Fiscal Year 2018, with most audits related to these proposals concluding in fiscal year 2020. In March 2024, DCAA noted that these proposals were pending due to pending litigation and are now being performed.

^bFor independent public accountant-led incurred cost audits, 12 of 15 proposals not subject to timeliness requirements were for those that obtained a waiver. One proposal was received prior to the enactment of the NDAA for Fiscal Year 2018, and two proposals were for corporate or intermediate home office audits and were assigned before DCAA reassessed its criteria for assigning audits to independent public accountants in November 2021.

^cDCAA calculates return on investment by dividing the net savings by the aggregate costs of performing incurred cost audits. Net savings are calculated using the amount of questioned costs sustained and may also include interest payments associated with overpayments. Questioned costs are when a contractor’s claimed costs are not deemed to be in accordance with the contract terms or the Federal Acquisition Regulation. Questioned costs sustained represent savings for the government and are those excess costs agreed upon by the government and the contractor after the completion of each incurred cost audit. The aggregate costs of performing incurred cost audits are calculated by dividing annual funding by direct audit hours charged for incurred cost audits.

GAO Contact

Mona Sehgal, sehgalm@gao.gov.

Staff Acknowledgments

In addition to the contact named above, the following staff members made key contributions to this report: Angie Nichols-Friedman (Assistant Director), Andrew Burton (Analyst-in-Charge), Tracy Abdo, Cassandra Ardern, Lori Fields, Laura Greifner, Zena Kesselman, Mark Oppel, and Thomas Twambly. Other contributions were made by Lidiana Cunningham, Brian Friedman, Jean McSween, and Jonathan Meyer.

GAO’s Mission

The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is through our website. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. You can also subscribe to GAO’s email updates to receive notification of newly posted products.

Order by Phone

The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, https://www.gao.gov/ordering.htm.

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO

Connect with GAO on X, LinkedIn, Instagram, and YouTube.
Subscribe to our Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.

To Report Fraud, Waste, and Abuse in Federal Programs

Contact FraudNet:

Website: https://www.gao.gov/about/what-gao-does/fraudnet

Automated answering system: (800) 424-5454

Media Relations

Sarah Kaczmarek, Managing Director, Media@gao.gov

Congressional Relations

A. Nicole Clowers, Managing Director, CongRel@gao.gov

General Inquiries

https://www.gao.gov/about/contact-us