Contractor Business Systems Series: Part 8 – Navigating Business Systems Audits and Reviews

BRENDAN HERIN: Hello and welcome to the Cherry Bekaert GovCon podcast, where we discuss current government contracting trends, compliance matters, and best practices to guide federal contractors forward.

I am Brendan Herin, a Senior Manager at Cherry Bekaert. With me today is Roy Rushing, a Manager in Cherry Bekaert’s Government Contract Advisory Services Group.

This is part of our continuing series on contractor business systems. Today, we will be talking about navigating business systems audits and reviews. Thank you for joining me, Roy.

The big question is why we are discussing how to navigate through business systems audits or reviews. The goal of obtaining an adequate or approved business system is critical to doing business with the government.

To further clarify, there are two primary agencies conducting these reviews. One is a functional review conducted by DCMA, and the other involves actual audit programs conducted by DCAA.

DCAA has responsibility for accounting, estimating, and MMAS. DCMA handles EVMS, property, and purchasing systems.

As one can imagine, this is a major undertaking. There is significant effort required on the part of a contractor as they work through these business system audits and reviews.

Contractors must prepare for the duration of the audit and remain focused on providing timely responses. It is essential to ensure that all provided information is current, accurate, and complete.

Establishing a good routine for preparation and following standard protocols will help avoid findings, deficiencies, or issues resulting from the review.

Roy, once a contractor receives notification that an audit or review is planned, what are some of the early steps they should take?

ROY RUSHING: When you have a contract that is CAS covered or has business system requirement clauses, you should be prepared with a plan for upcoming audits.

First, have an expectation that there will be requests for information and data calls. You should be prepared for walkthroughs with the agency regarding the data they are requesting.

You also want to have well-documented policies and procedures. Keep these current to ensure they are inherent with the requirements of the DoD business systems.

You should put your best people in front of these auditors. Have a subject matter expert (SME) or staff members who can speak to the individual areas or the data being requested.

You do not want to put someone in there who is guessing. Use your functional SMEs, such as your accounting, billing, estimating, and pricing personnel.

If it is a CPSR, you will want your procurement and supply chain staff involved. Because there will be many requests for information, I suggest using a tracking tool.

DCMA or DCAA will have associated timeframes for these requests. You want to ensure they are getting exactly the information they are asking for.

Ensure your staff is properly trained in the areas they are discussing. Develop a clear understanding of the audit or review program being requested, and do not be afraid to ask questions or seek feedback from the agency.

BRENDAN HERIN: You raised some good points, Roy, particularly regarding staffing. You want people who can keep things within the scope of the review or audit program.

This prevents the team from getting off-base or leading the auditor toward unrelated areas. Contractors should also keep in mind that turnaround times for RFIs or data calls can be very aggressive.

Once you receive notification and the process is underway, pay close attention to those deadlines. In some cases, the requested timeframes may not be realistic for pulling data or may conflict with staff PTO.

If there will be a delay, flag it at the onset. You may be able to negotiate additional time if providing the data without a prior internal review is impractical.

While they are not always flexible, you should try to leverage that communication. This emphasizes the importance of monitoring the process closely.

Additional preparation is also key. If you anticipate an initial walkthrough of the system, utilize that time to plan the presentation.

You will typically receive expectations regarding what should be covered. Use that to lay out exactly what you will walk the auditor through.

You could even prepare a presentation with screenshots or examples so you are not scrambling to pull records up in the system. Doing a trial run or rehearsal ensures the process goes smoothly.

While questions will arise, the more you can focus on answering exactly what they need, the more efficient the timeframe will be.

Roy, you mentioned understanding the audit program. Watch for questions or requests that go outside the scope of the audit.

While you want to provide the data needed for testing, you should be cognizant of requests that fall outside those bounds. Engage senior leadership and management so they have visibility into the process.

Leadership involvement is valuable for securing resources to support the review. If there are findings or deficiencies, they can make the necessary tools available to correct those items.

Roy, what are some of the typical timing and scheduling considerations for these reviews?

ROY RUSHING: It depends on which system is being reviewed. DCAA and DCMA have different timing expectations.

With DCAA, you may see an audit start quickly after a contract award. The start and completion dates for business system audits can range from six to 12 months.

You might hear from them within three months of an award regarding inquiries, documents, or walkthroughs of specific systems. DCMA might start even sooner with pre-work assignments and data calls.

They will initially issue RFIs and questionnaires. However, you should be prepared to conduct complete walkthroughs and track all interactions.

Scheduling a walkthrough for an accounting system could happen within weeks. DCAA is usually quick to schedule those initial meetings.

BRENDAN HERIN: I cannot reinforce preparation enough. Roy, you mentioned the RFI tracking tool, which is a simple but valuable step for any contractor.

It allows you to track every inquiry, due date, and response. You should provide a level of detail, such as file names and reports, so you can reference exactly what was provided.

Audits and reviews can go on for an extended period, and there may be turnover on the audit team. You do not want to be penalized for not responding when you actually did.

Monitoring this gives you a record of the process. It also helps you identify exactly which data was involved if a potential finding is flagged.

If a question or request is unclear, ask follow-up and clarifying questions. You do not want to send back data that is off-base or provides additional audit exposure.

Maintain good communication and a professional rapport with the review or audit team. Being clear and establishing a working relationship is important throughout the process.

If issues or findings are detected, you want to be able to work with the team on a corrective action plan. They will be the ones reviewing that plan for adequacy and performing follow-up testing.

ROY RUSHING: I would like to touch on that rapport. Auditors have a lot of work, are often overworked, and follow tight schedules.

They want to get through the audit efficiently. If the contractor provides information promptly and sufficiently, the audit will go much better.

There is a human factor involved. When someone is auditing your work, it can feel personal, but you should not take it personally or antagonize the auditor.

Develop a professional relationship and help them get to the finish line through cooperation. Successfully completing an audit to get an approved system is extremely valuable.

It provides future opportunities that were not available before. Having an approved business system is a great "check in the block" that makes it easier for evaluation teams.

Once the system is approved, the work continues. You must stay current and compliant; it is not a one-time effort.

Keep your policies and procedures current so you are ready for the next round.

BRENDAN HERIN: Those are great thoughts, Roy. Keeping the human factor in mind is important for everyone trying to accomplish their work.

If you are anticipating a review in the future, there is a lot of work you can do now to be ready. In a future podcast, we will discuss the steps to take once an audit is complete.

We will cover corrective actions and the determination process for system status.

Thank you for joining us. If you have any questions, feel free to email Roy Rushing at roy.rushing@cbh.com or myself at brendan.herin@cbh.com. Please join us again for our next podcast.