June 06, 2013

General Considerations for Internal Review Processes

I'd like to start the sequence on internal review processes with some top level considerations, then deep dive into issues including components of an effective internal review process; development of internal review teams; and the effective processing of internal review results.

What is the Regulatory Basis for Internal Review Process Requirements?

DFARS 252.244-7001, CONTRACTOR PURCHASING SYSTEM ADMINISTRATION (JUNE 2012) provides the 24 required elements of an approved purchasing system. Failure to adequately address one of these 24 elements can lead to purchasing system failure during a CPSR. DFARS 252.244-7001(c)(18) requires approved purchasing systems to maintain an active internal review process and ongoing training on issues within the federal supply chain. 

What Files Should Be Reviewed?

At a minimum, subcontracts and purchase orders subject to review during a CPSR should be included in the internal review process. This excludes orders issued under competitive firm fixed price contracts, commercial contracts and any contract(s) not issued by the federal government. Intercompany Work Order (IWOs) and certain types of consulting agreements (with individuals or sole proprietors who work under the direct supervision of the contractor) are also excluded from DCMA review during a CPSR.

How Many Files Should Be Reviewed?

Because DCMA will review all subcontracts/POs exceeding $500K in total value and a majority of subcontracts/POs with a total value between $100-500K, I suggest (at the least) including all files with a total value exceeding $100K in the internal review process. In particular, I would suggest mandatory pre-award review of all noncommercial subcontracts with a total value exceeding $650K as those agreements tend to be the "treasure trove" of public law findings. In addition, I suggest that any files subject to advance notice and consent requirements (for contractors without an approved purchasing system that includes LH, T&M and CR type subcontracts/order of any value) are included in the internal review process on at least a "spot audit" basis. 

What Happens If I Don't Have an Internal Review Process Prior to CPSR?

You will receive a finding of deficiency. The severity of this finding will likely be directly proportional to the number and severity of other deficiencies cited during the review. If the system is operating with multiple significant deficiencies, the lack of an internal review process and formal controls could grow to the level of significant deficiency, but generally "lack of formal internal audit/review process" is not a significant deficiency.

My CPSR Data Call Requires Me To Provide The Results of Internal Audits. Do I Have To?

It depends. DCMA requires submission of the results of formal internal audits of the contractor's purchasing system. The key term is "formal" - submission of draft internal audit results to DCMA is not required. If an external consultant is performing a first-time CPSR, request that he or she provide that report with a "DRAFT" watermark. Here's the caveat - if you have no internal audit results to share with DCMA, then you have not shown evidence of a formal internal review process and you will get a finding. We'll talk more about the strategy and issues surrounding submission of internal review results to DCMA prior to a CPSR in a future post. Because of the sensitivity of this issue to many contractors and their counsels, it'll likely get its own post.