February 17, 2014

When Should You Provide DCMA with Internal Purchasing Review/Audit Results?

In their final formal request before your scheduled CPSR, DCMA will request the results of any final internal audits performed on your purchasing system during the data call period. The current trend in the industry is to develop a definition of "Internal Audit" that allows "mock" CPSRs to be withheld from DCMA under a variety of legal theories. 

The prevailing withhold theory incorporates the idea that "draft" reviews and audits (reviews that aren't "final") are withholdable - so the theory requires that all reports be delivered and maintained in draft format so DCMA can't see them. DCMA is currently okay with this approach, so contractors use it and nod to each other with a "We got out of THAT one!" wink. 

But are you doing yourself any favors by withholding review results from DCMA before your CPSR? In all but one situation, I would argue that contractors do much more harm to their system status than good by withholding internal review results. Why should you share review results? A few reasons: 

Evidence of DFARS 252.244.7001 Compliance: (c)(18) requires contractors to perform internal reviews to maintain the integrity of their purchasing system. If you don't provide results, DCMA has no evidence of your compliance with this requirement. 

Transparency: this is the trend, isn't it? DCMA expects that compliance with DFARS 252.244-7001(c)(18) will result in reports and metrics that can be accessed by the government (think 52.215-2 concept without sharp teeth). 

Strategy: Consider two situations. In the first, the reviewers find issues in files that were not disclosed during the data call request process and require clarification during the live review or a finding of noncompliance results (keeping in mind that reviewers are not required to request clarification prior to issuing a finding and incorporating that finding in their final report). In the second, the reviewer knows every file issue before the review begins and has information regarding completed and ongoing remediative efforts in place for each such issue. Which CPSR situation sounds more likely to result in purchasing system approval? 

There is one situation in which I would suggest not disclosing internal review findings: when the mock CPSR was conducted too soon before the DCMA CPSR to result in meaningful remediative action. Contractors have all sorts of team names with colors, animals, precious metal types for these efforts. I just call them Winston Wolf jobs. You may remember the Winston Wolf character from Pulp Fiction - the "cleaner" who comes in at the end of the movie to remove evidence of a murder from a car? No one hires Mr. Wolf to detail their ride before a date - he gets called when a car full of blood and brains needs to make it to a trash compactor without incident. 

When a contractor who lets the clock run only has the option of bringing in a Mr. Wolf to "sop up the messy stuff" before DCMA comes onsite, I believe it's acceptable to keep the report in "draft" and withhold from disclosure. In these situations, where the results are fresh and findings/potential remediation are not finalized, it's appropriate under almost any definition of "final audit" to keep that report in draft format.