i \ IŪ J U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL Catalyst for Improving the Environment Audit Report Contractor Invoice Internal Controls Need Improvement Report No. 09-P-0242 September 23, 2009 ------- Report Contributors: Janet Kasper Michael Davis Melinda Burks Jennifer Hutkoff Shannon Schofield Abbreviations CMM Contracts Management Manual CO Contracting Officer COR Contracting Officer Representative EPA U.S. Environmental Protection Agency FAR Federal Acquisition Regulation FMR Financial Monitoring Review OAM Office of Acquisition Management OAR Office of Air and Radiation OARM Office of Administration and Resources Management OIG Office of Inspector General OMB Office of Management and Budget PO Project Officer RTP Research Triangle Park ------- tffcD STAf U.S. Environmental Protection Agency 09-P-0242 f \ Office of Inspector General September 23,2009 5 V|V " 4t PRO"*4- At a Glance Catalyst for Improving the Environment Why We Did This Review We conducted this review to determine whether U.S. Environmental Protection Agency (EPA) controls ensure that invoiced contractor costs are properly supported and allowable in accordance with the Federal Acquisition Regulation. Background In 2008, EPA paid contractors $1.3 billion. To safeguard EPA funds, invoices must be reviewed to determine whether the submitted costs are allowable, allocable, and reasonable. Contractor Invoice Internal Controls Need Improvement What We Found EPA should improve its invoice review procedures to ensure costs are allowable and supported in accordance with the Federal Acquisition Regulation. During our review, we found (1) invoice reviews were not always documented as required by the Contracts Management Manual (CMM), (2) Project Officer reviews were based on incomplete information, (3) monthly progress reports did not always contain the information needed to evaluate invoices, and (4) Agency staff did not perform required rate verifications and math checks. Some responsible for invoice reviews were unaware of the guidance and checklists in the CMM, did not understand the level of documentation needed to review invoices, or did not adhere to the guidance. EPA's Office of Acquisition Management (OAM) Financial Monitoring Reviews (FMRs) have identified repetitive findings related to contractor invoices. The FMRs continue to find errors in invoices that should have been identified when EPA employees reviewed the invoices prior to approval for payment. EPA did not develop a corrective action plan to address invoice review internal control weaknesses identified in FMR findings that were applicable across multiple contracts. Instead, FMR findings are resolved on a case-by-case basis. By not using information on trends identified in the FMR process to improve its policy and procedures, and without adequate controls over the invoice review process, the Agency is vulnerable to fraud, waste, abuse, and mismanagement of the funds that it has a fiduciary responsibility to safeguard. For further information, contact our Office of Congressional, Public Affairs and Management at (202) 566-2391. To view the full report, click on the following link: www.epa.aov/oia/reports/2009/ 20090923-09-P-0242.pdf What We Recommend We recommend that the Assistant Administrator for Administration and Resources Management require OAM to modify the CMM to require use of the checklist for invoice reviews, and have Contracting Officers verify compliance with the policy during invoice reviews. Further, OAM should take corrective actions in response to the trends identified in the FMR reviews. EPA agreed with the findings and provided corrective action plans for addressing all but one of the recommendations in the report. ------- t A \ OFFICE OF INSPECTOR GENERAL September 23, 2009 MEMORANDUM SUBJECT: Contractor Invoice Internal Controls Need Improvement Report No. 09-P-0242 FROM: Melissa M. Heist Assistant Inspector General for Audit TO: Craig E. Hooks, Assistant Administrator Office of Administration and Resources Management This is our report on the U.S. Environmental Protection Agency's (EPA's) review of contractor invoices. This report contains findings that describe the problems the EPA Office of Inspector General (OIG) has identified and corrective actions the OIG recommends. This report represents the position of the OIG and does not necessarily represent the final EPA position. Final determinations on matters in this report will be made by EPA managers in accordance with established audit resolution procedures. The estimated cost of this report - calculated by multiplying the project's staff days by the applicable daily full cost billing rates in effect at the time - is $363,581. Action Required In accordance with EPA Manual 2750, you are required to provide a written response to this report within 90 calendar days. You should include a corrective actions plan for agreed-upon actions, including milestone dates. We have no objections to the further release of this report to the public. This report will be available at http://www.epa.gov/oig. UNITED STATES ENVIRONMENTAL PROTECTION AGENCY WASHINGTON, D.C. 20460 If you or your staff have any questions, please contact Janet Kasper, Director, Contracts and Assistance Agreement Audits, at 312-886-3059 or kasper.ianet@epa.gov. ------- Contractor Invoice Internal Controls Need Improvement 09-P-0242 Table of C Chapters 1 Introduction 1 Purpose 1 Background 1 Noteworthy Achievements 2 Scope and Methodology 2 2 Improvements Needed in Invoice Review Process 4 Guidance Requires Review of Invoices for Cost Reasonableness 4 Invoice Reviews Not Documented 4 PO Reviews Based on Incomplete Information 6 Periods of Performance Differed from Monthly Progress Reports 6 Rate and Mathematical Verification Were Not Performed 8 Recommendations 9 Agency Comments and OIG Evaluation 9 3 Financial Monitoring Reviews Have Identified Repetitive Findings 11 Guidance Requires Internal Control Monitoring 11 Financial Monitoring Reviews Identify Repetitive Contractor Invoice Findings 12 EPA Needs Action Plan in Response to FMR Trends 13 Recommendations 14 Agency Comments and OIG Evaluation 14 Status of Recommendations and Potential Monetary Benefits 15 Appendices A OIG Sample of Contracts and Invoices 16 B Invoice Findings and Contract Numbers 17 C Agency Response to Draft Report 18 D Distribution 21 ------- 09-P-0242 Chapter 1 Introduction Purpose To safeguard U.S. Environmental Protection Agency (EPA) funds paid to contractors, EPA employees must review invoices to determine whether the submitted costs are allowable, allocable, and reasonable. Due to the importance of invoice review, we conducted this audit to determine whether EPA controls ensure that invoiced costs are properly supported and allowable in accordance with the Federal Acquisition Regulation (FAR). Background During Fiscal Year 2008, EPA spent $1.3 billion to procure goods and services from contractors. As defined in FAR Part 31.2, a cost is allowable only when it is (1) reasonable, (2) allocable, and (3) complies with standards promulgated by the United States Office of Management and Budget's (OMB 's) Cost Accounting Standards Board or generally accepted accounting principles and practices appropriate to the circumstances, terms of the contract, and any limitations set forth in the FAR. A cost is reasonable if, in its nature and amount, it does not exceed that which would be incurred by a prudent person in the conduct of competitive business. A cost is allocable if it is assignable or chargeable to one or more cost objectives on the basis of relative benefits received or other equitable relationship. Contracting Officers (COs) are responsible for administering contracts. The FAR specifies that the CO is responsible for ensuring performance of all necessary actions for effective contracting and for safeguarding the interest of the United States in its contractual relationships. In undertaking this effort, COs rely on the contributions of numerous financial, legal, and technical experts. Due to the size and complexity of Agency acquisitions, COs frequently appoint Contracting Officer Representatives (CORs) to perform certain contract administration activities. Over the years, EPA has developed a wide range of unique titles for employees who perform COR duties, such as project officer, work assignment manager, delivery order project officer, task order project officer, and task monitor. Titles and roles are based on the acquisition instrument managed - contract, work assignment, task order, or delivery order. For purposes of this report, Project Officer (PO) refers to all invoice approvers. We use the term COR to refer to those who focus on the technical, day-to-day aspects of contract management on behalf of the CO and who also work closely with POs when approving invoices. 1 ------- 09-P-0242 According to EPA's Contracts Management Manual (CMM), the CO is responsible for performing periodic reviews of invoices to ensure that the contractor, PO, and CORs are properly fulfilling their roles, and that all issues relevant to contract performance are being addressed. The CMM also requires the CO to perform at least one detailed review of an invoice on each contract each year. Noteworthy Achievements EPA's Office of Air Quality Planning and Standards has been responsive to the audit team's comments regarding invoice reviews. During our field work, we expressed our concern about instances where POs did not ensure CORs certified the actual invoice, but rather allowed them to complete checklists based upon monthly progress reports. Immediately, the Office of Air Quality Planning and Standards Team Leader issued guidance to POs to ensure invoices and progress report were in agreement, correct, and accurate. The guidance clarified the process for certifying and approving contractor invoices for payment. Additionally, two COs called a meeting with all their POs and highly recommended they start using the checklist to complete their invoice reviews. Scope and Methodology We conducted this performance audit in accordance with generally accepted government auditing standards issued by the Comptroller General of the United States. These standards required that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. We conducted the audit from September 2008 to August 2009. We also used information collected as part of a separate review of the invoice process the OIG conducted in 2007. We obtained an understanding of the contract invoice review process through analysis of the laws, regulations, and guidance, and an evaluation of internal controls over the process. We reviewed the FAR, the EPA Acquisition Regulation, and the CMM to understand regulations and directives governing contract invoice review. We reviewed OMB Circular A-123 and EPA Order 1000.24 to understand management's responsibility for internal controls. Our analysis of internal controls focused on control activities. We examined the policies and procedures that management established to address the risks associated with the invoicing process. We visited the Office of Air and Radiation (OAR) and the Office of Acquisition Management (OAM), both in Washington, DC, and in Research Triangle Park 2 ------- 09-P-0242 (RTP), North Carolina. We also visited EPA Region 9 in San Francisco, California, and RTP's Financial Management Center. We interviewed COs, POs, CORs, managers in the payment office, and others to determine the process for paying invoices. We reviewed contract clauses, invoices, monthly progress reports and various backup documentation for invoices to determine whether costs were supported and allowable. We obtained a universe of 368 EPA time and material, cost-reimbursable and level-of-effort contracts with a current contract value of almost $8.2 billion from the July 2008 active contract listing. We focused on cost-reimbursable contracts, as opposed to fixed-price contracts, as cost-reimbursable contracts pose a greater risk to the government. Unlike fixed-price contracts, cost-reimbursable contracts charge the government for expenses incurred and do not place full fiscal responsibility and the resulting profit or loss with the contractor. The team judgmentally selected a sample of 10 EPA contracts. We chose five contracts each from EPA Region 9 and OAR to capture a nonstatistical sample from both a national headquarters program office and a region. OAR and Region 9 offices were selected based on the Fiscal Year 2007 OAM accomplishments reports that showed that these offices accounted for a sizeable share of the contract dollars in EPA. The two offices represented 19 percent of the universe of time and material, cost-reimbursable, and level-of-effort contracts. Once the contracts were selected, we selected two of the more recent invoices for each contract. The dollar amount of the invoice was a consideration but not a determining factor. We also selected invoices not related to the same work assignment, task order, or line of accounting so that we would be speaking with different POs and CORs. The 10 OAR invoices selected for review had a total invoice amount of $196,285 (.002 percent of the universe). The 10 invoices selected for Region 9 totaled $3,567,966, of which we reviewed $964,614 (.01 percent of the universe). Since it was a nonstatistical sample, the error rate in the sample cannot be projected to the universe. See Appendix A for more details on the sample of contracts and invoices we reviewed. We reviewed the June 2004 OAM Intranet document titled Lessons Learned From the FMR Program, to obtain an understanding of findings identified by Financial Monitoring Reviews (FMRs) performed for 2004 and prior years. We reviewed more recent FMRs for 2005 and subsequent years to determine if these findings have continued. We are not aware of any recent prior report recommendations specifically related to this report's audit objective. 3 ------- 09-P-0242 Chapter 2 Improvements Needed in Invoice Review Process EPA should improve its invoice review procedures to ensure costs are allowable and supported in accordance with the FAR. We found that: invoice reviews were not documented, PO reviews were based on incomplete information, monthly progress reports did not always contain the information needed to evaluate invoices, and Agency staff did not perform required rate verifications and math checks. Some responsible for reviews were unaware of the guidance and checklists in the CMM, did not understand the level of documentation needed to review invoices, or did not adhere to the guidance. Without adequate controls over the invoice review process, the Agency becomes vulnerable to fraud, waste, abuse, and mismanagement. Guidance Requires Review of Invoices for Cost Reasonableness According to CMM Section 11.2.5, it is the policy of the government to review contract invoices thoroughly for cost reasonableness. The FAR states that no presumption of reasonableness shall be attached to the incurrence of costs by a contractor. The CMM invoice review checklists for POs and CORs illustrate the important items they are to verify prior to invoice approval. The following are some of the questions listed on the invoice review checklists. Does the invoice period of performance cover the progress report period of performance? Are the labor categories and hours billed appropriate for the work required? Are indirect rates and costs billed at the authorized rates for that period of performance? Are other direct costs reasonable and within the contract approved dollar ceiling? Is the math accurate? Invoice Reviews Not Documented POs did not always document their review and approval of contractor invoices. This occurred because POs did not understand the level of documentation needed to sufficiently document invoice reviews. Appropriate documentation is necessary 4 ------- 09-P-0242 to demonstrate that EPA is implementing its responsibility for invoice review. Without documentation, EPA does not have assurance that the costs were evaluated as to whether they are allowable and reasonable. Although the CMM provides checklists for POs and CORs to use in reviewing invoices, the use of the checklists is not mandatory. In the absence of checklists, the CMM requires that the EPA staff reviewing the invoice provide documentation to show that the appropriate review was performed. We found 12 of 20 invoices (60 percent) were not supported by evidence of review, either with a checklist or other documentation. For example: An OAR contractor submitted an invoice for over $29,000 that was paid without any evidence of review. The COR stated that he has the checklist, but he does not use it every time. He explained that it would be helpful to have some kind of training on what he should do and what should go in the file. The COR stated that more guidance on what forms to use and what records should be kept would be beneficial. An invoice for over $413,000 submitted to Region 9 was approved and paid without a checklist or any other evidence of tick marks or other means of showing that it had been reviewed. The PO explained that she spot-checks the cost among the invoice categories and did not document her review. Three factors contributed to the lack of documentation for invoice reviews. First, EPA staff that review invoices believed that they were insufficiently trained in reviewing invoices and documenting those reviews. However, EPA's required training for CORs includes a chapter on the invoice review process, which emphasizes the importance of the function and states that the COR must maintain a file of all invoices, invoice review checklists, and all other documentation associated with the invoice. The training materials include a copy of the invoice review checklist from the CMM. A second reason for the lack of documentation to support the invoice review is that EPA does not require POs to use the checklist in the CMM. According to OAM's Acting Director of Policy, Training and Oversight, the checklist is not mandatory because it is provided as general guidance on how to perform invoice reviews and as a tool to assist those who review invoices. Finally, COs were not ensuring that invoice reviews were appropriately documented. According to the CMM, the CO is responsible for performing periodic reviews, as needed, to ensure that the POs and CORs are fulfilling their roles properly in regard to invoice review. Several COs told us that they do not check on how the POs and CORs are documenting their invoice reviews. 5 ------- 09-P-0242 PO Reviews Based on Incomplete Information For 6 of 20 invoices (30 percent), PO invoice approvals were based on incomplete information. One PO approved two invoices based on invoice review checklists that CORs completed; these checklists were based upon cost information from the monthly progress report rather than the invoice. The PO did not provide the CORs with copies of the invoices to perform their reviews. For the remaining four invoices, the supporting documentation did not contain the detail needed to evaluate the allowability and reasonableness of invoiced costs. Without complete information, costs may be approved without EPA review to assess their allowability and reasonableness. The monthly progress report is an important tool in reviewing the invoice. The report identifies the project's progress, difficulties encountered, and anticipated future activity. However, without reviewing the invoice, the COR cannot accurately assure that costs claimed, as identified on the invoice, are reasonable and commensurate with work performed. For one of the invoices the PO approved using COR-completed invoice review checklists, we found that the cost summary information in the monthly progress report was not reliable. For example, the hours for Professional Level III Engineer reported on the monthly progress report were fewer than those reported on the invoice. The COR identified no exceptions and recommended payment of the invoice based on the monthly progress report alone. The PO approved the invoice for payment. The PO checklist noted, "Direct charges appear to be reasonable, accurate and commensurate with the level of effort performed during this time period." However, the PO's certification was based on the COR's review of information in monthly progress report and not the invoice. The contract terms require invoices to contain a description of the cost charges or detailed explanations for the cost categories when the costs exceeded set dollar amounts. We identified four invoices with other direct costs totaling $39,065 that POs approved for payment without a description of the costs as required in the contracts. For two of the invoices, the costs exceeded the amount specified in the contract for required detailed reporting. The PO approved the invoice in full without the required detailed support for other direct costs. Without detailed information for these costs, the PO cannot determine whether costs incurred and paid by the government are allowable and reasonable for work performed. Periods of Performance Differed from Monthly Progress Reports Four of 20 invoices (20 percent) had periods of performance that differed from the monthly progress report cost summaries. Each of the contracts required that the period covered by the progress reports and invoices be the same. The POs were aware of the different periods of performance, but not all had taken action to correct the issue. With different periods of performance, it's difficult to match the costs reported in the monthly progress report to costs invoiced. 6 ------- 09-P-0242 EPA Acquisition Regulation Section 1552.232-70 paragraph e.l, which is cited in contract terms and conditions, states, "when submitted on a monthly basis, the period covered by invoices or requests for contractor financing payments shall be the same as the period for monthly progress reports required under this contract." According to the CMM, Chapter 11.2.5, Agency personnel are responsible for reviewing the monthly progress report's consistency with invoices and for verifying compliance of both invoices and monthly progress reports with contract requirements. This is reflected in item number 2 of the PO and COR checklists, which questions whether the invoice period of performance cover the progress report period of performance. The CMM states that the CO is to conduct periodic oversight to confirm compliance with invoices and monthly report clauses in the contract. Two of the four invoices with periods of performance that differed from the progress report included: For the Region 9 emergency response contract, the invoice period is based on when relevant documentation is ready, and the progress report is issued monthly. When we asked the PO how she knows that the invoiced billing information is correct, the PO stated that it is correct "because it is done out of the contractor's accounting system." However, just because the information came from the contractor's accounting system does not ensure that it is accurate or allowable. A financial monitoring review of this contractor, performed in July 2008, determined that the contractor was not complying with cost accounting standards. The PO stated she was not aware of the results of the FMR. For an air contract, one invoice was for a single day's worth of subcontract charges, although the subcontractor invoice indicated the period of performance was 3 days. The corresponding progress report covered 14 days' worth of work. The PO explained that this contractor uses different periods of performance on its progress reports and invoices. For example, another invoice that was not in our sample covered four separate monthly progress reports. The PO said she depends on the CORs to tell her whether the contractor did the work. If there are no problems, the PO will approve the invoice. The POs were taking varying levels of action to enforce the terms of contract. One of the POs was working with the contractor to get the period of performance to be the same in the monthly progress reports and invoices. Another PO's team leader said he would take action to address the issue after we brought it to his attention during the audit. The PO responsible for reviewing two of the sample invoices did not consider the differences in period of performance as a problem and did not take action. Invoices that are approved based upon supporting cost documentation that covers a different period of performance presents a significant 7 ------- 09-P-0242 control weakness in the invoice approval process. It also illustrates a lack of enforcement of contract terms. Rate and Mathematical Verification Were Not Performed Agency staff did not perform their required rate verifications and math checks. We found that RTP's Finance Center did not perform these activities, and POs and CORs performed these activities for only 20 percent (4 of 20) of the invoices. Without performing consistent rate verifications and math checks on invoices, there is increased risk that overbillings could occur and not be detected prior to invoice approval and payment. Even though Agency guidance identifies the RTP Finance Center as having primary responsibility for verifying rates and mathematical accuracy of invoices, it is not performing this function. A payment section team leader explained that the RTP Finance Center does not perform the verification because they believe the task is more suitable to CORs. Section 11.2.5.1 of the CMM delegates primary responsibility for rate verification and mathematical accuracy on the invoice to RTP's Finance Center. In particular, the Finance Center is responsible for confirming that the rates billed for indirect costs, as well as for fixed or provisional rates for labor and equipment, are billed consistently with the contract rates. The Finance Center is also required to confirm that total current and cumulative costs are correctly summed, and that rates are correctly multiplied to produce dollars billed for direct and indirect costs (on a sample basis). According to the CMM, the PO and COR are secondarily responsible for verifying rates and mathematical accuracy of the invoice, but performed this function on only 20 percent (4 of 20) of the invoices we reviewed. In one case where the rates were not verified, we identified an overpayment to the contractor of $368. This overpayment resulted from a fixed fee that was calculated using an incorrect base. According to the terms of the contract, the rate for fixed fee was to be applied to professional labor hours. However, the base on the invoice calculation was for professional and nonprofessional labor hours. The PO confirmed that the same problem occurred on additional invoices, which resulted in a total overbilling of $560. This error would have been identified if either the RTP Finance Center or COR had verified the mathematical accuracy of the fixed fee calculation. While the CMM designates RTP Finance Center as having primary responsibility for rate and math verification, our observation is that the PO and COR are in a better position to conduct this review. The PO and COR maintain files that include the invoices and contract documents that would be needed to verify that the contractor is billing the correct rates. The PO, when approving the invoice, is expressing an opinion as to whether EPA should approve the invoice, which 8 ------- 09-P-0242 would require verification of the rates and mathematical accuracy of the invoice. OAM should reassign the responsibility for rate and math verifications to the POs and CORs. Although in our sample of 20 invoices the amount overpaid was minimal, it illustrates the importance of checking math and verifying rates. Given that RTP pays out more than $1 billion annually in contract payments, this dollar value could escalate considerably if controls are not in place to prevent overpayment. When the rate verification and math checks are not performed, the Agency is susceptible to paying costs that are unallowable or unsupported. See Appendix B for more details on invoice findings. Recommendations We recommend that the Assistant Administrator for the Office of Administration and Resources Management: 2-1 Modify the CMM to require use of the checklist for invoice reviews the CORs perform, and to ensure CORs receive invoices and supporting documentation to assist their reviews. 2-2 Where the progress report and invoice did not cover the same time period, require the contractors identified during this review to revise their progress reports to match the time period of the invoice. 2-3 Re-evaluate the assignment of the responsibility for math and rate verifications on contractor invoices and update the CMM accordingly. 2-4 Require that the COs, as part of the annual invoice review, perform periodic reviews to make certain that the POs and CORs are: a. Implementing changes to the CMM made in response to the audit report. b. Requiring contractors to submit invoices and progress reports with matching periods of performance. Agency Comments and OIG Evaluation In responding to the draft report, EPA agreed to take action to address all of the recommendations, and provided milestone dates for most of the recommendations. Recommendation 2-1. OAM agreed that the CMM should be modified to better define documentation needs at two levels: first, the supporting documentation that needs to be supplied by the contractor to assist the COR in invoice reviews; and second, the documentation that the COR needs to 9 ------- 09-P-0242 prepare to prove that a sufficient invoice review has been performed. OAM will encourage the use of the checklist, and will define the specific documentation that is needed when the checklist is not used. An interim policy notice will be issued by December 31, 2009. The CMM will also be revised, but that may take an additional 6 months. Recommendation 2-2. EPA contracting officers will send a letter to contractors reminding them of the requirement that progress reports and invoices cover the same time period. The letter will be issued by December 31, 2009. Recommendation 2-3. OAM agreed that math and rate verifications are important and that they would discuss the issue of who is responsible for the function with the Office of the Chief Financial Officer in greater depth by November 30, 2009. Based on that discussion, OAM will provide an action plan for addressing the recommendation. In responding to the final report, EPA needs to provide an action plan, with milestone dates, to address Recommendation 2-3. Recommendation 2-4. OAM agreed that contracting officer reviews will be used to verify compliance with the report recommendations. The quality assessment plan policy in the EPA's acquisition handbook will be updated by December 31, 2009. The Agency's full response is provided in Appendix C. 10 ------- 09-P-0242 Chapter 3 Financial Monitoring Reviews Have Identified Repetitive Findings OAM FMRs have identified repetitive findings related to contractor invoices. The FMRs continue to find errors in invoices, some of which the PO and CORs should have identified when reviewing the invoice. EPA did not develop a corrective action plan to address invoice review internal control weaknesses identified in FMR findings that were applicable across multiple contracts. Instead, FMR findings are resolved solely on a case-by-case basis for a specific contract. To maximize the usefulness of FMRs as an internal control tool, the Agency should identify trends in FMR findings and recommendations. The Agency can use this information to review and improve its invoice review process and other areas. Doing so will help reduce the Agency's vulnerability to fraud, waste, abuse, and mismanagement. Guidance Requires Internal Control Monitoring OMB Circular A-123, Management's Responsibility for Internal Control, states that once internal control activities are put into place, continuous monitoring and testing should help to identify poorly designed or ineffective controls. Findings in audit and internal management reviews are one source of information about the effectiveness of internal controls. In addition, a systematic process should be in place for addressing deficiencies. EPA Order 1000.24, which implements OMB Circular A-123, states that all methods of internal controls serve as the first line of defense against fraud, waste, abuse, and mismanagement. EPA's Cost Advisory personnel (i.e., the Financial Analysis Service Center at Headquarters and for the Regions, or the Cost Analysis staffs at RTP and Cincinnati, Ohio) perform FMRs on selected contracts. EPA schedules FMRs on active contracts in excess of $5 million. The CO and Financial Administrative Contracting Officer are responsible for resolving cost and financial issues raised during these reviews. The FMRs target current contractor invoices to determine whether there is adequate contractor data in the accounting records and systems to support the contractor's billings, and to identify potential internal control issues that might not otherwise be found until an audit is performed years later. 11 ------- 09-P-0242 Financial Monitoring Reviews Identify Repetitive Contractor Invoice Findings OAM FMRs have identified repetitive findings related to contractor invoices, meaning similar issues were identified during FMR reviews at different contractors. The OAM Intranet document titled Lessons Learned From the FMR Program (June 2004) identified issues that were noted during FMR reviews, including: overtoiling of indirect costs costs exceeding contract ceilings inadequate support for contract billings ineffective internal controls inadequate policies and procedures noncompliance with contractual and/or regulatory requirements billing costs that are either unallowable, unallocable, or unreasonable missing mandatory contract clauses incorrect billing of fees We found weaknesses and invoice errors during our review of 20 sample contractor invoices similar to the findings identified in the FMRs. For example: For 4 of 20 invoices, the monthly progress report dates differed from the invoice dates, contrary to the requirements stipulated in the contract terms. For 4 of 20 invoices, there was inadequate support for other direct costs. For 1 of 20 invoices, the fee was calculated incorrectly, resulting in an overbilling of the fixed fee. Because OAM's list of findings was several years old, we reviewed more recent FMRs to determine if the issues continued. According to more recent FMRs we obtained for 2005 and subsequent years, these FMR findings have continued. Overall, there were a total of 51 findings identified in the more recent FMRs and our invoice reviews combined. Of the 17 FMR findings from the OAM Intranet document, the more recent FMRs and invoice reviews identified 12 of these findings as continuing, with the most prevalent findings being (1) noncompliance with contractual and/or regulatory requirements, and (2) inadequate support for contract billings. Table 3-1, on page 13, illustrates the trends identified by the FMR findings and this audit. The FMRs continue to find errors in invoices that should have been identified when EPA employees reviewed the invoices prior to approval for payment. For example, overbillings of costs and incorrect fixed fee calculations should be identified during invoice review. Improved internal controls over the invoice review process, such as requiring the use of the invoice review checklist and 12 ------- 09-P-0242 ensuring math checks and rate verifications are performed, would help ensure such errors are detected prior to invoice approval for payment. Table 3-1: Trends Identified by Repetitive FMR Findings and OIG Review More Recent FMR OIG Review of Total Findings FMR Repetitive Findings (2004 and Prior Years) Findings (2005 and Subsequent Years) 20 Sample Contractor Invoices Identified by More Recent FMRs and OIG Review of Invoices Overbilling of direct or indirect costs 3 1 4 Gross underfunding of indirect costs 1 0 1 Cost overruns/exceeding contract ceilings 1 1 2 Inadequate support for contract billings 5 8 13 Noncompliance with contractual and/or 8 6 14 regulatory requirements Pre-billing of subcontractor 1 0 1 cost Billing costs that are either 2 0 2 unallowable, unallocable, or unreasonable Inadequate invoices 3 0 3 Missing mandatory contract clauses 2 1 3 Incorrect billing of fee 1 1 2 Incorrect level of effort 2 0 2 computations Actual rates/cost 4 0 4 significantly higher than the contractor's best and final offer Totals 33 18 51 Source: OIG Analysis of Recent FMR Findings and Results of OIG Review of Sample Invoices EPA Needs Action Plan in Response to FMR Trends EPA has not used the FMR findings to identify changes that are needed in Agency policy and procedures. Consequently, EPA did not develop a corrective action plan to address invoice review internal control weaknesses identified in FMR findings that were applicable across multiple contracts. Instead, FMR findings are resolved on a case-by-case basis for the specific contract reviewed. FMRs are useful tools that serve as a valuable internal control to identify trends that should be addressed. EPA is not using the FMRs as a tool to identify where improvements may be needed in EPA processes. In accordance with OMB Circular A-123, EPA should take corrective actions in response to the trends identified in the FMR findings. These changes may decrease the number of 13 ------- 09-P-0242 repetitive findings and invoice errors identified by the FMRs for contractor billings and reduce vulnerability of contract funds to fraud, waste, abuse, and mismanagement. Recommendations We recommend that the Assistant Administrator for the Office of Administration and Resources Management: 3-1 Analyze FMRs to identify findings that are recurring on multiple contracts. 3-2 Develop a corrective action for addressing the common findings identified in FMRs. Agency Comments and OIG Evaluation In responding to the draft report, EPA agreed with the recommendations and provided milestone dates for completing corrective actions. EPA agreed to conduct an analysis of the results of financial monitoring reviews by November 30, 2009, and to develop a corrective action plan for addressing common findings by December 31, 2009. The Agency's full response is provided in Appendix C. 14 ------- 09-P-0242 Status of Recommendations and Potential Monetary Benefits RECOMMENDATIONS POTENTIAL MONETARY BENEFITS (In $000s) Rec. No. 2-1 2-2 2-3 2-4 3-1 3-2 Page No. Subject Status1 Action Official Planned Completion Date Claimed Amount Agreed To Amount 14 14 Modify the CMM to require use of the checklist for invoice reviews the CORs perform, and to ensure CORs receive invoices and supporting documentation to assist their reviews. Where the progress report and invoice did not cover the same time period, require the contractors identified during this review to revise their progress reports to match the time period of the invoice. Re-evaluate the assignment of the responsibility for math and rate verifications on contractor invoices and update the CMM accordingly. Require that the COs, as part of the annual invoice review, make certain that the POs and CORs are: a. Implementing changes to the CMM made in response to the audit report. b. Requiring contractors to submit invoices and progress reports with matching periods of performance. Analyze FMRs to identify findings that are recurring on multiple contracts. Develop a corrective action for addressing the common findings identified in FMRs. Assistant Administrator for the Office of Administration and Resources Management Assistant Administrator for the Office of Administration and Resources Management Assistant Administrator for the Office of Administration and Resources Management Assistant Administrator for the Office of Administration and Resources Management 6/30/2010 12/31/2009 11/30/2009 12/31/2009 Assistant Administrator for the Office of Administration and Resources Management Assistant Administrator for the Office of Administration and Resources Management 11/30/2009 12/31/2009 1 O = recommendation is closed with agreed-to corrective actions pending C = recommendation is closed with all agreed-to actions completed U = recommendation is undecided with resolution efforts in progress 15 ------- 09-P-0242 Appendix A OIG Sample of Contracts and Invoices Table A-1: Sample of 10 Contracts and 20 Invoices Contract Number Invoice Number Invoice Period of Performance Total Invoice Amount OIG Reviewed Amount Office of Air and Radiation (OAR) Contracts EP-W-07-072 11005 6/1/08 - 6/30/08 $ 6,397.00 $ 6,397.00 11006 6/1/08-6/30/08 29,396.76 29,396.76 EP-D-06-011 8626 12/1/07-12/14/07 20,948.18 20,948.18 8634 12/14/07 2,234.67 2,234.67 EP-W-06-008 25 1/1/08- 1/27/08 13,552.29 13,552.29 2 5/26/08 - 6/30/08 23,695.48 23,695.48 EP-D-07-102 5-35468-8 5/1/08-5/31/08 39,713.89 39,713.89 5-35468-9 6/1/08-6/30/08 43,885.54 43,885.54 EP-W-06-016 BVN0005 6/22/08 6,779.15 6,779.15 BVN0006 8/24/08 9,682.72 9,682.72 OAR Totals $ 196,285.68 $ 196,285.68 Region 9 Contracts 68-W-98-225 269 5/31/08-6/27/08 $ 1,354,174.04 $ 7,167.13 271 6/28/08 - 7/25/08 1,055,408.54 1,864.18 EP-W-06-006 A026 2/25/08 - 3/30/08 122,455.00 55,988.89 A030 6/30/08 - 7/27/08 164,847.68 28,513.48 EP-W-07-022 262-001-005 2/26/08-7/18/08 74,995.72 74,995.72 262-015-002 6/3/08-8/17/08 413,350.43 413,350.43 EP-R9-08-01 2 7/26/08 - 8/29/08 171,964.36 171,964.36 1 7/15/08-7/25/08 2,909.44 2,909.44 EP-R9-07-02 10 7/9/08 92,324.58 92,324.58 11 7/1/08-7/31/08 115,536.76 115,536.76 Region 9 Totals $ 3,567,966.55 $ 964,614.97 Grand Totals $ 3,764,252.23 $ 1,160,900.70 Source: Financial Data Warehouse 16 ------- 09-P-0242 Appendix B Invoice Findings and Contract Numbers Table B-1: Invoice Review Findinc is and Related Contract Numbers Contract Number Invoice Number Invoice Reviews Not Documented PO Review Based on Incomplete Information Monthly Progress Reports Do Not Always Contain Information Needed to Evaluate Invoices Rate and Mathematical Verification Were Not Performed EP-W-07-072 11005 X X 11006 X X EP-D-06-011 8626 X X 8634 X X X EP-W-06-008 25 X 2 X EP-D-07-102 5-35468-8 X 5-35468-9 X EP-W-06-016 BVN0005 X X X BVN0006 X X 68-W-98-225 269 X X 271 X X EP-W-06-006 A026 X A030 X X EP-W-07-022 262-001-005 X X 262-015-002 X X EP-R9-08-01 2 X 1 X X EP-R9-07-02 10 X X X 11 X X X Totals 12 6 4 16 Source: OIG review of 10 sample contracts, and 2 recent invoices for each contract 17 ------- 09-P-0242 Appendix C Agency Response to Draft Report September 16, 2009 MEMORANDUM SUBJECT: Response to Draft Audit Report: Contractor Invoice Internal Controls Improvement, Project OA-FY08-0373 FROM: Craig E. Hooks Assistant Administrator TO: Janet Kasper Director, Contracts and Assistance Agreements Office of the Inspector General We appreciate the opportunity to comment on the report entitled "Contractor Invoice Internal Controls Need Improvement," dated August 10, 2009. Our comments on the report and recommendations are below: Recommendation 2-1 - We recommend that the Assistant Administrator (AA) for the Office of Administration and Resources Management (OARM) modify the Contract Management Manual (CMM) to require the use of the checklist for invoice reviews the contracting officer representatives (CORs) perform, and for CORs to receive invoices and supporting documentation to assist their reviews. Response - We agree that the CMM needs to be modified to better define documentation needs at two levels: first, the supporting documentation that needs to be supplied by the contractor to assist the COR in invoice reviews; and secondly, the documentation that the COR needs to prepare to prove that a sufficient invoice review has been performed. We will encourage CORs to use the checklist if it is applicable to their specific contract. However, that particular list is not suitable for all contracts or all invoices. For cases where it does not apply, we will define the specific documentation that the COR needs to prepare to properly document that an invoice review has been performed. We propose to develop the new documentation definitions by December 31, 2009, which we will promulgate via an Interim Policy Notice. (Formal CMM revisions generally take about 6 months to complete.) 18 ------- 09-P-0242 Recommendation 2-2 - We recommend that the AA for OARM require contractors, where the progress report and invoice do not cover the same time period, to revise their progress reports to match the time period of the invoice. Response - We concur with this recommendation. EPA's contracting officers (COs) will notify their contractors of this requirement, via a written letter, by December 31, 2009. In cases where the contracts do not contain the requirement that progress report and invoice periods match, the contracts will be modified. Recommendation 2-3 - We recommend that the AA for OARM reassign the responsibility for math and rate verification on contractor invoices to project officers (POs) and CORs, and update the CMM accordingly. Response - While we agree that math and rate verifications on invoices are an important internal control that should be required, we believe that assigning responsibility for these reviews needs to be further discussed. In some case, the PO or COR is the most logical candidate to perform such checks; in other cases, OCFO-RTP may be in a better position to do so. We suggest that you modify your recommendation and remove the identification of a specific party as being responsible in all cases. We need to discuss this issue with OCFO in greater depth, and will do so by November 30, 2009. Once this discussion has been held, we will respond to this recommendation accordingly. Recommendation 2-4 - We recommend that AA for OARM require that the COs perform periodic reviews to make certain that POs and CORs are: (a) implementing changes to the CMM made in response to the audit report; and (b) requiring contractors to submit invoices and progress reports with matching periods of performance. Response - We agree with these recommendations. These reviews will be carried out in each COs annual review of invoices as required by their Division's or Region's Quality Assessment Plan (QAP). The QAP policy will be modified accordingly in EPA's Acquisition Handbook, by December 31, 2009. Recommendation 3-1 - We recommend that the AA for OARM analyze financial monitoring reviews to identify findings that are recurring on multiple contracts. Response - We agree with this recommendation. The analysis will be completed by November 30, 2009. Recommendation 3-2 - We recommend that the AA for OARM develop a corrective action for addressing the common findings identified in financial monitoring reviews. Response - We concur with this recommendation. The corrective action plan will be developed by December 31, 2009. 19 ------- 09-P-0242 Should you have any questions regarding this response, please contact John Oliver in the Office of Acquisition Management, at (202) 564-4399. cc: John Gherardini Cris Thompson Joan Wooley John Oliver Yvonne Stiso Elena de Leon Bernie Davis-Ray Sandy Womack-Butler Brandon McDowell 20 ------- 09-P-0242 Appendix D Distribution Office of the Administrator Assistant Administrator for Administration and Resources Management Acting Chief Financial Officer Acting Director, Office of Acquisition Management Agency Follow-up Official (the CFO) Agency Follow-up Coordinator Acting Director, Office of Financial Management Acting Director, Office of Financial Services General Counsel Associate Administrator for Congressional and Intergovernmental Relations Associate Administrator for Public Affairs Audit Follow-up Coordinator, Office of Administration and Resources Management Acting Inspector General 21 ------- |