The DOD’s financial audit efforts are bringing the DCAA down on contractors’ government property systems

The Defense Contract Audit Agency (DCAA) is looking at government property. With that statement, contractors’ ears should be perking up across the *Department of Defense (DOD) contracting space. This is a crossing of the streams between the DCAA and the Defense Contract Management Agency (DCMA), but should contractors be concerned?

As far back as the interim rule around the Defense Federal Acquisition Regulation Supplement (DFARS) contractor business system rules (circa 2011), the six DFARS business systems have been evenly divided between the DCAA, who has responsibility for evaluating the accounting, estimating, and materials management and accounting systems (MMAS) — and DCMA, who has responsibility for purchasing, government property and the earned value management systems (EVMS). Despite the interconnectedness of the business systems, the review organizations have generally stayed within their swim lanes. Lately, though, the streams are starting to cross … sort of.

DCAA’s annual report to congress

The DCAA, in its annual report to congress for fiscal year 2024, published March 31, 2025[1], cited that it had been assisting “DOD’s Financial Improvement and Audit Readiness (FIAR) Posture.”

“DCAA is expanding efforts related to FIAR and is now assisting with DOD's implementation of the strategy to ensure all Government Property in Possession of Contractors is properly controlled, accounted for, and appropriately reported on financial statements of the respective military services and the DLA. DCAA completed an initial inventory of property related to 30 contracts located in 93 locations, finding records were 70 percent accurate. The lessons learned from this inventory will be leveraged as DOD further develops their strategy.”

In its outlook, DCAA stated that:

“DCAA also looks to continue our efforts supporting DOD’s FIAR effort. We recently completed an inventory for the Air Force of Government Furnished Equipment maintained by contractors in 90 locations. We are taking the lessons learned from this effort and will perform an expanded inventory of items and contractors for all services in [fiscal year] 2025. These efforts in determining inventory accuracy and asset value are essential to DOD passing an audit.”

Some industry reactions go something like this: “What does the DCAA know about property?” and “We already have property management system analyses (PMSAs) done by the DCMA, and now additional work by the DCAA?” Well, yes and no. To get a better sense of the DCAA’s role, and to understand the risks that contractors now face with this additional scrutiny, we have to understand FIAR. 

Lighting a FIAR

The Chief Financial Officers (CFO) Act of 1990 has required every federal agency to undergo and pass a financial statement audit. In 2005, the DOD started Financial Improvement and Audit Readiness (FIAR) efforts. However, as of this article and dating back to its first financial statement audit in fiscal year 2018, the DOD (consequently the largest and most complex federal agency) remains without an unmodified (read, “clean”) audit opinion — hence the renaming to Financial Improvement and Audit Remediation. One of the key reasons for this is the DOD’s material weakness related to property in the possession of contractors (PiPoC).

Challenges with existing property oversight

The answer likely falls into two primary areas of disconnect. First, the government property management system that is required by FAR 52.245-1, is not an accountable property system of record (APSR), per the DOD Instruction 5000.64, “Accountability and Management of DOD Equipment and Other Accountable Property.” Among prescribing procedures for accounting for DOD property, the instruction states that, “All accountable property and respective data elements are tracked in an Accountable Property System of Record (APSR).[3]” Section 4.3 of the same instruction lays out the requirements for an APSR as follows:

1. Contains the official records that form the basis for accountability, audit and fiduciary reporting of accountable property.
2. Functions as a sub-ledger to the DOD component accounting system for financial reporting purposes.
3. Enables electronic business transactions to facilitate management of accountable property as directed.
4. Meets the requirements of the Federal Information System Controls Audit Manual or Statement on Standards for Attestation Engagements No. 16, as appropriate.
5. Demonstrates compliance with, or a plan to achieve, the content in DD Form 3042.
6. Accommodates AIT to receive updates on property status.
7. Contains the data elements of Paragraph 4.6 of DODI 5000.64.

None of the above elements from (a)-(g) are required in FAR 52.245-1. Further, the DODI 5000.64 at section 4.4(f) also states, “Third-party property management or accountability systems, e.g. custodial systems, must not supersede or replace the APSR or the accountable property records maintained by the DOD.” The DOD has placed overreliance, as evidenced by the DOD IG’s findings, on contractor systems to function as APSRs when the DOD’s own instructions expressly prohibit it.

The second reason why the DOD faces the PiPoC material weakness is that PiPoC, despite all the regulations and contract clauses, surrounds the oversight requirement. DOD’s PMSA is an analysis, often conducted by reviewers from the DCMA. The “analysis” and “reviewers” portions are important. The DOD IG report states, “We were engaged to audit the DOD Agency-Wide Financial Statements in accordance with generally accepted government auditing standards (GAGAS).” GAGAS chapter 8 has a section on “Using the work of Others.” This would be the applicable section for the DOD IG to use if it were to rely on the results of PMSAs:

• 8.80 Auditors should determine whether other auditors have conducted, or are conducting, audits that could be relevant to the current audit objectives.
• 8.81 If auditors use the work of other auditors, they should perform procedures that provide a sufficient basis for using that work. Auditors should obtain evidence concerning the other auditors’ qualifications and independence and should determine whether the scope, quality, and timing of the audit work performed by the other auditors can be relied on in the context of the current audit objectives.

PMSAs are not audits, and the reviewers conducting them are not auditors. This would limit the ability of auditors to rely on the results. Because PMSAs are not audits, they are not performed to a consistent standard, and findings are not written to GAGAS. The reviewers are also not auditors, meaning that their experience, qualifications, procedures and oversight are also not standardized and/or required to meet the same standards as audits to allow other auditors to be able to rely on the results. Separately, there is also an independence debate as the DCMA falls under the Under Secretary of Defense for Acquisition and Sustainment, which impacts the DCMA’s ability to be independent and allows auditors to rely on their work.

What contractors should be asking

While this focus is an audit of the DOD, there are clear risks to contractors. As the DCAA conducts these audits, contractors could and should be asking:

1. What happens when the DCAA finds record discrepancies, who will it write its findings to?
2. What happens if the DCAA observes other discrepancies outside of this specific scope? After all, GAGAS states that, “Auditors should communicate findings in writing to audited entity officials when the auditors detect instances of noncompliance with provisions of laws, regulations, contracts, and grant agreements that are not significant within the context of the audit objectives but warrant the attention of those charged with governance[5]”
3. Who will get a copy of the report if one is generated (e.g., ACO, PCO, government customers, etc.?)
4. Will contractors have an opportunity to review and respond to any findings?
5. Who is paying for these additional support requirements? These audits are of the DOD records, not the contractor, so it’s unclear where these government audit rights exist (i.e., it may not fall under FAR 52.215-2 Audit and Records-Negotiation[6], which is generally specific to a particular contract, nor FAR 52.245-1(g) System Analysis, as this DCAA work is not intended to inspect or evaluate the contractor’s property system). Arguably, the DCAA review/audit of the DOD’s records has nothing to do with the contractor’s ordinary course of business

When DCAA auditors show up to perform such reviews in support of FIAR, contractors should ask and inquire about scoping questions like those listed above. Even more importantly, contractors should be looking at their property records and management systems and getting ahead of and remediating any risk areas that exist. It may take the DOD and the DCAA some time to figure out how to conduct, use and pay for these reviews, but are you ready for them?