Allow me to play a little devil’s advocate here. I have seen a lot of action on the contractor side as many companies scramble to either put in place or guard against what they think is going to happen from the DCAA perspective. I have read some ideas that the ICAPS will go away completely. I have read that DCMA will still rely upon DCAA to perform the same audits they always have, but the responsibility for the reporting and findings will rest with DCMA. I have seen comments run the gamut from little change to HUGE sweeping changes. This is my two cents.
First of all, DCAA has performed ICAPS forever. I will provide a little insight into the auditing world, if I may. Auditors have a duty to ensure that the information they are receiving is current, accurate, complete, etc. They have to make sure that what they are looking at is reliable. An ICAPS (consisting of 10 systems) accomplishes this relatively well – depending on auditor judgment/skill. The proposed rule talks only about 6 major systems.
From what I can tell, DCAA will still be assessing the overall control environment (related to the audits they perform in addition to those performed by DCMA) through the Accounting System review that will still be based on SF1408. Additionally, the IT General Controls will still need to be assessed (most likely by DCAA), as well as Compensation and Indirect & ODCs. Indirect and ODCs could potentially be encompassed under the accounting system review, but the basic requirements in the rule related to these costs are minimal.
Next, DCMA has been relying upon DCAA to perform audits for years. The thought that they can completely get away from DCAA (at least quickly) for performing some of these assessments will be a relatively large challenge. Remember back when you were a kid and your parents did your laundry? Then you went away to school or had to do laundry for yourself for the first time – or cook – or clean – etc. You figured it out through trial and error, but your first couple times doing any of it were “learning experiences.” I can foresee DCMA having to go through these same growing pains with auditing. They are certainly better suited to assess the systems, but they lack the auditing experiences that DCAA has. This is an area I am really interested in seeing work its way out.
In closing, I think the sting of the rule has a while before it becomes as sweeping a change as many believe it will become. Of course it is always wise to be proactive – especially given the size of some of the systems that are out there. The big question is how much work to put in before it becomes overkill?! I come back to a mantra that I have followed my entire life – do the right thing and change shouldn’t affect you (much). Regulations change all the time, but, if you are doing things (like accumulating costs) in a way that is accurate, reliable, and provides complete data, there should be little affect on how you do things. The only changes should be to how you report it, right?