Outsourced Pentagon audits return $0.35 per dollar. In-house: $2.38.

In 2017, Congress ordered the Defense Contract Audit Agency (DCAA) to start using private-sector "independent public accountants" to eliminate a backlog of incurred-cost audits -- the audits that determine whether a defense contractor's claimed costs are legitimate before the government pays out or closes a contract.▸ A May 2025 GAO report⧉ found DCAA had actually eliminated the backlog itself, through a new risk-based sampling method, before the outsourcing program's first audits were even completed in 2020 -- and that the outside audits DCAA now relies on for a fifth of its incurred-cost workload return $0.35 for every dollar spent, versus $2.38 for the audits DCAA's own auditors perform. A January 2025 Defense Department Inspector General review⧉, sampling one audit from every one of the nine firms under contract, found 11 of 16 audits violated government auditing standards -- including 8 where the government may never know whether $940 million in contractor costs was ever properly examined. DCAA disagrees with every recommendation both reports make.

DCAA audits the costs defense contractors claim on cost-type contracts -- confirming they're allowable, allocable, and reasonable before a contracting officer can close the contract out.▸ By fiscal year 2011, that workload had piled up into a backlog of roughly 21,000 incurred-cost audits, some based on cost proposals dating to 1996. Section 803 of the 2018 National Defense Authorization Act ordered DCAA to use qualified private accounting firms -- independent public accountants -- to help clear the backlog, complete audits within a year, and maintain what the law called "an appropriate mix of government and private sector capacity." DCAA submitted a plan to Congress in October 2018 projecting these firms would handle 100 audits a year in fiscal years 2019-2020, rising to 200 a year covering an estimated $16.5 billion in contractor costs annually by 2021-2025.

None of that materialized the way it was planned, largely because it wasn't needed the way it was planned.▸ DCAA had already eliminated its incurred-cost backlog by the end of fiscal year 2018 -- before independent public accountants completed their first audit in 2020 -- crediting a new risk-based sampling methodology that sharply cut the number of proposals requiring any audit at all. From fiscal years 2020 through 2023, the outside firms completed just 99 to 136 audits a year: 485 of DCAA's 2,408 total incurred-cost audits, about a fifth of the workload, covering $6 billion to $10.7 billion annually -- well short of the original plan's $16.5 billion target.

DCAA's own auditor workforce shrank from 4,148 in fiscal year 2018 to 3,504 in 2023, and DCAA officials say the outside firms have freed DCAA auditors to focus on more complex reviews -- business-system audits, for instance, rose from under 300 completed a year in 2018-2019 to a peak of 650 in 2022.▸ But despite that shrinking workforce and a program that's fallen well short of its own 2018 plan, DCAA has never formally reassessed how much of this work it should keep outsourcing, nor updated Congress on its plans, as the 2018 law also required. The Pentagon has agreed to finally deliver that assessment -- by April 30, 2026.

What the outsourcing has actually bought shows up starkest in DCAA's own return-on-investment math.▸ DCAA estimates that from fiscal years 2020 through 2023, its own auditors' incurred-cost work averaged $384,731 per audit and returned $2.38 in recovered costs for every dollar DCAA spent conducting it. The independent public accountants' audits averaged a much cheaper $45,257 per audit -- but returned just $0.35 per dollar spent, under a seventh of DCAA's own rate. GAO reviewed DCAA's methodology and found the estimates reliable, with one caveat: DCAA's own auditors generally handle the highest-risk, most complex audits, including on-site work at major contractors, so the comparison isn't apples-to-apples. Even so, a program built in part to save the government money is, by DCAA's own accounting, returning dramatically less of it per dollar than the work it was supposed to supplement.

GAO's report cites, but doesn't independently verify, a separate review that tested a more basic question than return on investment: are these outside audits even competent?▸ The Defense Department's own Inspector General pulled a sample of 16 incurred-cost audits from a universe of 369 completed between October 2018 and September 2022 -- one audit from each of the nine contracted firms, deliberately chosen for the combination auditors should find suspicious: high dollar amounts examined, but almost nothing questioned. Eleven of the 16 -- 69 percent -- violated government auditing standards, with 34 separate instances of noncompliance across them: insufficient evidence to support conclusions in 8 audits, an insufficient sample methodology in 4, inadequate documentation of the work performed in 11, and missing required inquiries into contractor management about prior findings or pending legal proceedings in 11.

The specific lapses read like a checklist of what an audit is supposed to prevent.▸ In one case, an auditor signed off on $1.4 million in equipment-rental costs without invoices or journal entries detailed enough to show the equipment was actually used on the contracts being billed. In another, an auditor accepted $92 million in direct labor costs as reasonable based only on confirming that timesheets were signed -- never comparing the pay rates to salary surveys or labor agreements, the way FAR guidance contemplates. In a third, DCAA had previously questioned $2.7 million in labor costs at the same contractor because the employees didn't meet the contract's labor qualifications -- and the outside auditor never asked whether that problem had been fixed. In a fourth, an auditor sampled from a $1.9 million subset of computing costs while the contractor's actual proposal claimed $5 million, without ever explaining in the workpapers why two-thirds of the claimed costs were excluded from testing. And in a fifth, an auditor set a $14 million materiality threshold for the whole audit, then applied that same threshold to a $358,100 travel-cost line item -- a test built to catch nothing, applied to a category too small for it to ever catch anything.

Add up the dollars behind just the 8 audits where evidence was ruled insufficient, and the government examined $2.88 billion in contractor costs through them -- and questioned a combined $464,000, or 0.016 percent, an amount so small it comes entirely from the 3 of those 8 audits that questioned anything at all.▸ The Inspector General's own estimate of what might be hiding inside that gap: up to $940 million in DoD contractor costs the government can't actually vouch for, because the auditors paid to check them didn't gather enough evidence to know either way.

DCAA disputes essentially all of it.▸ Of the eight audits flagged for insufficient evidence, DCAA says the Inspector General never proved five actually lacked it, and that the other three had documentation gaps -- not evidence gaps. DCAA's central defense of the whole program: the sample covered only 4.3 percent of the 369-audit universe and found noncompliance in just 1.7 percent of workpapers, making this a non-issue rather than a systemic one. The Inspector General's counter: its risk-based sample, while only 4.3 percent of audits by count, covered 35 percent of the dollars examined across the full universe -- and workpapers include large volumes of material that were never the basis for an auditor's conclusions in the first place, meaning DCAA's 1.7 percent figure measures the wrong denominator. All four of the Inspector General's recommendations -- to determine whether the eight flawed reports should be rescinded, to give DCAA's own contract monitors explicit authority to check compliance, to require the outside firms to document how they'll meet auditing standards, and to add auditing-standards questions to DCAA's own review checklists -- remain listed as unresolved. DCAA and the Defense Logistics Agency disagreed with all of them.