Key Internal Control Considerations in GovCon Compliance: Hire-to-Retire (Part 1)

In this six-article series, MorganFranklin Consulting’s Government Contracting Compliance team will breakdown business processes and discuss key considerations for government contractors to maintain compliance with federal contracting and Defense Federal Acquisition Regulation (“DFARS”) Business System requirements while establishing, evaluating, and enhancing internal controls.

In this article, we will look at elements of the hire-to-retire business process. The hire-to-retire lifecycle covers the processes involved from recruiting, hiring, paying, and offboarding employees. We will focus on timekeeping and labor, as labor costs—including related fringe benefits such as health, medical, union, and collective bargaining agreement requirements—are highly scrutinized by government audit agencies due to the fact that they are typically the largest component of costs billed to the government and have an elevated risk of inaccuracy due to human error.

Deficiencies in controls around these areas could result not only in reputational damage with government customers but also cash flow impacts due to withholds and/or financial losses to the organization through cost disqualifications, bid lost, fines and penalties.

Key Compliance Consideration #1: Effective Timesheet Review

Most contractors are intimately familiar with the requirement for employees to track and record all time worked, record time to the appropriate cost objective (e.g., direct project, overhead, general and administrative) and for this time to be reviewed and approved by a supervisor at the end of the week or the pay period.

An increased risk of control breakdowns and inadequacies in this system is introduced in the review portion of the process. Effective review of timesheets should extend beyond a simple review of time entered to a project code. While this type of review is important, it is also important that supervisors are monitoring employees through the timekeeping period to ensure they clearly understand what type of work is being performed and the timeframes employees are working so that they have an expectation of what should be included on the employee’s timesheet before they begin the review. Without this level of understanding, supervisors cannot effectively review employees’ timesheets and be confident that the time recorded was actually worked and is reasonable and commensurate with work performed.

How can this risk be mitigated?

The first step in improving timesheet review is informing and training employees in supervisory roles who have timesheet review responsibilities. Training should cover the types of review that should be performed over timesheets, including general compliance (e.g., total time accounting, charging to authorized timecodes) as well as a more subjective review of whether the time recorded is accurate when measured against the work performed during the week and the employee’s presence at the worksite or online, if working remotely. The supervisor must have firsthand knowledge of the scope of work an employee is assigned, what is required of the employee, and which project codes relate to the work the employee is performing. Supervisors should also stay informed on any delays or issues which may cause the task to take longer than originally estimated.

The second step is requiring supervisors to have routine check-ins with employees to monitor overall work progress, the specific tasks employees are performing, and be aware of any attendance or performance concerns. This is increasingly important in today’s hybrid and remote environment when employees may not be working in the same location as their supervisors. Not having adequate communication and monitoring processes in place may lead to auditor concerns around the accuracy of time recorded and approved.

Additionally, if inaccuracies are identified, the supervisors must proactively ensure employees are making timely timesheet corrections. Once corrections are made, the supervisor must then perform a second review of the timesheet prior to final approval.

Key Compliance Consideration #2: Adequate Support for Labor Category Qualifications

Contractors performing on time and materials and cost reimbursable type contracts must ensure that employees performing in the various contract labor categories have the required qualifications as stated by the contract. Ensuring individuals are qualified and gathering and maintaining support to justify the qualification, however, are two separate actions. Where contractors typically fall short, is the latter.

Often, the resume an employee submitted at their time of hire is the resume that stays on file for an employee’s tenure at the organization. In the normal course of business, employees grow in their roles and obtain new training, certifications, and qualifications to allow them to take on new positions. The issue is that these certifications or experiences are often not added to the employee’s official file and resume and therefore are not available as audit support. If audits are performed, and the employee’s qualifications are not adequately documented to meet the labor category the contractor is billing, disallowance of labor costs can occur.

How can this risk be mitigated?

Contractors can combat this in several ways. The two most efficient methods include identifying triggering events which require updates to employees’ resumes and files and implementing annual reviews of employees’ files for accuracy. Triggering events may include an employee being moved to a new role on a project, being assigned to a new project, or completing a training or certification. Employees, project managers, and human resources teams would need to be informed of these events and have a process for collecting the updated documentation. Contractors should implement annual or semi-annual reviews to ensure resumes are up-to-date and comprehensive. If employee qualification data is maintained within a HR or people software system, this data should also be reviewed annually or semi-annually. These reviews can even be incorporated with annual performance evaluations to gain efficiencies.

Conclusion

Strong, well-defined controls over processes that involve labor costs are critical for organizations. While time reporting and credential monitoring are not new concepts for government contractors, the hybrid work environment and fast-moving labor market are new environmental factors. These factors must be considered to ensure that existing processes and controls are adequate in addressing changing organizational atmospheres and risks.

The compliance self-assessment below can be used to consider your organization’s internal controls around timekeeping and labor costs and identify any areas which may need strengthened controls or refreshed training.

Compliance Self-Assessment

• Are timekeeping policies adequately documented to cover review and monitoring guidelines?
• Does current timekeeping and timesheet review training cover guidelines and expectations for review?
• How material to the organization is labor cost and are controls in place sufficient to mitigate risk of non-compliances?
• Is employee information routinely updated as necessary at my organization?
• Are all of our employees qualified to work in the labor categories they currently work in, and do we have documentation to support our assertion?

How MorganFranklin Can Help

We work with our clients to provide guidance to successfully contract with the Federal Government. We provide comprehensive and customized solutions including identification of the government contract risk profile, audit readiness assessments and ongoing audit support, DFARS business system compliance reviews, and implementation of system transformation compliance controls to help businesses efficiently and effectively execute government contracts. To learn more about MorganFranklin’s Government Contracting Advisory Services, contact our experts below.