CPA-IG audit: corp gov

Audit Report Corporate Governance for Contractors Performing Iraq Reconstruction Efforts Report Number 04-006 July 21, 2004 Office of the Inspector General Coalition Provisional Authority Acronyms AMEX American Stock Exchange CPA Coalition Provisional Authority CPA-IG CPA Inspector General DCAA Defense Contract Audit Agency DFARS Defense Federal Acquisition Regulations DoDIG Department of Defense Inspector General FAR Federal Acquisition Regulation GAAP Generally Accepted Auditing Principles GAO Government Accountability Office NASDAQ National Association of Security Dealers Automated Quotation System NYSE New York Stock Exchange PCO Project and Contracting Office PMO Iraq Program Management Office C O A L I T I O N P R O V I S I O N A L O F F I C E O F T H E I N S P E C T O R A U T H O R I T Y G E N E R A L July 21, 2004 MEMORANDUM FOR AMBASSADOR TO IRAQ DEPUTY ASSISTANT SECRETARY OF THE ARMY (POLICY AND PROCURMENT) IRAQ RECONSTRUCTION MANAGEMENT OFFICE SUBJECT: CORPORATE GOVERNANCE FOR CONTRACTORS PERFORMING IRAQ RECONSTRUCTION EFFORTS We are providing this audit report for your information and use. We performed the audit in accordance with our statutory duties contained in Public Law 108-106 which mandates the conduct of audits relating to the treatment, handling, and expenditure of funds by the Coalition Provisional Authority or its successor entities on Iraq reconstruction, and of the programs, operations, and contracts carried out in utilizing such funds. We considered comments from the contractors we visited on a draft of this report in preparing the final report. This final report contains no recommendations. Therefore, no additional comments are required. As no recommendations were made in this report, audit follow-up will not be performed. We appreciate the courtesies extended to the staff. Questions should be directed to Mr. Michael J. Guagliano at (703) 428-0244. Management may request a formal briefing on the results of this audit. The report distribution is shown at Appendix E. Stuart W. Bowen, Jr. Inspector General Coalition Provisional Authority 400 Army Navy Drive • Arlington, Virginia 22202 Office of the Inspector General Coalition Provisional Authority Report Number 04-006 July 21, 2004 Corporate Governance for Contractors Performing Iraq Reconstruction Efforts Executive Summary Introduction: The Coalition Provisional Authority, Office of the Inspector General (CPA-IG), pursuant to Public Law 108-106, “The Emergency Supplemental Appropriations Act for the Defense and Reconstruction of Iraq and Afghanistan,” November 6, 2003, is conducting a series of reviews related to the contracts awarded in support of the Iraq relief and reconstruction efforts. The review of corporate governance is an element of the CPA-IG efforts to deter and detect any fraud, waste, and abuse within the Iraq reconstruction efforts. We judgmentally selected five contractors performing work in Iraq for our audit of corporate governance programs. As part of the CPA-IG efforts to deter and detect any fraud, waste, and abuse within the Iraq reconstruction efforts, this audit directly reviewed corporate governance programs. Future audits will include an assessment of corporate governance programs in the audit scope once a particular review identifies weaknesses in corporate internal controls. Public Law 108-106 authorized $18.4 billion for security, relief, rehabilitation, and reconstruction in Iraq. The Project and Contracting Office∗ manages all activities associated with program, project, asset, construction, and financial management of the reconstruction efforts undertaken by the United States. The Project and Contracting Office established six sectors for the reconstruction effort: Building/Education/Health, Communications/Transportation, Electrical, Oil, Public Works/Water, and Security/Justice. While the Project and Contracting Office is responsible for the overall Iraq reconstruction program, the contractors have an important responsibility for executing programs and projects in the most economical and efficient manner in compliance with laws and regulations. Corporate governance touches all aspects of the way business activities are structured, objectives established, and risks assessed. Effective corporate governance fosters an enterprise-wide attitude of integrity and control consciousness and implements senior management’s commitment to ethical business practices and behavior. Key tenets of corporate governance are integrity and ethical values, codes of conduct, and management support of the program. Corporate governance becomes a key internal control to help ∗ The Coalition Provisional Authority Program Management Office was re-designated as the Project and Contracting Office on June 28, 2004. ensure that the country and people of Iraq receive the greatest benefit from the funds provided for reconstruction. Objective: The objective of this audit was to determine the adequacy and effectiveness of corporate self-governance programs of contractors awarded contracts or task orders funded by the “Emergency Supplemental Appropriation Act for the Defense and Reconstruction of Iraq.” Conclusion: Our review of the governance programs of five major contractors involved in reconstruction projects in Iraq disclosed that viable programs existed at each of those contractors. Governance policies and programs resonate from the most senior officers of those companies and all five companies demonstrated a commitment to ethics and corporate excellence for their reconstruction projects in Iraq. Using their collective past experiences in Iraq and the Middle East, the five contractors were taking unique measures to adapt their respective governance programs to reduce the risk of fraud, waste, and abuse. We believe that governance programs are fundamental to ensuring that companies effectively and efficiently perform on government contracts. Challenges remain as the pace of reconstruction in Iraq continues and we believe that this results in a heightened necessity for governance programs to be in place and to be effective. Addressing those challenges is fundamental to the application of efficient systems of governance. Recommendations: We make no recommendations in this report because viable corporate governance programs existed at each of the five contractors reviewed. ii Table of Contents Executive Summary Background 1 Objective 3 Finding Corporate Governance Programs 4 Appendix A. Scope and Methodology 13 B. Contractor Profiles 15 C. The Sarbanes-Oxley Act of 2002 - Overview and Securities Exchange Requirements 17 D. Defense Federal Acquisition Regulations Subpart 203.70 - Contractor Standards Of Conduct 19 E. Report Distribution 20 Background The Coalition Provisional Authority, Office of the Inspector General (CPA-IG), pursuant to Public Law 108-106, “The Emergency Supplemental Appropriations Act for the Defense and Reconstruction of Iraq and Afghanistan,” November 6, 2003, is conducting a series of reviews related to the contracts awarded in support of the Iraq relief and reconstruction efforts. The review of corporate governance is an element of the CPA-IG efforts to deter and detect any fraud, waste, and abuse within the Iraq reconstruction efforts. The scope and methodology used to perform this audit are discussed at Appendix A. Profiles of the contractors selected for our review are at Appendix B. As part of the CPA-IG efforts to deter and detect any fraud, waste, and abuse within the Iraq reconstruction efforts, this audit directly reviewed corporate governance programs. Future audits will include an assessment of corporate governance programs in the audit scope once a particular review identifies weaknesses in corporate internal controls. Appropriations Act for Reconstruction. Public Law 108-106 authorized $18.4 billion for security, relief, rehabilitation, and reconstruction in Iraq. Of the $18.4 billion, approximately $12.6 billion is for construction efforts and approximately $5.8 billion is for non-construction efforts. The Coalition Provisional Authority (CPA) and its Project and Contracting Office1 (PCO) are responsible for rebuilding Iraq through the execution of those funds appropriated on behalf of the CPA. The PCO manages all activities associated with program, project, asset, construction, and financial management for the reconstruction efforts undertaken by the United States. The PCO established six sectors for the reconstruction effort: Building/Education/Health, Communications/Transportation, Electrical, Oil, Public Works/Water, and Security/Justice. Some contractors have received multiple awards and some awards were made to companies that formed joint ventures to compete for the contracts. While PCO is responsible for the overall Iraq reconstruction program, the contractors have an important responsibility for executing programs and projects in the most economical and efficient manner in compliance with applicable laws and regulations. Corporate governance becomes a key internal control to help ensure that the country and people of Iraq receive the greatest benefit from the funds provided for reconstruction. Corporate Governance. Corporate governance (governance) touches all aspects of the way commercial business activities are structured, objectives established, and risks assessed. Effective governance fosters an enterprise-wide attitude of integrity and control consciousness and implements senior management’s commitment to ethical business practices and behavior. The necessity for self-governance in Iraq is, in fact, increased by the risks associated with the performance of the work and the importance of imparting transparent business practices to Iraq-based commercial partners whose experiences in this regard are likely to have been limited by the years of one-party rule in the country. Moreover, a healthy system of internal controls, ethics, and compliance provides a level of attestation with respect to the use of U.S. dollars that is expected by American taxpayers. Effective governance programs address a code of business ethics, attention to 1 The Coalition Provisional Authority Program Management Office was re-designated as the Project and Contracting Office on June 28, 2004. 1 systems of internal control, commitment to compliance requirements, and adaptation to the changing business environments. Code of Business Ethics. Integrity and ethical values are the product of the entity’s ethical behavior standards, how those standards are communicated, and how those standards are reinforced in practice. Contractor management should establish and maintain a written code of conduct addressing ethical business practices, conflicts of interests, and the expected standards of ethical and moral behavior. Management also should establish and maintain an effective system of internal controls and self- governance. Management should continually demonstrate through words and actions a commitment to high ethical standards and should convey the message that integrity and ethical values cannot be compromised. Management should ensure that employees receive and understand that message and should not condone signs of inappropriate practices. Effective Internal Control Systems. Recent events involving alleged misdeeds by corporate executives and independent auditors have damaged investor confidence in the financial markets. Those events have highlighted the need for strong, competent, and vigilant audit committees with effective authority. In response to the threat to domestic financial markets posed by those events, Congress passed, and on July 30, 2002, the President signed into law the Public Law 107-204 that may be cited as the “Sarbanes- Oxley Act of 2002” (the Sarbanes-Oxley Act). Pertinent extracts of the Sarbanes-Oxley Act (15 U.S.C. 7201) are discussed at Appendix C. The Sarbanes-Oxley Act mandates sweeping corporate disclosure and financial reporting reform to improve the responsibility of public companies for their financial disclosures. In addition, Sarbanes-Oxley requires corporations to document and certify to the effectiveness of their internal control systems. Among the areas of enhanced transparency and accountability, the Sarbanes-Oxley legislation and the subsequent Security and Exchange Commission regulations: • require corporate officers to certify that they are responsible for establishing, maintaining, and regularly evaluating the effectiveness of the issuer's internal controls; • provide for improved transparency in financial reporting and independent audits and accounting services; • increase corporate responsibility through the promotion of ethical codes; enhance conflict of interest standards and disclosures; and improve management’s assessment of internal controls. Academic research has suggested that the creation and enforcement of effective systems of governance may provide substantial benefits to companies in terms of both legal and financial measurements. Conversely, the absence of an ethical tone and systems of governance to support its vigilance may negatively affect a company’s reputation and result in legal difficulties. The tie between the “tone at the top,” the executable company function, and the checks and balances in between is clearly a product of a company’s culture of governance. Government Compliance. The Federal Acquisition Regulation (FAR), Part 3, prescribes policies and procedures for avoiding improper business practices and personal conflicts of interest and for dealing with their apparent or actual occurrence. The 2 Defense Federal Acquisition Regulations (DFARS) section 203.7000 concerning policy states “Government contractors must conduct themselves with the highest degree of integrity and honesty.” The FAR, Part 3, and the corresponding provisions of DFARS, concern topics that may be addressed by the CPA-IG initiative on governance. DFARS “Subpart 203.70 – Contractor Standards of Conduct” is discussed in more detail at Appendix D. Performing U.S. government contract work requires that contractors provide strict adherence to prescribed compliance standards. Specifically, the contractors must take measures to ensure adherence to government compliance in areas such as billing systems, cost accounting standards, labor records, purchasing systems, and flow-down clauses for subcontracting. Strong governance in those defined areas is essential to maintain compliance with government requirements in the interests of the public trust. Government oversight agencies such as the CPA-IG and the Defense Contract Audit Agency (DCAA) are focused on such efforts. Objective. The objective of this audit was to determine the adequacy and effectiveness of corporate self-governance programs of contractors awarded contracts or task orders funded by the “Emergency Supplemental Appropriation Act for the Defense and Reconstruction of Iraq.” 3 Corporate Governance Programs Our review of the governance programs of five major contractors involved in reconstruction projects in Iraq disclosed that viable programs existed at each of those contractors. Governance policies and programs resonate from the most senior officers of those companies and all five companies demonstrated a commitment to ethics and corporate excellence for their reconstruction projects in Iraq. Using their collective past experiences in Iraq and the Middle East, the five contractors were taking unique measures to adapt their respective governance programs to reduce the risk of fraud, waste, and abuse. We believe that governance programs are fundamental to ensuring that companies effectively and efficiently perform on government contracts. Challenges remain as the pace of reconstruction in Iraq continues and we believe that this results in a heightened necessity for governance programs to be in place and to be effective. Addressing those challenges is fundamental to the application of efficient systems of governance. Code of Business Ethics The Sarbanes-Oxley Act, section 406, requires public companies to institute a code of ethics for senior financial officers to promote “honest and ethical conduct, including the ethical handling of actual or apparent conflicts of interest between personal and professional relationships and full, fair, accurate, timely, and understandable disclosure and compliance with applicable governmental rules and regulations.” Each of the contractors we visited had established a code of business ethics that had been approved by the company’s board of directors, members of the board of director’s ethics committee, or senior management. Each of the contractors was providing training to its employees on its respective code of business ethics. The content of the respective code of business ethics was unique to each of those contractors. However, each code of business ethics covered similar issues such as equal employment opportunities, antitrust and competition laws, and standards of conduct that included ethics provisions. For example, one contractor’s Code of Business conducts states: “The [contractor] Code of Business Conduct is a guide for every Company Director, officer, employee and agent in applying legal and ethical practices to their everyday work. The Code describes not only our standards of integrity, but also some of the specific principles and areas of the law that are most likely to affect us. There is no quality more important than integrity. Integrity is a core value in our Code of Business Conduct. Compliance with the law and honesty and integrity in our dealings with others are not to be sacrificed in the name of profits. Management does not and will not condone any such actions.” While a code of business ethics sets the broad and general tone for the contractors employees, the companies’ attention to internal control systems, commitment to government compliance, and adaptation to changing business environments further refined the corporate governance programs of those contractors. 4 Reviews of Internal Controls The Sarbanes-Oxley Act focuses companies on the need for external audit and internal review of company policies and procedures and places a premium on strengthening internal control systems. Each of the contractors we visited was adopting comprehensive programs to comply with the Sarbanes-Oxley Act. Board of Directors. The Sarbanes-Oxley Act restructured the roles of the board of directors and audit committees for public corporations. Specifically, the Sarbanes-Oxley Act requires specific accountability actions by the board of directors as well as placing the board of directors at risk for actions taken. The board of directors, elected by and accountable to shareholders, is the focal point of the governance system. We found that senior officers of the five companies routinely reported to and were accountable to their boards of directors. Audit Committee. Sarbanes-Oxley Act, section 301, requires that audit committees of public companies establish “...procedures for the receipt, retention, and treatment of complaints received by the issuer regarding accounting, internal accounting controls, or auditing matters, as well as the confidential and anonymous submission by employees of the issuer of concerns regarding questionable accounting or auditing matters.” Audit committees for the five companies exercised an active oversight role. For example, at two companies, the audit committees, comprised of members of the board of directors, provided oversight and served as a check and balance on the companies’ financial reporting systems. The audit committees also provided independent review and oversight of their companies’ financial reporting processes, internal controls, and independent auditors. The audit committees provided a forum separate from management in which auditors and other interested parties could candidly discuss concerns. By effectively carrying out their functions and responsibilities, the audit committees helped to ensure that their managements’ properly developed and adhered to a sound system of internal controls, procedures were in place to objectively assess managements’ practices and internal controls, and independent auditors objectively assessed the companies’ financial reporting practices. Another strength we noted was that each company’s internal audit function reported to the company’s audit committee on a regular basis to discuss ongoing work. The internal audit functions responded to tasks assigned by the audit committees and sought approval for planned future audits. For example, at one company, the Director of the Internal Audit Department reported to the Chief Executive Officer as well as to the Director of the Audit Committee. In another example, one contractor required its corporate officers to provide the internal audit department a list of topics that should be reviewed within its respective global business units. At another contractor, the audit committee established requirements and provided directions for audits that the internal audit department was to perform and approved the proposed annual audit plan. Hotline. All five companies had means for employees and others to report allegations of fraud, waste, and abuse. For several of the contractors, the audit committee or the general counsel provided oversight for the hotline functions. Three of the contractors used an outside party to operate the hotline function which the contractors promoted using e-mail, posters, and training courses. The outside parties reported the results of the hotline to the responsible corporate official. In some cases, either a member of the audit 5 committee or the office of general counsel reviewed each allegation and determined the appropriate course of action to take. At one company, the audit committee assigned the internal auditor to review selected hotline cases and required the internal auditor to report their findings to the audit committee. Disclosure and Exchange Requirements. Sarbanes-Oxley Act, section 404 requires the certifying officers of listed public companies are required to certify to the existence and effectiveness of internal controls of the company. Specifically, the rule requires certifying officers to evaluate and express their opinions on the effectiveness of their company’s internal controls and procedures for financial reporting for the period covering each quarterly and annual report. In addition, Sarbanes-Oxley Act, section 404, requires that company’s external public accounting firms attest to and report on management’s assessment of the effectiveness of internal controls. The Exchanges2 require each issuer to adopt and disclose a code of business conduct and ethics for directors, officers, and employees and disclose any waivers of the code for directors or executive officers in an 8-K filing. The NYSE requires that each issuer must have an internal audit function. NASDAQ requires that an issuer must provide for an enforcement mechanism that ensures clear and objective standards for compliance, a fair process by which violations are determined, prompt and consistent enforcement of the code, and protection for persons reporting questionable behavior. Three of the four companies we visited that were subject to the disclosure requirements had established comprehensive programs to review and strengthen internal controls to ensure that the senior officials of the companies would be able to positively assert to the state of the company’s internal controls. The fourth company was finalizing its draft plan. Compliance with Government Contracting Policy and Procedures Several of the companies took actions to improve their compliance with federal requirements for contractors due to the increase in the amount of federal work that is being offered, especially the Iraq reconstruction efforts. Aside from Iraq-specific work, the contractors performed federal work for other Department of Defense (DoD) components, the Department of Energy, the Department of State, and other government organizations. Government Compliance. All five companies had recently strengthened or emphasized the importance of government compliance to their workforces. The companies had established federal compliance units, hired consultants with expertise in federal system requirements, restructured organizational units for government related operations, and were actively working with the DCAA to make their systems compliant with government requirements. At all five companies, the government compliance officer was at the board director, vice president, or office of the general counsel level within the corporation. Those positions provided appropriate authority to enforce the responsibilities of the government 6 2 For the purposes of this report, “exchanges” means the New York Stock Exchange (NYSE), American Stock Exchange (AMEX), and the National Association of Security Dealers Automated Quotation System (NASDAQ). compliance officer without risk of undue influence from corporate personnel or lack of response by employees. At one company, a consulting firm was hired to assist in developing and refining policies, procedures, and processes to ensure compliance with pertinent federal requirements. Another company established additional policies to address the laws and regulations governing business and contracting with the federal government. One company with a large government business unit, restructured its procurement division to provide a more robust procurement capability by adding a compliance division with five locations throughout the Middle East, including an office in Baghdad. Specifically, the company added additional procurement management staff, established a procurement academy, hired senior procurement officials with extensive federal procurement experience, and provided on-sight procurement training for its personnel deployed to Iraq. In addition, the procurement division and government compliance division of that company were working on resolving past discrepancies identified by DCAA. Another company developed a 2-day government contracting training course to familiarize its employees with government contracting. Several of the companies established compliance groups to provide an additional internal measure of oversight of their company’s efforts. For example, during March 2004, one company established a compliance group to provide internal oversight for its Iraq reconstruction contracts. That compliance group, among other things, conducted pre- submission reviews of the company’s billings to the U.S. Government to ensure that the submitted billings had adequate supporting documentation and were in accordance with prescribed contractual requirements and regulations. As of June 2004, the company had hired five people for the compliance unit, three of whom are former DCAA auditors. In addition to those five members, the company was in the process of hiring an additional compliance group member to be deployed to Iraq. Defense Contract Audit Agency. DCAA has established 10 different Accounting and Management Internal Control Audits for evaluating contractor internal controls and assessing related risk at large contractors. The DCAA Internal Control Audits include “Control Environment and Overall Accounting Controls,” which is a part of governance. According to a DCAA memorandum to the CPA-IG, “Draft Audit Report, Corporate Governance for Contractors Performing Iraq Reconstruction Efforts,” July 16, 2004, DCAA Control Environment and Overall Accounting Controls audits were in process at the majority of the contractors visited by the CPA-IG. DCAA noted that their audits may identify internal control deficiencies related to the contractors’ self-governance programs that are not reflected in the CPA-IG draft report. DCAA had noted in an audit report that certain aspects of DFARS requirements for standards for conduct were not addressed in one company’s policy (one of the companies included in our audit). The company stated that it would evaluate the DCAA recommendations for possible incorporation into updated company policies and procedures. That company, to address the DCAA concern, had established a formal ethics training program for its employees in addition to the ethics requirements documentation the company provides to its employees. DCAA acknowledged that the company was taking aggressive action to resolve those issues. We observed the same actions on the part of that particular company. 7 Overall, we observed that the companies we visited were working closely with DCAA to ensure that management processes and systems were in accordance with applicable federal and DoD standards. For example, one company we visited used personnel experienced in government procurement to oversee a corrective action plan to address deficiencies identified by the DCAA. In our opinion, the governance programs of the companies we reviewed, as those programs pertained to the Iraq reconstruction efforts, were adequate. Contractor Actions Taken for Efforts in Iraq The requirement for effective self-governance for companies performing work in Iraq is, in fact, increased by the risks associated with the performance of the work and the importance of imparting transparent business practices to Iraq-based commercial partners whose experiences in this regard are likely to have been limited by the years of one-party rule in the country. Business Risks. Doing business in Iraq presents a myriad of challenges to the governance programs of the companies involved in the reconstruction of Iraq. Generally, there is an increased business risk attendant to operations involving numerous commercial entities with wide-ranging occupational, ethical, and corporate practices and co-mingled spheres of contractual authority. Those potential problems present challenges to the integration of self-governance mechanisms. Under current circumstances in Iraq, where such challenges are further influenced by a dearth of recent historical reference to transparency in business operations, language barriers, the magnitude of the enterprise, and the overarching impact of security on the conduct of work performance; self- governance risk is further heightened. Addressing these risks, however, is fundamental to the application of efficient systems of self-governance. All five contractors were developing and implementing various governance measures applicable to their reconstruction efforts in Iraq. Specifically, the contractors had established compliance units, hired additional corporate officers to assist in oversight, hired external auditors for reviews of Iraq work, provided daily or weekly updates on Iraq efforts, revised their internal audit functions, and were using their past experiences in Iraq or the Middle East to determine what key governance related documents should be translated into Arabic for Iraqi subcontractors. Corporate Officer Involvement. Iraq reconstruction efforts were receiving the attention of senior corporate officers. In some instances, senior corporate officers were kept apprised of the Iraq reconstruction efforts on a daily basis. For example, according to the President and Chief Operating Officer of one company, he and the Chief Executive Officer were being provided updated reports daily from all business units performing Iraq efforts. In addition, that company’s corporate officers discussed Iraq reconstruction efforts and current news events concerning governance issues related to Iraq. The senior officers of that company, in anticipation of contract awards, discussed establishing a compliance group for providing internal oversight functions for future Iraq efforts. To improve corporate level oversight of their Iraq efforts, several of the companies hired individuals with extensive government contracting experience. For example, one company hired additional corporate officers to aide in providing corporate level oversight of Iraq efforts. In addition, corporate officers and management staff used situational awareness information such as government reports, industry information, media reports, 8 and press articles to identify governance related issues that occurred in Iraq. Company officials stated that they used the reports and information to assess governance issues against the company’s own performance. Audit Oversight. Several of the companies were increasing their internal and external audit capabilities to provide additional oversight of their Iraq reconstruction efforts. Internal Audit. Several companies were increasing the size of their internal audit departments and revising their audit plans to include audits of the Iraq reconstruction efforts. For example, one company hired an additional auditor for its internal audit department because of the anticipated additional oversight workload. Officials of the internal audit departments for the five companies stated that they were incorporating internal oversight for their Iraq efforts. The internal audit departments of two companies had already deployed personnel to either Iraq or Kuwait to review their companies’ operations. Another companies had planned to deploy its internal auditors to Iraq in April 2004 but due to security concerns the trip was postponed until August 2004. External Audit. External auditor oversight provides a measure of independent scrutiny of a company’s performance. For example, one of the companies hired external auditors to augment the indigenous internal audit capabilities. In another example, a company engaged a major accounting and auditing firm to provide additional audit oversight and, as of June 2004, the external auditors were performing a risk analysis for the company’s Iraq reconstruction efforts. The risk analyses was to form the basis for additional specific audit and oversight actions that need to be taken. Iraq Orientation Guide. One company developed a tailored Iraq Employee Orientation Guide to assist its employees deploying or working in Iraq. The orientation guide addressed the ethical responsibilities and obligations of its personnel and provided other pertinent information that the company deemed necessary for deployment of its personnel. Specifically, the guide stated: “recent newspaper articles that described problems with billings and potential ethical lapses on Iraqi contracts... [Contractor] operates all of its business under a Business Ethics Code that makes it quite clear that all employees, agency employees, and agents must comply with all applicable laws and must report information accurately and honest1y. There are further duties to ...avoid conflicts of interest and not to give or receive gifts in the course of business. Clearly, bribery and kickbacks are strictly prohibited and may even be criminal offenses. [Contractor] has a zero tolerance for legal and ethical violations of any type... it is never worth it to jeopardize your employment and reputation, and the reputation of [Contractor], regardless of the circumstances. You must read (or re-read) the Business Ethics Code in the next 14 days.” Training. All five companies had developed training and orientation courses that were to be presented to employees prior to their deploying to Iraq. However, one company was not able to ensure that it had provided all deploying employees compliance training during the initial mobilization process. The company deployed a training instructor to Iraq in May 2004 for targeted compliance training to resolve the situation. In addition, the company prepared an 8-hour compliance training videotape and packets of required reading material to be distributed to its employees in Iraq. Another company had developed a 5-day new-employee orientation program for Iraq operations. This program included ethics and hotline awareness, human resource 9 briefings, proper recording of timesheets using realistic Iraq work environments, and training for preparing expense reports. The company also provided briefings of Iraq operations by company employees who already have experience working in Iraq. Hiring. Several companies established specific new hire programs for their Iraq efforts and three company’s programs included criminal investigations and drug testing for new hires. One of the three companies also performed a psychological screening of the new employees. Translation. Several of the companies had already developed, or were in the process of developing, translation services for employees as well as translation of key governance and code of conduct policies to impart to Iraqi subcontractors. For example, one company provided a translator for pre-bid meetings and job-site visits. Subcontractors who were not familiar with the contracting process were able to ask for and receive one- on-one assistance with deliverables, invoice requirements, payment terms, and other contract terms and conditions. In addition, the company provided technical and procurement staff and a translator, if necessary, during the project execution phase. Further, the company was translating its contracts into Arabic as well as screening the contracts for compliance with Shari’ah3 . Another company was assessing key governance related documents for translation into Arabic for its future subcontracts to Iraqi companies. The company had planned to translate key corporate governance documents for distribution to two distinct levels of the Iraqi workforce. At one level, the company would provide specific policy and procedures in English and translate those documents into Arabic. At the other level, the company was developing one to two pages of key elements of governance that a common laborer would need to know. Those pages would also include a statement to seek out an Iraqi manager if there were questions on acceptable actions, code of conduct, ethics, or other governance matters. Management Support. Management support for governance is critical for success of company programs. The companies we reviewed demonstrated considerable management support for governance programs. The main concern for management was that unethical or liability-creating conduct by company employees would decrease the company’s reputation and/or shareholder value. According to officials of one company, two employees working in Iraq were terminated from service with the company because the military believed that communications send or received were inappropriate. In another example, two companies developed videos for ethics-training that featured the Chief Executive Officer discussing the importance of employees maintaining a high level of ethical conduct. Challenges to Corporate Governance An effective governance system is constantly adapted to its environment when company officials recognize challenges and implement measures to reduce the risks to an acceptable level. When we discussed the challenges of governance with officials of the 3 Shari’ah is the revealed and the canonical laws of the religion of Islam. The legislative power in the government lies in the hands of legislative assembly. The legislators are to make rules and regulations within the scope and dimensions of the Qur'an and the Sunnah of the Prophet (s.a.w.). These rules constitute the Shari'ah. 10 companies we visited, those officials identified several issues that they believed needed to be addressed as the Iraq reconstruction program moved forward. They believed that the government and the companies involved in Iraq will need to work together to effectively meet these challenges. Several of those company officials stated that they were looking to the government to set the tone for conducting business in Iraq. While all applauded the goals established by the CPA to provide transparency and large scale involvement of Iraqi companies and U.S. small businesses in the reconstruction program, they believed that those goals should be tempered with the realities of operating in a high risk, hostile, overseas environment. They also believed that extending their corporate values to international subcontractors would be a significant challenge. Further, company officials were looking for a more orderly process for the awarding of government task orders. Invariably, company officials believed that when task orders are awarded, those orders will require a company to respond quickly and deploy large work forces to accommodate the work. They believed that this immediate and significantly increased amount of work effort can cause strain to the implementation of governance programs. They believed that a more balanced and planned distribution of task orders would allow a company to develop a more well-developed plan to ensure that governance was adequately and effectively instilled into their efforts. Other risks that company officials were concerned about included applying government contracting procedures to the unusual circumstances in Iraq, incorporating new Iraqi government requirements, maintaining controls in a dynamic environment, subcontracting with Iraq companies, and sustaining a high level of Iraqi employment to avoid the incitement of the local population provided employment levels could not be maintained. Lastly, company officials believed that working in a hostile environment that lacks basic amenities afforded to domestic programs also strains governance programs. Specifically, staff levels are smaller than usual, the hours worked are longer, and critical decisions and actions performed in some instances are required within very short timeframes. They believed that such a fast paced rapid environment is conducive to employees doing things that may not comport with accepted governance policies. Conclusion Each company we reviewed demonstrated a viable governance program. Those companies had taken actions to identify and eliminate liability-creating conduct. Officials of each company had designed and implemented governance policies in unique approaches to best meet the needs of their companies. Governance consists predominantly of an attention to systems of internal controls, a code of business ethics, and a commitment to compliance requirements. Sound governance provides reasonable but not absolute assurance that a company and its employees will not engage in liability-creating conduct. However, sound governance should deter and detect such instances and adapt itself to mitigate the chance of the instance from reoccurring. Effective governance facilitates an enterprise-wide attitude of integrity and control consciousness, implements upper management’s commitment to ethical business practices and behavior, and adapts to a changing business environment. 11 We believe that strong internal controls are key to the furtherance of an effective governance program. We further believe that compliance with the Sarbanes-Oxley Act and the extensive disclosure requirements placed on companies strengthens governance programs and provides an additional check and balance to ensure that companies effectively and efficiently perform on government contracts. Moreover, a healthy system of internal controls, ethics, and compliance provides a level of attestation with respect to the use of taxpayer dollars that is expected by the providers of such sources of funds. The U.S. government relies on its contractors’ governance programs as the first line of defense to deter and detect fraud, waste, and abuse. Taxpayers, our coalition partners, and Iraqi citizens are the shareholders with a vested interest in the company’s efforts to implement effective governance programs for the Iraq reconstruction efforts. 12 Appendix A. Scope and Methodology We performed this audit from April to July 2004 in accordance with generally accepted government auditing standards. We judgmentally selected five contractors for our review. The criteria for selecting the contractors were the aggregate contract award amount and the particular Program Management Office (PMO - the Coalition Provisional Authority Program Management Office was re-designated as the Project and Contracting Office on June 28, 2004) sector for which the work was to be performed. The contractors were selected from a list of reconstruction Indefinite Deliver/Indefinite Quantity contracts awarded on behalf of the CPA as of March 27, 2004. Our intent was to provide coverage of high-dollar contracts and provide oversight in as many of the sectors as possible. We performed our audit work at the following contractors: • Fluor-AMEC LLC, Greenville, South Carolina • Halliburton, Houston, Texas • Parsons Corporation, Pasadena, California • Perini Corporation, Boston, Massachusetts • Washington Group International, Boise, Idaho We examined the applicability of defense-specific contractor requirements contained in the DFARS; Sarbanes-Oxley Act requirements (with respect to governance and transparency); and tested the impact of other attendant laws, regulations (such as the FAR), and systems as they applied to effective self-government mechanisms. In particular, we examined the FAR and DFARS requirements related to governance and internal controls and compliance in the performance of a contract. We conducted interviews with corporate officers and managers in human resources, government compliance, government operations, internal audit, and procurement functions who are responsible for the management and oversight of the companies’ Iraq reconstruction efforts. We identified and reviewed the contractors’ various policies and procedures concerning governance in areas such as codes of business ethics, codes of conduct, compliance manuals, corporate policy manuals, internal controls mechanisms and compliance systems, new employee information packages, and training documentation; as well as specific guidance and direction for Iraq operations. We documented the policies and procedures established and compared them to the actions and statements of the corporate officers and managers. In addition to the companies’ policies and procedures that were reviewed, we compiled publicly available data pertaining to governance issues within corporate America, as well as alleged unethical/criminal actions reported to have occurred by companies performing reconstruction efforts in Iraq. Scope Limitation. This review contained scope limitations that could materially impact the results. • We did not perform detailed testing in Iraq of the companies’ field-level compliance with governance policies and procedures. 13 • The DCAA Control Environment and Overall Accounting Control audits currently in process may identify issues we did not detect in our review that relate to corporate governance that could impact the Iraq reconstruction efforts. Use of Computer-Processed Data. We did not use computer-processed data to perform this audit. Prior Audit Coverage During the last 5 years, the Government Accountability Office (GAO) and the Inspector General of the Department of Defense (IG DoD) have issued two reports discussing corporate governance. Unrestricted GAO reports can be accessed over the Internet at http://www.gao.gov. Unrestricted IG DoD reports can be can be access at http://www.dodig.osd.mil/audit/reports. Government Accountability Office GAO-02-494SP, “Highlights of GAO’s Corporate Governance, Transparency and Accountability Forum,” March 5, 2002 DoD Inspector General IG DoD Report No. 2000-6-006, “Evaluation Report on Contractor Self- Governance Programs,” April 25, 2000 14 Appendix B. Contractor Profiles The following provides a synopsis of each contractor judgmentally selected for our review, including prior experience with DoD and other federal agencies: Fluor-AMEC LLC. Fluor-AMEC LLC is a joint venture between Fluor Corporation (USA) and AMEC plc (United Kingdom). Fluor Corporation provides services on a global basis in the fields of construction, engineering, maintenance, operations, procurement, and project management. AMEC provides design, engineering, maintenance support, and project delivery to clients in the industrial, infrastructure, oil and gas, and transport sectors. AMEC works at the local, national and international levels and employs 45,000 people in some 40 countries worldwide. Of the $18.4 billion appropriated for the Iraq reconstruction efforts, Fluor-AMEC LLC has been awarded contracts for Iraq reconstruction projects as follows: Electrical $500M Public Works and Water (NORTH) Public Works and Water (SOUTH) $600M $500M Total $1,600M Halliburton. Founded in 1919, Halliburton is one of the world's largest providers of products and services to the oil and gas industries. The company adds value through the entire lifecycle of oil and gas reservoirs. It provides and integrates products and services; starting with exploration and development, moving through production, operations, maintenance, conversion and refining, to infrastructure and abandonment. Halliburton employs more than 100,000 people in over 120 countries working in five major operating groups. The Engineering and Construction Group, known as Kellogg Brown & Root, serves the energy industry by designing and building liquefied natural gas plants, production facilities and pipelines, and refining and processing plants, both onshore and offshore. The Kellogg Brown & Root non-energy business meets the engineering and construction needs of governments and civil infrastructure customers. Kellogg Brown & Root also provides operations and maintenance for a wide variety of facilities. Of the $18.4 billion appropriated for the Iraq reconstruction efforts, Halliburton has been awarded contracts for Iraq reconstruction projects as follows: Oil (SOUTH) $412M Prior to the Coalition Provisional Authority (CPA) contracts, Halliburton was awarded the Logistic Civil Augmentation Program and Restore Iraqi Oil contracts. Parsons Corporation. Parsons Corporation was founded in 1944 and currently has over 9,000 employee-owners engaged in executing more than 5,000 projects in 46 States and 37 foreign countries. The Parsons Infrastructure and Technology Group – International Division is responsible for Iraq reconstruction efforts. Of the $18.4 billion appropriated for the Iraq reconstruction efforts, Parsons Corporation, including its joint venture partnerships, has been awarded contracts for Iraq reconstruction projects as follows: Buildings, Education, and Health $500M Security and Justice $900M Security and Justice (Iraqi Military Bases) $31M 15 Oil (NORTH) $415M Sector PMO Public Works and Water $55M Total 1,901M Prior to the CPA contracts, Parsons Corporation was awarded the Captured Enemy Ammunition Projects and Tadji Military Base Reconstruction contracts. Parsons has been performing construction efforts in Iraq from the 1950s through the mid-1980s in oil, transportation, and water projects. Perini Corporation. Perini Corporation was founded in 1894 and is ranked fourth among the top 10 power contractors performing operations and maintenance. This ranking reflects the operations of the Perini Corporation Power Group and the company’s ongoing relationship with Exelon Nuclear to provide operations and maintenance support services at 10 power generating stations, consisting of 17 operating units in the United States. Of the $18.4 billion appropriated for the Iraq reconstruction efforts, Perini Corporation has been awarded contracts for Iraq reconstruction projects as follows: Electrical (Transmission and Distribution SOUTH) $500M Prior to the CPA contracts, Perini Corporation was awarded Restore Iraqi Electricity under a U.S. Central Command contract. Perini is the prime contractor of a fasttrack, design/build project for the U.S. Army Corps of Engineers, Transatlantic Programs Center near Kabul, Afghanistan. Perini has begun construction of a 6,000-man training camp for the First Brigade of the Afghanistan National Army. The scope of work includes site development and infrastructure, including electrical power distribution, storage and distribution, waste water treatment, and water supply. Perini also performs contract work for the Department of State for upgrading embassies. Washington Group International. The Washington Construction Company was founded in 1964 and is an integration of more than 16 companies, each with a different niche or specialty. Washington Group International has over 26,000 employees working in 30 countries around the world and focuses on construction, engineering, and management solutions. Currently, the company has six business units; including defense, energy & environment, industrial/process, infrastructure, mining, and power. Washington Group International has been contracted by the CPA to build and repair electrical, water, and other infrastructure. Of the $18.4 billion appropriated for the Iraq reconstruction efforts, Washington Group International has been awarded contracts for Iraq reconstruction projects as follows: Electrical (Transmission and Distribution NORTH) $500M Public Works and Water $600M Total $1,100M Aside from the CPA contracts, Washington Group International is supporting the U.S. Central Command and the U.S. Army Corps of Engineers in Afghanistan in the construction of a number of administration facilities - including a new base to support that country’s military, located south of Kabul, Afghanistan. 16 Appendix C. The Sarbanes-Oxley Act of 2002 - Overview and Securities Exchange Requirements Recent events involving alleged misdeeds by corporate executives and independent auditors have damaged investor confidence in the financial markets. Those events have highlighted the need for strong, competent, and vigilant audit committees with effective authority. In response to the threat to domestic financial markets posed by those events, Congress passed, and on July 30, 2002, the President signed into law the Sarbanes-Oxley Act of 2002. The Sarbanes-Oxley Act of 2002 (Sarbanes-Oxley Act) is codified at 15 U.S.C. 7201. Audit Committees: Functions and Role Requirements to be Effected Through Listing Standards. Sarbanes-Oxley Act, sections 204 and 301, directs the New York Stock Exchange (NYSE), the American Stock Exchange (AMEX), and the National Association of Security Dealers Automated Quotation System (NASDAQ) to issue certain listing standards that impose the following requirements on audit committees’ functions and role: • Independence. Sarbanes-Oxley Act, section 301, requires audit committees must be composed entirely of independent directors. To be “independent” under the Sarbanes-Oxley Act, an audit committee member may not accept any consulting, advisory, or other compensatory fee from the company, except in his or her capacity as a board or board committee member. • Authority to Engage Advisors. Sarbanes-Oxley Act, section 301, requires audit committees must have the authority and any funding it finds appropriate; to engage an outside auditing firm, independent counsel, and other advisers as it determines necessary to carry out its duties. • Employee Complaint Procedures. Sarbanes-Oxley Act, section 301, requires audit committees must establish procedures for the receipt, retention, and treatment of complaints regarding accounting, internal accounting controls, or auditing matters and for the confidential, anonymous submission by employees of concerns regarding questionable accounting or auditing matters. • Auditor Reports to Audit Committees. Sarbanes-Oxley Act, section 204, requires registered public accounting firms to make timely reports to the audit committee of: o all critical accounting policies and practices to be used; o all alternative treatments of financial information within General Accepted Accounting Principles that have been discussed with management, ramifications of the use of such alternatives, and the treatment preferred by the accounting firm; and 17 o other material written communications between the accounting firm and management, such as any management letter or schedule of unadjusted differences. All companies with securities registered pursuant to the Securities Act of 1933 and/or the Securities Exchange Act of 1934 are subject to the Sarbanes-Oxley Act. However, in addition to the corporate governance (governance) standards of the Sarbanes-Oxley Act set forth above, each of the Exchanges (for purposes of this memorandum, “Exchange” means the NYSE, AMEX or NASDAQ) is to require each listed issuer to meet various governance standards, most of which go above and beyond the requirements of the Sarbanes-Oxley Act. The rules of each Exchange with respect to these governance standards vary to certain degrees and there are exceptions for certain foreign private issuers and small business issuers. However, for purposes of this report, a brief explanation of the material governance standards required by the Exchanges is set forth below. Internal Audit Function The NYSE requires that each issuer must have an internal audit function. Corporate Governance Guidelines The NYSE requires that each issuer must adopt and disclose governance guidelines, which include: director access to management, director qualification standards, director responsibilities, and, as necessary and appropriate, annual performance evaluation of the board, director compensation, director orientation and continuing education, independent advisors, and management succession. Code of Business Conduct and Ethics The Exchanges require each issuer to adopt and disclose a code of business conduct and ethics for directors, officers, and employees and to promptly disclose any waivers of the code for directors or executive officers in an 8-K filing. NASDAQ requires that an issuer must provide for an enforcement mechanism that ensures prompt and consistent enforcement of the code, protection for persons reporting questionable behavior, clear and objective standards for compliance, and a fair process by which to determine violations. 18 Appendix D. Defense Federal Acquisition Regulations Subpart 203.70 - Contractor Standards Of Conduct 203.700 Policy. Government contractors must conduct themselves with the highest degree of integrity and honesty. Contractors should have standards of conduct and internal control systems that: (1) Are suitable to the size of the company and the extent of their involvement in Government contracting, (2) Promote such standards, (3) Facilitate timely discovery and disclosure of improper conduct in connection with Government contracts, and (4) Ensure corrective measures are promptly instituted and carried out. 203.7001 Procedures. (a) A contractor's system of management controls should provide for: (1) A written code of business ethics and conduct and an ethics training program for all employees; (2) Periodic reviews of company business practices, procedures, policies, and internal controls for compliance with standards of conduct and the special requirements of Government contracting; (3) A mechanism, such as a hotline, by which employees may report suspected instances of improper conduct, and instructions that encourage employees to make such reports; (4) Internal and/or external audits, as appropriate; (5) Disciplinary action for improper conduct; (6) Timely reporting to appropriate Government officials of any suspected or possible violation of law in connection with Government contracts or any other irregularities in connection with such contracts; and (7) Full cooperation with any Government agencies responsible for either investigation or corrective actions. (b) Contractors who are awarded a DoD contract of $5 million or more must display DoD Hotline Posters prepared by the DoD Office of the Inspector General unless: (1) The contract will be performed in a foreign country; or (2) The contractor has established an internal reporting mechanism and program, as described in paragraph (a) of this section. 19 Appendix E. Report Distribution Office of the Secretary of Defense Under Secretary of Defense (Comptroller)/Chief Financial Officer Director, Defense Procurement and Acquisition Department of the Army Assistant Secretary of the Army, Acquisition, Logistics & Technology Auditor General, Department of the Army Other Defense Organizations Director, Defense Contract Audit Agency Inspector General, Department of Defense Administrator, Coalition Provisional Authority Director, Coalition Provisional Authority Program Management Office Non-Defense Federal Organizations Department of State Office of Management and Budget General Accounting Office U.S. Agency for International Development Inspector General, Department of Health and Human Services Inspector General, Department of Commerce Congressional Committees and Subcommittees, Chairman and Ranking Minority Member Senate Committee on Appropriations Senate Subcommittee on Defense, Committee on Appropriations Senate Committee on Armed Services Senate Committee on Governmental Affairs Senate Committee on Foreign Relations House Committee on Appropriations House Subcommittee on Defense, Committee on Appropriations House Committee on Armed Services House Committee on Government Reform House Subcommittee on Government Efficiency and Financial Management, Committee on Government Reform House Subcommittee on National Security, Emerging Threats, and International Relations, Committee on Government Reform House Subcommittee on Technology, Information Policy, Intergovernmental Relations, and the Census, Committee on Government Reform 20 Audit Team Members This report was prepared by the Office of the Assistant Inspector General for Auditing, Coalition Provisional Authority. John Betar Brian Flynn Robert Murrell Michael Guagliano Gerald Montoya Michael Roark Kristin Caskey Mackensie Ryan