The 12 Steps of the Cost Estimating Process as Key Elements of Internal Control
As described in this Guide, certain steps should be followed if reliable cost estimates are to be developed. These steps result in an overall process of established, repeatable methods that create high-quality cost estimates that can be easily and clearly traced, replicated, and updated. As such, each step of the cost estimating process can be mapped to one or more principles of an internal control system. For example:
Chapter 5 describes, as part of step 2, the importance of the cost estimating team’s composition and organization. Ideally, cost estimates are prepared according to a schedule by a multidisciplinary team of people who have experience in estimating all cost elements of the program and who have access to subject matter experts who are familiar with the program or a program like it. Thus, an estimating plan relates to the control environment component of an internal control system internal control because it requires management to establish structure, responsibility, and authority (principle 3), demonstrate commitment to competence (principle 4), and enforce accountability (principle 5).
As we describe in step 4 in chapter 7, a WBS is a necessary program management tool because it provides a basic framework for a variety of related activities like estimating costs, developing schedules, identifying resources, determining where risks may occur, and providing the means for measuring program status. Furthermore, we state that a WBS is a valuable communication tool between systems engineering, program management, and other functional organizations because it provides a clear picture of what needs to be accomplished and how the work will be done. Thus, a WBS relates to the information and communication component of an internal control system because it enables management to use quality information to achieve objectives (principle 13), internally communicates quality information (principle 14), and externally communicates quality information (principle 15).
In step 9 (chapter 12), we describe the importance of a risk and uncertainty analysis. For management to make good decisions, the program estimate must reflect the degree of uncertainty so that a level of confidence can be given about the estimate. Having a range of costs around a point estimate is more useful to decision-makers because it conveys the level of confidence in achieving the most likely cost and also informs them on cost, schedule, and technical risks. Thus, a risk and uncertainty analysis relates to the risk assessment component of internal control. A risk and uncertainty assessment helps management define objectives and risk tolerances (principle 6), and identify, analyze, and respond to risks (principle 7).
Chapter 13 explains the importance of step 10, documenting the cost estimate. Documentation provides total recall of the estimate’s detail so that it can be replicated by someone other than those who prepared it. It also serves as a reference to support future estimates. Documenting the cost estimate produces written justification showing how the estimate was developed and aids in updating it as key assumptions change and more information becomes available. Thus, documentation is related to the information and communication component of an internal control system because it helps management use quality information (principle 13) and to communicate internally (principle 14). Case study 30 gives an example of the relationship between inadequate cost estimate documentation and internal control.
Case Study 30: Cost Estimating Documentation and Internal Controls, from Service Contracts, GAO-17-398
Independent government cost estimates (IGCE) are the government’s best estimate of a contract’s potential costs—an important tool for both program and contracting officials to provide information when planning for and awarding contracts. IGCEs are particularly critical for service contracts—accounting for more than $270 billion in government contract spending in fiscal year 2015—to ensure the costs associated with labor are fully understood. GAO was asked to review federal agencies’ use of IGCEs. Officials at the departments in GAO’s review—Defense, Homeland Security, Health and Human Services, Education, Labor, and Housing and Urban Development—developed independent government cost estimates (IGCE) for 62 of the contracts GAO reviewed.
To maximize the use of the IGCE as a high-quality tool, having information about how it was developed, including sources of data and methodology used, is important. In addition, GAO previously found that documenting an IGCE’s methodology and data source in the contract file helped inform future contracting and program officials about the current contract when staff changed. Of the 62 IGCEs GAO reviewed, only 13 included such documentation. In one such case—for a $45 million Army engineering support contract—the IGCE included a statement that the estimate is based on costs from an existing contract and an analysis of labor hours for similar programs. In contrast, the IGCE for another engineering support contract, a $2.8 million award from DHS, lists the number of hours and rates for different labor categories but does not state the source of the information or how it was compiled. In other cases, the IGCEs that were not documented well included some details about their development and methodology in other contract file documents, such as the acquisition plan or price analysis, but this information was generally vague and did not include enough information to provide support for the estimates.
GAO cost estimating guidance and federal internal control standards emphasize the need for documentation, with GAO’s cost estimating guidance stating that well-documented cost estimates describe the data sources used, underlying assumptions, and the estimating methodologies used to derive costs. Without supporting documentation, the effectiveness of the IGCE is weakened, as contracting officers either cannot use it or must spend time gathering information they can use.
Table 50 provides examples of how each of the 12 steps of the cost estimating process can be mapped to the five components of internal control. Table 50 is not intended to be definitive or exhaustive; rather, it provides potential relationships between deficiencies in project control and the entity’s internal control system.
Table 50: Cost Estimating Steps Mapped to Selected Components and Principles of Internal Controls
| Component | Principle | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Control environment |
|
X | X | X | X | ||||||||
|
X | ||||||||||||
|
X | ||||||||||||
| Risk assessment |
|
X | X | X | X | X | X | ||||||
|
X | X | X | ||||||||||
|
X | X | |||||||||||
| Control activities |
|
X | |||||||||||
| Information and communication |
|
X | X | X | X | X | X | X | X | X | X | X | X |
|
X | X | X | X | X | X | X | X | X | ||||
|
X | X | X | X | X | X | X | ||||||
| Monitoring |
|
X | X | ||||||||||
|
X |