The Contract Was Fine. The Process Around It Wasn't.
A contract compliance case study
This composite case study is based on common issues encountered in government contract administration. Company details and circumstances are illustrative.
A small government contractor recently won several new awards in a relatively short period of time.
Business was good. The programs were performing well. Invoices were going out. Deliverables were being submitted. There were no major customer complaints.
Leadership wasn't particularly worried about contract compliance.
They simply wanted a second set of eyes on their processes.
And that's exactly when a compliance review is most valuable.
We Started With the Contract Files
Rather than asking, “Are you compliant?”—a question almost guaranteed to get a yes—we started by looking at how the contracts were actually being managed.
Could we reconstruct the history of each contract from the file?
Were all modifications present?
Could we identify current funding?
Were deliverables being tracked?
Was there evidence that required submissions had actually been made?
Could we determine which clauses required action or flowdown?
Were important decisions documented somewhere other than an employee's inbox?
Individually, none of these questions is particularly complicated.
Taken together, they tell you a lot about the health of a contracts function.
And that's where things got interesting.
Finding #1: Everyone Knew What Was Going On
This sounds like a good thing.
And operationally, it was.
The Contracts Administrator knew which modification was coming.
The Program Manager knew what the customer wanted.
Accounting knew the latest funding amount.
Leadership knew the program was performing.
But some of that information existed primarily in people's heads, inboxes, and individual tracking tools.
Ask the right person and you could get the answer immediately.
Ask someone else—or imagine that employee leaving the company—and suddenly the answer became much harder to find.
That's a risk I see frequently in growing organizations.
Institutional knowledge is valuable. It just shouldn't be your primary internal control.
Finding #2: The Modification Was There. Implementation Was Another Story.
The contract files contained the modifications.
Check.
But receiving and filing a modification isn't the same as fully implementing it.
One modification changed funding. Another affected the period of performance. Another updated a contractual requirement.
The question became:
Did every person and system affected by those changes get updated?
Contracts may receive the modification, but Accounting, Program Control, the Program Manager, HR, security, purchasing, or subcontract administration may also need to act on it.
That's why a strong modification process doesn't end with:
“Save PDF to contract folder.”
It ends when the organization has evaluated the change, communicated it, implemented it, and documented that implementation.
Finding #3: “Yes, We Submitted It.”
One contract required recurring deliverables.
The team was confident they had been submitted.
And I believed them.
But compliance reviews aren't really about whether someone remembers doing something.
They're about whether the organization can demonstrate that it happened.
Some submission emails were in individual inboxes. Some documentation was in the program files. Other deliverables were easy to verify.
The process simply wasn't consistent.
That distinction matters:
Doing the work is compliance. Documenting the work is audit readiness.
You need both.
Finding #4: Nothing Was Terribly Wrong
This may have been the most important finding of all.
There was no catastrophic compliance failure.
No giant missing contract.
No obvious unallowable-cost disaster.
No contract sitting forgotten in someone's desk drawer.
Instead, we found a collection of small process gaps.
And small gaps are exactly what tend to accumulate as companies grow.
A missing approval here.
An undocumented submission there.
An outdated tracker.
A modification that made it to Contracts but not another department.
None may create a crisis today.
But stack enough of them together—or introduce an audit, employee turnover, rapid growth, a difficult closeout, or a customer dispute—and suddenly those little gaps matter.
The Fix Wasn't More Bureaucracy
This is important, especially for small businesses.
The recommendation wasn't to create six new forms, three committees, and a 75-page contracts manual.
Small government contractors don't need processes designed for Fortune 500 companies.
They need repeatable processes that fit their organization.
In this case, the priorities would be straightforward:
Establish one standard for maintaining contract files.
Create a modification implementation checklist.
Clearly identify responsibility for contractual deliverables.
Retain evidence of submission and acceptance.
Reconcile funding information across Contracts, Accounting and Program Control.
Periodically review active contracts rather than waiting until closeout or an external review.
None of those changes is particularly complicated.
But together, they substantially strengthen the control environment.
The Question Isn't Whether Your Team Is Good
This is probably the biggest misconception about compliance reviews.
They're not an indictment of your Contracts Administrator, Program Manager, Controller, or leadership team.
In fact, some of the organizations that benefit most from an independent review have very good people.
The question is whether the process is strong enough that good performance doesn't depend entirely on those people.
If your Contracts Manager unexpectedly left tomorrow, could someone pick up the files?
Could they determine current funding?
Could they identify outstanding deliverables?
Could they see what changed through each modification?
Could they understand why important decisions were made?
If the answer is yes, you've probably built a pretty healthy contracts function.
If the answer is “Well…Sarah knows all of that,” you've just identified a risk.
What Would Someone Find in Your Contract Files?
That's the value of occasionally looking at your contracts from an outsider's perspective.
Don't ask:
“Do we think we're compliant?”
Ask:
“Could we prove it?”
Then pick a contract file and try.
You may find everything exactly where it should be.
Or you may find a handful of small things worth fixing now—before someone else is the one asking the questions.
Want a quick starting point?
Ally Compliance Solutions created a FREE 20-Question Contract Compliance Check to help small government contractors take a quick look at their current contract administration practices.
Because finding a gap internally gives you an opportunity to fix it.
Finding it during an audit, customer review, or dispute gives you considerably fewer options.
Comments