Think you know how to R.E.V.I.E.W. defined costs?

Expect additions to them.

Rarely do we see a vanilla ECC or PSC. Review carefully for variations in detailed scope information and z clauses (usual spots!).

Check the reimbursement method. Lots of times defined cost through SOCC on ECC contracts get substituted for pre-agreed rates. Often done for simplicity, but can lead to a whole host of problems on long term contracts if inflation, role churn, promotions etc aren’t properly considered.

Similarly on PSCs we see the rule change the other way, where instead of paying on rates they want to pay on defined cost.

Hiccups again if no formal SOCC. Another area of concern is when it’s rates but they are subject to capping, actualisations or reviews based on reasonableness (subjective!).

N.B. Understanding of the “precise” reimbursement method is a huge area of misinterpretation by project staff (on client and supplier side).

With ECCs, you will be reviewing defined costs against a SOCC, so compare these to a vanilla SOCC.

Understand the tweaks, common in things such as pensions, bonuses, sick pay, expenses. Think why?

Also, look to see if the rules specify certain roles that can’t be charged i.e. deemed to be overhead and part of the fee. Key to this will be understanding definitions in and around your working areas.

Next check for any specific mobilisation rules:

• Are there pre commencement rules which must be complied with? For example, the client authorising of on-boarding staff and their locations?
• How detailed is the narrative required as to what is being physically done?
• Is there a cost coding structure to be followed?
• Who (client and supplier side) has to approve the hours, and is it within a time limit?
• Are hours capped/adjusted on timesheets (per day/week or month)?
• Do divisors/utilisation present a risk or opportunity?
• Different rules for agency or subconsultant staff?
• Are there specific rules regarding pre-authorisation of overtime?
• Must CVs be shared in advance with the client? Approved? What if not?
• What rules are given if a new role is being mobilised – how does the rate get considered/calculated?
• Are there mid-term rules to advise on things such as promotions?
• Are there rules on handover periods trying to limit exposure on churn and duplicate costs?
• Are rules different if dealing with regional/overseas offices?

Beyond this work will commence and staff will start charging. Consider the following questions:

• How detailed are the rules in the contract around time charging?
• Must a timesheet specify certain information and be in an agreed format?
• Which roles/grades might overtime apply to?
• Or in fact does the contract give minimal rules? And what potential problems might that bring with it e.g. a supplier who doesn’t even ask staff to do timesheets, they just do central allocations.

Also read the contract rules to better understand the cost management aspects relating to staff, whether this be requirements for organisation charts, resource plans, monthly budget v actual analysis and forecasting reports (with variance narratives).

The above just gives a flavour of rules to look out for when commencing a review of staff cost.

There is one rule I’ve failed to mention. GDPR. I won’t explain it. If you need steer on that then you aren’t the right person to be handling sensitive information and doing staff audits!

Understand the importance of how staff costs are prepared and reported in your project and supplier environment as this influences risk.

• Obtain a good background to the project and your supplier. Consider process reviews to understand preventative and detective controls to drive robust charging and AFP compilation.
• Understand what data can be produced outside of the provided data i.e. payroll reports or global time reports.
• Assess the maturity of the supplier operating open book contracts and the supplier team managing staff costs.
• Look at the stability of the team over time and the reports produced. Much changed?
• Understand the wider environment at the client – is the supplier sharing staff across multiple projects? If so, you may need to liaise with other audit teams or project commercial staff.
• Understand the physical site or office in which supplier staff work. How close is it to the client’s team? How joined up are the teams? Who knows who? What’s the nature of the work? What is the expectation on charging – lots of full time workers or people in and out, booking the odd hour here and there?
• How has the account progressed to date? Staff costs typically start early so expect a conversation with the client cost manager and hopefully a good narrative on cumulative staff costs/headcount/FTEs and progress against the programme. Has the account been heavily reviewed to date? Have costs been disallowed? Accepted by the supplier?
• Finally, where is your audit going? Is it just basic support for the Project Manager in routine and ongoing AFP assessments or something wider? Does your review have Cl50.9/final account implications? Or perhaps the review will have future year’s implications i.e. re-baselining rates?

People data can be heavily protected by GDPR making analysis difficult. On ECC contracts where staff costs need proving back to actual cost, we usually see staff costs anonymised, journalled or separately actualised at routine points in time.

PSCs are that little bit easier as simple time charge data makes a lot of analysis possible, incorporating data fields such as name, role, rate, hours, date, work description etc.

The other issue with staff data is that there’s lots of it, best described as high volume/low value when looking at a transaction level. However, once the data is in a required format, analysis can quickly be undertaken to show:

• Total staff costs per month over time
• Total staff costs per grade per month over time
• Total staff costs per type (DEL, Agency, Subconsultant)
• Total staff costs per type (DEL, Agency, Subconsultant)
• Total staff costs per SOCC cost element per month over time
• Highest bookers/costed individuals
• Hours/costs charged per month per role and over time
• FTE charged per month and over time
• Frequency of bookers; high hours/low hours/overtime patterns
• Average charge rate per role
• SOCC cost items per month

The list is endless but needs to be relevant to the rules of the contract and environment to reveal relevant mis-charging risks.

A powerful, yet simple, piece of analysis is shared below:

A thorough understanding of the environment, plus good data analysis should help shape where costs may be mischarged against the identified rules.

It is important to consider or link all the rules back to specific tests. This should identify people or trends and patterns of interest for further inspection.

Beyond test design, you must also work up a pragmatic sampling strategy for risk based and other core transactions giving the assurance coverage required.

For PSCs, you’ll be testing individual people.

For ECC, you can also look at auditing by cost component.

This keeps sampling simple and manageable.

Remember sampling must be relevant to the wider population, so don’t just focus on a few people at a certain grade or costs in one year.

Request the information required and agree a GDPR compliant review process (for you the data processor and the supplier who is the data controller).

If things appear wrong always try to understand why? What is the root cause of the issue? Control problem? Isolated error? Does the supplier response hang together? Should you be widening your sampling to better understand the problem?