Politico and The Hill on October 5 reported that the IRS had awarded Equifax a sole source $j7.25 million contract “to verify taxpayer identity and to assist in ongoing identity verification and validations needs of the Service.” Naturally, this raised question from all quarters in the wake of the massive data breach suffered by Equifax. It may seem odd when the basic principle of federal procurement is “full and open competition” [48 CFR 6.101] for the IRS to give a sole source contract to Equifax when there are obviously other companies that could also perform the service.
To unravel this situation, we must understand the Government Accountability Office (GAO) bid protest process and the laws and regulations involved. The federal procurement process has a long history of mechanisms to allow disappointed bidders to challenge the government’s procurement actions. Federal procurement regulations (known as the FAR and found at 48 CFR Chapter 1) provide for what is called an agency level protest (48 CFR 33.103) that requires the agency to consider protests presented to the agency. A more formal protest option is to file a protest with GAO. [31 US Code 3552] The other option for protestors is to file an action at the US Court of Federal Claims. [28 US Code 1491(b)(1)]
If the agency receives notice of the protest from GAO in a short, prescribed time, the agency must direct the awarded contractor to not proceed with the performance of the new contract. When this stay of performance is in place, it is common practice for the agency to award a “bridge contract” (essentially an extension of the existing contract) to the incumbent contractor, which is often also the protestor. This is a good way for the losing incumbent contractor to get a few more months of work from the agency. But it also makes it easier for the agency to deal with a successful protest.
In this case, on July 7, 2017, Equifax Information Services, LLC filed a bid protest with GAO against an award by the IRS to an as yet unidentified contractor. [Solicitation TIRNO-17-Q-00047; File Number: B-414907.1] Apparently, the protest was filed within the time limit that required suspension of performance of the new contract. Equifax must have been the incumbent contractor. So the IRS basically extended Equifax as the contractor during the pending protest. This was the $7.25 million contract the news reports are referring to. The IRS justified this sole source award as follows: “A sole source order is required to cover the timeframe needed to resolve the protest on contract TIRNO-17-Z-00024. This is considered a critical service that cannot lapse.”
The IRS Commissioner claimed that “the only alternative” to doing business with Equifax was “to shut down all online access to taxpayer accounts.” This got the attention of GAO, which pointed out that the IRS could have proceeded with the newly awarded contract if the Commissioner had determined in writing “that urgent and compelling circumstances which significantly affect interests of the United States will not permit waiting for the decision of the Comptroller General.” [31 US Code 3553(c)(2)] While this provision and the GAO statement did nothing to make the IRS look good, this statutory authority was probably not useful in this case.
Switching contractors for any major program usually takes weeks if not months to turn over the program to the new contractor, a process which requires the participation of the prior contractor. In this case, it is likely that the agency has no certainty that the protest will be rejected which might require redoing the procurement. Even if the protest is rejected by GAO, Equifax would still have the option of a protest at the US Court of Federal Claims. Even if the Court of Federal Claims rejected the protest, that could be appealed to the US Court of Appeal for the Federal Circuit and even to the Supreme Court. This “bridge contract” that was awarded to Equifax was probably for three to six months. If that contract for that period was worth over $7 million, it should be obvious that Equifax has a financial interest in extending the contract as long as possible.
If Equifax takes that route, at some point after completion of the GAO protest process, IRS would most likely obtain court approval to move forward with the awarded contract even in the midst of appeals. In any event, it appears that the IRS suffered from a common and long standing federal agency problem, trying to successfully explain a complicated situation to Congress.