Contractor Purchasing System Review (CPSR)

A Contractor Purchasing System Review (CPSR) is a formal government evaluation of a prime contractor's subcontracting and purchasing practices to determine whether they comply with FAR requirements, including competition, flow-down clauses, and cost reasonableness.

What is a Contractor Purchasing System Review?

CPSRs are conducted by the Defense Contract Management Agency (DCMA) when a contractor's purchases from subcontractors and vendors reach certain thresholds, generally $25 million or more in contractor purchasing annually under DoD contracts. The review examines whether the contractor's purchasing system is adequate to ensure that subcontract awards are made on a competitive basis, prices are fair and reasonable, required FAR clauses flow down to subcontractors, and the contractor maintains sufficient documentation to support its purchasing decisions.

DCMA evaluates purchasing files for compliance with FAR Subpart 44.3 criteria, including source selection rationale, price reasonableness determinations, consent-to-subcontract requirements, and small business subcontracting plans. The review can result in an "approved," "approved with corrective action plan," or "disapproved" determination.

A disapproved purchasing system has serious consequences: the contracting officer may withhold a percentage of billings (typically 5-10%) until the system is corrected and re-approved. Disapproval also affects the contractor's ability to consent to subcontracts without prior government approval, adding significant administrative burden to ongoing contracts.

Why CPSRs matter for government contractors

As prime contractors grow, their purchasing systems become a significant audit risk area. Poor documentation of price reasonableness determinations, failure to flow down required clauses, and inadequate competition documentation are the most common CPSR deficiencies. Maintaining a CPSR-ready purchasing system avoids billing withholdings and the reputational damage of a disapproved determination.

Example

A large systems integrator with $80M in annual DoD subcontracting undergoes a CPSR. DCMA reviewers find that several large subcontracts were awarded non-competitively without adequate sole-source justification documentation. They also find that DFARS cybersecurity flow-down clauses were missing from three subcontracts. DCMA issues a disapproved determination and withholds 5% of billings on affected contracts until the contractor submits and receives approval of a corrective action plan.

Frequently Asked Questions

What triggers a CPSR?

A CPSR is triggered when a contractor's purchasing volume under DoD contracts exceeds $25 million annually. The ACO may also order a CPSR based on risk factors such as prior audit findings, a high percentage of sole-source subcontracts, or a history of inadequate subcontract documentation.

How often are CPSRs conducted?

For contractors with adequate systems, CPSRs are typically conducted every three years. Contractors with prior deficiencies or high-risk profiles may be reviewed annually. DCMA schedules reviews based on contractor risk tier and purchasing volume.

What documentation should contractors maintain for subcontract awards?

For each significant subcontract award, contractors should maintain records of the competition solicited, offers received, price reasonableness analysis, basis for source selection, any sole-source justification, and documentation that required FAR and DFARS clauses were included. Files should be organized to allow auditors to review them without contractor assistance.

Can a small business be subject to a CPSR?

Small businesses are generally exempt from CPSR requirements because their purchasing volume rarely exceeds the threshold. However, small businesses that grow into large business status or that become significant prime contractors on DoD programs may eventually cross the threshold and need to establish formal purchasing system policies.