The Securities and Exchange Commission paid a contractor a general and administrative rate higher than the one in its contract, paid overtime that nobody preapproved, and accepted travel and other direct costs without asking for the paperwork behind them. Inspector General Kevin B. Muhlendorf laid out those findings in a final management letter issued July 2, 2026 to Vance Cathell, director of the SEC's Office of Acquisitions. The dollar figure is small: $5,463.31 in questioned costs. The sample behind it is smaller still: nine of 82 invoices.
Background
The letter did not come from a contract audit. Contract management problems surfaced during a separate OIG evaluation of how the SEC's Division of Enforcement collects and distributes disgorgements and penalties, and the OIG broke them out into their own communication to the acquisitions shop.
The contractor is C2 Alaska, LLC, which provides legal and administrative services to Enforcement's offices of Collections and Distributions under contract 50310221D0010, task order 50310222F0082. Per usaspending.gov, as of May 5, 2026 the SEC had obligated $130.2 million to the contract, $75.1 million of it to this single task order. The SEC awarded the contract in 2021 for a 10-year period and the task order in 2022, structured as a one-year base with nine option years. The contract carries 37 other task orders.
The pricing structure matters to everything that follows. The task order is designated firm-fixed-price, which most contractors read as a ceiling that ends the conversation about costs. It also allows billing for reimbursement of "extended hours" — overtime — and other direct costs, but only if preapproved. And the contract includes a G&A rate that is not to be exceeded. So a nominally fixed-price vehicle still carries two cost-type mechanics that demand the same discipline a cost-reimbursement contract would: approval before the hours are worked, and support after they are billed.
Key Details
The OIG found three problems across the nine invoices it sampled, drawn from 82 paid as of March 3, 2026: a G&A rate above the contract limit; overtime and other direct costs, including travel, that the contractor did not support and the SEC never asked it to support until the OIG raised concerns; and overtime the SEC paid without approval.
Take the G&A finding first, because its mechanics should worry every contractor running an automated billing template. Two invoices carried a G&A rate 0.59 percent above the agreed rate, overcharging the SEC by $67.56. The contracting officer's representative explained why: the contractor's invoice template automatically applied its most recent G&A rate rather than the rate written into the contract. A system default did it, and the government's reviewer did not catch it.
The overtime findings are harder to wave off, and they carry most of the money. Four of the nine sampled invoices included overtime charges. For three of them, no adequate support was provided and none was requested. The OIG could not match overtime charged for six contractor employees to their timesheets — either the timesheets disagreed with the invoiced amounts, or they did not clearly separate regular hours, built into the task order's fixed price, from overtime billed as an additional reimbursable cost. That accounted for $4,337.26 in unsupported costs. Overtime for two employees on two invoices exceeded what the COR approved, and the SEC paid the unapproved $534.00 anyway. Two invoices carried travel costs supported by incomplete hotel and mileage documentation, adding $524.49.
The total, $5,463.31, invites a shrug, and the OIG anticipated it. The letter's own framing is that the practices it observed "are not new," so the concerns "may be more widespread" and other invoices paid since contract award "may have also included excessive G&A expenses, unsupported overtime and other direct costs, and/or unapproved overtime." Read the arithmetic the way it did: three of the four sampled invoices carrying overtime drew findings, 82 invoices is one task order, and there are 37 others. The OIG gave management until August 17, 2026 to describe what it will do — including whether the concerns reach invoices nobody has looked at yet.
This is a management letter with questioned costs, and it is explicit about its own limits. C2 Alaska has not been charged with anything. There is no False Claims Act case, no settlement, no finding of liability. Questioned costs are an auditor's assertion that a charge lacks adequate support or exceeds a contract term, not a determination that anyone did anything wrong. The contracting officer and COR acknowledged the findings and said they are working with the contractor to correct the rate and recoup the overcharge. The OIG addressed its letter to the SEC's own acquisitions office, not to a prosecutor.
What It Means for Contractors
The lesson here is not about C2 Alaska. It is about the gap between what a contract says and what a billing system does, and who is supposed to notice.
First, audit your invoice templates against the contract, not against your current indirect rates. A template that pulls "most recent G&A" from an accounting system will silently diverge from a contracted rate the moment your provisional or final rate moves. The delta at issue was 0.59 percent and $67.56 across two invoices — trivial on its own, but it accrued without any human deciding to bill it, which is why the OIG wants to know how far it spread. Reconcile the rate your billing system applies against each active contract document.
Second, treat "firm-fixed-price" as a label, not a shield. If your task order reimburses overtime and other direct costs on a preapproval basis, then every one of those charges needs the approval on file before the work happens and the timesheet behind it afterward. Timesheets that do not separate fixed-price regular hours from reimbursable overtime are the failure the OIG actually found. That is a failure a contractor can prevent with its own records.
Third, do not rely on the government to police your file. The letter faults the SEC as much as the contractor: the agency did not request support and paid unapproved overtime. A COR who never asks for backup is not evidence that your documentation is adequate, only that no one has tested it yet. When someone finally does — here it took an unrelated evaluation of a disgorgement program — the review starts from whatever your records can prove, years after the fact.
Finally, note the sampling posture. Consistent billing behavior is what hands an auditor a reason to extrapolate from nine invoices to a whole contract. The cheapest moment to fix a template default or a missing approval e-mail is before an evaluation of some other program pulls your invoices into view.
