DCAA - Access to Internal and External Audit Reports

Items That May be Requested During an Audit

FAR 52.216-7 Allowable Cost and Payment Clause

(I) List of all internal audit reports issued since last disclosure of internal audit reports to the Government.

(J) Annual internal audit plan of scheduled audits to be performed in the fiscal year when the final indirect cost rate submission is made.

Accounting System Administration, DFARS 252.242-7006(c)

(8) Management reviews or internal audits of the system to ensure compliance with the Contractors' established policies, procedures, and accounting practices.

Contracting Purchasing System Administration, DFARS 252.244-7001(c)

(18) Perform internal audits or management reviews, training, and maintain policies and procedures for the purchasing department to ensure the integrity of the purchasing system.

History of Providing Audit Reports to DCAA

1988 - Newport News Shipbuilding & Dry Dock

Internal Audit Reports up until December 2011 were not generally provided to DCAA. The rationale behind not providing the reports to DCAA, was that DCAA did not have the right to those documents. This rationale was based on the court decision of United States v. Newport News Shipbuilding & Dry Dock, Co., 837 F.2d 162 (4th Cir. 1988) and Newport News Shipbuilding & Dry Dock, Co., 862 F.2d 464 (4th Cir. 1988).

Courts have held that DCAA does not have unlimited power to demand access to internal reports. However it is clear that DCAA may demand access to reports that are relevant to carrying out its audit responsibilities.

December 2011 - GAO Report

In December 2011, this changed with the issuance by the Government Accountability Office (GAO) of a report, where GAO stated “that the number of DCAA requests for internal audit reports was relatively small when compared to the number of internal audits GAO identified as relevant to defense contract oversight.” As a result of this report DCAA began asking contractors for their internal audit reports.

A summary of the GAO Report findings are:

DCAA access to and use of internal audit reports was limited,

DCAA does not track requests for internal audit reports, therefore information on how frequently DCAA was denied the reports was unavailable,

Internal audit reports could be useful to DCAA

DCAA should take steps to facilitate access to internal audits, and access whether other actions are needed, including subpoenas.

GAO Report

You can read the entire GAO report here. File:GAO Report on Internal Audit Reports and Workpapers 12-11.pdf

August 2012

An August 14, 2012 DCAA issued a Policy Memorandum, and along with an updated DCAA Contract Audit Manual (DCAM), addressing DCAA's intent to get access to contractor internal audit reports. The DCAA Memorandum requires that DCAA Contract Audit Coordinator (CAC) offices and Field Audit Offices (FAO) at major contractor locations establish a process and central point of contact (POC) to obtain and monitor DCAA’s access to and use of internal audits. Additionally, adjustments have been made to the DCAM 4-202 to address the specific duties of the central POC. Of particular note, the central POC must:

Obtain a semi-annual summary listing of all internal audit reports issued with a sufficient description in the listing to ascertain whether the internal audit may affect Government contracts.

That listing will be provided to the CAC Network or the FAO’s audit teams responsible for audits of the contractor.

Copies of reports and/or working papers considered pertinent by the auditors will be requested and the contractor’s response to these requests will be tracked.

DCAA Headquarters will receive a semi-annual summary of all requests for internal audit reports, the contractor’s response to each request and the audit assignment for which access to the internal audit report was requested.

While the foregoing formal tracking requirements are mandatory only for major contractors, the Memorandum notes that internal audits for non-major contractors remain useful. DCAM notes that requests for internal audit reports for non-major contractors will be issued “when warranted.”DCAA will not only extend beyond internal audit reports but will demand work papers as well.

Contractors that refuse to provide internal audit information will be subject to DCAA’s standard procedures relating to record access issues, set forth at http://www.dcaa.mil/cam/Chapter_01_-_Introduction_To_Contract_Audit.pdf. DCAA - Conditions Representing Denial of Access to Contractor Records

DCAA may seek the records by means of a subpoena.

2013

Section 832

Requires DCAA to establish specific procedures for access to contractor internal audit reports.

1. Document a determination that access to such reports is necessary to complete required evaluations of contractor business systems;

2. Maintain a record of the contractor response, including rationale or justification if access to requested reports was not granted;

3. Include safeguards and protections to ensure that contractor internal audit reports cannot be used by DCAA for any purpose other than evaluating and testing the efficacy of contractor internal controls and the reliability of associated contractor business systems; and

4. Use a determination of sound internal controls as the basis for increased reliance on contractor business systems or a reduced level of testing.

Section 843

In the Senate version of the 2013 National Defense Authorization Act, a contractor’s failure to provide access to internal audit reports can serve as a basis to determine related contractor business systems inadequate. but shall not be the sole basis for such a determination.

DCAA Guidance

MRD 12-PPS-019(R) - Audit Guidance on Access to Contractor Internal Audit Reports, dated August 14, 2012

CAM 4 - 200 - Contractor Internal and External Audits

DCAA - Conditions Representing Denial of Access to Contractor Records

Conclusion

Whether or not Section 843 survives in the final bill, the reality for contractors is that government auditors will be routinely seeking access to internal audit reports. If Section 843 does not pass, contractors will continue to have a reasonable legal basis under the U.S. v. Newport News Shipbuilding & Dry Dock Co. case to resist DCAA demands that exceed its audit access.

Contractors should implement and/or update their practices and procedures relating to internal audits to ensure that, when auditors, or investigators request that information, that contractors have appropriatedly protected their rights, especially if the information was collected in support of a legal analysis, or under attorney-client privilege.

The report states that “by not routinely obtaining access to relevant company internal audits, DCAA auditors are hindered in their ability to effectively plan work and meet audit standards for evaluating internal controls.” This is a very broad statement, and the information needs to have relevance to a particular audit, or audits anticipated for the upcoming year.

Contractor Response Options

Common Contractors reactions to DCAA request for Internal Audit Reports are:

1. Provide DCAA full access to internal audit reports;

2. Allow them to view selected reports but not copy or take possession of them;

3. Allow them to view selected reports and copy or take possession of them or,

4. Deny any and all access to internal audit reports.

Before GAO issued its report, the FAR Councils had taken action that opens the door to potential demands for access to internal audit reports. In June 2011, new guidance on what constitutes an adequate incurred cost submission was added to FAR 52.216-7, Allowable Cost and Payment. The new guidance identifies a list of internal audit reports and the contractor’s internal audit plan for the current year as elements that may be required.

It is suggested that contractors maintain a listing of internal audits performed by title and date that can be provided to DCAA. From that listing, DCAA can choose what internal audit reports it would like access. Once they have chosen specific internal audit reports, they need to document, in writing, their choice of report and what it is that they expect to obtain from reviewing the chosen report.

Only after this is done and the reasoning for access to the given report accepted, should “view only” access be provided unless the report is one that should be disclosed under FAR 52.203-13. Supporting working papers should not be provided. The contractor should guide them through the report and what it indicates, if anything, and they should not be allowed to copy or retain any part of the provided report.

From DCAA’s point of view, it should be noted that many internal audit reports are targeted at financial controls and not the internal controls for government contracting. While they intersect to some extent, they are implemented to satisfy different goals. There is also the potential that internal audit staff will not have the organizational freedom necessary to express candid opinions in their reports or to audit areas that could actually benefit from oversight.

It is anticipated that the referenced GAO report along with DoD’s acceptance of GAO recommendations will lead to increased requests of internal audit report access. Contractors should have a plan established and be ready to provide a prompt response to these requests.