Defense Contract Audit Agency s Access to Contractor Internal Audit Reports: Is Newport News Still the Standard? I. INTRODUCTION

Transcription

1 Defense Contract Audit Agency's Access to Contractor Internal Audit Reports: Is Newport News Still the Standard?... 1 I. INTRODUCTION... 1 II. III. IV. BACKGROUND: ACCESS TO CONTRACTOR RECORDS, PRE- NEWPORT NEWS... 2 THE DCAA S OVERSIGHT ROLE AND AUTHORITY TO ACCESS CONTRACTOR RECORDS... 4 A. The DCAA s Oversight Role... 4 B. The DCAA s Authority to Access Contractor Records... 4 NEWPORT NEWS I AND II... 5 A. Newport News I... 5 B. Newport News II... 6 C. The Newport News Standard... 6 V. THE GAO REPORT AND THE IMPLEMENTING DCAA GUIDANCE... 7 VI. A. The GAO Report... 7 B. The DCAA Guidance... 7 EFFECT OF THE GAO REPORT AND THE GUIDANCE... 8 A. Access to Relevant Materials... 8 B. Access to Objective Materials... 9 VII. LEGISLATIVE DEVELOP- MENTS VIII. CONCLUSION This article was originally published in the Public Contract Law Journal, Vol. 42, No. 3, Spring Reproduced by permission. This information or any portion thereof may not be copied or disseminated in any form or by any means or downloaded or stored in an electronic database or retrieval system without the express written consent of the American Bar Association. Defense Contract Audit Agency s Access to Contractor Internal Audit Reports: Is Newport News Still the Standard? By Vincent J. Napoleon and Shanelle Henry I. INTRODUCTION The Government obligates hundreds of billions of dollars in contracts for goods and services each year. 1 In the past decade, defense spending has increased to about $700 billion, representing a 70% increase during this period. 2 This upward trend in spending was driven by the continued and increased focus on issues related to National Security and the global war on terrorism, the demand for government stimulus, and the drive toward economic recovery. Given the recent history of increased defense spending, the need for heightened levels of financial oversight of government contracts has become imperative. As it relates to Department of Defense (DoD or the Department) contracts, the Defense Contract Audit Agency (DCAA or the Agency) has been anointed with the financial oversight role and is responsible for ensuring that the DoD obtains the best value for every dollar spent. 3 Established in 1965 by Secretary of Defense Robert S. McNamara, the DCAA represents an attempt by the Federal Government to create a more effective and centralized audit function for the DoD. 4 The DCAA independently investigates DoD contracts to determine the accuracy and completeness of financial records and reports, as well as the effectiveness of any transactions the Department has made. 5 The Agency also provides related financial advisory services to the DoD, while assisting the Department in determining whether contract costs are allowable, allocable, and reasonable. 6 In making this determination, DCAA auditors may examine, review, and gain access to contractors accounts, records, general business documents, and related materials in accordance with generally accepted government auditing standards. 7 While exercising its responsibility of engaging in audits of contractors and subcontractors accounts and records through independent reviews of their financial representations, the DCAA is met with many challenges regarding the quality of its audits. 8 Given these challenges, the DCAA developed various strategies in 2011 that, among other things, sought to improve audit quality and produce more rigorous evaluations of contractor data. 9 In furtherance of its strategies, the DCAA has sought to gain greater access to contractor data, including internal audit reports and related workpapers (sometimes referred to as Internal Audit Materials), to measure and assess the adequacy of a contractor s internal controls. 10 To this end, the DCAA recently provided direction to its auditors for requesting

2 2 Part V discusses a report the U.S. Government Accountability Office (GAO) 16 issued (the GAO Report), which served as the catalyst for the DCAA s issuance of the Guidance that calls for greater access to contractor internal audit reports and materials. Part VI analyzes the effect of the GAO Report and the Guidance in light of the principles enunciated in Newport News. More specifically, Part VI explores whether the DCAA, in issuing the Guidance in direct response to the GAO Report, ran afoul of the present judicial standard construing access to defense contractor internal records. a contractor s Internal Audit Materials. 11 This direction, which the Agency issued pursuant to a guidance memorandum dated August 14, 2012 (the Guidance), seeks to implement further DCAA access to contractor data. 12 The Guidance, however, exists in contrast with the Fourth Circuit s longstanding, dual decisions in United States v. Newport News Shipbuilding & Dry Dock Co. (collectively, Newport News ), 13 which have essentially evolved into the standard governing access to contractor records. 14 In the first Newport News decision (Newport News I), the Fourth Circuit concluded that internal audits are not the type of documents that fall within the scope of [the] DCAA s subpoena [and audit] power[s]. 15 This Article examines the question of whether Newport News continues to be the standard for guiding the DCAA auditors access to contractor Internal Audit Materials. Correspondingly, this Article analyzes whether the DCAA acted ultra vires in issuing the Guidance, which seemingly runs contrary to the Newport News standard. Part II of this Article provides a historical background of legislative interest and earlier case law on access to contractor records, which have long preceded Newport News. Part III outlines the DCAA s oversight role and its access authority to contractor records and documents by and through statute, federal regulation, and contract clause. Part IV discusses the judicial precedence outlined in Newport News, which has prevailed as the standard throughout the government contracting community for the DCAA s access authority to defense contractor internal records, including internal audit reports. Finally, Part VII discusses legislation that Congress passed as part of the Fiscal Year 2013 National Defense Authorization Act (NDAA), which addresses DCAA auditor access to contractor internal audit reports and supporting materials. II. BACKGROUND: ACCESS TO CONTRACTOR RECORDS, PRE- NEWPORT NEWS Newport News is not the first instance where access to contractor records has been the subject of discussion. In fact, the Government s access to contractor internal business records and documents has been a concern of Congress since at least the promulgation of the Armed Services Procurement Act of 1947 (ASPA). 17 The legislative history of the ASPA indicates that Congress s concern regarding access to contractor records became heightened as a result of fraud perpetrated on the Government by Major General Bennett E. Meyers, the U.S. Army s then Deputy Chief of Procurement of Aircraft and Aircraft Parts. 18 General Meyers had a financial interest in a defense subcontractor, whereby Meyers allowed the subcontractor to charge some of his personal expenses to the Government as business expenses. 19 In addition, the subcontractor also charged (as business expenses) other services that were never actually performed. 20 Congress s response to the Meyers procurement scandal resulted in the development of legislation that would allow the Government to verify actual costs charged to it by entitling agencies to inspect the facilities and audit the books and records of contractors. 21 But Congress was not the only institution grappling with issues related to the Government s access to contractor business records. About twenty years prior to Newport News, courts started to become the venue for deciding issues related to the Government s access to contractor business records, and, as a result, a vigorous debate ensued among the federal circuit courts. 22 The courts first began to review these issues in the context of Comptroller General audits. 23 In the 1960s, the Court of Appeals for the Ninth Circuit in Hewlett-Packard v. United States 24 addressed the Government s desire to gain access to a contractor s books and records of

3 production costs that were not used in arriving at the terms and conditions of the contracts at issue. 25 In particular, the Comptroller General requested access to Hewlett-Packard s books, documents, papers, and records relating to the pricing and cost of performance, support for prices charged to the Government, and such other necessary information that would permit [the Comptroller General s] [r]epresentatives to review the reasonableness of the contract prices. 26 At the time, the statute at issue, 10 U.S.C. 2313(b), authorized the GAO to examine a contractor s books and records that directly pertain to, and involve transactions relating to, the contract or subcontract. 27 In addition, consistent with the statute, the four contracts Hewlett-Packard held gave the Comptroller General the right to access and examine any directly pertinent books, documents, papers, and records of the [c]ontractor involving transactions related to this contract. 28 Hewlett-Packard refused the request, citing the cost of producing the information requested as not being directly pertinent to the contracts for equipment it held. 29 In affirming the district court s decision which rejected Hewlett-Packard s claim that the Comptroller General exceeded its access authority the Ninth Circuit found the Government s authority to be very broad. 30 In this regard, the Ninth Circuit concluded that the word contract as used in the statute not only comprised the specific terms and conditions of an agreement, but also its general subject matter. 31 The production costs, the court determined, fell within the ambit of the subject matter of the contract namely, the procurement process as a whole. 32 Not only is Hewlett-Packard a unique application of the familiar power of government control over those with whom it contracts, 33 it is also an example of the Government s desire to reach for contractor information beyond that which is related to a particular contract. Ten years later, the Seventh Circuit in Eli Lilly & Co. v. Staats 34 addressed an access issue growing out of a similar set of requests that the Comptroller General had made to Hewlett- Packard. 35 As in Hewlett-Packard, the Seventh Circuit also construed the Comptroller General s access powers broadly. 36 Specifically, the court in Eli Lilly examined the question of whether the Comptroller General has authority to access contractor records, which reflect the cost of products purchased by the Government from pharmaceutical companies. 37 Eli Lilly & Co. held a total of seven contracts involving pharmaceutical products that were widely sold commercially at standard catalog prices. 38 The Comptroller General, pursuant to the contract clauses and underlying statutes in 10 U.S.C. 2313(b) and 41 U.S.C. 254(c), requested that Eli Lilly make available for examination all books, documents, papers, and other records directly pertinent to the contracts, which include, but are not limited to (1) records of experienced costs including costs of direct materials, direct labor, overhead, and other pertinent corporate costs, (2) support for prices charged to the Government, and (3) such other information as may be necessary for use to review the reasonableness of the contract prices and the adequacy of the protection afforded the Government s interests. 39 Eli Lilly refused to provide these records, as the information sought was part of an investigation of production costs in the drug industry and a subsequent economic study of the industry by the Comptroller General in concert with the Pharmaceutical Manufacturers Association. 40 Relying on the holding and rationale set forth in Hewlett- Packard, 41 the Seventh Circuit found the costs of direct materials, direct labor, and overhead to be directly pertinent to government contracts. 42 Hence, the Seventh Circuit held that the Comptroller General s request for Eli Lilly s records was within its investigatory authority to engage in broad studies like that which was focused on the pharmaceutical industry. 43 Moreover, the court found that the Comptroller General s request served a legitimate purpose in determining the costs of producing the items purchased by the Government under the seven contracts. 44 In a spirited dissent, Judge Pell found that the majority s reliance on Hewlett-Packard was misplaced and that in reading the majority opinion he was strain[ing] to find justification for the Comptroller[] [General s] broad sweeping attempt to delve into information in excess of his authority under law. 45 Judge Pell believed government access to these records was proscribed, since neither the negotiations nor the performance of the contracts was directly related to Eli Lilly s costs of production or pricing methodology. 46 According to Judge Pell, the judiciary should not give the Comptroller [General] coercive power to pursue quidnuncish purposes which power has been refused by Congress and which would require private companies to open their records to him to make it easier for him to study the cost and practices of the entire pharmaceutical industry. 47 In another pharmaceutical-related case, the U.S. Circuit Court of Appeals for the Second Circuit in Bristol Laboratories Division of Bristol-Myers Company v. Staats 48 again addressed the Comptroller General s ability to access contractor records that are directly pertinent to the government contract. 49 This time, however, the Comptroller General s access to contractor records was limited, with the Second Circuit more narrowly interpreting its authority. 50 Much like the basic facts in Eli Lilly, the Government awarded to Bristol Laboratories Division of Bristol-Myers Company negotiated fixed-price contracts for the sale of prescription drugs. 51 Again, each of the contracts contained an access-torecords clause that was consistent with the statutory authority provided in 10 U.S.C. 2313(b). 52 Pursuant to these clauses, the Defense Contract Audit Agency s Access to Contractor Internal Audit Reports: Is Newport News Still the Standard? 3

4 Comptroller General made a request for records identical to the one it presented to the contractor in Eli Lilly. 53 Namely, the Comptroller General wanted access to records of experienced costs including costs of direct materials, direct labor, overhead, and other pertinent corporate costs. 54 As with Eli Lilly, this request stemmed from the general review of drug procurement that the GAO had undertaken. 55 Bristol-Myers was willing to provide the manufacturing costs, manufacturing overhead, royalty expenses, and delivery costs to the Government, which Bristol-Myers believed were factors taken into account in setting prices to the Government. 56 But it refused to provide the Government any examination rights for records pertaining to the costs of research and development, marketing and promotion, distribution, and administration. 57 Unlike its sister circuits in the foregoing cases, the court in Bristol-Myers started to trend away from broad government access by noting the limiting language in the statutes and contract clauses. 58 Affirming the district court s ruling, the Second Circuit precluded the Government from gaining access to material that was essentially more corporate-related. 59 According to the district court, the Government did not have a right to review everything there is to know about the structure of the contractor[ s] business. 60 Given the nature of Bristol- Myers business, under which the revenues and expenses for government versus nongovernmental contracts could not be severable, the Government s reading would give it access to virtually all of Bristol-Myers books and cost records. 61 In sum, Congress s enactment of the ASPA and the trilogy of decisions in Hewlett-Packard, Eli Lilly, and Bristol-Myers collectively set the stage for government access to record issues involving other federal agencies, including the DCAA. III. THE DCAA S OVERSIGHT ROLE AND AUTHORITY TO ACCESS CONTRACTOR RECORDS A. The DCAA s Oversight Role The DCAA is a separate agency of the DoD operating under the authority and direction of the undersecretary of defense. 62 Generally, the DCAA is charged with providing oversight on the DoD s many defense contracts. 63 The DCAA s primary role is to furnish all necessary contract audits for the DoD, along with cost accounting and financial advisory services pertaining to contracts and all subcontracts. 64 In particular, the Agency must review and verify cost data of government contractors. 65 The DCAA provides these services for use by DoD government personnel 66 at all stages in the procurement process, including the negotiation, award, administration, repricing, and settlement of contracts. 67 The DCAA performs audits in accordance with generally accepted government auditing standards 68 to ensure that a contractor maintains adequate internal controls that would thwart improvident or ineffective practices. 69 According to the DCAA Contract Audit Manual, 70 [t]he purpose of contract auditing is to assist in achieving prudent contracting by providing those responsible for [g]overnment procurement with financial information and advice relating to contractual matters and the effectiveness, efficiency, and economy of contractors operations. 71 In alignment with its role in validating current or proposed contractor costs, the DCAA performs a wide array of reviews that range from preaward surveys to final contract close-out audits. 72 These audits include evaluating the accuracy, reasonableness, and acceptability of a contractor s representations on costs incurred or cost estimates to be incurred. 73 The audits also assess any activity having some bearing or contribution to proposed or incurred costs of government contracts. 74 Another area of concern to DCAA auditors is the adequacy of a contractor s policies, procedures, practices, and internal controls relating to estimating, accounting, and procurement. 75 While the DCAA has historically engaged in audits of contractor records, books, and other data as part of proposal evaluations, system reviews, and operations audits, the Agency has sought to expand its role, particularly in its access to contractor business records. 76 B. The DCAA s Authority to Access Contractor Records The DCAA s authority to access and audit contractor 77 data and records flows from statutory, regulatory, and contractual rights. 78 Sections 2313 and 2306a of Title 10 of the U.S. Code governs the DCAA s ability to access internal corporate documents primarily for the purpose of verifying costs. 79 In pertinent part, 2313(a) empowers the DCAA 80 to audit the records of a contractor or subcontractor performing a costreimbursement, incentive, time-and-materials, labor-hour, or price-redeterminable contract or subcontract. 81 This statute also gives the DCAA direct authority to examine all records of the contractor or subcontractor related to (A) the proposal for the contract or subcontract; (B) the discussions conducted on the proposal; (C) pricing of the contract or subcontract; or (D) performance of the contract or subcontract where such information is necessary for the purpose of evaluating the accuracy, completeness, and currency of certified cost or pricing data 82 required to be submitted to the Government under 2306a. 83 Section 2306a of Title 10 of the U.S. Code 84 authorizes the head of an agency 85 to require offerors, contractors, and subcontractors to submit cost or pricing data certified as Defense Contract Audit Agency s Access to Contractor Internal Audit Reports: Is Newport News Still the Standard? 4

5 accurate, complete, and current when negotiating contracts with the Government. 86 It also provides the head of an agency with the authority to review the records provided by the offerors, contractors, and subcontractors for the purpose of evaluating their accuracy, completeness, and currency. 87 FAR (b) provides the regulatory authority for the DCAA s audit and access rights. 88 Implementing 10 U.S.C. 2313(a), this FAR provision requires that defense contracts contain a clause guaranteeing the DCAA access to documents. 89 The corresponding FAR clause, found at FAR (Audits and Records Negotiation), provides in pertinent part: (b) Examination of costs. If this is a cost-reimbursement, incentive, time-and materials, labor-hour, or price redeterminable contract, or any combination of these... the Contracting Officer, or an authorized representative of the Contracting Officer, shall have the right to examine and audit all records and other evidence sufficient to reflect properly all costs claimed to have been incurred or anticipated to be incurred directly or indirectly in performance of this contract. (c) Certified cost or pricing data. If the Contractor has been required to submit certified cost or pricing data..., the Contracting Officer, or an authorized representative of the Contracting Officer, in order to evaluate the accuracy, completeness, and currency of the certified cost or pricing data, shall have the right to examine and audit all of the Contractor s records... related to (1) The proposal for the contract, subcontract, or modification; (2) The discussions conducted on the proposal(s), including those related to negotiating; (3) Pricing of the contract, subcontract, or modification; or (4) Performance of the contract, subcontract or modification. 90 FAR therefore further authorizes the DCAA, as the authorized representative of the Contracting Officer, 91 to audit and access contractor data and records. IV. NEWPORT NEWS I AND II Newport News I 92 and Newport News II 93 are a set of complementary cases decided by the U.S. Court of Appeals for the Fourth Circuit in 1988 that test the extent of the DCAA s subpoena power, and its corresponding access authority, to contractor internal audit reports and documents that pertain to a contractor s corporate enterprise. 94 Like the predecessor cases involving the Comptroller General, 95 Newport News also interpreted statutes that required a nexus between access to contractor documents and a government contract. 96 Of particular importance to this Article are the limitations the Fourth Circuit placed on the DCAA s ability to access internal audit reports. 97 In these cases, the Fourth Circuit limited the DCAA s access to only those records of a contractor that relate to a particular contract and the verification of costs charged under a cost-type contract. 98 This has essentially remained the standard for the DCAA in guiding access to contractor internal documents since the Fourth Circuit issued the Newport News decisions in A. Newport News I Newport News I involved the DCAA s desire to access Internal Audit Materials produced by the Newport News Shipbuilding and Dry Dock Company s (Newport News Shipbuilding) internal audit department. 100 By way of background, Newport News Shipbuilding was engaged in the business of shipbuilding and repair, primarily for the United States Navy. 101 Many of the company s contracts with the Navy were of the cost-reimbursement type. 102 In conducting periodic reviews as to the soundness and efficiency of the various departments within the company, Newport News Shipbuilding had nine auditors in its internal audit department who served as an independent management control. 103 The internal audit department was responsible for evaluating and making recommendations for improvements and ways of obtaining greater organizational efficiencies. 104 These internal reviews or audits did not relate to individual contracts. 105 Instead, they addressed departmental performance over a number of projects and contracts across the entire enterprise. 106 In addition, the costs associated with these internal audits were charged as general and administrative expenses, which were allocated as overhead to the Government much like executive salaries. 107 In other words, Newport News Shipbuilding did not charge the costs of these internal audits to any particular contract. 108 Upon the completion of these audits, the internal auditors prepared final reports that included conclusions and recommendations for management. 109 In 1984, the DCAA sought access to internal audit reports and associated materials from Newport News Shipbuilding. 110 When the company refused, the DCAA served a subpoena duces tecum on Newport News Shipbuilding pursuant to 10 U.S.C. 2313(d), 111 demanding schedules of the internal audits performed, working papers associated with any audit, written summary reports of the audits, any follow-up action to the reports the company took, and any time-charging records of employees assigned to the audit department. 112 In response, Newport News Shipbuilding filed a declaratory judgment action with the U.S. District Court for the Eastern District of Virginia to have the subpoena declared unlawful. 113 The Government then moved to dismiss the case and requested summary enforcement of the subpoena. 114 The district court denied enforcement of the subpoena, holding that the internal audit reports themselves Defense Contract Audit Agency s Access to Contractor Internal Audit Reports: Is Newport News Still the Standard? 5

6 are not cost or pricing data related to the negotiation, pricing or performance of a particular defense contract. 115 Affirming the order of the district court, the Fourth Circuit held that the statutory subpoena power of the DCAA extends to [objective] cost information related to government contracts, not corporate materials such as the subjective evaluations developed by internal auditors. 116 Equally as important, the Fourth Circuit confirmed that the DCAA does not enjoy unlimited access to all internal corporate materials of companies performing cost-type contracts for the Government. 117 In reaching these conclusions, the court construed 10 U.S.C. 2313(a) and 2306(f )(5), the statutes that govern the DCAA s access to corporate documents and under which the DCAA issued the subpoena. 118 A review of the statutes language, legislative history, and implementing regulations indicated that the DCAA s subpoena authority provided its auditors access only to objective information needed to verify the cost charges paid by the Government in relation to the performance of particular government contracts. 119 In the specific context of the case at hand, the DCAA lacked statutory authority to subpoena the internal audit reports and concomitant materials of Newport News Shipbuilding s internal audit department. 120 The subpoenaed reports were not related to a government contract, nor were the costs charged to any particular government contract. 121 In addition, the internal audit reports contained subjective analyses, conclusions, and recommendations of the company s audit staff. 122 B. Newport News II Subsequent to the Fourth Circuit s refusal to enforce the DCAA s subpoena to access Newport News Shipbuilding s internal audit reports and other corporate business materials and documents in Newport News I, the court was confronted again, in the same year, 123 with a similar question about the scope of the DCAA s subpoena power and its ability to gain access to certain business records of the company in Newport News II. 124 Specifically, the DCAA in that case sought access to Newport News Shipbuilding s federal and state income tax returns, financial statements, and supporting schedules, among other documents. 125 The company provided its state tax returns to the DCAA but withheld the remaining subpoenaed materials. 126 The company instead filed a declaratory judgment action, petitioning the court to deny enforcement of the DCAA s subpoena and declare it unlawful. 127 As in Newport News I, the DCAA subpoena in Newport News II was issued pursuant to 10 U.S.C. 2313(d). 128 As such, the Fourth Circuit again interpreted the construction of the statutes conferring the DCAA with its access authority, namely 10 U.S.C. 2313(a) and 2306a(f ). 129 Reversing the district court s decision denying enforcement of the subpoena, 130 the Fourth Circuit adopted much of the same analysis it undertook in Newport News I. 131 Specifically, the circuit court analyzed the language, legislative history, and implementing regulations of these two access-to-records statutes. 132 The Fourth Circuit concluded that the district court took too restrictive of a view in its interpretation of the DCAA s statutory subpoena power. 133 The court repeatedly focused on cost verification data as the proper scope of a DCAA subpoena, with particular emphasis on the DCAA s authority extending to objective, and not subjective, data. 134 According to the court, the DCAA has access to objective factual materials useful in verifying the actual costs, including general and administrative overhead costs, charged by companies performing cost-type contracts for the [G]overnment. 135 As it applied to the corporate tax returns and other information sought in Newport News II, the court determined that such information was objective financial and cost information. 136 Thus, the Fourth Circuit deemed this information to be within the contemplation of [the] DCAA s statutory subpoena authority to the extent that the materials subpoenaed... would assist the DCAA in verifying and evaluating the cost claims charged by Newport News Shipbuilding under its government contracts. 137 Accordingly, the Fourth Circuit remanded the case to the district court for a factual review of these subpoenaed records in accordance with the principles set forth above. 138 C. The Newport News Standard Newport News I and Newport News II present a consistent and clear standard in interpreting the bounds of the DCAA s access authority to a contractor s records. The two cases did not conflict in the rules they collectively established. 139 This is true notwithstanding the Fourth Circuit s refusal to enforce the subpoena in the first case while reversing and remanding the district court s decision not to enforce the subpoena in the second case. 140 Rather, in a thematic approach to its decisions, the court in both cases underscored the DCAA s role in obtaining information pertinent to cost verification. 141 Essentially, there are three principles that can be extrapolated from these two cases. First, both cases established that the DCAA does not enjoy unfettered access to all internal, corporate material of a defense contractor. 142 Second, the documents that the DCAA seeks must be related to a particular government contract. 143 Finally, the materials to which the DCAA has statutory access must be objective factual information that may be useful in verifying actual cost submissions of contractors. 144 While the court in both Newport News cases established this last principle, it was in Newport News II that the Fourth Circuit placed greater emphasis on the need for objective financial cost data as distinguished from the subjective Defense Contract Audit Agency s Access to Contractor Internal Audit Reports: Is Newport News Still the Standard? 6

7 work product and assessments of the contractor s internal audit department. 145 Indeed, its decision to remand and reverse the district court s ruling in Newport News II was premised on the fact that the tax returns and related material, unlike that of the internal audit reports in Newport News I, contained objective information rather than the subjective evaluations of the company s internal audit department. 146 V. THE GAO REPORT AND THE IMPLEMENTING DCAA GUIDANCE A. The GAO Report Recognizing the DoD s increasing reliance on defense contractors in providing goods and services annually, and the DCAA s critical role in ensuring the reasonableness of costs incurred, Congress has expressed a heightened level of interest in ensuring greater integrity of the government contracting process. 147 Given this interest, Congress, through the GAO, has recently pressured the DCAA to pursue greater access to contractor records, particularly Internal Audit Materials. 148 At the request of Congress, the GAO conducted a performance audit during the period from September 2010 through December 2011, during which time it assessed the role of defense contractor internal audit departments and their ability to provide [the] DCAA with information on company internal controls, business systems, and policies affecting government contracts. 149 The results of this assessment culminated in the publication of the GAO Report, a December 2011 report entitled Defense Contract Audits: Actions Needed to Improve DCAA s Access to and Use of Defense Company Internal Audit Reports. 150 Of relevance to this Article, the GAO assessed the DCAA s ability to access Internal Audit Materials and its ability to use the information therein. 151 Particularly, the GAO examined the extent to which the DCAA requested and subsequently obtained internal audit reports in furtherance of the Agency s contract oversight role. 152 To conduct its assessment, the GAO selected seven major defense companies as a nongeneralizable sample for its review. 153 The GAO requested a list of all internal audit reports these defense companies had completed over a two-year period between January 1, 2008, and December 31, 2009, and, as a result, it received information on 1,125 audits. 154 Each audit report contained the audit s title, objective, and scope. 155 Upon review of the audit information, the GAO determined that 520 internal audit reports, or almost half of all the internal audit reports assessed, were relevant to the DCAA s role in overseeing government contracts. 156 In furtherance of its study, the GAO sought to determine the number of requests that the DCAA had made for relevant, internal audit reports. 157 This evaluation, however, was restricted to information from the same seven defense companies because the DCAA does not centrally track its requests or company responses thereto. 158 Notwithstanding the DCAA s limited tracking data, based on information from company records, the GAO estimated that the DCAA had requested only 115 audit reports over the two year period. 159 In other words, the number of requests was markedly lower than the 520 internal audit reports that the GAO deemed to be defense-related. As a result, the GAO found that the number of DCAA requests for internal audit reports was small compared to the number of internal audits the GAO identified as relevant to defense contract oversight. 160 The DCAA s limited access to and use of internal audit information, according to the GAO, potentially inhibits the Agency from assessing contractor internal controls 161 and reviewing relevant material for audit planning. 162 In its assessment, the GAO found that the DCAA s access to and use of internal audit reports were limited due to several factors. 163 Significantly, one such factor was DCAA officials interpretation of the Newport News standard as holding that the Agency s subpoena power does not extend to contractor internal audit reports. 164 While acknowledging Newport News as the prevailing standard in precluding the DCAA from unlimited access to Internal Audit Materials and other corporate business documents, the GAO nonetheless concluded that the DCAA should more actively seek broader access to contractor internal audit reports and supporting workpapers. 165 The GAO contended that greater access to Internal Audit Materials would improve the DCAA s audit efficiency while also moving the DCAA closer to achieving its overall objective and mission. 166 Additionally, the GAO concluded that such expanded access would enable the DCAA to meet auditing standards for effectively evaluating a contractor s internal controls. 167 B. The DCAA Guidance In direct response to the findings contained in the GAO Report, the DCAA issued guidance that directed its auditors to take steps to facilitate and expand its access to contractor internal audit reports and related materials, including workpapers. 168 In very short form, the Guidance primarily adopts the findings and conclusions of the GAO. 169 While acknowledging that it cannot request unlimited access to all internal contractor business documents and corporate materials, the DCAA, in the Guidance, stated that its auditors should have access to all materials relevant to its audit responsibilities. 170 The Guidance, however, failed to mention Newport News or provide a discussion as to the effect those cases have on the DCAA s access authority, particularly as it relates to the internal audit reports and related workpapers the Agency seeks. 171 The Guidance implemented the three recommendations from the GAO Report. 172 Specifically, the Guidance required its auditors to (i) [e]nsure that [the] DCAA s central point of contact for each company coordinates issues pertaining to internal audits ; (ii) [p]eriodically assess information compiled Defense Contract Audit Agency s Access to Contractor Internal Audit Reports: Is Newport News Still the Standard? 7

8 by the central points of contact regarding the number of requests for internal audits and their disposition to determine whether additional actions are needed ; and (iii) [r]eaffirm with DCAA staff through guidance and training how and under what circumstances company internal audit reports can be accessed and used to improve the efficiency of audit planning and execution. 173 VI. EFFECT OF THE GAO REPORT AND THE GUIDANCE Absent overturning case law or the promulgation of subsequent legislation, 174 Newport News still remains the standard that guides the DCAA s authority to access contractor internal audit reports and other related corporate documents. 175 Nonetheless, the standard established by Newport News is subject to jeopardy due to the issuance of the GAO Report. 176 The DCAA s Guidance fares no better, as it merely implements the GAO s recommendations in almost identical form and fails to even mention (much less discuss) judicial precedent. 177 Perhaps under a fair reading, one could argue that Newport News does contemplate that internal audit reports may be accessible when they are linked to a government contract and contain objective, factual information pertaining to cost verification. 178 But, as a practical matter, the GAO Report either overlooks the realities of internal auditing or, at the very least, creates ambiguities by failing to clearly specify the Internal Audit Materials to which the DCAA has proper access. As such, the GAO Report and the follow-on Guidance are subject to broad interpretation by DCAA auditors, sparked by the ambiguities contained therein and the scant treatment of the decisions in Newport News to limit access to internal audit reports. 179 These obscurities may lead DCAA auditors to request access to Internal Audit Materials far beyond those that can be tied to a government contract, 180 the effect of which is to put DCAA auditors dangerously close to acting ultra vires of the standards in Newport News and usurping established judicial precedent. A. Access to Relevant Materials For the reasons described below, the GAO Report and the Guidance increase the risk that DCAA auditors will misinterpret their authority and overreach by requesting access to internal materials that go well beyond those related to a government contract. To begin, the scope of internal auditing is usually broad and may involve the efficiency of contractor operations across many departments or programs. 181 Even where the focus of internal audits is narrower, the GAO Report muddles the relevancy standard of Newport News by making continuous reference to contractor materials being accessible when they are relevant to carrying out [the DCAA s] audit responsibilities. 182 Nevertheless, the standard in Newport News requires that the DCAA s access to records be limited to information that is related to a government contract. 183 This may appear to be a very fine distinction, but the DCAA and other associated government entities have long misperceived the extent of the Agency s audit responsibilities as extending with little to no limitation deep into contractor records. For example, the DoD IG in 1984 stated: Full and unrestricted access to contractor s records is essential in order to examine sufficient competent evidential matter to afford a reasonable basis for an informed opinion in the variety of contract audit functions performed. Restrictions on access to contractor s records can impair the auditor s ability to render informed opinions and must be promptly resolved through appropriate actions with the contractor, contracting officers, and acquisition authorities. 184 In another example, a high-ranking DCAA official in 1985 expressed that the DCAA should enjoy access to a garden variety of contract documents, including internal audit reports, budgets and forecasts, corporate tax returns, Securities and Exchange Commission filings, operational audits, and even board of director meeting minutes. 185 This official even espoused that DCAA should contact employees for interviews and conduct unannounced floor checks. 186 Such aggrandizements of the DCAA s access authority have not been confined to the period preceding the Fourth Circuit s decision in Newport News. For example, upon passage of the Sarbanes-Oxley Act (SOX), 187 the DCAA pushed to gain access to internal audit material that was required by SOX. 188 The Agency, however, has been fairly unsuccessful in this endeavor. 189 A September 2009 leaked from former DCAA Director April Stephenson also lends further support to the notion that the Agency feels a sense of entitlement to have greater access to contractor records. 190 Recognizing the judicial limits imposed on the Agency, Ms. Stephenson unsuccessfully offered a legislative proposal to expand [the] DCAA s access to contractor records required to accomplish our mission as a remedy to a prior court imposed limitation. 191 Even as recently as 2012, the DCAA has continued its bold pronouncements, urging its auditors to gain access to materials that are potentially protected by the attorney-client and work product privileges under certain circumstances. 192 The GAO Report itself even contains an acknowledgment by the DCAA auditors that they seek material from contractors beyond the government contract, notwithstanding the judicial precedence established by Newport News: [DCAA auditors] also acknowledge that they have not used their subpoena authority to get access to internal audits or other company documents since the [Newport News] decisions were issued in 1988 in part because the Fourth Circuit Court of Appeals held that Defense Contract Audit Agency s Access to Contractor Internal Audit Reports: Is Newport News Still the Standard? 8

9 the language in the statutes did not generally include internal audit reports unrelated to a specific contract or proposal. 193 The potential for misinterpretation of access authority at the DCAA auditor level is further exacerbated in light of the unfavorable atmosphere in which the Agency has been operating. 194 For the past few years, the DCAA has been under immense pressure to improve its audit quality and obtain greater access to contractor records. 195 In August 2009, for example, the DoD IG released a jarring report in which it opined that the DCAA Western Region has a work environment not conducive to performing quality audits. 196 Members of Congress have also weighed in, with Senator Claire McCaskill of Missouri labeling the DCAA as fundamentally broken. 197 Finally, two recent GAO evaluations of the DCAA audits found massive noncompliance with applicable audit standards. A July 2008 GAO assessment found widespread independence and audit quality issues in the DCAA s Western Region. 198 Similarly, the GAO undertook a study in September 2009, during which it found that Agency auditors failed to follow basic auditing standards in sixty-five of sixty-nine audits. 199 Without clearer instructions about the constraints of Newport News, the GAO Report s amorphous and simplistic description of the DCAA s audit authority is subject to misinterpretation by DCAA auditors. 200 Such misinterpretations are not improbable, given the Agency s overall mandate to ensure that taxpayers are getting fair value 201 and what has been perceived by commentators as the Agency s insatiable appetite for records. 202 While the GAO Report does sporadically refer to materials being available to the DCAA where they are related to the execution of government contracts, when read in its entirety, there is the notion that the GAO is merely paying lip service to Newport News. 203 In particular, aspects of the GAO Report send conflicting messages and give the impression that the DCAA can seek greater access to contractor records than that which is allowed by statute, implementing regulatory authority, and judicial precedent. 204 As it relates to internal controls, for instance, the GAO notes that both the DCAA and company internal auditors are charged with internal control evaluations. 205 As such, the GAO believes internal audit reports will include information on the type and extent of internal controls of the contractor. 206 Though the DCAA Contract Audit Manual does require the DCAA to assess internal controls, 207 the GAO Report fails to make a distinction between audits conducted by internal auditors and those that are supposed to be conducted by the DCAA. In other words, [o]ne significant distinction... is that DCAA audits examine internal controls or business systems as they are used in the execution of government contracts, while internal audits review internal controls and business systems for purposes of financial statement reporting. 208 Yet, the GAO Report fails to note that the objectives of DCAA auditors and internal auditors rarely overlap. 209 Furthermore, the GAO Report gives the impression that the DCAA auditors are privy to a broader range of materials. For example, the GAO defines an internal audit report as defense-related when the audit s scope and objectives include review of some aspect of the overall internal control system. 210 What is even more telling about the GAO Report is its endorsement for expanded access to not only internal audit reports but also related contractor workpapers. 211 This represents an unprecedented intrusion into contractor corporate [decision making]. 212 Contractor workpapers may contain materials far outside the scope of government contracts, such as board minutes, casual observations of the internal auditor, unrelated financial audits, contractor and documents relating to an internal SOX review. 213 Absent clearer instruction in conformity with the bounds of Newport News, the ambiguities contained within the GAO Report open the door to greater DCAA scrutiny in areas that become more corporate-related and not uniquely governmentcontract related. 214 Such an effect would be to place the DCAA deeply into corporate management judgments and decision making. This puts the DCAA dangerously close to acting ultra vires or outside the bounds of Newport News, the effect of which usurps the authority of the courts and ignores the concepts of precedent and stare decisis. B. Access to Objective Materials Even if the GAO could make it clear as to which Internal Audit Materials the DCAA may appropriately access, it still raises the question as to whether internal audit reports and related workpapers could ever be objective and therefore subject to disclosure. An aggressive reading of Newport News limits the DCAA s statutory and regulatory access to contractor records that are strictly objective. 215 The internal audit process, in and of itself, is largely very subjective. 216 Internal audit departments are usually established at large companies as a voluntary mechanism for selfgovernance. 217 These departments play a critical role in an organization, serving as an independent, oversight body that advises management and the Board of Directors about the economical, legal, and effective delivery of services. 218 An internal audit department is designed to add value to the corporate governance system of a company by systematically identifying organizational risks and thereby evoking positive change in an organization s operations. 219 At the end of each audit, an internal audit report usually serves as the principal means by which the department communicates to management. 220 The very nature of internal audit reports which contain the internal auditor s findings, related recommendations, and action Defense Contract Audit Agency s Access to Contractor Internal Audit Reports: Is Newport News Still the Standard? 9

10 plans appears to place the whole internal audit regime well beyond the DCAA s purview. Internal audit reports are inherently subjective since they provide recommendations for improvement based on analyses and assessments of data. 221 While the DCAA may be entitled to any objective, underlying material contained therein, the purpose of internal audit reports, and hence the information that the DCAA would obtain by requesting them, is indeed the subjective conclusions and work product of the internal auditors. VII. LEGISLATIVE DEVELOPMENTS While there has been a drive for the DCAA to have greater access to contractor internal audit records, there are some commentators who believe that the DCAA s reliance on contractor internal audits is overrated primarily because government audit and contractor internal audit objectives rarely overlap. 222 Notwithstanding this view, it is believed that contractor internal audits and their related reports and materials are useful to the extent they demonstrate contractor commitment to maintaining good internal controls. 223 This perspective is further embraced by Congress, as it recently affirmed the need for legislative intervention that, while not completely adhering to all the tenets of Newport News, comes closer in alignment with those decisions. Section 832 of the Fiscal Year 2013 NDAA addresses DCAA access to contractor internal audit reports and directs the DCAA to issue guidance thereto. 224 Section 832 provides that all requests for access to defense contractor internal audit reports will be appropriately documented, and requires a [w]ritten determination that access... is necessary to complete... evaluations of contractor business systems, which must include a rationale if access is not granted, as well as a record of the contractor s response to the request. 225 Section 832 also provides that new, revised guidance from the DCAA will include safeguards to ensure that contractor internal audit reports cannot be used... for any purpose other than evaluating and testing the efficacy of contractor internal controls and the reliability of associated contractor business systems. 226 Section 832 differs significantly from the proposed legislation originally introduced as section 843 of the NDAA, 227 which, if passed, would have unequivocally allowed the DCAA unqualified, statutory access to defense contractor internal audit reports and supporting materials (such as workpapers) and would have essentially overruled the Newport News decisions. 228 The rationale for introducing section 843 as part of the NDAA was to create opportunities for DCAA auditors to assess the risk and evaluate the efficacy of contractor internal controls and the reliability of associated contractor business systems. 229 Opposing section 843 and recommending that it be dropped from the final bill, the Acquisition Reform Working Group (ARWG) 230 of the National Defense Industrial Association asserted that section 843 is an inappropriately coercive policy. 231 In a further expression of the group s disapproval of the proposed legislation, the ARWG argued that subjecting all internal audits to access by outside parties removes the contractor s ability to self-correct and instead places an unintended formality on the process. 232 The effect is that [t]his may cause a [contractor] to reduce the scope of audits undertaken and documents reviewed to more routine matters, rather than those intended to identify any internal control problems, which could result in penalization should the government auditor misinterpret the results of such internal audits. 233 In addition, the ARWG voiced concerns regarding the extent of the internal contractor documents to which government auditors would have access as a result of section The group explained that many of the internal company management reports, operating plans, and other related corporate documents are company proprietary and sensitive in nature and contain information far beyond that which is the subject of a DCAA audit. 235 To meet the objectives of section 843 and the DCAA auditors seeking access to contractor internal audit reports, the ARWG cited at least two alternative ways to ensure adequate controls and good governance in a contractor organization. One is by the existence itself of a well-functioning internal audit department 236 with independent (peer) reviews of the audit departments. 237 The ARWG continued: A second is through external audit, which reviews and signs off on a company s financial controls and conducts testing of its own to gain comfort in the control environment of the corporation. Contractors external auditors are uniquely qualified to opine on the effective controls of a corporation and are inspected annually by the Public Company Accounting Oversight Board (PCAOB) and recognized by the Institute of Internal Auditors (IIA) as the standard in ability to give those opinions. 238 Subjecting contractor internal audits and resulting Internal Audit Materials to the mandates of the originally proposed legislation outlined in section 843 may have caused contractors to reduce the scope of their internal audits. 239 This may have exposed contractors to weaknesses in their respective internal audit processes and in the detection of inadequacies in their business systems. 240 Such deficiencies could emanate from a contractor s more perfunctory review and examination of their internal systems, as opposed to an audit that will reveal and flag more substantive issues and problems. 241 The legislation that actually passed as section 832 of the NDAA is closer in line with the standards of Newport News than the originally proposed section 843. Nevertheless, future amendments should be proposed to include language that would further limit the authority of DCAA auditors to access Defense Contract Audit Agency s Access to Contractor Internal Audit Reports: Is Newport News Still the Standard? 10

11 Internal Audit Materials to when such materials are limited to a particular contract, are provided to verify costs, and are objective in nature. VIII. CONCLUSION Since the days of the Meyers procurement scandal and the subsequent enactment of the ASPA, questions have been raised regarding the extent of the Government s access to contractor business records. These questions have more recently and more specifically been at the forefront of the DCAA, which seeks to gain broader access to corporate documents and records, including contractor Internal Audit Materials. Court precedent does not support unfettered DCAA access to these materials. In fact, courts have limited the DCAA s access to contractor records that support objective cost issues arising out of a particular contract. Nevertheless, the GAO Report and the Guidance seemingly run counter to the case law that has guided access issues over the last thirty years. Specifically, certain ambiguities in the Guidance leave the door wide open to misinterpretation by the DCAA, which has long sought to expand its access to contractor records. Additionally, the DCAA s Guidance and its reliance on the GAO Report tend to give DCAA auditors the impression that they are entitled to a greater number of internal audit reports. The practical realities, however, suggest that a majority of these materials may be inaccessible either due to lack of relevancy to a government contract or due to the subjective content that is inherent in these reports. potential chilling effect could call into question the adequacy of contractor internal controls and their systems, while also leading contractors to operate more inefficiently. Such inefficiency may have the unintended consequence of fraud, waste, and abuse in government contracts while also leading to increased friction between the DCAA and contractors in an already stressed business, regulatory, and economic environment. This article was originally published in the Public Contract Law Journal, Vol. 42, No. 3, Spring Reproduced by permission. This information or any portion thereof may not be copied or disseminated in any form or by any means or downloaded or stored in an electronic database or retrieval system without the express written consent of the American Bar Association. Any attempt by the DCAA to go beyond its statutory authority could be enormous and would not occur without significant adverse implications. For example, as one commentator has concluded, contractors [may] be incentivized to perform fewer [internal] audits or to document their audit work in less detail than is currently in practice. 242 This is contrary to the common view that [g]overnment actions should foster contractor selfgovernance... [and not] discourage aggressive self-review. 243 Expanding the DCAA s authority to access Internal Audit Materials would therefore have an enormous and degrading impact on contractors monitoring capability of their business systems and internal controls. It would also certainly impact the contractors representations as to the quality of these systems. The DCAA s request for Internal Audit Materials and other related corporate documents pursuant to the Guidance is beyond the statutory authority granted to the Agency. Without a statutory basis in 10 U.S.C and 2306a, contractors may seek to rely on Newport News in objecting to DCAA requests for internal audit reports and related workpapers. Given that the Newport News decisions continue to represent the standard for the DCAA s authority to access contractor business records generally and contractor internal audit reports and related workpapers specifically, it would surprise no one if defense contractors decide to scale back or eliminate their audit departments in light of the Guidance. 244 The Guidance s Defense Contract Audit Agency s Access to Contractor Internal Audit Reports: Is Newport News Still the Standard? 11

12 REFERENCES 1 See, e.g., OFFICE OF THE INSPECTOR GEN., U.S. DEP T OF DEF., DODIG , CONTRACTOR-INVOICED COSTS WERE ACCURATE, BUT DOD DID NOT ADEQUATELY TRACK FUNDING 1 (2012) (noting that the Department of Defense (DoD) spends $100 billion on contracts for goods and services annually, with the expectation of obligating more than $2 trillion between FY 2011 and FY 2015). 2 Fareed Zakaria, Cut Defense Spending, CNN WORLD (Aug. 9, 2011), square.blogs.cnn.com/2011/08/09/cut-defensespending/. 3 See U.S. DEP T OF DEF., DIRECTIVE NO , DEFENSE CONTRACT AUDIT AGENCY (DCAA) 1 (2010); DEF. CONTRACT AUDIT AGENCY, U.S. DEP T OF DEF., REPORT TO CONGRESS ON FY 2011 ACTIVITIES AT THE DEFENSE CONTRACT AUDIT AGENCY 1 (2012) [hereinafter DCAA REPORT TO CONGRESS ON FY 2011]. 4 Prior to the establishment of the Defense Contract Audit Agency (DCAA) on January 9, 1965, the Army, Navy, and Air Force operated their own contract auditing agencies, each with different accounting practices. DCAA History, DCAA (Nov. 25, 2011), In May 1962, Secretary of Defense Robert S. McNamara instituted Project 60, in which the DoD examined the efficacy of creating a central body that would consolidate and manage the activities associated with contract administration and audit. Id. By December 1964, after conducting the study, the DoD decided that government procurement would be more effective and efficient if defense contract audits were housed within one entity, the DCAA. DEF. CONTRACT AUDIT AGENCY, U.S. DEP T OF DEF., DCAA MANUAL NO (2012). 5 See DCAA REPORT TO CONGRESS ON FY 2011, supra note 3, at 1. 6 See id. See generally FAR (discussing the determination of cost allowability, reasonableness, and allocability). 7 See DCAA REPORT TO CONGRESS ON FY 2011, supra note 3, at 1. For a brief description of generally accepted government auditing standards, see infra note 68 and accompanying text. 8 See DCAA REPORT TO CONGRESS ON FY 2011, supra note 3, at See id. at See DEF. CONTRACT AUDIT AGENCY, U.S. DEP T OF DEF., 12-PPS- 019(R), AUDIT GUIDANCE ON ACCESS TO CONTRACTOR INTERNAL AUDIT REPORTS (2012) [hereinafter AUDIT GUIDANCE]. Contractors are responsible for maintaining audit reports and related workpapers (Internal Audit Materials) as part of their duty to maintain adequate internal controls. See DEF. CONTRACT AUDIT AGENCY, U.S. DEP T OF DEF., DCAA CONTRACT AUDIT MANUAL, DCAA MANUAL NO (b) (2012) [hereinafter DCAAM NO ]. Internal control is defined as a process designed to provide reasonable assurance regarding the achievement of objectives in the following categories: (a) reliability of financial reporting, (b) effectiveness and efficiency of operations, and (c) compliance with applicable laws and regulations. Id. (internal citation and quotations omitted). Internal controls will have five interrelated components : Control environment sets the tone of an organization, influencing the control consciousness of its people; Risk assessment the entity s identification and analysis of relevant risks to achievement of its objectives, forming a basis for determining how the risks should be managed; Control activities the policies and procedures that help ensure that management directives are carried out; Information and communication the identification, capture, and exchange of information in a form and time frame that enable people to carry out their responsibilities; and Monitoring the process that assesses the quality of internal control performance over time. Id (c). Elements of these components are designed into an entity s accounting and management systems to help ensure that management objectives are achieved as effectively and efficiently as possible. Id (d). 11 See AUDIT GUIDANCE, supra note Id. 13 United States v. Newport News Shipbuilding & Dry Dock Co. (Newport News I), 837 F.2d 162 (4th Cir. 1988); United States v. Newport News Shipbuilding & Dry Dock Co. (Newport News II), 862 F.2d 464 (4th Cir. 1988). These cases are referred to collectively as Newport News. 14 U.S. GOV T ACCOUNTABILITY OFFICE, GAO 12-88, DEFENSE CONTRACT AUDITS: ACTIONS NEEDED TO IMPROVE DCAA S ACCESS TO AND USE OF DEFENSE COMPANY INTERNAL AUDIT REPORTS 21 (2011) [hereinafter ACTIONS NEEDED TO IMPROVE DCAA S ACCESS]. 15 Newport News I, 837 F.2d at 168. The Fourth Circuit in Newport News I found that the facts and circumstances underlying the internal audits at issue made the reports inaccessible to DCAA. Id. at Effective July 7, 2004, the GAO s legal name was changed from the General Accounting Office to the Government Accountability Office pursuant to the GAO Human Capital Reform Act of 2004, Pub. L. No , 8(a), 118 Stat. 811, 814 (codified as amended at 31 U.S.C. 702 (2006)). 17 Armed Services Procurement Act of 1947 (ASPA), Pub. L. No , 4, 62 Stat. 21, 23 (1948) (codified as amended at 10 U.S.C (2006 & Supp. V (2011)). The foundation for modern-day government contracting at the federal level, the ASPA is a law governing procurement procedures of the U.S. Department of Defense in all types of property (except land), construction, and services acquisition. Id. 2. The ASPA also established sealed bidding as the preferred method of procurement. Id. 2, Newport News I, 837 F.2d at 167; see also 94 CONG. REC.79 (1948) (statement of Sen. Byrd discussing the catalytic role of the Meyers procurement scandal and introducing a floor amendment to legislation designed to allow greater agency access to contractor records); Investigation of the National Defense Program: Hearings Before a Special S. Comm. Investigating the Nat l Def. Program, 80th Cong. 26, (1948) (Part 43: Aircraft Procurement, Activities of Gen. Bennett E. Meyers); Bennett E. Meyers Testifies Before Senate War Investigating Subcommittee, 1947 in Washington, DC, CRITICAL PAST, Robard-Hughes_man-testifies_dignitaries (last visited Feb. 15, 2013). 19 Newport News I, 837 F.2d at Id. 21 See id. at See Hewlett-Packard Co. v. United States, 385 F.2d 1013 (9th Cir. 1967); Eli Lilly & Co. v. Staats, 574 F.2d 904 (7th Cir. 1978); Bristol Labs. Div. of Bristol- Myers Co. v. Staats, 620 F.2d 17 (2d Cir. 1980), aff d per curiam, 451 U.S. 400 (1981) (also discussing the litany of cases addressing government access to contractor business records). 23 See, e.g., Eli Lilly & Co., 574 F.2d 904. The Comptroller General is the head of the Government Accountability Office (GAO). 31 U.S.C. 702 (2006) F.2d See id. at Id. at 1015 (internal quotation marks omitted). 27 Id. (quoting 10 U.S.C. 2313(b) (1964)); see also Willis A. Siegfried Jr., Government Contracts: Contractor s Obligation to Allow Examination of Records Under 10 U.S.C. 2313(b), 72 DICK. L. REV. 687, 691 (1967) (noting that the purpose as given in the legislative history of 10 U.S.C. 2313(b) was solely to 12

13 provide a method to discover fraudulent activities [as opposed to] a means by which government agencies can improve their procurement techniques for use in future contracts ). 28 Hewlett-Packard Co., 385 F.2d at 1015 (emphasis added) (internal quotations marks omitted). 29 Id. 30 See id. at Id. 32 Id. 33 Siegfried, supra note 27, at F.2d 904 (7th Cir. 1978). 35 See id. at Id. at Id. at Id. at Eli Lilly sold each product to the Government below Eli Lilly s catalog price and lower than the price given [to] any other person or entity. Id. 39 Id. at 906 (emphasis added) (internal quotation marks omitted). 40 Id. at 909. The investigation was pursuant to the Subcommittee on Monopoly of the Senate Select Committee on Small Business Problems in the Drug Industry: Hearings on Present Status of Competition in the Pharmaceutical Industry. Id. at 907; see also Case Comment, The Comptroller General s Authority to Examine the Private Business Records of Government Contractors: Eli Lilly & Co. v. Staats, 92 HARV. L. REV. 1148, 1149 (1979). 41 Eli Lilly, 574 F.2d at Id. at Id. at Id. at Id. at 918 (Pell, J., dissenting). 46 Id. at Id F.2d 17 (2d Cir. 1980), aff d per curiam, 451 U.S. 400 (1981). 49 See id. at See id; see also Bristol Labs. Div. of Bristol-Myers Co. v. Staats, 428 F. Supp (S.D.N.Y. 1977). In short order, the Second Circuit s opinion in Bristol- Myers affirmed the district court and relied heavily on the facts and rationale contained within the lower court s opinion. Bristol Labs., 620 F.2d at See Bristol Labs., 428 F. Supp. at Id. at Id. 54 Id. at 1389 (internal quotation marks omitted). 55 See The Comptroller General s Authority, supra note 40 at , 1150 n Bristol Labs., 428 F. Supp. at Id. at See id. at See Bristol Labs. Div. of Bristol-Myers Co. v. Staats, 620 F.2d 17, 18 (2d Cir. 1980), aff d per curiam, 451 U.S. 400 (1981). 60 See Bristol Labs., 428 F. Supp. at Id. 62 Defense Contract Audit Agency, DEF. CONTRACT AUDIT AGENCY, (last visited Feb. 15, 2013). 63 Jess Oyer, Note, Plea for Penalty: Remediating Contingency Contract Oversight with Existing but Underutilized Regulatory Mechanisms, 40 PUB. CONT. L.J. 1041, 1044 (2011); see also Defense Contract Audit Agency, supra note See DCAAM NO , supra note 10, 1-102(a), (a); Defense Contract Audit Agency, supra note See DCAAM NO , supra note 10, (a); Defense Contract Audit Agency, supra note To a lesser extent, the DCAA also provides contract audit services to other government agencies outside of the DoD. See DCAAM NO , supra note 10, 1-102(a); Defense Contract Audit Agency, supra note DCAAM NO , supra note 10, 1-102(a), (a). 68 The generally accepted government auditing standards (GAGAS) are a set of professional standards that measure the quality of audits and ensure that audit conclusions are well supported by evidence. DCAA REPORT TO CONGRESS ON FY 2011, supra note 3, at 1. These standards are contained within the 2011 Revision of the Government Auditing Standards (Yellow Book), which are developed and published by the Comptroller General of the Government Accountability Office. U.S. GOV T ACCOUNTABILITY OFFICE, GAO G, GOVERNMENT AUDITING STANDARDS 2011 REVISION (2011), available at The DCAA has incorporated the Yellow Book by reference through DoD Instruction U.S. DEP T OF DEFENSE, INSTRUCTION AUDIT POLICIES (2007). In conducting its audits, the DCAA must comply with GAGAS. See DCAAM NO , supra note 10, 2-101(a). The scope of work falling within the ambit of GAGAS is financial audits, attestation engagements, and performance audits. Id (c). 69 See DCAAM NO , supra note 10, (a); Oyer, supra note 63, at 1044 (noting that the DCAA exists to protect government interest in preventing fraud, waste, error, or abuse of taxpayer dollars). 70 The DCAA Contract Audit Manual (DCAAM) is an official publication of the DCAA that outlines technical and procedural audit guidance for those involved in fulfilling the DCAA s missions. See DCAAM NO , supra note 10. This manual is available electronically at Publications: DCAA Contract Audit Manual (CAM) DCAAM , DEF. CONTRACT AUDIT AGENCY, (last visited Feb. 15, 2013). 71 See DCAAM NO , supra note 10, (a). 72 See About DCAA: Products and Services, DEF. CONTRACT AUDIT AGENCY, (last visited Feb. 15, 2013). 73 See DCAAM NO , supra note 10, (a); see also DEFENSE CONTRACT AUDIT AGENCY, U.S. DEP T OF DEF., DIRECTIVE NO SUPP. 1-1S1 1 (2010) [hereinafter DCAA CHARTER]. 74 See DCAAM NO , supra note 10, (a). 75 Id. 76 See DCAA REPORT TO CONGRESS ON FY 2011, supra note 3, at When discussing the DCAA s access to the records of a contractor, it is also implied throughout this Article that the DCAA may access and review the records of a subcontractor with equal force. See 10 U.S.C. 2313(a) (b) (2006 & Supp. III 2009) (authorizing DCAA subpoena power over both contractor and subcontractor records). 78 See discussion infra Part IV for Newport News case law interpretation on these authorities in relation to the DCAA s power. Defense Contract Audit Agency s Access to Contractor Internal Audit Reports: Is Newport News Still the Standard? 13

14 79 10 U.S.C. 2306a (2006 & Supp. IV 2010), 2313; see also Richard C. Johnson, Identifying Subcontractors Under TINA and Access-to-Records Statutes: Filling an Annoying Gap in Government Contracts Jurisprudence, 32 PUB. CONT. L.J. 739, 744 (2003). 80 Section 2313 grants such authority to the head of the agency, or the secretary of defense, who acts through the DCAA as its authorized representative. 10 U.S.C Id. 2313(a)(1)(A). 82 The term cost or pricing data is defined as all facts that, as of the date of agreement on the price of a contract (or the price of a contract modification), or... another date agreed upon between the parties, a prudent buyer or seller would reasonably expect to affect price negotiations significantly. Id. 2306a(h)(1). 83 Id. 2313(a)(2). 84 Section 2306a comprises the truth-in-negotiations provisions relating to cost or pricing data to be submitted by certain contractors and subcontractors. See id. 2306(f). 85 Section 2313, which allows the head of an agency to delegate its authority to an authorized representative (such as the DCAA), explicitly makes reference to 10 U.S.C. 2306a in relation to the DCAA s access authority. See id. 2313(a)(2). 86 Id. 2306a(a)(1) (2). 87 Id. 2306a(g) (referring to the access rights conferred to the DCAA in 10 U.S.C. 2313(a)(2)). 88 FAR (b)(1). 89 Id.; FAR FAR (b) (c). 91 The DCAA has traditionally functioned as the independent financial advisor to the Contracting Officer. See Joseph D. West & Judith B. Kassel, Access to Contractor Records/Edition II, BRIEFING PAPERS, Apr. 1988, at United States v. Newport News Shipbuilding & Dry Dock Co. (Newport News I ), 837 F.2d 162 (4th Cir. 1988). 93 United States v. Newport News Shipbuilding & Dry Dock Co. (Newport News II ), 862 F.2d 464 (4th Cir. 1988). 94 While Newport News I and Newport News II addressed the proper scope of a DCAA subpoena, the cases also implicitly addressed the proper scope of the DCAA s access to records. See Newport News I, 837 F.2d at 164, 166, 169; Newport News II, 862 F.2d at 466. This is so because the statute giving DCAA subpoena power, 10 U.S.C. 2313(b), allows the DCAA to subpoena only materials to which it has access under 10 U.S.C. 2313(a) or 10 U.S.C. 2306a (2006 & Supp. IV 2010). See 10 U.S.C. 2313(b)(1) (2006 & Supp. III 2009) ( The Director of the [DCAA] (or any successor agency) may require by subpoena the production of any records of a contractor that the Secretary of Defense is authorized to audit or examine under subsection (a). ). The legislative history reinforces this, as the intent behind the subpoena statute was not to expand the DCAA access to contractor records but rather to provide the Agency with an enforcement mechanism of its existing rights to a contractor s books and records. See Newport News Shipbuilding & Dry Dock Co. v Reed, 655 F. Supp. 1408, 1412 (E.D. Va. 1987). 95 See discussion supra Part II. 96 See Newport News I, 837 F.2d at 169; Newport News II, 862 F.2d at See Newport News I, 837 F.2d at 164; Newport News II, 862 F.2d at See Newport News I, 837 F.2d at 166; Newport News II, 862 F.2d at See ACTIONS NEEDED TO IMPROVE DCAA S ACCESS, supra note 14, at (stating that DCAA officials admitted to declining to use their subpoena authority to obtain internal audit reports because of the standard established in Newport News I in 1988). 100 See Newport News I, 837 F.2d at Id. 102 Id. As of this writing, Newport News Shipbuilding and Dry Dock Company (Newport News Shipbuilding), now formally known simply as Newport News Shipbuilding, is a division of Huntington Ingalls Industries and continues to be engaged in the business of shipbuilding and repair. Who We Are: About Our Company, HUNTINGTON INGALLS, (last visited Feb. 15, 2013). 103 Newport News I, 837 F.2d at Id. 105 Id. 106 Id. at 165, Id.; see also Newport News Shipbuilding & Dry Dock Co. v. Reed, 655 F. Supp. 1408, 1410 (E.D. Va. 1987). 108 Newport News I, 837 F.2d at Id. 110 Id. 111 The DCAA s statutory subpoena power was recodified as 10 U.S.C. 2313(b) in October U.S.C (1994). 112 See Newport News I, 837 F.2d at See Newport News Shipbuilding & Dry Dock Co. v. Reed, 655 F. Supp. 1408, 1409 (E.D. Va. 1987). 114 Id. 115 Id. at 1413, 1415 ( In the case sub judice, the [c]ourt has found that the DCAA lacks the statutory authority to subpoena Newport News internal audit reports. ). 116 Newport News I, 837 F.2d at 164, 168 (emphasis added). 117 Id. 118 Id. at Id. at Id. at Distinguishing between the limits of the DCAA s power to access the company s internal documents versus the powers of the DoD inspector general (IG), the district court suggested that the IG would be the proper entity to access the company s internal audit reports given its broad and virtually unlimited investigatory power including the power to subpoena. Newport News, 655 F. Supp. at 1414 (citing United States v. Westinghouse Elec. Corp., 615 F. Supp (W.D. Pa. 1985), aff d, 788 F.2d 164 (3d Cir. 1986)). 121 Newport News I, 837 F.2d at 165, ( [Newport News Shipbuilding s] internal audits are not the type of documents that fall within the scope of the DCAA s subpoena power. ). 122 Id. at Newport News I was decided in January Newport News I, 837 F.2d at 162. One month prior to this decision, the Eastern District of Virginia issued its decision on December 23, 1987, in what was later appealed to the Fourth Circuit in Newport News II. See United States v. Newport News Shipbuilding & Dry Dock Co. (Newport News II), 862 F.2d 464, 466 (4th Cir. 1988). 124 See Newport News II, 862 F.2d at Id. at 466. In particular, the Government issued a subpoena duces tecum demanding [t]rial balance, adjusting entries, segment financial workpapers, consolidating entries, formal consolidated balance sheet and income statement, Defense Contract Audit Agency s Access to Contractor Internal Audit Reports: Is Newport News Still the Standard? 14

15 [f]ederal income tax return, Virginia income tax return and any other supporting schedules, documentation or correspondence related to preparation and issuance of financial statements or preparation or payments of any tax liabilities on a Federal, state or local level for the period 1 January 1983 to the present[.] Id. (quoting the Government s subpoena) (alteration in original). 126 Id. 127 Id. 128 Id. 129 The court in Newport News I analyzed 10 U.S.C. 2306(f)(5), the predecessor statute to 10 U.S.C. 2306a(f). See United States v. Newport News Shipbuilding & Dry Dock Co. (Newport News I), 837 F.2d 162, 164 (4th Cir. 1988). In 1986, Congress recodified the statute, but its content remained virtually unchanged. See Act of Oct. 18, 1986, Pub. L. No , 952, 100 Stat. 1783, (codified as amended at 10 U.S.C. 2306(f) (2006 & Supp. V 2011), 2306a(f ) (2006 & Supp. IV 2010)). 130 Newport News II, 862 F.2d at 465, See id. at Id. 133 Id. at , Id. at 467, Id. at Id. at See id. at (finding access to requested documents would allow the DCAA to verify the accuracy of costs incurred and corroborate Newport News Shipbuilding s computation and allocation of direct and indirect costs to particular government contracts). 138 Id. at 471. On remand, the Eastern District of Virginia granted enforcement of the DCAA s subpoena after Newport News Shipbuilding still refused to provide a category of documents. United States v. Newport News Shipbuilding & Dry Dock Co., 737 F. Supp. 897, , 903 (E.D. Va. 1989). Principally, these documents were workpapers containing the company s estimates and projections. Id. at The court granted the DCAA access to these workpapers after finding that the estimates and computations contained therein constituted corroborative information that may assist in the verification of cost charges claimed by Newport News Shipbuilding. Id. at ( Clearly, estimates and projections must be used in the ongoing process of negotiation and payment of contracts that involve large-scale work over a period of years. ). 139 Compare United States v. Newport News Shipbuilding & Dry Dock Co. (Newport News I ), 837 F.2d 162, 164 (4th Cir. 1988) (holding that the statutory subpoena power of the DCAA extends to objective cost information relating to a government contract), with Newport News II, 862 F.2d at 470 (stating that the DCAA had the authority to subpoena objective cost information but that the information subpoenaed in this particular case was, in fact, objective, not subjective). 140 Newport News I, 837 F.2d at 168; Newport News II, 862 F.2d at 470. The district court on remand ultimately granted enforcement of the DCAA s subpoena after finding that certain workpapers could reflect upon the accuracy of... cost charges submitted to the [G]overnment and assist DCAA in verifying costs charged. Newport News, 737 F. Supp. at 901 (quoting Newport News II, 862 F.2d at 469). 141 Compare Newport News I, 837 F.2d at 166 ( [ ] 2313(a) and 2306(f )(5) provide DCAA access to corporate records primarily for the purpose of verifying the costs ), with Newport News II, 862 F.2d at 467 (holding the DCAA has access to objective factual materials useful in verifying the actual costs ). 142 Newport News I, 837 F.2d at 164; Newport News II, 862 F.2d at Newport News I, 837 F.2d at 166. The court in Newport News II did note a fine distinction that the DCAA s access to a contractor s internal materials need not necessarily extend to one particular government contract. Newport News II, 862 F.2d at 465. Rather, in the case of indirect, or overhead, costs, the DCAA has access to such records enabling it to verify the allowability and allocability across the government contracts held by the contractor. Id. at 465, Although slightly broadening this principle of relevancy, Newport News II established that the materials sought still have to be at least related to a government contract as opposed to the DCAA having unfettered access to corporate material, in general. See id. at ( DCAA may thus [access and] subpoena objective factual information for the purpose of verifying costs, including general and administrative overhead costs, associated with contracts being audited by DCAA. ) (emphasis added). 144 Newport News I, 837 F.2d at 169; Newport News II, 862 F.2d at 470. The Eastern District of Virginia, on remand, held that the subpoenaed workpapers for federal tax returns and profit and loss statements in Newport News II were essentially subjective information in the form of estimates and projections. See Newport News, 737 F. Supp. at 899, 902. The court, however, recognized some sort of sliding scale by distinguishing those subjective workpapers from the subjective internal audit results the DCAA had sought in Newport News I. Id. at 902. Such workpapers in Newport News II constituted corroborative information that related to particular, long-term government contracts, whereas the internal audit reports addressing overall, department-wide performance, rather than individual contracts, were of the improper kind of subjective material falling outside of the DCAA s access authority. Id. 145 See Newport News I, 837 F.2d at 169; Newport News II, 862 F.2d at Newport News II, 862 F.2d at See ACTIONS NEEDED TO IMPROVE DCAA S ACCESS, supra note 14, at 1 (explaining to senators the congressional inquiry as the basis for GAO Report). 148 See id. at The GAO is an independent, nonpartisan agency that works for Congress. About GAO, U.S. GOV T ACCOUNTABILITY OFFICE, (last visited Feb. 15, 2013). It has broad authority to conduct audits and investigations that aid Congress in controlling the use and disbursement of federal funds. See DCAAM NO , supra note 10, 1-202(a). The GAO s mission is to support the Congress in meeting its constitutional responsibilities and to help improve the performance and ensure the accountability of the federal government for the benefit of the American people. About GAO, supra. In that regard, the GAO s primary purpose is to investigate executive branch expenditures of taxpayer dollars. See id. 149 ACTIONS NEEDED TO IMPROVE DCAA S ACCESS, supra note 14, at 1, Id. 151 Id. at 1. The GAO, in its assessment, also reviewed whether the selected companies adhered to internal auditing standards and the extent to which those companies internal audit reports addressed defense contract management internal controls. Id. 152 Id. at Id. at 1, Id. at Id. 156 Id. at 13, See id. at 15 (stating the difficulty of determining the number of requests made by the DCAA, and implying that the GAO was attempting to quantify the number of requests). 158 Id. at Id. Defense Contract Audit Agency s Access to Contractor Internal Audit Reports: Is Newport News Still the Standard? 15

16 160 Id. 161 Internal controls for purposes of the GAO Report encompass the following areas: Control environment positive and supportive attitude toward internal controls, conscientious management, and ethics standards; Risk assessment identification and assessment of risks from internal and external sources and establishment of controls to mitigate them; Control activities policies, procedures, techniques, and mechanisms that ensure management s directives to mitigate risk are carried out; Information and communications systems assurance that information is recorded and communicated to management and others in a form and within a time frame that enables them to carry out internal controls and operational responsibilities; and Monitoring activities that assess the quality of performance over time and ensure that audit and review findings are promptly resolved. Id. at Id. at Id. at Id. at 17, See id. at Id. 167 Id. 168 AUDIT GUIDANCE, supra note 10, at See id. 170 Id. 171 See id. 172 Id.; ACTIONS NEEDED TO IMPROVE DCAA S ACCESS, supra note 14, at ACTIONS NEEDED TO IMPROVE DCAA S ACCESS, supra note 14, at 22 23; see AUDIT GUIDANCE, supra note 10, at For a discussion on legislative developments, see infra Part VII. 175 See AUDIT GUIDANCE, supra note See ACTIONS NEEDED TO IMPROVE DCAA S ACCESS, supra note 14, at 22 (advocating an increase in the DCAA s access to contractors internal audits, despite the precedent in Newport News to limit such power of the DCAA). 177 See AUDIT GUIDANCE, supra note 10. Because the DCAA did not deviate from the points and recommendations of the GAO Report, any reference to the GAO Report hereinafter also implicitly relates to the DCAA Guidance when not mentioned. 178 See United States v. Newport News Shipbuilding & Dry Dock Co. (Newport News II ), 862 F.2d 464, 470 (4th Cir. 1988). 179 See United States v. Newport News Shipbuilding & Dry Dock Co. (Newport News I ), 837 F.2d 162, 164 (4th Cir. 1988); ACTIONS NEEDED TO IMPROVE DCAA S ACCESS, supra note 14, at 7, 22 (briefly explaining the holding in the Newport News I case and asserting that both Newport News cases together allow DCAA access to internal audits that are relevant to its duties, but failing to provide any further specificity on the Newport News standard). 180 See Thomas A. Lemmer & Tyson J. Bareis, Feature Comment: A Brave New World Managing DCAA Requests for Internal Audits, 54 GOV T CONTRACTOR 34, Feb. 8, 2012, at 1, 2, available at %20Contractor.pdf. 181 Jeffery M. Chiow & Peter A. McDonald, GAO Prods DCAA on Internal Audits, 97 Fed. Cont. Rep. (Bloomberg/BNA), Mar. 13, 2013, at 2, available at ACTIONS NEEDED TO IMPROVE DCAA S ACCESS, supra note 14, at 22; AUDIT GUIDANCE, supra note 10, at 22 (citing Newport News I, 837 F.2d 162; Newport News II, 862 F.2d 464). 183 See Newport News I, 837 F.2d at 169; Newport News II, 862 F.2d at See West & Kassel, supra note 91, at 4 (emphasis added) (quoting OFFICE OF THE INSPECTOR GEN., U.S. DEP T OF DEF., APO 84-5, REPORT ON OVERSIGHT REVIEW OF THE DEFENSE CONTRACT AUDIT AGENCY ACCESS TO RECORDS 1 (1984)); see also OFFICE OF THE INSPECTOR GEN., U.S. DEP T OF DEF., HANDBOOK ON LABOR FRAUD INDICATORS I (1985) (noting that in defining the role of the DCAA auditors, DoD IG aimed to stimulate the contract auditor s imagination regarding the detection of labor fraud indicators and task the auditors with the duty of identify[ing] and minimiz[ing] those areas where the [G]overnment s risk of and vulnerability to fraud is [sic] the greatest ). 185 Patrick D. Mirch, The Access to Records Offensive: The DCAA as Investigator, 19 NAT L CONT. MGM TJ. 31, (1985). Mirch was then-regional director of the Los Angeles Region of the DCAA. 186 Id. at Sarbanes-Oxley Act of 2002 (SOX), Pub. L. No , 116 Stat. 745 (2002). SOX requires formal auditor reports regarding a company s accounting practices and management assessments of a company s internal controls. Sarbanes-Oxley Act of (a)(2)(A); see Chiow & McDonald, supra note 181, at 2; Lemmer & Bareis, supra note 180, at 3. Among other things, section 404 directs the Securities and Exchange Commission to promulgate rules requiring a report reflecting an assessment by a public company s management of the effectiveness of its internal control structure and procedures for financial reporting. Id The DCAA issued a guidance instructing its auditors to seek access to disclosures made to the contractor s auditors and audit committee, as well as any audit work performed in support of the contractor s financial statement certification, management assessment controls, and external auditor report. See DEF. CONTRACT AUDIT AGENCY, 03-PPD-072(R), AUDIT GUIDANCE ON FINAL SECURITIES AND EXCHANGE COMMISSION (SEC) RULINGS RELATING TO SECTIONS 204, 302, 404, 406, AND407OF THE SARBANES-OXLEY ACT OF2002, at 2 (2003); see also Karen L. Manos, Caveat Contractor: DCAA s New Audit Guidance on the Sarbanes-Oxley Act and Contractor Internal Controls, 80 Fed. Contracts Rep. (BNA), Nov. 25, 2003, at See Lemmer & Bareis, supra note 180, at Charles S. Clark, Leaked Shows Defense Audit Agency Sought Subpoena Power, Contractor Pay Caps, GOV T EXEC. ( July 14, 2011), com%2fdefense%2f2011%2f07%2f leaked- -shows-defenseauditagency-sought-subpoena-power-contractor-pay-caps%2f34379%2f. An attachment to the from then-director of the DCAA April Stephenson to then-director of the Pentagon s Defense Procurement and Acquisition Policy Shay Assad stated: [B]ecause the courts have limited DCAA s access to contractor records under the existing laws, the proposed amendments are needed to provide DCAA with the access required to obtain sufficient evidence to comply with the applicable auditing standards. Id. 191 Id. (quoting the attachment). 192 See DEF. CONTRACT AUDIT AGENCY, 12-PPS-018(R), AUDIT GUIDANCE DENIAL OF ACCESS TO RECORDS DUE TO CONTRACTOR ASSERTION OF ATTORNEY-WORK-PRODUCT DOCTRINE OR ATTORNEY-CLIENT PRIVILEGE (2012), available at Defense Contract Audit Agency s Access to Contractor Internal Audit Reports: Is Newport News Still the Standard? 16

17 193 See ACTIONS NEEDED TO IMPROVE DCAA S ACCESS, supra note 14, at One auditor noted that [w]e have been basically on the trust system for years. Richard Lardner, Auditors Can Be Easy on Defense Contractors, ASSOCIATED PRESS (Nov. 10, 2008), _easy_on_defense_contractors/. A veteran of the DCAA further noted that [the condition of anonymity, barring DCAA employees from speaking in public about their work] did not work on Wall Street and it is not working for federal contracts. Id. 195 See, e.g., U.S. GOV T ACCOUNTABILITY OFFICE, GAO , DCAA AUDITS: WIDESPREAD PROBLEMS WITH AUDIT QUALITY REQUIRE SIGNIFICANT REFORM(2009) [hereinafter WIDESPREAD PROBLEMS WITH AUDIT QUALITY]. 196 OFFICE OF THE INSPECTOR GEN., U.S. DEP T OF DEF., D , FOLLOW UP REVIEW: DEFENSE CONTRACT AUDIT AGENCY AUDIT WORK DEFICIENCIES AND ABUSIVE WORK ENVIRONMENT IDENTIFIED BY THE GOVERNMENT ACCOUNTABILITY OFFICE i (2009). 197 See Expediency versus Integrity: Do Assembly-Line Audits at the Defense Contract Audit Agency Waste Taxpayer Dollars?: Hearing Before the S. Comm. on Homeland Sec. & Governmental Affairs, 110th Cong. 26 (2008) (statement of Sen. Claire McCaskill); see also Robert Brodsky, DCAA Takes Another Shot to the Gut, GOV T EXEC. ( June 9, 2009), (stating that Senator Charles Grassley of Iowa called the DCAA a substandard auditor ). 198 U.S. GOV T ACCOUNTABILITY OFFICE, GAO , DCAA AUDITS: ALLEGATIONS THAT CERTAIN AUDITS AT THREE LOCATIONS DID NOT MEET PROFESSIONAL STANDARDS WERE SUBSTANTIATED 3 4 (2008). 199 WIDESPREAD PROBLEMS WITH AUDIT QUALITY, supra note 195, at See Lemmer & Bareis, supra note 180, at 2 (contemplating scenarios where broad DCAA requests for internal audit material could reach areas that contractors view as highly sensitive ). 201 DCAA REPORT TO CONGRESS ON FY 2011, supra note 3, at See Clark, supra note 190 (quoting Alan Chvotkin, executive vice president and counsel of the Professional Services Council, a contractor trade group). 203 See generally ACTIONS NEEDED TO IMPROVE DCAA S ACCESS, supra note See generally id. at 21, 22 (noting that the Fourth Circuit has limited requests for internal audits to those pertaining to a specific contract, then asserting that the DCAA should have access to any audits relevant in carrying out its duties and advocating for additional DCAA access). 205 Id. at 1, Id. at 1, See DCAAM NO , supra note 10, at ch Chiow & McDonald, supra note 181, at 2 (emphasis in original). Moreover, [b]ecause DCAA and internal auditors both examine internal controls, [the] GAO simplistically concluded [in the GAO Report] that such internal audit reports automatically contain information relevant to DCAA audits. Id. 209 See ACTIONS NEEDED TO IMPROVE DCAA S ACCESS, supra note 14, at 22 (acknowledging that DCAA auditors have been hesitant to request internal audits due to uncertainty of the audits objectives, but failing to note that the DCAA s objectives and the companies objectives do not often coincide). 210 Id. at 27; see also John S. Pachter, The Incredible Shrinking Contracting Officer, 39 PUB. CONT. L.J. 705, (2010) ( While [the] DCAA has done this under the guise of reviewing internal controls, [it] has not explained how, as an audit agency whose function is to audit costs it may properly use internal controls as a springboard to broadly monitor contractor ethics and compliance programs. There is no little irony in DCAA assuming this expanded role at the same time that it has been criticized for a lack of professionalism and competence. ). 211 See ACTIONS NEEDED TO IMPROVE DCAA S ACCESS, supra note 14, at 22, 23 (suggesting methods for improved identification and tracking of relevant workpapers, thus impliedly advocating for greater access to internal workpapers as well as internal audits). 212 See Jacob B. Pankowski & William J. Mack, New Policy Seeks to Give Government Access to Defense Contractors Internal Audit Reports, MARTINDALE (Sept. 7, 2012), See generally Am. Inst. of Certified Pub. Accountants, Statement on Auditing Standards No. 103, ,.10.11,.15 (2010) (stating that the term audit documentation is synonymous with workpapers and should include enough information for an unaffiliated auditor to understand by including a wide variety of data, such as meeting minutes). 214 See Lemmer & Bareis, supra note 180, at Id. at Tamar Frankel, Accountants Independence the Recent Dilemma, 2000 COLUM. BUS. L. REV. 261, 268 (2000) ( [A]uditing is a more subjective discipline than it seems. ). 217 ACTIONS NEEDED TO IMPROVE DCAA S ACCESS, supra note 14, at See id. at See id.; V. Gerard Comizio, Banking Regulators Begin to Apply the Sarbanes-Oxley Act, 58 CONSUMER FIN. L. Q. REP. 29, 34 (2004) (noting that the purpose of the audit function is to identify risks inherent in the institution s operations ). 220 ACTIONS NEEDED TO IMPROVE DCAA S ACCESS, supra note 14, at See Lemmer & Bareis, supra note 180, at See Paul D. Cederwall, Congress Moving to Require Access to Internal Audits, PNWC S GOV T CONTRACTING UPDATE ( June 11, 2012, 9:01 AM), Id. 224 See National Defense Authorization Act for Fiscal Year 2013 (NDAA), Pub. L. No , 832, 126 Stat. 1632, 1844 ( Department of Defense Access to, Use of, and Safeguards and Protections for Contractor Internal Audit Reports ) (enacted Jan. 4, 2012). 225 Id. 832(b). 226 Id. 227 H.R. 4310, 112th Cong. 843 (2012) (as amended by the Senate on Dec. 12, 2012) ( Department of Defense Access to and Use of Contractor Internal Audit Reports ), available at This proposed section was not adopted in the final enacted legislation. Compare id., with NDAA The proposed section included the addition of a new ground for audit access authority under 10 U.S.C. 2313(a)(2) (2006 & Supp. III 2009), providing access to determine the efficacy of contractor or subcontractor internal controls and the reliability of contractor or subcontractor business systems. H.R (a). Included in the section was a provision Defense Contract Audit Agency s Access to Contractor Internal Audit Reports: Is Newport News Still the Standard? 17

18 permitting the sanction of contractors failing to provide requested audits and related materials. See id. 843(c). 229 See H.R (b)(2) ( The purpose... shall be to ensure that the [DCAA] has sufficient access to contractor internal audit reports and supporting materials in order to (A) evaluate and test the efficacy of contractor internal controls and the reliability of associated contractor business systems; and (B) assess the amount of risk and level of testing required in connection with specific audits to be conducted by the Agency. ). 230 The Acquisition Reform Working Group (ARWG) concentrates on issues related to the federal acquisition process and represents a cross-section of the government contracting community including large and small businesses, systems integrators, manufacturers, service companies, and electronics and technology providers. The Acquisition Reform Working Group (ARWG), NAT L DEF. INDUS. ASS N, (last visited Feb. 15, 2013). The ARWG annually reviews sets of legislative proposals and takes a variety of issues to the relevant committees of Congress. Id. The member organizations of the ARWG include the Aerospace Industries Association, the American Council of Engineering Companies, the American Council of Independent Laboratories, the Associated General Contractors of America, the National Defense Industrial Association, the Professional Services Council, Tech America (formally AeA and ITAA), and the U.S. Chamber of Commerce. Id. 231 ACQUISITION REFORM WORKING GRP., COMMENTS ON FY 2013 NATIONAL DEFENSE AUTHORIZATION ACT; HOUSE PASSED H.R. 4310AND SENATE COMMITTEE-REPORTED S. 3254, at 37 (2012), available at mments.aspx. 232 Id. 233 Id. 234 Id. 235 Id. 236 Id. 237 See id. ( Independent [peer] reviews are commonplace in the audit community and can be demonstrated through external quality assessments. (alteration in original)). 238 Id. SOX governs the Public Company Accounting Oversight Board s (PCAOB) oversight authority in inspecting these external auditors. Sarbanes- Oxley Act of 2002 (SOX), Pub. L. No , 101(a), 116 Stat. 745, 750. Thus, a channel of government oversight already exists within the realm of internal controls, thereby ensuring good governance. 239 ACQUISITION REFORM WORKING GRP., supra note 231, at Id. 241 See id. 242 See PRICEWATERHOUSECOOPERS LLC, POTENTIAL IMPACTS TO THE INDUSTRY FROM THE GAO STUDY REGARDING ACCESS TO INTERNAL AUDIT REPORTS 3 (2012), available at THE DEPARTMENT OF DEFENSE: DOCUMENTS ON ORGANIZATION AND MISSION, , at 36 (Roger R. Trask & John P. Glennon eds., 2008). 244 Chiow & McDonald, supra note 181, at 4. Defense Contract Audit Agency s Access to Contractor Internal Audit Reports: Is Newport News Still the Standard? 18