Potential Impacts to the Industry from the GAO Study Regarding DCAA Access to Internal Audit Reports In its December 8, 2011 report to the US Senate Committee on Armed Services, the US Government Accountability Office (GAO) reported findings and recommendations resulting from its audit of the use of internal audit reports and work papers by the Defense Contract Audit Agency (DCAA). The GAO s recommendations may have an impact on DCAA s tactical approach to requesting access to contractor records. Contractors should understand the latest developments relating to the government s interest in internal audit activities and evaluate their policies and procedures for managing the government s access to internal audit documentation.
Summary of GAO Report and Findings DCAA s authority for access to contractor records is addressed by sections 2313 and 2306a of title 10 of the US Code and by the Federal Acquisition Regulation (FAR). 11 Access to internal audit reports and work papers is addressed by case precedent, most notably United States v Newport News Shipbuilding and Dry Dock Company, 837 F.2d 162 (Newport News I), and United States v Newport News Shipbuilding and Dry Dock Company, 862 F.2d 464 (Newport News II). Based upon its review of DCAA s interaction with the internal audit departments at the five largest government contractors and two smaller, but major, government contractors, the GAO concluded that DCAA does not take maximum advantage of internal audit information. DCAA identified several contributing factors for this condition, including: Information provided regarding the subjects of audits performed was insufficient for DCAA to make informed requests for reports and/or work papers. Contractor companies requirements that DCAA justify its request for information and demonstrate the relevance of the request to existing or planned DCAA audit effort often hinders DCAA s efforts. Information contained in completed audit reports that were provided 1 FAR 52.216-7, the Allowable Cost and Payment Clause, provides that internal audit plans and a listing of internal audit reports are not required in order for an Incurred Cost Submission to be deemed adequate, but that this information may be required during the audit process. often lacked sufficient detail to be of use to DCAA in planning or executing its audits. There are restrictions on DCAA auditors regarding reliance on the work of other audit organizations. The number of DCAA audits of contractor internal controls has been reduced because of anticipated regulatory changes that would redefine controls requirements and render completed audits out-ofdate. Court precedent does not favor DCAA access to internal audit reports and work papers. GAO concluded that DCAA s lack of access exists in part because DCAA management is not aware of the access limitations and also because DCAA does not regularly track the status of requests for internal audit information. GAO also concluded that this lack of access to information to which DCAA might be entitled limits their ability to conform to generally accepted government audit standards (GAGAS) and hinders the effective planning and execution of DCAA audits. It is clear that GAO does not expect DCAA, in developing its own audit opinions, to in any way leverage the testing performed by internal auditors. The GAO believes, however, that by considering the work performed by internal audit departments, DCAA will be able develop better informed audit plans. Relevant Case Precedent Newport News I and II, both decided in 1988, dealt with the enforceability of DCAA s subpoena access to internal documents at Newport News Shipbuilding and Dry Dock Company. In Newport News I, the court decided that DCAA should not enjoy unlimited access to all internal corporate materials and should have access only to information related to cost incurred on government contracts. Because the information requested by DCAA was not interpreted to be cost information related to government contracts, the enforcement of the subpoena was denied. In Newport News II, the records being sought by DCAA were company tax returns, financial statements, and supporting schedules. The court held that these documents should be provided to DCAA because of its relevance to DCAA s audit work and because it was financial information that would allow DCAA to verify cost on government contracts. Newport News I, in particular, has provided the industry with a precedential argument that DCAA should not be provided access to internal audit reports. It is common practice in the industry today including among the majority of contractors whose internal audit departments were the subject of the GAO audit that DCAA is provided some level of controlled access to internal audit reports and even audit work papers. This is perhaps because even industry recognizes the potential relevance of some internal audit work to the DCAA s efforts to execute financial advisory and controls oversight. It is worth noting that these cases were litigated before the new requirements in the Contractor Code of Business Ethics and Conduct at FAR 52.203-13 for periodic reviews of internal controls, and the most recent changes to the Allowable Cost and Payment Clause at 52.216-7, which specifically identifies certain internal audit Government Contracting 2
information as items that may be required during the audit process. What Contractors Can Expect As a result of this GAO audit report, contractors should expect an increase in requests for internal audit documents, including plans, reports, and work papers. Based on the Department of Defense s (DOD) acknowledgement and commitment to implement the GAO s three key recommendations, contractors can also expect DCAA to coordinate its approach to internal audit data access in the following ways: Establishment of a main point of contractor contact who will: (1) obtain information regarding the subject and content and internal audit reports so that auditors can more easily identify relevant internal audits, and (2) track the number and status of DCAA s request for access to internal audit data Periodic assessment of the status of requests in order to determine if contractors are making their best efforts to share relevant need-toknow data with DCAA, which will result in increased pressure on company leadership to facilitate access Increased training and guidance for DCAA auditors in order to develop a better informed workforce to result in increased access to internal audit work papers The GAO audit findings further DCAA s efforts to obtain access to records to validate that contractors maintain compliance programs. The Contractor Code of Business Ethics and Conduct provided at FAR 52.203-13 requires that contractors implement internal control systems that provide for periodic reviews of company business practices, procedures, policies, and internal controls for compliance with the contractor s code of business ethics and conduct and the special requirements of government contracting. In addition, contractors must provide full cooperation with any government agencies responsible for audits, investigations, or corrective actions. Full cooperation means: [d]disclosure to the Government of the information sufficient for law enforcement to identify the nature and extent of the offense and the individuals responsible for the conduct. It includes providing timely and complete response to Government auditors and investigators request for documents and access to employees with information; As a result of the new compliance program requirements in the Contractor Code of Business Ethics and Conduct, 2 references to internal audit information in the Allowable Cost and Payment Clause, 3 and this recent GAO report, DCAA will likely pursue access more aggressively. Potential Impacts to Contractor Internal Audit Programs of GAO s Report The potential impact of an enhanced DCAA approach to obtaining internal audit reports is that companies will be incentivized to perform fewer audits or to document their audit work in less detail than is currently in practice. 2 FAR 52.203-13 3 FAR 52.216-7 However, the same rule providing substance to DCAA s anticipated increase in requests for internal audit information may indicate that contractors have internal audit programs that: 1. Establish standards and procedures to facilitate timely discovery of improper conduct in connection with government contracts 2. Ensure corrective measures are promptly instituted and carried out It is important that companies have their internal audit plans, reports, and recommendations reviewed for accuracy, including legal review where appropriate. Approaches to Permitting Access to Relevant Internal Audit Reports Current approaches to managing outsider access to internal audit data range from very limited access to nearly open access. Conventional wisdom favors a midpoint of these approaches so as not to test the boundaries of precedent or to antagonize government oversight, but also not to provide unfettered access to sensitive company data, especially if not relevant to DCAA s audit work. Effective approaches may employ all or some of the following elements: Provide the DCAA point of contact with a list of the titles of audit reports where audit work has been completed and corrective action plans are in place. Brief descriptions of each audit can be paired with the titles to help DCAA identify the reports that are relevant to their audit work. Government Contracting 3
Require that requests for internal audit information be made in writing with sufficient explanation to justify the relevance of the requested internal audit information to planned audit work. Provide a consistent medium of access, which may include read-only access to audit information; copies of whole audit reports; copies of redacted audit reports; or audit report summaries of actions, findings, and recommendations. Additionally, it is important to determine if the company will, as a rule, allow access to internal audit work papers or to information for audits in process. Maintain the companies own log of DCAA requests for audit reports, the specifics of the request, the final determination on access, and the rational for permission or denial. Impact The US government will continue to actively adapt its oversight to the changing nature of business in its efforts to strengthen its buying position and increase the value it derives from taxpayer dollars. Contractors should expect that periodic changes in law, regulation, and agency policy may result in real changes to the way that business is conducted in the industry as well as to the relationships between contractors and government oversight personnel. The GAO s findings and recommendations and DCAA s commitments adjust the government s strategy of oversight that has not followed a rule-making or legislative process. Contractors should be proactive in developing the stance that best supports their business strategy while still fulfilling obligations for adequate disclosure and access to records before a precedent is set for them through the audit process. Government Contracting 4
Contacts A special acknowledgment to the author of this piece: Richard Meene (646) 471-7346 richard.j.meene@us.pwc.com Philip Koos (646) 471-2454 philip.koos@us.pwc.com To have a deeper conversation about how this subject may affect your business, please contact: James Bucrek (312) 298-3907 james.bucrek@us.pwc.com John May (617) 530-5340 john.m.may@us.pwc.com James Thomas (703) 918-3050 james.w.thomas@us.pwc.com Philip Treccagnoli (646) 471-8191 philip.d.treccagnoli@us.pwc.com 2012 PricewaterhouseCoopers LLP. All rights reserved. refers to the United States member firm, and may sometimes refer to the network. Each member firm is a separate legal entity. Please see www.pwc.com/structure for further details. This content is for general information purposes only, and should not be used as a substitute for consultation with professional advisors.