DCAA New Tactics in Obtaining Contractor Internal audit reports By Todd Bishop and David Eck, CPA In August 2012, the Defense Contract Audit Agency (DCAA) issued updates to its policy guidance and the Contract Audit Manual associated with audits of Contractor Business Systems. Permeating these updates is the DCAA long established belief that contractor internal audit reports are a necessity to the delivery of a satisfactory audit. Although the courts have found internal audit reports are not a necessity, some individuals within the Agency continue to pressure contractors to cooperate or threaten submit or face the wrath. A recent GAO report added significant support to the DCAA position. Contractors respond to the DCAA requests in a wide variety of ways. At one extreme a company may provide entire internal audit report including workpapers and at the other extreme are contractors that deny access entirely. This is clearly spelled out in the Government Accountability Office s (GAO) report (GAO-12-88) dated December 8, 2011 entitled Defense Contract Audits-Actions Needed to Improve DCAA s Access to and Use of Defense Company Audit Reports. In this report, the GAO recommended that:... DCAA take steps to facilitate access to internal audits and assess periodically whether other actions are needed. DOD generally agreed to implement GAO s recommendations but expressed skepticism that this alone would fully ensure access to internal audits. What the GAO Found The GAO concluded that DCAA is not making full use of defense company internal audit reports to help accomplish its contract audit mission. The GAO believes that DCAA access to relevant internal audit reports is required for DCAA to meet the Generally Accepted Government Auditing Standards (GAGAS) requirements for assessing internal controls and the information is relevant to DCAA audit planning and risk assessment. The GAO believes that internal audit reports include information on defense contractor internal controls and business systems used to manage defense contracts that DCAA is responsible for auditing and contain information and analysis that DCAA could find useful as it conducts its own audit work. The GAO recommends that DCAA increase its access to and use of defense company internal audit reports.
The GAO reviewed 1,125 internal audits at seven large defense contractors during the period 2008-2009 and found that the contractors generally complied with recognized professional standards (i.e., Institute of Internal Audit Standards) for organizing their internal audit departments and performing internal audits. Of the 1,125 internal audits reviewed, GAO determined that 520 audits relate to defense contracts and DCAA s contract audit mission. Of the 520 audits, DCAA only requested 115 internal audit reports. DCAA provided several reasons for not requesting other internal audit reports, including: Access to contractor audit information was not critical to the audit work being performed. DCAA had difficulty in determining which internal audit reports were relevant to DCAA s audit work (e.g., title of the audit report was not descriptive enough). Decrease in the number of DCAA audits performed over the last few years. Contractor requires DCAA to link the request for internal audits to an ongoing DCAA audit of a particular contract or proposal. DCAA Policy Memorandum In response to GAO s report and recommendations, DCAA issued an August 14, 2012 Policy Memorandum and made updates to the DCAA Contract Audit Manual (DCAM) to provide direction to the DCAA auditors for requesting and monitoring requests for contractors internal audit reports. The Policy Memorandum requires the DCAA Contract Audit Coordinator (CAC) offices and Field Audit Offices (FAOs) at major contractor locations to establish a process and a central point of contact to obtain and monitor DCAA s access to and use of internal audits. DCAM 4-202 was updated to require the central point of contact to: Coordinate with the contractor and obtain a semi-annual summary level listing of all internal audit reports issued. The summary document will contain sufficient descriptions to ascertain whether the internal audit may affect Government contracts. Review the summary list of internal audits. If the summary is not adequate to determine which internal audits may affect Government contracts, coordinate with the contractor to obtain the information necessary. Provide the summary list to the CAC Network or the FAO s audit teams responsible for audits of the contractor. Send a request to the contractor for copies of reports and/or working papers considered pertinent by the auditors and provide the auditors copies of the information obtained from the contractor. Implement a process to track auditor s requests for internal audit reports and the contractor s response to the requests.
Provide DCAA Headquarters a semi-annual summary of all requests for internal audit reports, the contractor s response to each request and the audit assignment for which access to the internal audit report was requested. The guidance states that for non major contractors, a formal tracking process or a central point of contact is not mandatory, but notes that internal audit reports can still be useful in the performance of audits at these contractors. DCAA does acknowledge, as outlined in the GAO report, that the Agency cannot request unlimited access to all internal company materials, but should have access to materials relevant to its audit responsibilities. Contractors that fail to comply will face the Access to Record Procedures of the DCAA. These procedures may lead to a subpoena of the reports, if access is ultimately denied by the contractor and possibly to the next test case for DCAA and access to records in the courts. DCAA Authority to Access DCAA s use of its access authority was addressed in two court decisions issued in 1988, commonly referred to as Newport News I and Newport News II. The courts held that DCAA does not have unlimited power to demand access to all internal company documents, but they also held that DCAA may demand access to materials relevant to its audit responsibilities. The court further held that DCAA statutory subpoena power could not be used to access internal audits not tied to a specific contract or proposal. The Director of DCAA has not issued any subpoenas to obtain internal audits since 1988, primarily because DCAA cannot link any denial of internal audit reports to a specific contract or proposal. In the DCAA s first annual report to Congress issued in March 2012, the DCAA states that amendments to laws are required to give DCAA a much broader access to the types of records needed to accomplish the Agency s mission. If companies have a policy to release internal audit reports to DCAA, they should, at a minimum, require the auditor to identify the nexus between their request and a specific contract or proposal. Most contractors that have provided DCAA access say they receive no feedback from DCAA on the results of the evaluations of the audits and the extent of reliance. In fact, contractors believe that DCAA too often uses the reports for the sake of obtaining audit leads increasing DCAA audit work, where the procedural intent is alleged to rely on the internal audit work to reduce the quantity of DCAA s limited resources necessary to accomplish audit objectives.
One chief financial executive at a top five defense contractor commented: I used to provide DCAA with unrestricted access to internal audit reports and working papers, but when they started to misuse this information as audit leads to increase audit scope, I pulled back on the access. If DCAA is provided access to relevant internal audit information, contractors should require that the auditor provide timely feedback on their evaluations of this information and extent of reliance. The Internal Audit Access Road Ahead Contractors should expect a continued increase in the number of DCAA requests for internal audit reports. In anticipation of these requests, contractors should ensure they have adequate policies and procedures on describing the company s process for providing or not providing DCAA access to these reports, including: Identifying and segregating those reports that relate to DCAA s audit mission. Requiring DCAA to provide a link between requests for internal audit reports to specific contracts and proposals. Describing what access to internal audit reports and related working papers will be provided to DCAA (complete copies, executive summaries, review only with no copies provided, etc.). Requiring DCAA to provide timely feedback on its evaluations and use of internal audit reports. What is evident is more DCAA requests will be made and the subsequent scrutiny of internal audit reports and workpapers will certainly create future issues and challenges. For those contractors that deny access or provide limited access, it is likely that DCAA will follow its Denial of Access to Records process whereby up to four letters may be issued stating that the contractor has denied access to pertinent contract records which could lead to a DCAA subpoena for the requested documents. Additionally, these denials will likely erode well defined relationships with contracting officers at all levels and result in withholdings under the business systems rule. In the end, contractors should prepare for either providing internal audit reports at some level or develop a well defined legal position in anticipation of litigation. With the support of the GAO report and significant political pressure lobbying for Congress to provide DCAA broader statutory authority regarding access only time will tell if rational heads will prevail and contractors will be allowed to run their businesses
without threats. Time will also tell if contractors need to brace for additional barriers to success in an industry where the pendulum currently favoring auditors running the show with little getting done. If you have any questions or need assistance, please contact your Government Contracting Consultant or Todd Bishop at 703.970.0504 todd.bishop@dhgllp.com or David Eck at 703.970.0480 david.eck@dhgllp.com. David Eck has more than 31 years experience working in the government accounting field. He has extensive knowledge and experience in all aspects of government laws and regulations, including the Federal Acquisition Regulations, individual agency supplements to the FAR, the Truth in Negotiations Act, the Cost Accounting Standards and the Office of Management and Budget (OMB) Circulars. David worked with the Defense Contract Audit Agency (DCAA) for more than 30 years and was responsible for the development and implementation of DCAA s contract audit policy, including the Contract Audit Manual and standard audit programs. Todd Bishop has more than 20 years of experience helping companies identify and resolve issues associated with cost accounting, financial management systems, requests for equitable adjustments and claims. Todd s work includes helping clients understand the requirements associated with compliance with Federal business system requirements, developing and implementing pricing strategies, indirect cost allocation solutions, developing accounting, estimating, procurement, project management and integrated system requirements for clients in various industries. About the Dixon Hughes Goodman LLP Government Contracting Industry Group: With more than 1,700 people in 11 states, Dixon Hughes Goodman is the largest certified public accounting firm based in the Southern U.S. and the 14th largest in the nation. Our Government Contracting Services Group is active in government contracting associations, keeps up to date with the effects of policies on the local and national levels and provides proactive advice to our clients. In addition, we actively monitor the Federal Acquisition Regulations (FAR), the Cost Accounting Standards (CAS) agenda, as well as changes to the Small Business Administration (SBA). Visit www.dhgllp.com/govcon for more information