What are control objectives, anyway - Part 1?

In yesterday's post, The State of Federal Contracting, we discussed DCAA's (Defense Contract Audit Agency) new policy regarding the adequacy of contractor internal control systems. Under the new audit policy, a contractor's failure to meet a single internal control objective, would render the entire internal control system inadequate. So, what are "internal control objectives"?

Before we discuss "internal control objectives", we need to first identify the internal control systems that the Government (primarily DCAA) is interested in. Contractors have many systems that are not particularly important to the Government. For example, internal controls over cash is important for the independent auditor rendering an opinion of the financial statements but does not significantly affect costs charged to Government contract.. The internal control systems that are most relevant to Government contractors include:

• Overall accounting
• Information technology
• Budget and planning
• Purchasing
• Material management and accounting system
• Compensation
• Labor
• Indirect and other direct costs
• Billing
• Estimating

In order for auditors to determine whether these internal control systems are working effectively, they test for compliance with pre-established criteria or "control objectives". Each of these internal control systems has an associated set of "control objectives". For example, the first system listed, overall accounting internal control system, has eight "control objectives":

1. Integrity and ethical values - management must convey the message that integrity and ethical values cannot be compromised, and employees must receive and understand that message through continuous demonstration of words, actions and commitment to high ethical standards.
2. External audit reports - management should take timely corrective action on any deficiencies note by the external auditor.
3. Board of directors/audit committee - basically dealing with independence and setting the tone at the top
4. Basic organizational structure - clear lines of authority
5. Assignment of authority and responsibility - appropriate for risk and accountability
6. Financial capability - adequate financial resources to perform the contract(s)
7. Accounting system and controls - well-designed and operating effectively to provide reliable accounting data and prevent misstatements that would otherwise occur
8. Cost allocations - costs are assigned based on rules, regulations, and standards for proper distribution of direct cost and allocation of indirect costs.

These control objectives are not found in contract regulations or statutes. They were adapted by DCAA from accounting and auditing literature. Additionally, even a cursory reading of these control objectives reveals the highly subjective nature of many of them. These were two points raised by the attorney who testified at the House Subcommittee on Management, Organization, and Procurement and led her to conclude that DCAA was "wreaking havoc on the Government procurement world".