Getting Your "Inadequate" Internal Control Rating Changed

The Defense Contract Audit Agency performs various audits to assess the adequacy of contractor internal control systems. The most common reviews performed at small contractors include the timekeeping and accounting systems. Medium and large contractors may receive audits of billing, budgeting, compensation, purchasing, and more, depending on whether the particular control system is deemed to be a risk area for the Government. The audit opinions on reviews of internal control systems range from "adequate" when a contractor meets all internal control objectives to "inadequate" when significant deficiencies and/or material weaknesses are disclosed.

Before an audit report is issued, it is important for contractors to ensure that the auditors fully understand the system of internal controls. Things that might appear to be deficiencies, might not be true deficience because there are other compensating controls or contractors can show that the alleged deficiency poses no risk to the Government. One of the recent trends among auditors that frustrates contractors and befuddles us is their notion that internal controls must be devised in such a way to cover every contingency. In one recent case, a contractor did not have a policy or process to periodically review and update its interim billing rates. The fact that the contractor did not have any contracts that required billing rates was lost on the auditor. In his mind, it was still a deficiency becuase the contractor, as some point in time, might be awarded a cost-reimbursable contract where billing rates are needed. Contractors must be firm in representing their cases.

Once an audit report containing an "inadequate" opinion has been issued, its usually too late to continue letter writing letters and appeal to the contracting officer. If the deficiency is such that a corrective action plan can be easily implemented, it is often most efficient, timewise, to simply do so, even if you do not agree with the substance of the audit finding. Once corrective action has been accomplished, you can invite the auditors back. Many contractors simply wait until the auditor gets around to performing a followup audit. That could take a long time and extend the period when an "inadequate" opinion is on the street - potentially affecting your business. There is a better way. DCAA Audit policy requires the auditor to immediately schedule a followup audit when a contractor notifies it that the corrective action has been implemented and there are sufficient transactions for the auditor to examine and test to see if the correcting action has been effective in correcting the deficiency. Therefore, contractors should make every effort to expedite the corrective action process.

If the followup audit concludes that the corrective actions have been effective in resolving whatever internal control deficiency was identified, DCAA will report that fact in a followup report and reference it in other types of audit reports as well.