Congress Moving to Require Access to Internal Audits

Government contractors have always played a little cat-and-mouse game with providing the Government access to their internal audits and  associated work product. When we were auditors, we always wanted to see them. After all, there might be information in them that we could rely upon thereby reducing the audit steps we had to perform. Why do the same thing twice? We sincerely thought that it was a win-win for both the contractor and the Government. Our position has not changed. We still think that contractors should provide access to routine internal audits to DCAA and other Government contract auditors.

Contractors are sometimes wary of providing the Government access to their internal audits. They ask such questions as why do you want them and what are you going to do with them? If those audits disclose an internal weakness or two in a control activity, contractors are concerned that the reports might might somehow be used against them.

As a practical matter, the ability to rely on contractor internal audits to reduce the amount of effort that Government auditors need to perform seems overrated. In our experience, there typically is not much savings to be achieved. Contractor internal audit and Government audit objectives rarely overlap. But internal audit reports are nevertheless useful to the extent that they demonstrate contractor commitment to maintaining good internal controls and for ensuring that any recommendations are followed up with corrective action plans.

Section 843 of the Senate Version of the Fiscal Year 2013 National Defense Authorization Act contains a provision that will require contractors to disclose their internal audit reports as an element of maintaining adequate "business systems". Specifically, the recently enacted "business system" rules will soon be modified to require the following:

1. ensure that any assessment of the adequacy of contractor business systems takes into account the efficacy of contractor internal controls, including contractor internal audit reports and supporting materials, that are relevant to such assessment; and
2. provide that the refusal of a contractor to permit access to contractor internal audit reports and supporting materials that are relevant to such assessment is a basis for disapproving the contractor business system or systems to which such materials are relevant and taking the remedial actions (i.e. billing withholds).