The Auditors are Starting to Ask Contractors Whether They Have Engaged in Fraudulent Activity

In a policy memorandum issued late July, DCAA announced a major policy shift in detecting and reporting fraud. GAGAS (Generally Accepted Government Auditing Standards) have long required auditors to consider the risk of fraud when designing audit steps. DCAA made it a little more formal about a year ago when it made a policy to require team-planning meetings to discuss the risk of fraud and other noncompliances with applicable laws and regulations that could have a material effect on the audit. Now, DCAA is expanding on its previous efforts to provide, what the Agency terms, a comprehensive approach to detecting and responding to the risk of fraud.

This new guidance is already controversial and you will be hearing a lot about it in the coming months as contractors assess what is being asked and determining whether they will or should respond. Here's the controversial matter:

The audit team should make the following inquiries of contractor management responsible for the subject matter under audit:

• Whether management has knowledge of any fraud or suspected fraud affecting the subject matter under audit;

• Whether management is aware of allegations of fraud or suspected fraud affecting the subject matter under audit, for example, received in communications from employees, former employees, regulators, or others;

• Management’s understanding about the risks of fraud relevant to the subject matter under audit, including any specific fraud risks the contractor has identified or account balances or classes of transactions for which a risk of fraud may be likely to exist.

The audit team should make these inquiries in every audit. The audit team should use information obtained at annual planning meetings about the contractor’s programs and controls that mitigate fraud risk in order to facilitate additional inquiries related to the subject matter under audit. When possible, the audit team should conduct inquiries as part of face-to-face discussions. 

Now as far as we know, there is no contractual or regulatory requirement that contractors respond to these kinds of questions. Our sense is that DCAA is out-of-line in making such requests. It wouldn't surprise us if DCAA will have to retract it sooner rather than later. In the meantime, we suggest you consult with counsel as to the advisability of responding to these series of questions.