Independent Audits of Contractor Business Systems - Part 3

For the past two days, we've been discussing the proposed DFARS (DoD FAR Supplement) rule that will require contractors to perform their own annual assessments of compliance with business system criteria and to have an independent CPA audit of those business systems performed every third year. The business systems covered by the new rule include estimating systems, accounting systems, and MMAS (Material Management and Accounting Systems).  This new rule applies primarily to large contractors (small businesses are exempt) and marks a significant departure in the manner in which the Government administers its oversight functions. It will also cost contractors (and the Government) a lot of money.

The cornerstone of the new procedure is the requirement for a triennial audit by independent CPAs. By definition, the CPA must be an independent certified public accountant, in public practice and not directly employed as an employee by the contractor, performing audits for the contractor in accordance with GAGAS (generally accepted government auditing standards). It is the contractor's responsibility to ensure that whatever CPA firm is selected, is independent and qualified. To ensure the CPA firm meets these conditions, the contractor must do a little homework:

First of all, the contractor must reasonably ensure that the CPA firm performing the audit is independent and objective with respect to the audited entity by obtaining and reviewing a written representation from the CPA firm that the firm and the assigned engagement team is:

1. independent and objective with respect to the audited entity
2. will remain independent throughout the audit
3. has not performed any non-audit services for the audited entity that impair the auditors' independence for the subject audit, and
4. will disclose any independence issues discovered

Next, the contractor must ensure that the CPA firm is qualified to perform the audit by obtaining and reviewing

1. information about key engagement team members regarding professional qualifications and experience, including valid CPA licenses or certificates in good standing, and current knowledge and experience in the type of work to be done, and
2. the firm's most recent peer review report, in accordance with the American Institute of Certified Public Accountants (AICPA) Peer Review Program or equivalent.

It is almost a certainty that someone in the Government, most likely the contract auditor (i.e. DCAA) will request information to assess whether the contractor has performed due diligence in assessing their selected CPA firm's independence, objectivity, and qualifications.

Click here for Part 4 of this series where we discuss additional requirements related to the triennial audit including the requirement to furnish interim data to the contracting officer and the auditor.