Previously Reported Audit Findings

Many times, contract auditors issue internal control deficiency reports with recommended corrective actions or, more likely, a comment or two on contractor corrective action plans. Sometimes its months or years before the auditor comes back to reassess that particular audit area (e.g. accounting system internal controls, billing system internal controls, etc.). In the meantime, no one has assessed whether the contractor's corrective actions are working as intended and even if effectively implemented, have solved the internal control problem. With auditor turnover, the next batch of auditors are unaware of the history of previous audits. According to a DoD-IG (Department of Defense, Office of Inspector General) report issued earlier this year, many of these "new" teams never bothered to assess promised contractor corrective actions to previous audit findings. According to the DoD-IG, this failure represented a departure from GAGAS (Generally Accepted Government Auditing Standards) Section 5.06 which requires auditors to obtain an understanding of contractor corrective actions to previous audit findings in assessing risk and determining the nature, timing, and extent of current work, including potential testing of the implemented corrective actions.

The Defense Contract Audit Agency (DCAA) recently issued an audit alert regarding the need to assess contractor corrective actions to previously reported audit findings. Audit findings in this case could pertain to DCAA audit findings and/or findings from audits or studies performed by other than DCAA that are relevant to the subject matter under audit. The "other" audits or studies would include contractor internal audit reports which the Agency has been trying to access, without much success, for many years, management letters issued by a firms independent public accountants, and reviews performed pursuant to the Sarbanes - Oxley Act.

DCAA has modified its audit programs to emphasis this audit step. The additional audit program language requires that auditors review permanent file to determine if previous audits included findings and recommendations that impact the subject matter under audit (GAGAS 5.06). If there were findings, auditors should document this information in the risk assessment and ask contractor management if corrective actions were taken to address findings and recommendations reported in previous DCAA audits (e.g., questioned costs, business system deficiencies, CAS audits) that are relevant to the subject matter of audit. If yes, have contractor explain corrective actions taken and determine if additional audit procedures should be included in the fieldwork to test the corrective actions.

Contractors should anticipate these additional queries during future audits.