DoD Professional Practice Guide (Audit) - Part 1

Back in January when the Section 809 Panel issued its third and final report, we briefly touched on their recommendation to develop a PPG (Professional Practice Guide) to guide Government auditors and commercial audit firms in conducting audits of Government contractors. This week we will dig deeper into the new guidance to see what it may portend for Government contractors. The guide itself is included in Vol 3 of the Section 809 Panel's report.

The PPG is intended to supplement existing guidance for auditors involved in DoD Procurement contract auditing. It provides additional information regarding how to interpret and apply specific auditing concepts for Government contract audits to assist auditors, contracting officers, and other stakeholders involved in the audit process.

Eventually, the PPG will address seven areas although the current draft version contains just coverage of the first three. Due to its limited statutory term, the Panel did not have time to address them all.

1. Risk assessment
2. Materiality
3. Audits of Internal Controls
4. Independence
5. Objectivity
6. Sufficient evidence
7. Reliance on the work of others

Risk Assessment

The risk assessment framework provides incentives for contractors to achieve and maintain compliant cost accounting and internal controls over Government contract compliance. It also provides disincentives for those contractors who have not.

The framework provides for three levels of risk: low, medium, and high risk strata based on a contractor's ADV (auditable dollar volume). ADV is the total costs charged to flexibly priced (i.e. CPFF, CPIF, FPI, T&M, etc) each year. For contractors with ADV of $1 billion or more, an annual incurred cost audit is mandatory. At the other end of the spectrum, contractors with ADV of less than $5 million, get dumped into a sampling pool if there were no significant questioned costs in the last completed incurred cost audit and there are no "concerns" expressed by someone in the Government acquisition community concerning the particular submission. Contractors with ADV between $5 and $100 million are also in the low-risk sampling pool if they have approved accounting systems. Contractors who don't make it to the "sampling pool" are audited.

Medium risk strata include contractors with ADV between $100 million and $500 million. To make it to the sampling pool, the contractors must meed the three criteria previously discussed  plus not have any business system deficiencies on the books, nor have had any accounting practice or organization changes. Contractors in this strata, even if they make it to the sampling pool, must be audited every four or five years.

The high risk strata includes contractors with ADV between $500 million and $1 billion. It uses the same criteria as the previous strata to determine whether it makes it to the sampling pool. The only difference is that contractors in this strata must be audited at least every other year.

Tomorrow we will discuss the PPG concept of materiality.