When "Adequate" is the Best that You Can Be

The following is a slightly edited version of an article we published in our June 2007 Government Contracting Update newsletter. We discontinued the newsletter format in 2009 in favor of this blog.

Many times during our years as Government auditors, we would sit down with contractors at the conclusion of an audit of one or more of their internal control systems and proclaim that their system was “adequate”. 

“Adequate, only adequate?” they would ask. “We’ve done this and we’ve done that, we have great policies and procedures, we have superb internal controls, we test for compliance and we have other checks and balances. How can you say our system is only adequate?”

We would then explain that “adequate” was as good as it gets. Under Generally Accepted Government Auditing Standards (GAGAS), an internal control system is declared adequate when no significant deficiencies are found. The only other reporting option is that the system is "inadequate". 


An "inadequate" opinion arises whenever a significant deficiency or material weakness is disclosed by the audit. A significant deficiency is a control deficiency, or combination of deficiencies, that adversely affects the company's ability to initiate, authorize, record, process, or report Government contract costs in accordance with applicable Government contract laws and regulations, results in a reasonable possibility that unallowable costs will be charged to the Government, and the potential unallowable cost is not clearly immaterial. A material weakness is a significant deficiency, or combination of significant deficiencies that results in more than a remote likelihood that unallowable costs will be charged to the Government.


Sometimes audits disclose conditions that do not materially affect the adequacy of the system but if corrected, would enhance the system of internal controls. Until 2008, these would have been reported as “Suggestions to Improve the System” rather than deficiencies and would not have affected the overall audit opinion. In 2008, DCAA discontinued its practice of reporting "Suggestions to Improve the System" since such reporting was not required by GAGAS.


Some internal control audits are required by FAR (e.g. purchasing system and estimating system) while others are based on perceived risk to the Government (e.g. accounting system and labor system). Generally, contractors should not fear internal control audits. Fundamentally, the goals and objectives for both contractors and the Government are the same. Good internal controls are fundamental to good business practices and provide the government with some assurances that its procurement dollars are well spent.


The audit programs that DCAA and other governmental audit agencies use to assess the adequacy of contractor internal controls are available on DCAA’s website,