Internal Controls - What's Important

Today's post is a bit on the technical side. The purpose here is to walk through the process of identifying internal controls that are important to Government contracting and to show how the Government determines whether controls, as implements, are effective.

We will start with one of the DFARS (DoD FAR Supplement) business systems; accounting. DFARS 252.242-7006 states that contractors must establish and maintain an acceptable accounting system that provides reasonable assurance that applicable laws and regulations are complied with, that produces reliable cost data, minimizes the risk of misallocations and mischarges, and consistent with the billing system.

On the surface, that might seem fairly straight-forward - just buy a $200 QuickBooks package and you're off. Well its a little more complicated than that because this DFARS clause then goes on to list 18 attributes that the accounting system must provide for.

The first of these 18 criteria is "The Contractor's accounting system shall provide for a sound internal control environment, accounting framework, and organizational structure." Now it gets a little confusing and note the subjective word "sound". How is a contractor supposed to figure out what this means and how can it satisfy such a fuzzy requirement?

Do not despair. DCAA has come to your rescue. You can refer to Chapter 5 of the Contract Audit Manual or download the internal control matrix for Control Environment and Overall Accounting System Controls and obtain sample control objectives and examples of corresponding control activities for creating a sound environment, framework, and organizational structure. These control objectives include:

1. Integrity and ethical values: management must convey the message that integrity and ethical values cannot be compromised, and employees must receive and understand that message through continuous demonstration of words, actions and commitment to high ethical standards. 
2. External auditor's report: management should take timely corrective action on any deficiencies noted by the external auditor.
3. Board of directors/audit committee: the board and audit committee should be sufficiently independent enough from management to constructively challenge management's decisions and act effectively on external audit communications and recommendations.
4. Basic structural organization: the organization structure provides the overall framework for planning, directing and controlling operations
5. Assignment of authority and responsibility: management ensures that appropriate responsibility and delegation of authority is assigned to deal with goals and objectives, operating functions, regulatory requirements, information systems and authorization for changes. The delegation of authority ensures a basis for accountability and control and sets forth individual respective roles.
6. Financial capability: management must ensure that the contractor has adequate financial resources to perform on Government contracts.
7. Accounting system and controls: the accounting system is well-designed and is operating effectively to provide reliable accounting data and prevent misstatements that would otherwise occur.
8. Cost allocations: management ensures that an item of cost or a group of items of cost are assigned to one or more cost objectives in accordance with rules, regulations, and standards for proper distribution of direct cost and allocation of indirect costs. Management ensures the proper allocation of both the direct assignment of cost and the reassignment of a share from an indirect cost pool.

Now that you see what's important, you can begin to devise "control activities" to help ensure these "control objectives" are carried out. DCAA provides some ideas here as well. We'll look at a couple of those tomorrow.