Government Access to Internal Audits - Part II

Last Friday, we reported on DCAA's recently revised audit guidance related to accessing contractor internal audit reports and related working papers. Essentially, the revised guidance was a result of a GAO report from last December (see GAO-12-88 dated December 8, 2011). GAO looked at seven defense contractors to assess their compliance with standards for internal audits, the extent to which those companies' internal audit reports address defense contract management internal controls, and DCAA's ability to examine internal audits and use information from those audits.

GAO found that the internal audit departments did a pretty good job of adhering or complying with professional standards and that those audits covered a broad spectrum of policies, business systems, and programs that are relevant to DCAA audits. GAO discovered however, that those seven contractors had widely varying policies for providing DCAA access to those reports. Some provided access on a case-by-case basis, some upon request and one, not at all.

GAO found that the number of internal audits requested by DCAA is very small relative to the number of internal audits that GAO identified as relevant to the Government contracting oversight process. In explaining why so few reports were requested, auditors noted that there was uncertainty as to how useful those reports could be to their own oversight (a point we made earlier).

GAO recommended that DCAA take steps to facilitate access oto internal audits and assess periodically whether other actions aqre needed. DCAA generally agreed to implement GAO's recommendations but expressed skepticism that these recommendations alone would fully ensure access to internal audits.

In a related matter, Sec 843 of the National Defense Authorization Act of 2013, if enacted, will put some statutory teeth to accessing internal audits. The proposed legislation will (i) require that assessments of contractor business systems take into account the "efficacy of contractor internal controls, including contractor internal audit reports and supporting materials that are relevant to such assessment and (ii) provide that the refusal of a contractor to permit access to contractor internal audit reports and supporting materials that are relevant to such an assessment is a basis for disapproving the contract business system to which such materials are relevant. Disapproved business systems will result in billing withhold and cash flow disruptions.

Tomorrow, we will discuss some of the specifics of DCAA's new policy on accessing internal audits.