Farewell, Kinder/Gentler DCAA

DCAA (Defense Contract Audit Agency) recently revised its CAM guidance (Contract Audit Manual) dealing with access to contractor internal audits.

Previously, the guidance in CAM Section 4-202 (Relationships with Contractor Internal and External Auditors) focused on coordinated audit planning. Coordinated audit planning is a voluntary process wherein DCAA and the contractor's internal and external auditors consider each other's work in determining the nature, timing and extent of auditing procedures. One benefit of coordinated audit planning is that, in theory, it promotes contractor self-governance , enabling organizations to better develop and maintain strong systems of internal controls. Coordinated audit planning also helps identify and eliminate duplicative audit effort, thus saving resources for all parties. Contractors were encouraged to participate in coordinated audit planning activities but it was strictly voluntary.

The previous guidance made no demands for internal audits. It simply stated that where internal audits were provided, auditors should review them to see if there was any items that impact planned or in-process audits. Also, the previous audit guidance provided that where coordinated audit planning was practiced, the contractor's internal and external auditors were authorized to review and reproduce DCAA working papers to the extent needed to document their own working papers.

Gone now is the warm and fuzzy lets get along mentality. The revised CAM Section 4-202 guidance (now re titled: Access to Contractor Internal and External Audits) sets forth a very different and perhaps confrontational approach to reviewing internal audit reports and working papers.

Under the revised guidance, auditors must establish a process and a central point of contact to obtain and monitor access to and use of internal audit reports. The process must include a method for tracking requests for internal auditor reports and working papers and the contractor's disposition of these requests.

The guidance fully expects contractors to provide access to internal audit reports and working papers. Once received, the audit is instructed to review the internal audit reports and determine if sufficient information is contained in the report for use in identifying risk in audit assignments. In order for the internal audit report to be useful in audit planning, the auditor needs to understand the scope of the review, the reported deficiencies and any recommended corrective actions. If sufficient information is not included in the report, the auditor is instructed to request access to the working papers.

If contractors choose not to provide access to internal audits, things could turn confrontational. The new guidance instructs the auditor to report the denial as an "access to records" issue, which means, it will be quickly elevated right to the top of DCAA's food chain. One possible outcome from an "access to records" charge is billing withholds until the issue is resolved.

Finally, there is no mention the revised guidance authorizing contractor personnel to review DCAA working papers.

___________________________________

Thanks to a reader who alerted us to this policy change.