Government Contracts Monitor

DCAA ACCESS TO INTERNAL AUDIT REPORTS AND WORKPAPERS

March 1, 2012

By: Lindsay Simmons

The Defense Contract Audit Agency (DCAA) oversees contractor compliance by performing routine and non-routine audits. In addition, however, defense contractors typically maintain their own internal auditors to monitor policies, procedures, and business systems related to their government contracts.

Most internal audit reports cover a broad range of matters that, understandably, the General Accountability Office (GAO) views as relevant to the work of the DCAA.  But DCAA’s access to and use of internal audit information has been limited, in part because of court decisions restricting DCAA’s access to these documents. Indeed, most companies limit access to internal audit information (although they may provide DCAA with access to internal audit reports on a case-by-case basis).

Last year the GAO was asked to assess the work of defense contractors’ internal audit departments and their ability to provide DCAA with information relevant to DCAA’s mandate.  Interestingly, the number of DCAA requests for internal audit reports has historically been quite small.

As a result of its study, the GAO recommended that DCAA take the following steps to access government contractors’ internal audits:

1. Coordinate with companies that have an internal audit function that produces reports which may be relevant to DCAA’s audit responsibilities to -
   • Obtain sufficient information from the companies on their internal audit reports so DCAA auditors can better identify and request relevant audit reports and workpapers; and
   • Track DCAA auditors’ requests for access to internal audit reports and workpapers and the companies’ disposition of those requests.
2. Periodically assess information compiled by the company regarding the number of requests for internal audits and their disposition to determine whether additional actions are needed. Additional actions could include senior level DCAA engagement with company officials to change company access policies or, as warranted, the issuance of subpoenas.
3. Reaffirm with DCAA staff how and under what circumstances company internal audit reports can be accessed.

GAO’s report – and suggested course of action – is based upon the premise that while DCAA may not have unlimited power to demand access to internal company materials, it does have the right to demand access to materials relevant to DCAA’s audit responsibilities.

The Department of Defense has expressed skepticism that GAO’s recommended steps will actually achieve access to contractors’ internal audit report. Nonetheless, contractors should be on the lookout for a sharp increase in DCAA’s request for access to internal audit reports and workpapers.

A copy of GAO’s report is available at http://gao.gov/assets/590/586765.pdf

 

Lindsay Simmons is the attorney responsible for the content of this post.