Government Contracts Monitor

Watch Out! DCAA Will Soon Be Asking for your Internal Audit Reports

January 9, 2013

The 2013 National Defense Authorization Act (“2013 NDAA”), which was signed by the President on January 3, 2013, includes a provision allowing the Defense Contract Audit Agency (DCAA) to ask contractors for their internal audit reports and then keep track of the contractors’ responses, but stops short of actually requiring contractors to produce the reports.  An earlier version of the bill that passed the Senate required contractors to turn over their audit reports to DCAA, but this requirement was subsequently watered down by the conference committee to merely require DCAA to keep a better record of its requests and the responses it receives from contractors.

Prior case law held that DCAA lacks the statutory authority to require contractors to turn over their internal reports.  See United States v. Newport News Shipbuilding & Dry Dock Co., 837 F.2d 162 (4th Cir. 1988).  Last year, however, the Government Accountability Office (GAO) criticized DCAA for not seeking these reports during its audits.  See U.S. Gov’t Accountability Office, GAO-12-88, Actions Needed to Improve DCAA's Access to and Use of Defense Company Internal Audit Reports (2011).  GAO also noted that DCAA did not maintain adequate records to determine how often and for what reasons contractors refuse to turn over internal audit reports.

In response, DCAA sought expanded statutory authority from Congress in its annual report.  See U.S. Dep’t of Defense, Report to Congress on FY 2011 Activities at the Defense Contract Audit Agency (March 30, 2012).  DCAA believes it is “essential for [it] to have access to contractor reviews, inquiries, investigations, and internal audits in order to evaluate contractor internal control systems and determine compliance with any applicable contract clauses or Federal or agency acquisition regulations.”  Id. at 10.  DCAA also believes increased access to contractors’ internal audits would increase efficiency and cost effectiveness by “reducing duplication of effort.”  Id.    

The Senate version of the 2013 NDAA included a provision giving DCAA the authority to access “defense contractor internal audit reports related to the efficacy of contractor or subcontractor internal controls and the reliability of contractor or subcontractor business systems.”  See S. 3254, 112th Cong., § 843 (2012).  As noted above, this was watered down in conference to merely require DCAA to (1) determine in writing that the report is necessary to audit the contractor, (2) document its request for any such reports, and (3) record the contractor’s rationale or justification for not producing the report.  DCAA is also directed to issue safeguards to ensure that the reports are not used by DCAA for any purpose “other than evaluating and testing the efficacy of contractor internal controls and the reliability of associated contractor business systems.”  H.R. 4310, 112th Cong., § 832.

Although the 2013 NDAA does not give DCAA the authority to force contractors to turn over their internal audit reports, given the focus of GAO and DCAA on this issue, contractors should expect DCAA to begin routinely seeking these reports as part of their audits.  At least for now, however, turning over internal reports will remain voluntary.

Jeffry Cook is the attorney responsible for the content of this article.