GAO Report on DCAA Access to Company Internal Audit Reports

The Government Accountability Office (“GAO”) released a report on December 8, 2011 titled “DEFENSE CONTRACT AUDITS: Actions Needed to Improve DCAA’s Access to and Use of Defense Company Internal Audit Reports” (GAO-12-88). The GAO performed their study to assess whether defense contractors’ internal audit departments, and the reports they issue, should play a greater role in Defense Contract Audit Agency (“DCAA”) audits. The GAO study included seven (7) contractors, five (5) large and two (2) small. The GAO determined that approximately 46% of the internal audit reports of the companies related to work potentially being performed by the DCAA.

Some of the areas covered by the relevant internal audit reports are:

• Audits related to defense programs,
• Audits of the accounting system,
• Reviews of purchase card transactions,
• Reviews of controls over information technology, etc.

Historically, the “DCAA’s access to and use of internal audit information from reports and workpapers is limited.” The courts have ruled the DCAA cannot demand access to all internal company documents, but they may request access to documents related to their audits, provided they know what the reports are. Of the seven companies studied, four allow DCAA access to internal reports and supporting workpapers, two allow for access to the reports but not the support, and two do not allows DCAA access to any internal reports or supporting workpapers.

By not having access to company internal audit reports (for those companies whose internal audit departments meet the “Institute of Internal Auditors standards for organizing their internal audit department”) the GAO recommends that the Secretary of Defense directs the Director of the DCAA to:

1. Establish one point of contact with each contractor who coordinates issues related to internal audits. This should allow for the DCAA auditor to identify and request relevant internal audits, and to track their requests.
2. Assess the responsiveness of the contractor and consider additional actions to obtain the appropriate information.
3. Work with DCAA staff to learn which internal audit reports to request, how to request them, and how to use those reports to improve audit planning.

Got questions? Connect with an experienced Aprio advisor today.
Schedule a Consultation