# Presentation: 723485

## Institute of Management Accountants Sarbanes-Oxley Act The DCAA Perspective

**Darleen Wall**
**Supervisory Auditor**
**Rainier Branch Office**
**Richland Suboffice**
**December 12, 2006**

## Topics

- DCAA Organization and Mission
- Sarbanes-Oxley Act – Section 404
- Potential for Coordinated Audit
- Potential for Relying on Work of Others
- Benefits
- Resources

## DCAA History

- Military Branches – Separate Contract Audit Functions
- 1939 – Army and Air Corps Joined Forces
- 1942 – Joint Navy, Army Air Corps, Ordinance Dept
- 1952 – Established Contract Audit Manual
- 1962 – “Project 60” Feasibility Study
- 1965 – DCAA Established

## Defense Contract Audit Agency Mission

**DCAA Charter - DoD Directive 5105.36**
- Mission -- DCAA shall:
*Perform all necessary contract audit for the Department of Defense and provide accounting and financial advisory services regarding contracts and subcontracts to all Department of Defense components responsible for procurement and contract administration.  These services will be provided in connection with negotiation, administration and settlement of contracts and subcontracts.*
*Provide contract audit services, to other Government Agencies as appropriate.*
-       (Over 35 civilian agencies received 570,300 hours of contract audit & financial advisory services in FY 2004. Represents 12% of DCAA’s $428 million budget.)

## DCAA in the Department of Defense

## Defense Contract Audit Agency

## DCAA Structure

- Headquarters – Ft. Belvoir, VA
- Regional Offices –
- Irving, Texas
- Smyrna, Georgia,
- Philadelphia, Pennsylvania,
- Lowell, Massachusetts,
- La Mirada, California

## Western Region

- Field Audit Offices - FAO
- Resident Office – Contractor On-Site
- Branch – Strategically Placed Within Region
- Suboffice – Satellite Office of Branch Office
- Rainier Branch Office – Richland Suboffice

## Commitment to Excellence

## Section 404: Management Assessment of Internal ControlsWhat Does It Require?

- Requires annual report to SEC that contains an internal control report which must include:
- Statement that management is responsible for establishing and maintaining an adequate internal control structure and procedures for financial reporting for the company
- Management’s assessment of the effectiveness of the internal control structure and procedures for financial reporting
- Independent auditor’s attestation on management’s assessment

## Sarbanes-Oxley Act – Section 404Management’s Self Assessment

- When implementing Section 404, public companies and their independent auditors may perform additional audit and documentation effort to support the management’s report on the company’s internal control over financial reporting
- Company management may express increased interest in the FAO’s audit plan, accomplished audit work related to internal controls, opportunities for coordinated audits, and in identifying and resolving significant internal control deficiencies cited during our previous audits

## Impact on DCAA

- 	While the Sarbanes-Oxley Act does not affect DCAA directly, the intent of DCAA involvement is to determine the potential availability of additional contractor information that may enhance the quality of our audits or to avoid performing ***duplicative*** efforts that the contractor’s internal or external auditors may already have performed in complying with the new requirements.

## DCAA Audit Guidance on Sarbanes Oxley Act of 2002 

- DCAA guidance requires auditors to review the contractor’s documentation supporting its compliance with Sarbanes-Oxley and consider the impact on the scope of DCAA audits (e.g., internal control audits).  Auditors may consider the potential for:
- relying on the work of others, and
- coordinated audits.
- DCAA auditors at the corporate office are required to review documentation supporting SEC filings and accompanying notes. Corporate auditors will communicate results to applicable field audit offices.

## Determine Potential for Relying on the Work of Others and Coordinated Audits

-    DCAA & contractor assess the relevancy of the planned or performed audit work to support management’s report on internal controls to the objectives of the DCAA internal control audits
-    For example, DCAA & contractor review the following Sarbanes-Oxley internal control documentation for relevancy/impact on DCAA internal control audits:
- System descriptions
- Internal control component documentation (CAM 5-102)
- Control objectives and activities identified by each system
- Key controls tested for each system

## Determine Potential for Coordinated Audit Planning

- DCAA currently performs audits on the effectiveness of company internal controls over financial reporting, compliance, and operations related to 10 specific systems (Internal Control Audit Planning Summaries – ICAPS) that impact Government contracts on a cyclical basis, including:

- Control Environment & Overall Accounting Controls
- Information Technology System General Controls
- Budget and Planning System Internal Controls
- Purchasing System Internal Controls

## Determine Potential for Relying on the Work of Others and Coordinated Audit Planning

- Internal Control Systems (Con’t)
- Billing System Internal Controls
- Material Management
- Labor System Internal Controls
- Compensation System Internal Controls
- Indirect/ODC Internal Controls
- Estimating System Internal Controls

## Key Initial Step for Determining Potential for Relying on the Work of Others and Coordinated Audit Planning

-   Contractor provides DCAA a copy of the company system descriptions (narratives, flowcharts, etc.) of the _**relevant**_ processes and sub-processes, including the control objectives and control activities, identified by the company during its Sarbanes-Oxley assessment at corporate and other Government business units

## Key Steps for Determining Potential for Relying on the Work of Others and Coordinated Audit Planning

-   Based on understanding the company’s systems of internal control:
- Compare the company’s process/systems descriptions with the accounting and management systems identified by DCAA and determine where any common control objectives exist (e.g., accounting system and controls)
- Where common objectives exist, DCAA and the contractor jointly determine areas for potential reliance and coordinated audits
- DCAA must follow Agency policy for relying on the work of others (CAM 4-1000)

## Criteria for Relying on the Work of OthersCAM 4-1000

- Personnel performing the work are:
- Competent
- Independent
- Objective
- Work product is sufficient
- Scope of work is appropriate
- Working papers adequately document
- Conclusions are appropriate

## Criteria for Relying on the Work of OthersCAM 4-1000

**Evaluation of Work Product**
- Work of External Auditors
- Consider whether to conduct additional tests such as reviewing audit procedures they followed and the results of audits they conducted
- Should review their audit program and/or working papers, tests of compliance, and conclusions reached
- May review documentary evidence in the external auditors’ working papers or make supplemental tests of the work conducted

## Criteria for Relying on the Work of OthersCAM 4-1000

**Evaluation of Work Product (cont.)**
- Work of Non-auditors, consider whether to -
- Conduct additional testing
- Review the work program
- Review the working papers
- Make supplemental tests of the work conducted, and
- Consider the methods or assumptions used

## Criteria for Relying on the Work of OthersCAM 4-1000

**Evaluation of Work Product (cont.)**
- Work of Internal Auditors
- Should examine, on a test basis, documentary evidence of the work performed
- Should consider such factors as whether the scope of work is appropriate, audit programs are adequate, working papers adequately document work performed, conclusions reached are appropriate, reports are consistent with the results of the work performed.
- Should perform tests of some of the work of internal auditors

## What are the Benefits?

- For the company:
- Less time spent supporting DCAA audits of internal control systems
- Provides the company a vehicle to demonstrate the effectiveness of its internal controls and highlight controls or compensating controls
- For the Government:
- Reduced audit effort
- Provides a comprehensive picture and understanding of the company’s complex system of internal control facilitating a more efficient and effective audit

## Experiences-to-date on Sarbanes Oxley

- Generally, the larger DoD contractors are currently performing efforts to meet the Sarbanes-Oxley requirements and have briefed DCAA on their Sarbanes-Oxley implementation plans.
- Some contractors have provided DCAA access to internal audits and/or other data supporting its Sarbanes Oxley requirement.  DCAA reviewed this data and considered the impact on the scope of DCAA audits (e.g., internal control audits) and the potential for relying on the contractor’s work.

## Experiences-to-date on Sarbanes Oxley

- In some instances, with a release from DCAA’s customers, DCAA has provided contractors’ internal audit staff access to its audits and working papers.  In addition, we have provided copies of flow charts and narratives developed within the scope of our internal control reviews (ICAPS) so that the contractor did not have to recreate this information.  Contractors could  review this data and consider the impact on the scope of its self assessment narratives.

## More Information on DCAA 

- DCAA pamphlet to assist contractors in understanding applicable requirements and to help ease the contract audit process is available at:
- 		http://www.dcaa.mil/DCAAP_7641.90.pdf
- DCAA audit guidance memos and Contract Audit Manual (CAM) are available on DCAA’s web site at:
- 		http://www.dcaa.mil

## Resources for Contractors

- DCAA Regional Audit Guidance
- FAR Revisions
- Allowability Issues
- DCAA Interpretations
- Cost Accounting Standards
- Cost of Money Interest Rate

## Resources for Contractors

- DCAA Audit Programs
- Systems (110XX; 120XX, 130XX)
- Major Incurred Cost (10100)
- Non-major Incurred Cost (10100)
- CAS (191XX; 194XX)
- Proposals (210XX)
- Postaward Reviews (420XX)

## Questions?