DEFENSE 

CONTRACT AUDITS

Actions Needed to 

Improve DCAA's 

Access to and Use of 

Defense Company 

Internal Audit Reports

Report to the Committee on Armed 

Services, U.S. Senate

December 2011

GAO-12-88

United States Government Accountability Office

GAO
United States Government Accountability Office

Highlights of GAO-12-88, a report to the 

Committee on Armed Services, U.S. Senate

December 2011

DEFENSE CONTRACT AUDITS

Actions Needed to Improve DCAA’s Access to and 

Use of Defense Company Internal Audit Reports

Why GAO Did This Study

The Defense Contract Audit Agency 

(DCAA) has a critical role in contract 

oversight. DCAA audits are intended to 

help provide reasonable assurance 

that defense company policies for 

safeguarding assets and complying 

with contractual requirements are 

fulfilled. Defense companies also 

maintain their own internal audit 

departments to monitor policies, 

procedures, and business systems 

related to their government contracts. 

GAO was asked to assess the role of 

defense companies’ internal audit 

departments and their ability to provide 

DCAA with information on their internal 

controls. GAO assessed (1) selected 

defense companies’ adherence to 

standards for internal audits, (2) the 

extent to which those companies’ 

internal audit reports address defense 

contract management internal controls, 

and (3) DCAA’s ability to examine 

internal audits and use information 

from these audits. GAO reviewed a 

nongeneralizable sample of seven

major defense companies including the 

five largest defense contractors and 

two smaller contractors; analyzed 

information on their 2008 and 2009 

internal audits, which were the latest 

available when GAO began its 

assessment; and reviewed DCAA’s 

ability to examine and use the audits in 

carrying out its oversight. 

What GAO Recommends

GAO recommends that DCAA take 

steps to facilitate access to internal 

audits and assess periodically whether 

other actions are needed. DOD 

generally agreed to implement GAO’s 

recommendations but expressed 

skepticism that this alone would fully 

ensure access to internal audits. 

What GAO Found

The seven internal audit departments GAO reviewed generally adhered to 

Institute of Internal Auditors standards for organizing their internal audit 

departments. These standards include maintaining independence and having a 

proficient workforce. For example, all seven companies are organized so that the 

internal audit department is independent of company management. For 

performing individual audits, the majority of the companies followed the 

standards in areas such as planning the audit work and obtaining evidence. In its 

examination of evidentiary workpapers, GAO found documentation of the internal 

auditors’ testing to show the level of compliance with company policies.

The selected companies’ internal audit reports cover a broad spectrum of 

policies, business systems, and programs that are relevant to DCAA audits. Each 

company performs audits with scope and objectives specific to that company and 

its individual businesses, such as audits about defense programs or audits that 

review a company’s accounting system. In addition, some audits are common 

across companies, such as reviews of purchase card transactions or controls 

over information technology. In 2008 and 2009, the seven companies conducted 

1,125 internal audits. GAO determined that of these, 520 were related to the 

defense contract control environment and one or more areas reviewed by DCAA, 

such as overall internal control functions and specific business systems. 

DCAA’s access to and use of internal audit information from reports and 

workpapers is limited, in part, because of company interpretations of court 

decisions concerning DCAA’s access to documents. Consequently, the seven 

companies GAO reviewed have developed differing policies and procedures for

providing internal audit information to DCAA but ultimately provide DCAA access 

to internal audit reports and workpapers on a case-by-case basis. 

• Six of the companies have policies that provide for DCAA access to at least 

some internal audits reports upon request. Of the six, four have policies for 

providing access to supporting workpapers for their internal audits upon 

request. The other two companies have policies of not providing DCAA with 

access to supporting workpapers.

• One company has a policy of not providing DCAA with access to internal 

audits or workpapers.

DCAA’s use of its access authority has been addressed in two court decisions. 

The courts held that DCAA does not have unlimited power to demand access to 

all internal company materials, but they also held that DCAA may demand 

access to materials relevant to its audit responsibilities. However, DCAA does 

not generally track its requests or denials for internal audit reports. GAO found 

that the number of DCAA requests for internal audit reports is small relative to 

the number of internal audits GAO identified as relevant to defense contract 

oversight. In explaining why few reports are requested, DCAA auditors noted 

obstacles such as not being able to identify internal audits relevant to their work 

and uncertainty as to how useful those reports could be. By not routinely 

obtaining access to relevant company internal audits, DCAA auditors are 

hindered in their ability to effectively plan work and meet auditing standards for 

evaluating internal controls.

View GAO-12-88. For more information, 

contact William T. Woods at (202) 512-4841 or 

woodsw@gao.gov.
Page i GAO-12-88 Defense Contract Audits

Letter 1 

Background 3

Internal Audit Departments We Reviewed Generally Adhered to 

Institute Standards 7

Internal Audit Reports Contain Information Relevant to DCAA 

Audits 13

DCAA’s Access to and Use of Company Internal Audits Are Limited 15

Conclusions 21

Recommendations for Executive Action 22

Agency and Third-Party Comments and Our Evaluation 23

Appendix I Scope and Methodology 26

Appendix II Comments from the Department of Defense 30

Appendix III Comments from Lockheed Martin Corporation 33

Appendix IV DCAA Access Authority and Associated Court Cases 34

Appendix V GAO Contact and Acknowledgments 36

Tables

Table 1: Internal Audit Staff Experience and Percent of Auditors 

with Certifications for Six Companies 10

Table 2: Internal Audit Reports Requested by DCAA for Seven 

Selected Companies in 2008 and 2009 19

Figures

Figure 1: Adherence to Selected Institute Standards by Seven 

Companies’ Internal Audit Departments 8

Figure 2: Business System Internal Audit Reports 15

Contents
Page ii GAO-12-88 Defense Contract Audits

Abbreviations

AICPA American Institute of Certified Public Accountants

CIA Certified Internal Auditor

CAE Chief Audit Executive

CPE Continuing Professional Education

CAC Contract Audit Coordinator

CAM Contract Audit Manual

COSO Committee of Sponsoring Organizations of the 

 Treadway Commission 

DCAA Defense Contract Audit Agency

DCMA Defense Contract Management Agency

DFARS Defense Federal Acquisition Regulation Supplement

DOD Department of Defense

FAR Federal Acquisition Regulation

GAGAS Generally Accepted Government Auditing Standards

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-12-88 Defense Contract Audits

United States Government Accountability Office

Washington, DC 20548

December 8, 2011

The Honorable Carl Levin

Chairman

The Honorable John McCain

Ranking Member

Committee on Armed Services

United States Senate

The Department of Defense (DOD) relies extensively on private 

companies to obtain billions of dollars of goods and services annually. 

This reliance underscores the importance of overseeing contractor 

operations and contract costs, particularly in an era of constrained 

budgets. The Defense Contract Audit Agency (DCAA) plays a critical role 

in helping to ensure that contract costs are reasonable. As part of its 

efforts, DCAA performs audits of companies’ overall internal controls, 

which are intended to provide reasonable assurance that company 

policies for safeguarding assets and complying with contractual 

requirements are being carried out. In addition, major defense companies 

have internal audit departments to monitor policies and procedures 

established by their management to ensure the integrity of their business 

systems, including those related to their government contracts. Taken 

together, DCAA and the internal audit departments measure company 

performance against quality and reliability standards in support of 

government contracts as part of the overall internal controls.

You requested that we assess the role of defense company internal audit 

departments and their ability to provide DCAA with information on 

company internal controls, business systems, and policies affecting 

government contracts. In response, we assessed (1) the adherence of 

selected major defense companies to internal auditing standards for 

organizations and individual audits, (2) the extent to which the internal 

audit reports of those companies address internal controls for the 

management of defense contracts and associated business systems, and 

(3) DCAA’s ability to examine and use those reports in carrying out its 

oversight responsibilities.

We used the following methodologies to address our objectives: 

• To assess defense company adherence to internal audit standards, 

we selected a nongeneralizable sample of seven major defense 

companies. We selected major defense companies, based on DOD 

contract obligations, that had over $1 billion in DOD contracts in 2009. 

 
 

Page 2 GAO-12-88 Defense Contract Audits

These include five companies with at least $15 billion in DOD 

contracts and two smaller companies that still qualify as major 

defense companies. For each company, we interviewed company 

executives and obtained documents pertaining to the internal audit 

organizational structure, policies, and procedures. We then assessed 

whether their organizations, reports, and engagements conform to 

standards established by the Institute of Internal Auditors.1

• We obtained the titles, objectives, and scope of all internal audit 

reports completed in 2008 and 2009—the latest audits completed 

when we began our assessment—by the seven selected companies. 

We analyzed the information and determined that 520 internal audits 

were related to contracting with the federal government. We then 

asked to examine all 520 reports. Six of the seven companies agreed 

to provide us their audit reports. We reviewed 470 reports to 

determine the findings, corrective actions, and any connection to a 

DCAA audit. We also requested that each company provide us with 

workpaper sets from five internal audits, which we selected based on 

a nongeneralizable random sample. Five of the seven companies 

agreed to provide us access to their workpaper sets. We examined 

the 25 sets of documents to verify that the workpapers contained 

evidence for the findings and corrective actions identified in the 

internal audit reports. The seven companies we reviewed are listed in 

our full scope and methodology in appendix I, together with details on 

the extent to which the companies provided us with the information we 

requested. When materials were not provided for our review, we 

obtained the company’s rationale for documenting purposes. These 

rationales include the limitations on access to company internal 

documents discussed in two court cases and ownership of the 

workpapers by a third party. We do not regard the company decisions 

as a limitation of our scope since we were fully able to address our 

audit objectives based on examination of the vast majority of 

documents we requested.

• In evaluating DCAA’s access to and use of internal audit reports, we 

reviewed DCAA’s statutory and regulatory authority to access 

 

1

The Institute of Internal Auditors is an international association of more than 

170,000 members and is recognized as the internal audit profession’s leader in 

certification, education, research and technical guidance. The Institute publishes the 

International Standards for the Professional Practice of Internal Auditing, (Altamonte 

Springs, Fla: 2011).
 

Page 3 GAO-12-88 Defense Contract Audits

contractor records. We also reviewed DCAA’s audit manual to 

determine the agency’s requirements for obtaining audit reports, as 

well as the seven selected companies’ policies and procedures for 

providing internal audit information to DCAA. We requested data from 

DCAA and the selected companies on the number of company 

internal audit reports DCAA had requested in 2008 and 2009, the 

number of reports the companies provided, and rationale for not 

providing requested reports. We interviewed DCAA officials, including 

those who conduct audits at the seven selected companies, and 

reviewed documentation to determine how DCAA auditors ask for and 

track their requests and use of internal audit information.

The results of our review cannot be generalized across major defense 

companies. Instead, they provide insights into how the selected 

companies have organized their internal audit function, conduct internal 

audits, and interact with DCAA.

We conducted this performance audit from September 2010 through 

December 2011 in accordance with generally accepted government 

auditing standards. Those standards require that we plan and perform the 

audit to obtain sufficient, appropriate evidence to provide a reasonable 

basis for our findings and conclusions based on our audit objectives. We 

believe that the evidence obtained provides a reasonable basis for our 

findings and conclusions based on our audit objectives.

Both DCAA and company internal auditors have the critical responsibility 

of assessing the quality of company internal controls. Broadly speaking, 

internal controls refer to management processes designed to provide 

reasonable assurance about a company’s ability to provide reliable 

financial reporting, promote effective and efficient operations, and comply 

with applicable laws, regulations, and contract provisions. Internal 

Background 
 

Page 4 GAO-12-88 Defense Contract Audits

controls encompass five areas.2

• Control environment—positive and supportive attitude toward internal 

controls, conscientious management, and ethics standards.

For purposes of this report, we define the 

five areas as follows:

• Risk assessment—identification and assessment of risks from internal 

and external sources and establishment of controls to mitigate them.

• Control activities—policies, procedures, techniques, and mechanisms 

that ensure management’s directives to mitigate risk are carried out.

• Information and communication systems—assurance that information 

is recorded and communicated to management and others in a form 

and within a time frame that enables them to carry out internal 

controls and operational responsibilities.

• Monitoring—activities that assess the quality of performance over time 

and ensure that audit and review findings are promptly resolved.

As part of their overall governance and control, many companies 

establish internal audit departments to monitor adherence to 

management policies and controls, report exceptions to policies and 

procedures, and track corrective actions. One of the principal authorities 

on the standards and practices of internal auditing is the Institute of 

Internal Auditors (the Institute). The Institute is a non-profit professional 

organization that provides guidance on assessing, maintaining, and 

improving the quality of internal auditing within the profession. 

Importantly, the Institute provides guidance for the profession through its 

 

2

Internal controls are defined by both private and government sector organizations. For 

the purposes of this report, we used definitions developed by the Committee of 

Sponsoring Organizations of the Treadway Commission (COSO) and GAO. COSO is a 

joint initiative of the American Accounting Association, the American Institute of Certified 

Public Accountants, Financial Executives International, the Association for Accountants 

and Financial Professionals in Business, and the Institute of Internal Auditors. COSO 

develops frameworks and guidance on enterprise risk management, internal control, and 

fraud deterrence. GAO publishes Government Auditing Standards (the Yellow Book). The 

Yellow Book contains standards for audits of government organizations and activities and 

for other nongovernment organizations such as contractors. These standards, referred to 

as generally accepted government auditing standards (GAGAS), are to be followed by 

auditors when required by law, contract, or regulation.
 

Page 5 GAO-12-88 Defense Contract Audits

International Standards for the Professional Practice of Internal Auditing.

3

These standards include requirements at the organizational level such as 

independence and objectivity, as well as for conducting audits, including 

planning, performing fieldwork, communicating results, and following up 

on corrective actions. The Institute also conducts training and administers 

the Certified Internal Auditor (CIA) testing and certification program. The 

CIA certification is acknowledged by auditing professionals as a standard 

by which individuals demonstrate their competence in internal auditing.4

In addition to a company’s own internal audit department, companies that 

provide goods and services to DOD may be audited by DCAA. As 

required by the Federal Acquisition Regulation (FAR) and the Defense 

Federal Acquisition Regulation Supplement (DFARS), DCAA’s audits 

examine internal controls, incurred costs, and business systems used in 

the execution of government contracts. DCAA’s contract audit services 

are intended to be a key control that helps ensure that prices paid by the 

government are fair and reasonable and that companies are charging the 

government in accordance with applicable laws, regulations, cost 

accounting standards, and contract terms. At the completion of an audit, 

DCAA provides the contracting officer with a report to assist in 

negotiations or in assessing contract costs, as well as in determining 

compliance with regulations and contractual requirements.

DCAA, which employs approximately 4,000 auditors, consists of a 

headquarters office at Ft. Belvoir, Virginia and six major organizational 

components—five regional offices across the United States that direct 

and administer audits for assigned geographical areas and a field 

detachment office that audits classified contracting activity. The five 

regional offices manage about 300 field audit offices. Field audit offices 

can be categorized as branch offices, resident offices, or suboffices.

• Branch offices are located within each region and have responsibility 

for all contract audit services within the assigned geographical area.

 

3

The Institute has developed additional guidance for internal auditors including the code of 

ethics, practice advisories, position papers, and practice guides. 

4

Examples of other certifications include the Certified Information Systems Auditor offered 

by ISACA and the Certified Fraud Examiner offered by the Association of Certified Fraud 

Examiners.
 

Page 6 GAO-12-88 Defense Contract Audits

• Resident offices are established at company locations where the audit 

workload justifies assignment of a permanent staff of auditors.

• Suboffices are established by regional directors as extensions of 

branch or resident offices when required to furnish audit services. A 

suboffice depends on its parent field office for release of reports.

For larger companies with operations at multiple locations, DCAA assigns 

a Contract Audit Coordinator (CAC) who serves as a central point of 

communication between DCAA auditors and company representatives.

DCAA audits are governed by generally accepted government auditing 

standards (GAGAS). These standards require evaluation and testing of 

the overall internal controls including the work of the contractor’s internal 

audit activity, specific controls, and business systems. These standards

and associated principles govern the audit planning and evidence 

required to conduct a GAGAS-compliant audit. DCAA’s procedures for 

adhering to GAGAS in conducting different types of audits, such as audits 

of internal controls or company business systems, are contained in its 

Contract Audit Manual (CAM). According to the CAM, DCAA is required 

periodically to examine the contractor’s internal controls, as well as 

contractor policies and procedures. It also states that in the process of 

planning an audit, auditors should consider the company’s self 

governance programs when assessing the adequacy of the internal 

controls to determine the scope of their audit. Further, the CAM states 

that audits of individual business systems are to include an evaluation of 

the internal control activities applicable to that system.5

 

5

Officials at DCAA and the Defense Contract Management Agency (DCMA) informed 

GAO during interviews that they had divided their DOD audit responsibilities between the 

two agencies. DCAA has primary responsibility for reviewing the internal controls of three 

business systems—accounting, estimating, and material management and accounting. 

DCMA has primary responsibility for reviewing the internal controls of the earned value 

management, property management, and purchasing systems. For additional information 

on DCMA, see GAO, Defense Contract Management Agency: Amid Ongoing Efforts to 

Rebuild Capacity, Several Factors Present Challenges in Meeting Its Missions, 

Lastly, DCAA 

guidance for audit procedures states that auditors should consider a 

company’s internal audit activities to determine the adequacy of its 

internal controls when performing an audit of the company’s control 

environment and accounting system.

GAO-12-83 (Washington, D.C.: Nov. 3, 2011).
 

Page 7 GAO-12-88 Defense Contract Audits

To conduct its audits, DCAA relies on the examination of contractor 

financial, accounting, and other data. DCAA’s authority to access and 

audit contractor records in support of DOD contracting and contract 

payment functions is described in sections 2313 and 2306a of title 10 of 

the United States Code (U.S.C.) and in the FAR. DCAA’s use of its 

authority has been addressed in two court decisions involving Newport 

News Shipbuilding and Dry Dock Company. The decisions are generally 

known as Newport News I and Newport News II, both decided in 1988. In 

the first case (Newport News I), the court held that DCAA’s statutory 

subpoena power could not be used to access internal audits not tied to a 

specific contract or proposal.6 In the second case, (Newport News II), the 

court held that DCAA could subpoena company tax returns and other 

materials, which were directly relevant to an audit and would allow DCAA 

to corroborate the company’s computation of direct and indirect costs. 7

All of the companies we reviewed generally followed the Institute’s 

standards for organizing their internal audit departments. These 

organizational standards include maintaining independence and 

objectivity, constructing a risk-based audit plan, employing and 

maintaining a skilled, professional audit staff, and completing an external 

assessment. Similarly, based on our examination of internal audit reports 

and audit documentation (generally referred to as workpapers), we found 

that the majority of companies followed the standards for performing 

individual audits.

For additional information on DCAA’s access authorities and the Newport 

News cases, see appendix IV. 

8

 

6

United States v Newport News Shipbuilding and Dry Dock Company, 837 F.2d 162 (Fed. 

Cir. 1988).

These standards include assessing risks during audit 

planning, including the risk of fraud, obtaining evidence for findings to 

include testing and documenting evidence, and following up on audit 

issues. However, some companies did not provide sufficient information 

on how they conduct individual audits for us to determine if the standards 

for performance were met. Figure 1 shows the applicable Institute 

standards and the number of companies in our review that followed them.

7

United States v Newport News Shipbuilding and Dry Dock Company, 862 F.2d 464 (Fed. 

Cir. 1988).

8

Workpapers document the work and analysis of the audit team and give evidence that 

substantive work is behind the audit report.

Internal Audit 

Departments We 

Reviewed Generally 

Adhered to Institute 

Standards 
 

Page 8 GAO-12-88 Defense Contract Audits

Figure 1: Adherence to Selected Institute Standards by Seven Companies’ Internal 

Audit Departments
 

Page 9 GAO-12-88 Defense Contract Audits

Our analysis indicates that five of the seven companies we evaluated 

generally conformed to five Institute standards for internal audit 

organizations. The remaining two companies did not provide for an 

external quality assurance review as required under the Institute’s 

standards. The five standards are:

• Independence and objectivity—According to the organizational charts 

of the seven selected companies, their Vice Presidents of Internal 

Audit, also called the Chief Audit Executives (CAE), report directly to 

the Audit Committees of the Board of Directors for matters related to

internal audits. For administrative matters such as payroll and office 

space, the internal audit departments can be linked to the Chief 

Financial Officer or another department. This organizational feature 

allows the internal audit activity to be independent of company 

management, as called for under the Institute’s standards. To further 

ensure independence and objectivity, most audit executives we met 

with stated that they encourage an attitude of objectivity in their staff. 

For example, one CAE said that if staff from other divisions of the 

company are assigned to the internal audit department, those staff do 

not audit their former division’s activities to mitigate conflict of interest 

risks. 

• Risk-based audit plan—All seven companies we reviewed developed

audit plans using risk-based assessments consistent with the 

Institute’s standards. Audit plans are used by companies’ internal 

audit departments to schedule their audits throughout the year so that 

the highest risk issues the company is facing are covered. According 

to the Institute’s standards, internal audit departments should base 

audit plans on an annual evaluation of multiple risk factors, prioritized 

to ensure coverage of the highest risk areas. In reviewing how the 

companies develop their audit plans, we found that they receive input 

from management and the board of directors and consider a variety of 

factors such as changes in government regulations, review of highrisk areas identified in previous risk assessments, the potential for 

financial misstatement, and external factors facing the company. 

Once the information is compiled, the seven internal audit 

departments plan specific audits across company businesses and 

product lines, taking into account the likelihood of the risk 

materializing and the damage to the company should the risk 

materialize. Sometimes companies conduct a follow-up audit for highrisk issues highlighted in a previous year. Follow-up audits allow the 

internal audit department to track high-risk findings to ensure they are 

corrected.

Organizational 

Characteristics of Internal 

Audit Departments We 

Reviewed Generally 

Conformed to Institute 

Standards 
 

Page 10 GAO-12-88 Defense Contract Audits

• Proficiency—The Institute’s standards require that internal auditors 

have sufficient expertise. We found that although internal audit 

departments’ staff varies in number, the staff are comparable in 

professional qualifications. Six of the company internal audit 

departments are staffed by company employees, while the seventh 

company contracts with an accounting firm to conduct its audits. 

Based on information provided by the companies, we found that the 

staff from six companies have a wide range of professional 

credentials including certified public accountants, certified fraud 

examiners, certified internal auditors, and certified information 

systems auditors. In addition, more than half of the staff members 

have advanced degrees, such as a masters of business 

administration. Table 1 shows the audit staff experience and the 

average number of auditors with certifications for six companies.

Table 1: Internal Audit Staff Experience and Percent of Auditors with Certifications for Six Companies

Number of auditors, 

including vice president, 

for internal audits

Years of staff

auditing experience 

Number

of auditors that hold an

advanced degree (percent)a

Number of auditors

that hold at least

one certification

(percent)

Average 61 7.8 36 (59%) 29 (48%)

Range 

(low-high) 18-134 3.5-18 10-90 15-55

Source: GAO analysis of data from six internal audit departments.

a

Masters degree or higher.

For the seventh company that retains an outside accounting firm to 

perform its internal audits, the audit directors and the staff of the 

accounting firm combined have a range of professional certifications 

and advanced degrees comparable to the other companies. Company 

officials informed us that their practice enhances the audit function’s 

independence since the audit staff is not employed by the company 

and ensures the availability of specialists, if needed. Another 

company in our review previously outsourced its internal audit function 

but stopped doing so, according to a senior internal audit official, to 

save money, provide an in-house talent pool, and enhance the 

connection between the auditors and the company.

• Continuing professional development—The Institute’s standards 

require certified internal auditors to complete 80 hours of continuing 

professional education (CPE) every 2 years to ensure that they 

maintain and update their knowledge and skills. We found that the 
 

Page 11 GAO-12-88 Defense Contract Audits

companies take a variety of measures to enhance auditors’ 

knowledge and skills. For example, one company provides 100 hours 

of annual training, covers the cost of professional certifications, 

provides financial incentives for their completion, and expects auditors 

to obtain an additional 100 hours of training on their own. In addition 

to CPE requirements and professional certifications, officials at three 

companies stated they have training programs that allow staff from 

other departments or business units to rotate through the internal 

audit department for a limited time.

• External assessments—Institute standards require that internal audit 

departments must be subjected to external assessments at least once 

every 5 years. Five of the selected companies have had external 

quality assurance reviews of their organization and audit performance 

within the previous 5 years. These assessments review a company’s 

conformity with the Institute’s standards and provide comments on the 

performance of the internal audit function. All five companies received 

the highest possible rating of “generally conforms.” Officials from the 

other two companies in our review stated that they do not have an 

external assessment of their internal audit departments.

Our analysis found that five of the companies met the standards for 

individual audits (see figure 1), including engagement planning, 

conducting fieldwork and testing, reporting findings, and tracking 

corrective actions. We were unable to completely assess two companies’ 

compliance with the standards because the companies did not provide 

the information needed to do so. Specifically, we found that the 470 audit 

reports provided by six companies and 25 sets of supporting workpapers 

provided by five companies followed the Institute’s standards.

• Planning the audit including assessing the risk of fraud—Workpapers 

we examined from the five companies that provided them contained 

documents showing planning steps for each objective consistent with 

the Institute’s standards. Some companies completed an additional 

step by noting in the workpapers the evidence associated with each 

planning step. We also found that some workpapers contained 

assessments of the fraud risks specific to the audit’s scope. For 

example, one workpaper set we reviewed reported that the audit team 

met with the legal department about fraud risks and ethics 

considerations for that particular audit. Another set of workpapers 

showed that a risk assessment chart was used to identify areas to be 

included in the audit’s scope along with a rationale for its inclusion.

Internal Audits We 

Reviewed Followed 

Institute Standards
 

Page 12 GAO-12-88 Defense Contract Audits

• Conducting fieldwork including testing—The Institute’s standards 

require internal auditors to conduct sufficient analysis and document 

information to support the audit. The workpapers we reviewed 

contained extensive documentation of the fieldwork, such as 

interviews with company officials, and testing, such as comparing 

company actions to policies and procedures to determine the extent of 

compliance. The audit reports we reviewed from the six companies 

showed evidence of substantive testing and provided analysis of the 

testing showing the level of compliance with company policies, 

procedures, business systems, and defense contracts. When testing 

was conducted, it was cited in the reports as support for reportable 

issues. Some testing relied on judgmental samples, but for certain 

audits, such as audits of purchase card transactions, all of the 

transactions were examined. In addition, we traced identified findings 

through the workpapers to track the testing and the inclusion of the 

work in the audit planning. By tracing the findings back to their origin 

in the audit objectives, we verified that the findings reported were 

supported by sufficient audit work.

• Reporting findings—The audit reports we reviewed followed the 

Institute’s standards for reporting results of the audit work by providing 

reports to upper management and the audited party. The audit reports 

provided the objectives and scope of the audit work and the findings 

or issues discovered through the audit work. While the companies do 

not follow GAGAS standards, the reports, although brief, contained a 

clear explanation of the findings often citing criteria, condition, cause, 

and effect as defined in GAGAS.9

 

9

The definitions of criteria, condition, cause, and effect are based on a discussion 

contained in GAO, Government Auditing Standards, 

Audit officials at one company 

stated that they include only those findings they consider to be the 

most important in their reports because that is what company 

management has indicated has the most value to them. Officials said 

that highlighting the most important issues allows them to prioritize 

GAO-07-731G (Washington, D.C.: 

July 2007). Criteria are the laws, regulations, contracts, grant agreements, standards, 

measures, expected performance, defined business practices, and benchmarks against 

which performance is compared or evaluated. Condition is a situation that exists. Cause 

identifies the reason or explanation for the condition or the factor(s) responsible for the 

difference between the situation that exists (condition) and the required or desired state 

(criteria), which may also serve as a basis for recommendations for corrective actions. 

Effect is a clear, logical link to establish the impact or potential impact of the difference 

between the situation that exists (condition) and the required or desired state (criteria). 

The effect or potential effect identifies the outcomes or consequences of the condition.
 

Page 13 GAO-12-88 Defense Contract Audits

their resources and take appropriate actions to correct them. In 

contrast, some companies include nearly every finding discovered 

during the audit work. Illustrative of these different approaches, the 

company that only reports on the highest risk issues routinely had 2 to 

4 findings per report, while other companies had multiple reports with 

more than 10 findings per report.

• Tracking corrective actions—The Institute’s standards require that the 

CAE establish a process for the internal audit department to track 

corrective actions to ensure they have been implemented or that 

management has accepted the risk of not taking the corrective action. 

We found that five companies documented the corrective actions they 

had taken or intended to take to fix the problems identified in the audit 

reports. Usually, the responsibility and accountability for implementing 

the corrective actions were assigned to specific individuals and were 

generally required to be implemented within a certain time period. 

According to officials at one company, if corrective actions are not 

taken or completed in a timely manner internal audit management and 

company management are notified. In addition to findings that require 

corrective actions, some companies’ audit reports include suggestions 

for process enhancements for improving operations, comments that 

are notable business practices, and observed areas of excellence that 

are exceptional practices that would benefit other business units 

within the company.

The internal audits conducted by the seven selected defense companies 

cover a broad spectrum of policies, business systems, and programs. The 

seven companies conducted 1,125 internal audits from January 1, 2008, 

through December 31, 2009, with 520—slightly less than half—of these 

audits relevant to the internal control for defense contracts.10

• All 520 audits examined some aspect of the companies’ overall 

control environment.

The 

defense-related internal audit reports fell into one or more of the following 

categories:

 

10The audit reports that were not related to defense contracts included reviews of 

executives’ travel, payroll, environmental health and safety, and international operations.

Internal Audit Reports 

Contain Information 

Relevant to DCAA 

Audits 
 

Page 14 GAO-12-88 Defense Contract Audits

• 338 audits related to one or more of the six business systems that 

DOD audits.

• 97 audits pertained to a specific DOD program and could include 

reviews of an entire business system, such as the earned value 

management system, or one component of a business system, such 

as purchasing.

• 96 audits were associated with a company’s compliance with federal 

laws and regulations, or company policies related to its management 

and oversight of its defense contracts. 

Of the 338 audits related to the business systems audited by DOD, we 

found that most concerned some aspect of the company’s accounting 

system. In addition, the audits reviewed a wide range of subjects, 

including purchase cards or earned value management systems to 

determine if they are compliant with FAR and DFARS standards, and 

internal controls over accounts payable. For example, an audit from one 

company assessed a division’s purchase card program and found several 

issues of non-compliance with policies and procedures and identified 

control weaknesses related to the administration of the purchase card 

program. Another company’s audit reviewed the general controls, 

including the accounting system, for a division within a company and 

found that controls were not operating effectively to ensure consistent 

classification of accounting transactions. Figure 2 shows the distribution 

of internal audits among the six business systems.
 

Page 15 GAO-12-88 Defense Contract Audits

Figure 2: Business System Internal Audit Reports

DCAA’s access to and use of internal audit information were generally 

limited at the companies we reviewed. Company policies on providing 

DCAA access to such information varied at the seven companies—from 

allowing full access on a case-by-case basis to denying access. The 

extent to which DCAA has requested or been denied access to internal 

audits is difficult to determine because DCAA does not track its requests 

or denials. Based on information provided to us by the seven companies, 

we estimate that DCAA requested access to 115 of the 520 audits we 

identified as being relevant to internal controls and oversight of defense 

contracting. We identified a number of factors that affect how frequently 

DCAA auditors request internal audits, including interpretations of prior 

legal decisions on DCAA’s access and the limited details DCAA receives

from the companies about the contents of the internal audit reports. 

However, GAGAS and DCAA’s audit manual require an evaluation of 

internal control, which includes internal audits, to provide a basis for 

efficiently and effectively planning an audit.

DCAA’s Access to and 

Use of Company 

Internal Audits Are 

Limited
 

Page 16 GAO-12-88 Defense Contract Audits

The seven companies that we reviewed do not have uniform policies 

about providing DCAA with access to internal audit reports and 

workpapers. Of the seven companies:

• Six companies have policies that provide for DCAA access to at least 

some internal audits reports upon request. Four of the six, however, 

provide that access on a “view-only” or “read-only” basis, meaning 

that DCAA auditors may not have physical or electronic copies of the 

reports but may view them and take notes in the presence of 

company staff. Company officials explained to us that they adopted 

this policy because the reports are sensitive and proprietary.11 One 

company provides copies only of the sections of the reports and 

workpapers that company officials consider relevant to DCAA’s work.

• Of those six, four companies have policies that provide for DCAA 

access to the supporting workpapers for their internal audits upon 

request. Again, one company’s policy is to provide only workpapers 

for the sections of internal audit reports the company deems relevant 

to DCAA’s work. The other two companies have policies to not 

provide DCAA with access to supporting workpapers.

• One company adopted a policy of not providing DCAA with access to 

its internal audits or workpapers.

Each of the six companies that have policies for providing access to their 

internal audit reports require approval for specific requests for access on 

a case-by-case basis, and most require that the requested internal audit 

information directly relate to a DCAA audit of a specific contract or 

proposal. When companies determined that such a request is not 

relevant, the companies have denied DCAA’s requests. For example, one 

company denied DCAA access to two requested audits because 

company officials determined that the audits were related to commercial 

or other activities the company believed were not subject to DCAA’s 

review. Another company official said that the company would not provide 

DCAA with access to internal audits related to internal controls for 

information technology due to the potential threat of unauthorized 

individuals getting access to networks, critical applications, and 

confidential company or client data.

 

11GAO’s Government Auditing Standards (GAO-07-731G) require auditors to properly 

handle sensitive information.

DCAA Obtains Limited 

Access to Internal Audit 

Reports and Workpapers
 

Page 17 GAO-12-88 Defense Contract Audits

For the company with the policy of not providing DCAA with access to 

internal audit reports, DCAA has cited the lack of access as preventing it 

from obtaining an understanding of the company’s internal controls and 

reported this as a deficiency in the audit of the company’s overall 

accounting system. DCAA concluded that without access to the 

company’s internal audit reports, DCAA could not determine if the 

company’s monitoring function was operating effectively and whether 

deficiencies were corrected. The company’s response cited the Newport 

News I decision to support its position that contractors are not required to 

provide DCAA with access to internal audit reports that are not tied to a 

specific DCAA audit.12 While the company provided DCAA with lists of 

planned audits as requested by DCAA and a summary of the three 

requested audits, DCAA noted in its 2010 report that this was not enough 

information to establish that the company’s internal controls were

effective.13

In another instance, DCAA reported a deficiency in another company’s 

control environment, citing the company’s policy of limiting access to 

sections of internal audit reports the company deemed relevant to 

contract oversight and not providing adequate and timely disclosure of 

audit reports that identified unallowable costs. The company changed its 

policy and agreed to provide DCAA with access to all audit reports the 

company determines to include findings related to government costs. 

However, auditors at one DCAA office who have requested internal audit 

reports from the company said that the company has not adhered to the 

revised policy and has continued to deny DCAA access to reports.

Another company we reviewed also changed its policy in recent years in 

response to discussions with DCAA officials or as the result of DCAA 

reporting the lack of access as contributing to a control environment 

deficiency. The company previously had a policy of providing DCAA with 

no access to internal audit reports, citing the Newport News I court case 

as support for restricting DCAA’s access. After the CAC sent a letter in 

2009 challenging this access policy and discussed the access issue with 

company officials, the company changed its policy to provide DCAA with 

read-only access to internal audit reports.

 

12United States v Newport News Shipbuilding and Dry Dock Company, 837 F.2d 162 (Fed. 

Cir.1988).

13DCAA Audit Report No. 3321-2007K11070001.
 

Page 18 GAO-12-88 Defense Contract Audits

DCAA audit teams generally do not coordinate their requests for audit 

reports among their field audit offices, which limits DCAA’s insight into the 

extent to which audit teams are requesting or are being denied access to 

internal audit reports. Within DCAA, one of the responsibilities of the CAC 

assigned to a company is to serve as a contact point for discussions 

related to access to contractor information, such as internal audit reports. 

However, we found only one DCAA audit team that has implemented a 

system in which the CAC serves as a focal point for all internal audit 

report requests by all the field offices. For the other companies, the 

corporate and field offices submit requests directly to the company. As a 

result, the CAC does not necessarily know how frequently or what type of 

internal audit information field audit offices are requesting. One of these 

CACs noted that the CAC is informed when DCAA teams are denied 

access, but otherwise the CAC does not track requests or company 

responses. In the case of the one company that has multiple locations but 

does not have a CAC, the DCAA audit team does not coordinate internal 

audit requests to the company. As a result, the audit team does not know 

how many requests for internal audit information are made to company, 

what type of information is being requested, or whether the requests are 

fulfilled or denied.

Although DCAA does not generally track requests or denials for internal 

audit reports and, therefore, cannot say how many audit reports it asks for 

or receives, the companies we reviewed maintain such information with 

varying degrees of specificity. Based primarily on information from these 

companies, we determined that for the most part, DCAA audit teams 

request a small number of company internal audits, even though a 

significant number of internal audits pertain to internal controls and 

systems that are subject to DCAA audits. The companies provided us 

with estimates or specific counts of how many internal audits were 

requested by DCAA since 2008. In most cases, the number of reports 

requested was significantly fewer than the number of reports we 

determined were related to DOD contract oversight. The companies 

estimated that DCAA requested 115 audit reports over the 2-year period 

while we determined that 520 audit reports were related to some aspect 

of oversight of DOD contracts. Information on the number of reports 

requested from each of the companies and the number of reports we 

determined to be related to oversight of government contracts is 

summarized in table 2.

DCAA Does Not Generally 

Track Requests and 

Company Responses 

Related to Internal Audits
 

Page 19 GAO-12-88 Defense Contract Audits

Table 2: Internal Audit Reports Requested by DCAA for Seven Selected Companies in 2008 and 2009

Company

Company count of the 

number of 2008-2009 

internal audit reports 

requested by DCAA 

related to contract 

oversight Description

Number of 2008-

2009 internal 

audit reports 

selected for 

review by GAO 

related to DOD 

contract 

oversight

A. 1 According to a company official, DCAA requested one internal audit report 

released in 2008 and made no requests in 2009. 

28

B. 7 The company recorded 7 requests from DCAA auditors for internal audit 

reports that were issued 2008 and 2009. DCAA also requested 

14 additional reports issued in previous years.

75

C. 23 According to a company official, DCAA requested approximately 23 of the 

company’s internal audit reports since 2008. 

148

D. 34 The company recorded 34 internal audit reports requests from DCAA that 

were issued in 2008 and 2009, and 35 additional reports issued in 

previous years.

139

E. 44 One DCAA audit team requested to review all of the company’s 

107 internal audit reports issued in 2008 and 2009, which included all 

44 related to DOD contract oversight as well as those related to the 

company’s commercial activities. Also, various DCAA field audit offices 

made 85 requests for additional internal audit information in 2008 and 

2009, according to the company.

44

F. 3 A company official estimated that DCAA requested three internal audit 

reports that were issued by the company in 2008 from the company and 

eight additional reports issued in previous years.

44

G. 3 DCAA requested three internal audit reports from the company in 2009. 42

Source: GAO analysis of data from seven companies and DCAA.

DCAA auditors we spoke with identified several factors that could affect 

the number of internal audits they request.

• Auditors from four DCAA audit teams told us they have difficulty 

determining which internal audit reports are relevant to their own 

audit work because descriptions of internal audits they receive from 

the companies are often too brief to assess the relevancy to ongoing 

or planned DCAA audits. Our review of the lists of audits provided to 

DCAA confirmed that five of the companies provide only brief titles of 

audits, while two provide more detailed summaries that included the 

purpose, potential risks, and scope.

• DCAA auditors stated when they request an internal audit report, the 

company usually requires them to justify their request by linking it to a 

planned or ongoing DCAA audit of a particular contract or proposal. 
 

Page 20 GAO-12-88 Defense Contract Audits

As a result, DCAA auditors believe they are limited to requesting only 

those reports related to a specific planned or ongoing DCAA audit, 

even if the company has other internal audit reports related to 

another system or program that DCAA is responsible for auditing.

• Auditors from three DCAA audit teams stated that they did not believe 

that access to contractor internal audit information is critical to their 

own audit work and that the internal audit reports do not have enough 

detail to be helpful. They also stated that they are restricted by 

auditing standards in relying on the work of others. However, auditing 

standards do not restrict auditors from relying on the work of other 

auditors, including internal audit functions. While not reducing the 

level of work to be performed by DCAA auditors, consideration of 

relevant internal audit reports in planning related DCAA audits and 

performing risk assessments can provide useful information for 

planning DCAA’s scope of work and audit procedures.

• DCAA has issued significantly fewer audit reports since 2008. The 

annual number of DCAA audits of the seven companies selected for 

this review decreased by almost 50 percent from 2008 to 2010. The 

number of internal control audits DCAA performed on the companies 

decreased from 128 to 62 in the same period. A DCAA policy official 

noted that DCAA decreased its number of control environment audits 

because it was waiting for a regulatory change that would redefine 

critical business systems for contractors.14 As a result of this 

decrease, the number of internal audits necessary to supplement 

DCAA’s audit work also decreased during this time period.

Auditors from the DCAA audit teams we spoke with confirmed that while 

they request relatively few internal audits, when they are provided access 

to the audit reports, they use them primarily to help assess the 

companies’ internal controls and to determine whether companies took 

corrective action to address reported issues. Other uses of internal audits 

that DCAA auditors identified included:

• assessing the risk associated with a given DCAA audit,

• identifying the amount of testing needed for a given area, and

 

14DFARS interim rule 252.242-7005, Contractor Business Systems issued on May 18, 

2011.
 

Page 21 GAO-12-88 Defense Contract Audits

• determining whether company audit report findings identify 

unallowable costs that affect government contracts.

DCAA officials have acknowledged that getting access to internal audit 

information has been an issue with some of the major defense 

contractors and, at best, they have access on a case-by-case basis. They 

also acknowledge that they have not used their subpoena authority to get 

access to internal audits or other company documents since the Newport 

News decisions were issued in 1988 in part because the Fourth Circuit 

Court of Appeals held that the language in the statutes did not generally 

include internal audit reports unrelated to a specific contract or proposal.15

They also stated that the court’s decisions may have resulted in some 

DCAA auditors limiting their requests for internal audit information. A 

DCAA official noted that they have implemented a pilot program with one 

major defense contractor that could be a model for how the agency 

disseminates and coordinates internal information. The pilot program 

consolidates authority and communication among various field offices 

throughout the country that are responsible for auditing the contractor into 

one regional audit team. DCAA auditors and company representatives 

told us that the pilot provided enhanced communications and efficiency 

between DCAA and the company. While the pilot does not specifically 

address requests for internal audits, a senior DCAA official suggested 

that the model could be applied to the process of requesting and 

distributing company internal audit information as well.

The internal audits conducted by the seven companies we reviewed 

generally were conducted in accordance with recognized professional 

organizational standards. For individual company audits, the audit reports 

and workpapers from five companies demonstrate that they likewise 

adhere to recognized professional standards. The audit reports assess 

the controls and systems for managing defense contracts that DCAA is 

charged with auditing and contain information and analysis that DCAA 

could find useful as it conducts its own work. However, DCAA is not 

making full use of internal audits to help accomplish its critical oversight 

role. This is attributable, in part, to company limits on access to internal 

audit information based on their interpretations of DCAA’s access 

 

15United States v Newport News Shipbuilding and Dry Dock Company, 837 F.2d 162 (Fed. 

Cir. 1988) and United States v Newport News Shipbuilding and Dry Dock Company, 862 

F.2d 464 (Fed. Cir. 1988).

Conclusions 
 

Page 22 GAO-12-88 Defense Contract Audits

authority and related court cases. While the courts have held that DCAA 

does not have unlimited power to demand access to all internal company 

materials, the courts have also made it clear that DCAA may demand 

access to materials that are relevant to carrying out its audit 

responsibilities.16

When companies do not provide DCAA with access to internal audits or 

DCAA auditors do not request them, DCAA auditors do not have 

information that may be relevant for audit planning and risk assessment. 

Conversely, greater access to internal audit information could improve

DCAA’s efficiency. DCAA auditors could either conduct a full audit of all 

components of internal control, or in instances in which internal auditors 

have conducted related work, DCAA auditors could examine the audit 

reports and workpapers, if needed, and adjust their planning accordingly. 

Moreover, we believe that by not routinely obtaining access to relevant 

company internal audits that can inform their audits of the companies’ 

control environments, as well as audits of specific business systems and 

contracts, DCAA auditors are hindered in their ability to meet the GAGAS 

requirement for assessing internal controls. The work of the internal 

auditors by no means replaces the work of DCAA auditors, but it could 

provide DCAA auditors with a basis for making a judgment about a 

company’s internal controls and help inform their audit planning, thereby 

making more effective and efficient use of DCAA audits.

There are other issues that also account for DCAA’s 

limited use of internal audit reports. Specifically, DCAA auditors do not 

routinely request access to the reports due to limited visibility into the 

scope and objectives of internal audits and uncertainty as to how relevant 

internal audits can be used. DCAA management lacks insight into the 

limited access and use of internal audits because DCAA does not 

centrally track requests and denials for access to documents that could 

improve its ability to carry out its mission.

To increase DCAA’s access to and use of internal audits, we recommend 

that the Secretary of Defense direct that the Director of DCAA take the 

following three actions:

 

16United States v Newport News Shipbuilding and Dry Dock Company, 837 F.2d 162 (Fed. 

Cir. 1988) and United States v Newport News Shipbuilding and Dry Dock Company, 862 

F.2d 464 (Fed. Cir. 1988).

Recommendations for 

Executive Action
 

Page 23 GAO-12-88 Defense Contract Audits

• Ensure that DCAA’s central point of contact for each company 

coordinates issues pertaining to internal audits. For some companies, 

this would be the Contract Audit Coordinator. For companies without 

a Contract Audit Coordinator, a point of contact would need to be 

designated except when DCAA officials have determined that a 

company does not have an internal audit function that produces 

reports that may be relevant to DCAA’s audit responsibilities.

Coordination responsibilities should include

• obtaining sufficient information from the companies on their 

internal audit reports so DCAA auditors can better identify and 

request relevant audit reports and workpapers and

• tracking DCAA auditors’ requests for access to internal audit 

reports and workpapers and the companies’ disposition of those 

requests.

• Periodically assess information compiled by the central points of 

contact regarding the number of requests for internal audits and their 

disposition to determine whether additional actions are needed. Such 

additional actions could include senior level engagement with 

company officials to change company access policies or, as 

warranted, the issuance of subpoenas.

• Reaffirm with DCAA staff through guidance and training how and 

under what circumstances company internal audit reports can be 

accessed and used to improve the efficiency of audit planning and 

execution.

We requested comments on a draft of this report from DOD. In its written 

comments, reproduced in appendix II, DOD concurred with two of the 

recommendations and partially concurred with the recommendation 

regarding DCAA central points of contact for issues pertaining to internal 

audits. In its partial concurrence, DOD explained that DCAA would 

implement the recommendation to establish central points of contact for 

larger companies to attempt to obtain internal audit information from them 

and establish processes for tracking auditor’s requests for internal audit 

reports and workpapers. DOD stated, however, that doing so for smaller 

companies may not be feasible or beneficial, as some smaller contractors 

may not have sophisticated internal audit functions. DOD further 

expressed skepticism that implementing the recommended actions alone 

would fully ensure that DCAA would have complete and full access to 

contractor internal audits, citing the limits that companies have placed on 

DCAA’s access to internal audits and prior legal precedence. 

Agency and ThirdParty Comments and 

Our Evaluation
 

Page 24 GAO-12-88 Defense Contract Audits

We agree that for companies without internal audit functions that produce 

reports that may be relevant to DCAA’s audit responsibilities, designated 

coordinators would not be necessary. We, therefore, revised our original 

recommendation to provide for such an exception. We agree that 

implementing these recommendations alone may not be sufficient to 

provide DCAA with full and complete access to internal audit reports in all 

instances. However, implementation of the recommendations is a 

necessary step for DCAA to obtain the information needed to determine 

the extent to which DCAA is or is not getting access and how that is 

affecting DCAA’s ability to fulfill efficiently its oversight responsibilities. 

After taking such steps, DOD may be in a better position to identify and 

pursue other remedies for ensuring DCAA’s access to internal audit 

reports.

We also provided a draft of the report to the Chief Audit Executives of the 

seven selected companies for their review and comment. In its written 

comments on the draft, which are reproduced in appendix III, Lockheed 

Martin Corporation expressed support for providing DCAA with internal 

audit reports to the extent they can be used by DCAA to satisfy internal 

control reviews. Lockheed Martin also noted, with regard to the 

recommendation for DCAA central points of contact, that all DCAA audit 

requests are already centrally coordinated through the DCAA CAC, which 

has allowed the company to be responsive to DCAA request for internal 

audit reports. The other six companies declined to provide official 

comments, but two provided technical comments, which we incorporated 

into the final report as appropriate.

We are sending copies of this report to the Secretary of Defense, the 

Director of the Defense Contract Audit Agency, the Director of the Office 

of Management and Budget, appropriate congressional committees, and 

other interested parties. We will make this report available to the public at 

no charge on the GAO website at http://www.gao.gov. 
 

Page 25 GAO-12-88 Defense Contract Audits

If you or your staff have any questions about this report, please contact 

me at (202) 512-4841 or at woodsw@gao.gov. Contact points for our 

Offices of Congressional Relations and Public Affairs may be found on 

the last page of this report. Key contributors to this report are listed in 

appendix V. 

William T. Woods

Director 

Acquisition and Sourcing Management
Appendix I: Scope and Methodology

Page 26 GAO-12-88 Defense Contract Audits

In response to a congressional request to assess the role of defense 

companies’ internal audit departments and their ability to provide the 

Defense Contract Audit Agency (DCAA) with information on their control 

environments, business systems, and policies affecting government 

contracts, we examined (1) the adherence of selected major defense 

companies to internal auditing standards for organizations and individual 

audits, (2) the extent to which the internal audit reports of those 

companies address internal controls for the management of defense 

contracts and associated business systems, and (3) DCAA’s ability to 

examine and use those reports in carrying out its oversight 

responsibilities.

Our review focused on seven selected major defense companies. For 

purposes of our review we defined a major defense company as having at 

least $500 million in contracts with the Department of Defense (DOD) and 

at least $100 million in cost reimbursable contracts.1 The companies we 

selected had at least $1 billion in DOD contracts and derived at least 

25 percent of their revenue from DOD contracts in fiscal year 2009. We 

selected the top five major defense companies based on fiscal year 2009 

DOD contract obligations—The Boeing Company, Lockheed Martin 

Corporation, Raytheon Company, Northrop Grumman Corporation, and 

General Dynamics Corporation. We then judgmentally selected URS 

Corporation and KBR, Incorporated to obtain insights on how smaller 

major defense companies carry out their internal audit functions. 

Collectively these seven companies represent about $106.7 billion 

(57 percent) of the value of all contracts awarded by DOD to all major 

defense companies in fiscal year 2009. The results of our review cannot 

be generalized across major defense companies; instead, they provide 

insights into how companies have organized their internal audit function, 

conduct audits, and interact with DCAA.

 

1

The definition of major defense contractor is based on a combination of language 

contained in the John Warner National Defense Authorization Act for Fiscal Year 2007. 

Pub. L. No 109-364 §851 (2007) and DCAA’s definition of a major defense contractor 

provided to GAO during interviews with DCAA officials. The act describes major defense 

contractors as those contractors that have $500 million in defense contracts in a year. 

DCAA defines its major defense contractors as those that have $100 million in cost 

reimbursable contracts.

Appendix I: Scope and Methodology
Appendix I: Scope and Methodology

Page 27 GAO-12-88 Defense Contract Audits

To provide a framework for our assessment of the seven companies’ 

internal audit organization and engagement performance, we interviewed 

officials with the Institute of Internal Auditors and reviewed standards 

promulgated by the Institute for characteristics used in their peer review 

assessment of internal audit organizations as well as the standards for 

engagement performance. We also interviewed officials and reviewed 

documentation pertaining to the Institute’s Certified Internal Auditor 

examination and its training programs and conferences available to the 

auditing profession.

To develop information on companies’ organizational characteristics, we 

reviewed documents related to the organization and reporting structure of 

companies’ internal audit departments. We conducted an initial interview 

and obtained documents from officials from all seven companies to 

determine the internal audit department’s organizational standards, 

including its reporting structure, qualifications of staff, and whether the 

company participated in a peer review of its organization and 

engagement performance. We compared company policies, standards, 

and practices to standards set by the Institute regarding the organization 

and activities of company internal audit departments and to the standards 

for engagements.

Our work in examining the audit reports was conducted in two phases. 

First, we requested a list of all audit reports completed by the companies 

from January 1, 2008, through December 31, 2009—the latest audits 

completed when we began our assessment. We asked that the lists 

contain the titles, objectives, and scope of the audits. In total, the seven 

companies provided information on 1,125 audits. Second, we analyzed 

the information provided on the 1,125 audits and identified reports that 

pertained to the oversight of government contracts. We categorized the 

report as defense-related if the audit report’s scope and objectives 

identified one or more of the following aspects of company operations that 

are related to execution of government contracts:

• The audit’s scope and objectives included review of some aspect of 

the overall internal control system.

• The audit’s scope and objectives included review of one of the six 

business systems DOD is charged with reviewing—accounting 

system, earned value management system, estimating system, 

purchasing system, material management and accounting system, 

and property management system.
Appendix I: Scope and Methodology

Page 28 GAO-12-88 Defense Contract Audits

• The audit’s scope and objectives covered one or more DOD 

programs.

• The audit’s scope and objectives covered some aspect of the Federal 

Acquisition Regulation (FAR), Defense Federal Acquisition Regulation 

Supplement (DFARS), or company policies related to defense 

contract oversight. 

In total, we identified 520 audit reports as defense-related and requested 

those reports from the companies. We also selected a nongeneralizable 

random sample of five sets of workpapers from each company’s audit 

reports in order to assess how individual audits adhere to the Institute’s 

standards for conducting audits.

The companies provided us with 470 audit reports and 25 sets of 

workpapers. Lockheed Martin Corporation, Northrop Grumman 

Corporation, The Boeing Company, Raytheon Company, and URS 

Corporation provided us with both audit reports and workpapers for 

review. General Dynamics Corporation provided only audit reports for 

review. KBR, Incorporated did not provide audit reports or workpapers for 

our review. When companies did not provide us with requested audit 

reports or workpapers, we obtained the rationale for not providing the 

materials from company officials for documenting purposes. These 

rationales included the limitations on access to company internal 

documents discussed in two court cases and ownership of the 

workpapers by a third party. We do not regard the company decisions as 

a limitation of our scope since we examined the vast majority of the 

documents we requested and were fully able to address our audit 

objectives.

To assess how internal auditors applied the standards in conducting their 

audits, we reviewed 470 audit reports and 25 sets of workpapers. For the 

audit reports we determined the issues raised by the auditors, distribution 

of audit findings as well as evidence in the reports of testing conducted 

and follow-up of corrective actions. For our examination of the 

workpapers, we looked for evidence of planning for the engagement, risk 

assessments to include the risk of fraud, testing of company policies and 

procedures to determine if they are being followed, and whether the work 

performed supported the findings. For the workpaper reviews, we traced 

a finding from the conclusion back through the evidentiary materials 

including testing to the planning and risk evaluation to ascertain whether 

the finding was supported by the audit evidence and planning. To 

determine whether the audit finding was followed until it was corrected, 
Appendix I: Scope and Methodology

Page 29 GAO-12-88 Defense Contract Audits

we examined documentation in the audit workpapers to identify the 

person responsible for taking the action, what action was taken, and the 

date corrective action was completed.

To assess DCAA’s access and use of company internal audits, we 

reviewed DCAA’s audit manual and its audit programs for control 

environment audits as well as for audits of business systems and incurred 

costs. We interviewed DCAA officials responsible for audit policy. At the 

seven companies we selected, we also interviewed the DCAA audit staff 

to determine their experience in examining internal audit reports. We 

obtained DCAA documents requesting audit reports and copies of 

material provided by the companies in response to requests. We 

discussed actions taken by DCAA to gain material requested and 

reviewed reports of internal control deficiencies citing a lack of access to 

company audit reports. We interviewed staff to review their rationale for 

requesting company audit reports as well as the materiality of those 

reports to DCAA’s work.

We reviewed sections 2313 and 2306a of title 10 of the United States 

Code concerning DCAA access to records and FAR and DFARS 

provisions governing DCAA’s responsibilities. We also reviewed two key 

court decisions regarding DCAA’s ability to enforce a subpoena for 

company records including internal audits.2

We conducted this performance audit from September 2010 through 

December 2011 in accordance with generally accepted government 

auditing standards. Those standards require that we plan and perform the 

audit to obtain sufficient, appropriate evidence to provide a reasonable 

basis for our findings and conclusions based on our audit objectives. We 

believe that the evidence obtained provides a reasonable basis for our 

findings and conclusions based on our audit objectives.

 

2

United States v Newport News Shipbuilding and Dry Dock Company, 837 F.2d 162 (Fed. 

Cir. 1988) and United States v Newport News Shipbuilding and Dry Dock Company, 862 

F.2d 464 (Fed. Cir. 1988).
Appendix II: Comments from the Department 

of Defense

Page 30 GAO-12-88 Defense Contract Audits

Appendix II: Comments from the Department 

of Defense
Appendix II: Comments from the Department 

of Defense

Page 31 GAO-12-88 Defense Contract Audits
Appendix II: Comments from the Department 

of Defense

Page 32 GAO-12-88 Defense Contract Audits
Appendix III: Comments from Lockheed Martin 

Corporation

Page 33 GAO-12-88 Defense Contract Audits

Appendix III: Comments from Lockheed 

Martin Corporation 
Appendix IV: DCAA Access Authority and 

Associated Court Cases

Page 34 GAO-12-88 Defense Contract Audits

The Defense Contract Audit Agency’s (DCAA) authority to access and 

audit contractor records in support of Department of Defense (DOD) 

contracting and contract payment functions is described in sections 2313 

and 2306a of title 10 of the United States Code (U.S. Code) and in the 

Federal Acquisition Regulation (FAR).

• Section 2313 of title 10 of the U.S. Code gives the head of an agency, 

acting through DCAA as its authorized representative, the authority to 

inspect the plant and audit the records of a contractor performing a 

cost-reimbursement, incentive, time and materials, labor hour, or price 

redeterminable contract for agency. Records are defined as including 

both documents and data (among other things) whether written or in 

electronic form. The statute also provides that records may be 

subpoenaed if not provided by the contractor.

• Section 2313(i) of title 10 of the U.S. Code defines records to include 

books, documents, accounting procedures and practices, and other 

data, regardless of type and regardless of whether such items are in 

written form, in the form of computer data, or in any other form.

• Section 2306a of title 10 of the U.S. Code gives the head of an 

agency, acting through the contracting officer, the authority to require 

offerors, contractors, and subcontractors to make available cost or 

pricing data to the government. It also provides the head of an 

agency, acting through the contracting officer and DCAA, with the 

authority to review the records provided by the offerors, contractors, 

and subcontractors for the purpose of evaluating its accuracy, 

completeness, and currency.

The FAR describes the auditor’s contract audit responsibilities such 

as submitting information and advice to the requesting activity based 

on the auditor’s analysis of contractor’s financial and accounting 

records or other related data as to the acceptability of the contractor’s 

incurred and estimated costs. In addition, the auditor is responsible for 

reviewing the financial and accounting aspects of contractor cost 

control systems and performing other analyses and reviews that 

require access to contractor financial and accounting records 

supporting proposed and incurred costs. The FAR also provides 

specific language regarding DCAA role as the responsible 

government audit agency.1

 

1

FAR §§ 42.101 (a) and (b).

Appendix IV: DCAA Access Authority and 

Associated Court Cases
Appendix IV: DCAA Access Authority and 

Associated Court Cases

Page 35 GAO-12-88 Defense Contract Audits

DCAA’s use of its access authority has been addressed in at least two 

court decisions, generally known as Newport News I and Newport News 

II, both decided in 1988. In both cases, DCAA sought to enforce 

subpoenas for access to internal documents of Newport News 

Shipbuilding and Dry Dock Company. In the first case (Newport News I), 

Newport News challenged the scope of DCAA’s subpoena power as it 

related to Newport News’ internal audits.2

In the second case (Newport News II), DCAA subpoenaed the company’s 

tax returns, financial statements, and supporting schedules.

 The court held that the 

statutory subpoena power of DCAA extends to cost information related to 

government contracts but that DCAA does not have unlimited power to 

demand access to all internal corporate materials of companies 

performing cost type contracts for the government. Because the materials 

sought by DCAA were not within the scope of its statutory authority, the 

court affirmed the district court’s order denying enforcement of the 

subpoena.

3

 

2

United States v Newport News Shipbuilding and Dry Dock Company, 837 F.2d 162 (Fed. 

Cir.1988). 

The court 

decided to uphold enforcement of the subpoena, concluding that the 

requested material was relevant to an audit and provided evidence of the 

consistency of costing methods and the reconciliation of costs claimed for 

tax purposes. Further, the court decided that access to the documents 

would allow DCAA to corroborate the company’s computation of direct 

and indirect costs. The court contrasted the two cases, stating that the 

subpoena at issue in the first case did not extend to internal audits, which 

contain the subjective assessments of Newport News’ internal audit staff. 

In the second case, DCAA requested production of objective financial and 

cost data and summaries, not the subjective work product of Newport 

News’ internal auditors. To the extent that the materials subpoenaed 

would assist DCAA in verifying and evaluating the cost claims of the 

contractor, the court determined they were within DCAA’s statutory 

subpoena authority.

3

United States v Newport News Shipbuilding and Dry Dock Company, 862 F.2d 464 (Fed. 

Cir. 1988).
Appendix V: GAO Contact and 

Acknowledgments

Page 36 GAO-12-88 Defense Contract Audits

William T. Woods, (202) 512-4841 or woodsw@gao.gov

Principal contributors to this report were Johana R. Ayers, Assistant 

Director; James Ashley; Lisa M. Brownson; John W. Crawford; Gayle L. 

Fischer; Laura S. Greifner; Carolyn R. Kirby; John Krump; Jean L. 

McSween; Carol T. Mebane; John Needham; Matthew M. Shaffer; Robert 

A. Sharpe; and Roxanna T. Sun.

Appendix V: GAO Contact and 

Acknowledgments 

GAO Contact

Acknowledgments

(120932)
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (www.gao.gov). Each weekday afternoon, 

GAO posts on its website newly released reports, testimony, and 

correspondence. To have GAO e-mail you a list of newly posted products, 

go to www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. 

Visit GAO on the web at www.gao.gov. 

Contact:

Website: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400

U.S. Government Accountability Office, 441 G Street NW, Room 7125

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations 

Public Affairs

Please Print on Recycled Paper.