Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Contract Compliance and Audit Volume 1

Recommendation 10: Replace system criteria from DFARS 252.242-7006,

Accounting System Administration, with an internal control audit to assess the 

adequacy of contractors’ accounting systems.

Problem

The DoD is not obtaining timely assurance that internal controls for defense contractors’ accounting 

systems are properly designed and functioning.1 Ensuring effective internal controls is one of the most 

efficient ways to protect the government’s interest, reduce risk, and improve performance.

Background

The Committee of Sponsoring Organizations (COSO) of the Treadway Commission has developed an 

Internal Control—Integrated Framework (May 2013) that has gained broad acceptance in the private 

sector and is widely used around the world.2 COSO is a private-sector initiative that was jointly 

sponsored by the American Accounting Association (AAA), American Institute of Certified Public 

Accountants (AICPA), Financial Executives International (FEI), Institute of Management Accountants 

(IMA), and the Institute of Internal Auditors (IIA).3 COSO is dedicated to providing thought leadership 

through the development of a comprehensive framework and guidance on internal control, enterprise 

risk management, and fraud deterrence designed to improve organizational performance and oversight 

and to reduce the extent of fraud in organizations. Its integrated framework of internal controls enables 

organizations to develop systems of internal control that adapt to changing business and operating 

environments, mitigate risks to acceptable levels, and support sound decision-making and governance 

of the organization.

The federal government has developed a similar framework that adapts the COSO Internal Control –

Integrated Framework principles and addresses the unique government environment in the Standards 

for Internal Control in the Federal Government (GAO-14-704G), which is commonly referred to as the 

Green Book.

4 The U.S. Comptroller General developed the Green Book to set forth the internal control 

standards for federal entities. The Green Book defines the standards through components and principles 

and explains why they are integral to entities’ internal control system.

Internal control also is defined as a process used by management to help an entity meet its objectives. 

Internal control helps an entity run its operations efficiently and effectively, report reliable information 

about its operations, and comply with applicable laws and regulations. Intended users of the Green 

Book are program managers, independent public accountants conducting audits of federal 

expenditures, and IG staff conducting financial or performance audits. Assurance of an effective 

 

1 DCAA, email to Section 809 Panel Staff, December 18, 2017. The email indicated that DCAA completed eight accounting system audits in 

FY 2016.

2 Committee of Sponsoring Organizations of the Treadway Commission, Internal Control – Integrated Framework, Executive Summary, i,

accessed October 30, 2017, https://www.coso.org/Documents/990025P-Executive-Summary-final-may20.pdf. 3 “Guidance on Internal Control,” COSO: Committee of Sponsoring Organizations of the Treadway Commission, accessed October 30, 

2017 https://www.coso.org/Pages/ic.aspx. 4 GAO, Standards for Internal Control in the Federal Government, GAO-14-704G, accessed October 30, 2017,

http://www.gao.gov/assets/670/665712.pdf. 
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Contract Compliance and Audit Volume 1

internal control system provides management with added confidence that it can adapt to shifting 

environments, evolving demands, changing risks, and new priorities.

Accounting business systems make up much of the business systems in the DoD’s Contract Business 

Analysis Repository (CBAR). In addition to being the most prevalent contractor system, it is the most 

critical system for ensuring the government’s interests are protected. The accounting system is the 

central and integral internal control system that enables companies to successfully conduct business 

with the federal government.

Figure 2-1. Business System Relationships

FAR 16.301-3, Limitations, recognizes the criticality of the accounting system by requiring the 

contractor to maintain an adequate accounting system for determining cost applicable to contracts 

awarded on the basis of cost.5 In addition, FAR subpart 32.5, Progress Payments Based on Costs, and 

FAR 32.503, Postaward Matters, contain multiple provisions requiring an adequate accounting system 

and controls.6 Even prospective contractors wanting to do business with the federal government must 

have the necessary accounting and operational control structure to be deemed responsible in 

accordance with FAR 9.104-1, General Standards.7 

This requires prospective contractors to demonstrate capability to meet the requirements outlined in 

the Standard Form 1408, Pre-Award Survey of a Prospective Contractor Accounting System.8 This preaward system review should not be confused with the reviews required by the DFARS Business System 

 

5 Cost-Reimbursement Contracts: Limitations, FAR 16.301-3. 6 Progress Payments Based on Costs, FAR 32.5. 

7 Responsible Prospective Contractors: Standards, FAR 9.104-1. 8 Defense Contract Audit Agency, Preaward Survey of Prospective Contractor Accounting System, Version 6.13, dated April 2017, accessed 

November 20, 2017, http://www.dcaa.mil/Content/Documents/sap/17740_AP_NA.pdf. 

Labor Compensation

Indirect/

ODCs

B&P

Billing

MMAS

Cost Representations

Purchasing

Property

Accounting

EVMS Estimating
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Contract Compliance and Audit Volume 1

rule that test the design and capability of the system, as well whether the controls are in place and 

functioning properly.

Findings

The Sarbanes–Oxley Act (SOX) established the first mandated audit of Internal Controls over Financial 

Reports (ICFR) to determine the effectiveness of controls (SOX 404(b)).9 Most publicly traded 

companies, with the exception of those with a market capitalization of $75 million or less, are required 

to have an annual audit of ICFR.

10

As a result of SOX, in the last 15 years, industry organizations have established a framework with 

standards, objective criteria, and defined terminology. The Public Company Accounting Oversight 

Board (PCAOB) has established Auditing Standard 2201 (AS 2201), and the American Institute of 

Certified Public Accountants (AICPA) has developed AU-C Section 940 auditing standards. Both 

documents are titled An Audit of Internal Control over Financial Reporting That is Integrated with an Audit 

of Financial Statements.

11 Refinements over the last 15 years have brought about reliable, consistent, and 

well-understood guidance for private-sector auditors.

Conclusions

DoD should build on the established and well-understood internal control audit framework provided 

by SOX to cover DoD’s contractor accounting system requirements. SOX 404(b) serves as a foundation 

to help meet the government’s objectives to obtain assurance that contractors have effective internal 

controls for their business systems. Starting with this framework eliminates the need to develop 

uniquely defined criteria and terminology, which in turn reduces the time needed to make this 

framework operational.

DoD should use the SOX internal control audit framework and adapt it to meet the government’s 

objectives for contractor accounting-system oversight. Audits of internal controls designed to assess 

controls over financial reporting (the SOX mandate) cannot meet the government’s contracting audit 

needs without some adjustments to the scope of the engagement. Using the current audit of internal 

controls over financial reporting as a basis to certify that the government’s control objectives are 

adequately addressed and satisfy the intent of the current business is an insufficient approach because 

it would not address all of the relevant control objectives. The audit of ICFR addresses some of 

government’s objectives, but comes woefully short of addressing all of them. 

Adapting the current internal control framework would address a shortcoming in the FY 2017 NDAA 

Section 893 (c)(1) that states “if a registered public accounting firm attests to the internal control 

 

9 Securities and Exchange Commission, Office of Economic Analysis, Study of the Sarbanes-Oxley Act of 2002 Section 404 Internal Control 

over Financial Reporting Requirements, 3, accessed November 20, 2017, https://www.sec.gov/news/studies/2009/sox-404_study.pdf. 10 Securities and Exchange Commission, Final Rule – Internal Control Over Financial Reporting In Exchange Act Periodic Reports of NonAccelerated Filers, Effective Date: September 21, 2010, accessed November 20, 2017, https://www.sec.gov/rules/final/2010/33-9142.pdf. 11 Public Company Accounting Oversight Board, Auditing Standard No. 5 – An Audit of Internal Control Over Financial Reporting That Is 

Integrated with An Audit of Financial Statements and Related Independence Rule and Conforming Amendments, PCAOB Release No. 2007-

005A, June 12, 2007, accessed November 20, 2017, https://pcaobus.org/Rulemaking/Docket%20021/2007-06-12_Release_No_2007-

005A.pdf. American Institute of Certified Public Accountants (AICPA), AU-C Section 940 – An Audit of Internal Control Over Financial 

Reporting That Is Integrated With an Audit of Financial Statements, accessed November 20, 2017, 

https://www.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments/au-c-00940.pdf.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Contract Compliance and Audit Volume 1

assessment of a contractor pursuant to section 404(b) of the Sarbanes-Oxley Act of 2002 allow the 

contractor ... to submit certified documentation ... that the contractor business systems of the 

contractor meet the business system requirements referred in subsection (b)(1) and to thereby eliminate 

the need for further review of the contractor business system by the Secretary of Defense.”12

The envisioned internal control audits will focus on assessing the key controls that ensure government 

objectives are being met. Auditors’ conclusions on the effectiveness of the key controls are essential 

information for contracting officers and contractors to evaluate whether the government’s interests are 

adequately protected. Specifically, auditors will evaluate whether key internal controls are in place and 

operating to do the following:

§ Ensure a sound internal control environment and accounting framework.

§ Appropriate classification of direct costs from indirect costs.

§ Allocate indirect costs properly.

§ Exclude unallowable costs.

§ Confirm costs by contract.

§ Reconcile subsidiary cost ledgers to general ledger accounts.

§ Ensure periodic posting of books of account at least monthly for contract billings.

§ Certify proper controls over adjusting entries.

§ Ensure timekeeping and labor distribution controls are proper.

§ Comply with contract terms.

§ Ensure accordance with Cost Accounting Standards if applicable and GAAP.

§ Monitor the internal control environment.

Under the internal control audit engagement, auditors will determine whether reasonable assurance 

exists that controls will prevent any significant or material mischarge from occurring. This is in contrast 

to the current evaluation criteria that determine compliance by using an inspection-like pass or fail for 

each of the 18 requirements. In many instances, the current engagement fails to consider a holistic view 

of the system of controls and the significance of a noncompliance and the likelihood that a significant 

noncompliance could actually occur. 

Using the private-sector-established internal control audit framework can resolve a consistent 

complaint expressed in Section 809 Panel meetings with stakeholders that the accounting system 

criteria were not objective and measureable because of the current terminology used in the business 

system rule.13 Internal control audits should be performed as the basis for assessing the adequacy of 

defense contractors’ accounting systems because these audits provide the following:

 

12 Section 893 of FY 2017 NDAA, Pub. L. No. 114-328 (2016). 13 Defense Industry officials, interview conducted July 25, 2017 by Section 809 Panel Team 4: Barriers to Entry. American Institute of 

CPAs, DoD Comment Letter Finbal-AICPA, https://www.regulations.gov/document?D=DARS-2014-0047-0020.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Contract Compliance and Audit Volume 1

§ An engagement framework used in the private sector that is well established and understood.

§ More useful and relevant information to the acquisition team, contracting officer, and 

contractor.

§ Clear and objective criteria for accounting system requirements.

The framework’s standards and criteria would satisfy the FY 2017 NDAA Section 893 (a) requirement 

to develop “clear and specific business system requirements that are identifiable and made publicly 

available.”14

Implementation

Legislative Branch

§ No statutory changes are required.

Executive Branch

§ Revise DFARS 252.242-7006 to allow DoD use of internal control audits conducted by 

contractors for accounting system oversight.

Implications for Other Agencies

§ There are no cross-agency implications for this recommendation.

 

14 Section 893 of FY 2017 NDAA, Pub. L. No. 114–328 (2016).