Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

Streamlining and Improving Compliance Volume 3

Recommendation 73: Revise the definition of business system deficiencies to 

more closely align with generally accepted auditing standards. 

Problem

The definition of the term significant deficiency for contractor business systems in Section 893 of the 

FY 2011 NDAA and the DFARS does not align with generally accepted auditing standards for 

evaluating and reporting on internal control deficiencies. This lack of consistency creates confusion 

regarding the identification, severity, meaning, and resolution of deficiencies.

Background

The FY 2011 NDAA and DFARS definition for significant deficiency describes it as materially affecting 

DoD officials’ and contractor’s ability to rely on information produced by the business system that is 

needed for management purposes. The term in generally accepted auditing standards for a deficiency 

of this severity, that is, a deficiency that is material, is material weakness. Generally accepted auditing 

standards also use the term significant deficiency, but to describe a deficiency that is less severe than a 

material weakness. The use of the same term to mean different levels of severity of a deficiency creates 

confusion about the meaning of significant deficiency among contractors, independent public 

accountants performing SOX 404(b) audits, government auditors, and the acquisition community. 

The FY 2011 NDAA and the DFARS regulations provide for only a significant deficiency, but in reality, 

the contractor business system could have a number of deficiencies that range from trivial to severe. 

Reporting deficiencies by different levels of severity, and in a manner that aligns with established 

auditing standards, will allow contracting officers to make informed decisions on the acceptability of 

the business system 

Discussion

The FY 2011 NDAA, Section 893, and DFARS 252.242-7005, Contractor Business Systems, define 

significant deficiency as “a shortcoming in the system that materially affects the ability of officials of the 

Department of Defense and the contractor to rely on information produced by the system that is 

needed for management purposes.” The term and its definition are mismatched relative to generally 

accepted auditing standards, which have a two-tiered approach to evaluating and reporting business 

system deficiencies. As shown here, the statutory and regulatory definition above better aligns with the 

private-sector, Public Company Accounting Oversight Board, GAO Yellow Book, and Securities and 

Exchange Commission definitions of material weakness: 

Material weakness. A deficiency, or a combination of deficiencies, in internal control over financial 

reporting, such that there is a reasonable possibility that a material misstatement of the entity's financial 

statements will not be prevented, or detected and corrected, on a timely basis. A reasonable possibility 

exists when the likelihood of an event occurring is either reasonably possible, meaning the chance of the 

future event occurring is more than remote but less than likely, or is probable.

Significant deficiency. A deficiency, or a combination of deficiencies, in internal control over financial 

reporting that is less severe than a material weakness yet important enough to merit attention by those 
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

Streamlining and Improving Compliance Volume 3

charged with governance. (AICPA, Professional Standards, AU-C section 265, Communicating Internal 

Control Related Matters Identified in an Audit)

Financial statement audits and examination engagements conducted in accordance with GAO, 

Government Auditing Standards 2018 Revision, (paragraphs 6.29 and 7.42), refers to use of the terms 

material weakness reporting on internal control deficiencies. The paragraph also references the AICPA, 

Professional Standards, AU-C section 265, for consistent use of the terminology. 

Conclusions

The definition for system deficiencies in the FY 2011 NDAA, Section 893, and DFARS regulation 

require revision to be more consistent with the definitions in generally accepted auditing standards 

that apply to different types of engagements (e.g., inspection, attestation, and performance). 

Statutory Revision

In the FY 2011 NDAA, Section 893, the term significant deficiency and its definition need to be stricken 

and replaced with the term material weakness and its definition as follows: 

§ Material Weakness: A deficiency, or combination of deficiencies, in internal control over risks 

related to Government contract compliances or other shortcomings in the system, such that 

there is a reasonable possibility that a material noncompliance will not be prevented, or 

detected and corrected, on a timely basis. A reasonable possibility exists when the likelihood of 

an event occurring is either reasonably possible, meaning the chance of the future event 

occurring is more than remote but less than likely, or is probable.

DFARS Revision 

In the DFARS regulations (e.g., Accounting System Administration 252.242-7006, Contractor Business 

Systems 252.242-7005), the term significant deficiency and its definition should be stricken and replaced 

with the term material weakness and its definition. Additionally, the regulations should include new 

terms and their respective definitions for significant deficiency and other deficiency. 

The definition of material weakness, significant deficiency, and other deficiency is applicable to any 

type of engagement (e.g., attestation, inspection) that is designed to test internal controls or compliance 

with a specific criterion. For an audit or inspection designed to test compliance with specific criteria, a 

deficiency can occur due to either internal control defect or a system shortcoming. A shortcoming in 

this regard would occur if a business system lacks a capability or element of functionality required by 

the system criteria. The revised DFARS language for business system deficiencies is as follows: 

§ Material Weakness: A deficiency, or combination of deficiencies, in internal control over risks 

related to Government contract compliances or other shortcomings in the system, such that 

there is a reasonable possibility that a material noncompliance will not be prevented, or 

detected and corrected, on a timely basis. A reasonable possibility exists when the likelihood of 

an event occurring is either reasonably possible, meaning the chance of the future event 

occurring is more than remote but less than likely, or is probable.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

Streamlining and Improving Compliance Volume 3

§ Significant Deficiency: A deficiency, or combination of deficiencies, in internal control over risks 

related to Government contract compliance or other shortcomings in the system that is less 

severe than a material weakness yet important enough to merit the attention of those charged 

with governance. 

§ Other Deficiency: A deficiency, or combination of deficiencies, in internal control over 

Government contract compliance or other shortcomings in the system that have a clearly trivial, 

or inconsequential, effect on the ability of the business system to prevent or detect and correct, 

material noncompliances on a timely basis. 

The other deficiency definition acknowledges the possibility that a business system deficiency, or 

combination of systems deficiencies, may have a clearly trivial effect on the quality of information 

produced by the contractor’s business systems. Clearly trivial represents the inverse of material whether 

judged by any criteria of size, nature, or circumstances. Other deficiencies will not impact the audit 

opinion or conclusions and will not be included in the audit report. These deficiencies may be 

communicated to the contracting officer using email or other method of communication. 

The revisions introduce new terms, such as material noncompliance and misstatement and a new 

definitions for acceptable contractor business system that are not currently in the DFARS but are 

important to understanding the revised business system deficiency definitions. As a result, and in 

conjunction with the revised DFARS deficiency definitions, the following definitions should be added 

to the DFARS to enhance understanding and provide clarity to stakeholders: 

§ Material Noncompliance: A misstatement in the information provided to the Government 

(e.g., billings, incurred cost submissions, pricing proposals, etc.) that will materially influence, 

and may adversely impact the economic or management decisions of the users of the 

information. 

§ Misstatement: Information provided to the Government does not comply with contract terms 

and applicable federal regulations such as the Federal Acquisition Regulations (FAR) and Cost 

Accounting Standards (CAS). 

§ Acceptable Contractor Business System: Contractor business systems that comply with the 

criteria of applicable business system clauses and does not contain a material weakness that 

would affect the ability of officials of the Department of Defense to rely on information 

produced by the business system that is needed for management purposes.

Implementation

Legislative Branch

§ Revise and replace the definition for significant deficiency in Section 893 of the FY 2011 NDAA, 

Section 893, with the new definitions of material weakness. 

§ Define material weakness as a deficiency, or combination of deficiencies, in internal control over 

risks related to government contract compliances or other shortcomings in the business system, 

such that there is a reasonable possibility that a material noncompliance will not be prevented, 
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

Streamlining and Improving Compliance Volume 3

or detected and corrected, on a timely basis. A reasonable possibility exists when the likelihood 

of an event occurring is either reasonably possible, meaning the chance of the future event 

occurring is more than remote but less than likely, or is probable.

Executive Branch

§ Revise the Business System DFARS sections (for all systems with the significant deficiency 

defined) to replace the term significant deficiency with the new definitions of material weakness, 

significant deficiency, and other deficiency as follows: 

- Significant Deficiency: A deficiency, or combination of deficiencies, in internal control over

risk related to Government contract compliance or other shortcomings in the business 

system that is less severe than a material weakness yet important enough to merit the 

attention of those charged with governance. 

- Other Deficiency: A deficiency, or combination of deficiencies, in internal control over 

Government contract compliance or other shortcomings in the business system that have a 

clearly trivial, or inconsequential, effect on the ability of the business system to prevent or 

detect and correct, material noncompliances on a timely basis. 

§ Define material weakness as a deficiency, or combination of deficiencies, in internal control over 

risks related to Government contract compliances or other shortcomings in the business system, 

such that there is a reasonable possibility that a material noncompliance will not be prevented, 

or detected and corrected, on a timely basis. A reasonable possibility exists when the likelihood 

of an event occurring is either reasonably possible, meaning the chance of the future event 

occurring is more than remote but less than likely, or is probable.

§ Revise the Business System DFARS sections (for all systems) to include the definitions: 

- Material Noncompliance: A misstatement in the information provided to the Government 

(e.g. billings, incurred cost submissions, pricing proposals, etc.) that will materially 

influence, and may adversely impact the economic or management decisions of the users of 

the information. 

- Misstatement: Information provided to the Government does not comply with contract 

terms and applicable federal regulations such as the Federal Acquisition Regulations (FAR) 

and Cost Accounting Standards (CAS). 

- Acceptable Contractor Business System (DFARS Revision): Means contractor business 

systems that complies with the criteria of applicable business system clauses and does not 

contain a material weakness that would affect the ability of officials of the Department of 

Defense to rely on information produced by the system that is needed for management 

purposes.

Implications for Other Agencies

§ There are no cross-agency implications for this recommendation.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

Streamlining and Improving Compliance Volume 3

THIS PAGE INTENTIONALLY LEFT BLANK