Central Intelligence Agency

Washington, D.C. 20505

Office of Inspector General

16 March 2021

Report on the External Peer Review of the National Geospatial-Intelligence 

Agency, Office of Inspector General, Audit Division (2021-0003-AS) 

Attachment A 

System Review Report 

We have reviewed the system of quality control for the audit organization of the National 

Geospatial-Intelligence Agency (NGA), Office of Inspector General (OIG) in effect for the 

year ended 30 September 2020. A system of quality control encompasses NGA OIG’s 

organizational structure and the policies adopted and procedures established to provide it 

with reasonable assurance of conforming in all material respects with Government Auditing

Standards1and applicable legal and regulatory requirements. The elements of quality 

control are described in Government Auditing Standards. 

In our opinion, the system of quality control for the audit organization of NGA OIG in effect 

for the year ended 30 September 2020, has been suitably designed and complied with to 

provide NGA OIG with reasonable assurance of performing and reporting in conformity 

with applicable professional standards and applicable legal and regulatory requirements in all 

material respects. 

Audit organizations can receive a rating of pass, pass with deficiencies, or fail. NGA 

OIG has received an External Peer Review rating of pass. 

Monitoring of GAGAS Engagements Performed by Independent 

Public Accountants 

In addition to reviewing its system of quality control to ensure adherence with Government

Auditing Standards, we applied certain limited procedures in accordance with guidance 

established by the Council of the Inspectors General on Integrity and Efficiency 

(CIGIE) related to NGA OIG’s monitoring of engagements conducted in accordance with 

generally accepted government auditing standards (GAGAS engagements) by Independent 

Public Accountants (IPAs) under contract where the IPA served as the auditor. It should be 

noted that monitoring of GAGAS engagements performed by IPAs is not an audit and, 

therefore, is not subject to the requirements of Government Auditing Standards. The purpose 

of our limited procedures was to determine whether NGA OIG had adequate controls to ensure 

1 NGA OIG was subject to both the 2011 and the 2018 revisions of Government Auditing Standards for the 

period under review. 

• . < 

. 

Approved for Public Release, 22-200
Attachment A – System Review Report 

2

IPAs performed contracted work in accordance with professional standards. However, our 

objective was not to express an opinion; accordingly, we do not express an opinion on NGA

OIG’s monitoring of work performed by IPAs.

Letter of Comment

We have issued a letter dated 16 March 2021 that sets forth findings that were not 

considered to be of sufficient significance to affect our opinion expressed in this report. 

We also made certain comments related to NGA OIG’s monitoring of GAGAS 

engagements performed by IPAs, which we included in the above referenced letter dated 

16 March 2021. 

Basis of Opinion 

Our review was conducted in accordance with Government Auditing Standards and the 

CIGIE Guide for Conducting Peer Reviews of Audit Organizations of Federal Offices of 

Inspector General. 

During our review, we interviewed2 NGA OIG personnel and obtained an understanding of 

the nature of the NGA OIG audit organization, and the design of NGA OIG’s system of 

quality control sufficient to assess the risks implicit in its audit function. Based on our 

assessments, we selected GAGAS engagements and administrative files to test for 

conformity with professional standards and compliance with NGA OIG’s system of quality 

control. The GAGAS engagements selected represented a reasonable cross-section of NGA 

OIG audit organization engagements, with an emphasis on higher-risk engagements. 

In performing our review, we obtained an understanding of the system of quality control for 

the NGA OIG audit organization. In addition, we tested compliance with NGA OIG’s 

quality control policies and procedures to the extent we considered appropriate. These tests 

covered the application of NGA OIG’s policies and procedures on selected GAGAS 

engagements. Our review was based on selected tests; therefore, it would not necessarily 

detect all weaknesses in the system of quality control or all instances of noncompliance. 

Prior to concluding the peer review, we reassessed the adequacy of the scope of the peer 

review procedures and met with NGA OIG management to discuss the results of our review. 

We believe that the procedures we performed provide a reasonable basis for our opinion. 

The enclosure to this report identifies the engagements we reviewed. 

2 Due to circumstances surrounding the COVID-19 pandemic, in-person interviews were not conducted. The 

team relied upon questionnaire responses, e-mails, and phone conversations. 
Attachment A – System Review Report 

3

Responsibilities and Limitations

NGA OIG is responsible for establishing and maintaining a system of quality control 

designed to provide NGA OIG with reasonable assurance that the organization and its 

personnel comply in all material respects with professional standards and applicable legal 

and regulatory requirements. Our responsibility is to express an opinion on the design of the 

system of quality control and NGA OIG’s compliance based on our review.

There are inherent limitations in the effectiveness of any system of quality control; therefore, 

noncompliance with the system of quality control may occur and may not be detected. 

Projection of any evaluation of a system of quality control to future periods is subject to the risk 

that the system of quality control may become inadequate because of changes in conditions, or 

because the degree of compliance with the policies or procedures may deteriorate. 

Enclosure

Assistant Inspector General for Audits 
Attachment A – System Review Report 

4

Enclosure

Scope and Methodology 

We tested compliance with NGA OIG audit organization’s system of quality control to the 

extent we considered appropriate. These tests included a review of two of eight 

engagements conducted in accordance with generally accepted government auditing 

standards (GAGAS engagement) and one engagement terminated during the period 

1 October 2017 through 30 September 2020. We also reviewed the internal quality control 

reviews performed by NGA OIG. 

In addition, we reviewed NGA OIG’s monitoring of GAGAS engagements performed by 

IPAs where the IPA served as the auditor from 1 October 2017 through 30 September 2020. 

During the period, NGA OIG contracted for the audit of its agency’s fiscal year 2017, 2018, 

and 2019 financial statements. NGA OIG also contracted for other engagements that were 

performed in accordance with Government Auditing Standards. 

Reviewed GAGAS Engagements Performed by NGA OIG:

Report No. Report Date Report Title

17-A08 5 March 2020 Audit of NGA's Analysis Event Response 

for National Security and Natural 

Disasters

19-A01 18 June 2020 Audit of NGA's Supply Chain Risk 

Management

19-A08 Terminated 

29 July 2020

Audit of NGA's Implementation of Agile 

Software Development

 Reviewed Monitoring Files of NGA OIG for Contracted GAGAS Engagements:

Report No. Report Date Report Title

19-A05 12 November 2019 Independent Auditors' Report on the NGA 

Financial Statements for FY 2019