For purposes of this report, we define the Control environment—positive and supportive attitude toward internal controls, conscientious management, and ethics standards. Risk assessment—identification and assessment of risks from internal and external sources and establishment of controls to mitigate them. Control activities—policies, procedures, techniques, and mechanisms that ensure management’s directives to mitigate risk are carried out. Information and communication systems—assurance that information is recorded and communicated to management and others in a form and within a time frame that enables them to carry out internal controls and operational responsibilities. Monitoring—activities that assess the quality of performance over time and ensure that audit and review findings are promptly resolved. As part of their overall governance and control, many companies establish internal audit departments to monitor adherence to management policies and controls, report exceptions to policies and procedures, and track corrective actions. One of the principal authorities on the standards and practices of internal auditing is the Institute of Internal Auditors (the Institute). The Institute is a non-profit professional organization that provides guidance on assessing, maintaining, and improving the quality of internal auditing within the profession. Importantly, the Institute provides guidance for the profession through its International Standards for the Professional Practice of Internal Auditing. These standards include requirements at the organizational level such as independence and objectivity, as well as for conducting audits, including planning, performing fieldwork, communicating results, and following up on corrective actions. The Institute also conducts training and administers the Certified Internal Auditor (CIA) testing and certification program. The CIA certification is acknowledged by auditing professionals as a standard by which individuals demonstrate their competence in internal auditing. In addition to a company’s own internal audit department, companies that provide goods and services to DOD may be audited by DCAA. As required by the Federal Acquisition Regulation (FAR) and the Defense Federal Acquisition Regulation Supplement (DFARS), DCAA’s audits examine internal controls, incurred costs, and business systems used in the execution of government contracts. DCAA’s contract audit services are intended to be a key control that helps ensure that prices paid by the government are fair and reasonable and that companies are charging the government in accordance with applicable laws, regulations, cost accounting standards, and contract terms. At the completion of an audit, DCAA provides the contracting officer with a report to assist in negotiations or in assessing contract costs, as well as in determining compliance with regulations and contractual requirements. DCAA, which employs approximately 4,000 auditors, consists of a headquarters office at Ft. Belvoir, Virginia and six major organizational components—five regional offices across the United States that direct and administer audits for assigned geographical areas and a field detachment office that audits classified contracting activity. The five regional offices manage about 300 field audit offices. Field audit offices can be categorized as branch offices, resident offices, or suboffices. Branch offices are located within each region and have responsibility for all contract audit services within the assigned geographical area. Resident offices are established at company locations where the audit workload justifies assignment of a permanent staff of auditors. Suboffices are established by regional directors as extensions of branch or resident offices when required to furnish audit services. A suboffice depends on its parent field office for release of reports. For larger companies with operations at multiple locations, DCAA assigns a Contract Audit Coordinator (CAC) who serves as a central point of communication between DCAA auditors and company representatives. DCAA audits are governed by generally accepted government auditing standards (GAGAS). These standards require evaluation and testing of the overall internal controls including the work of the contractor’s internal audit activity, specific controls, and business systems. These standards and associated principles govern the audit planning and evidence required to conduct a GAGAS-compliant audit. DCAA’s procedures for adhering to GAGAS in conducting different types of audits, such as audits of internal controls or company business systems, are contained in its Contract Audit Manual (CAM). According to the CAM, DCAA is required periodically to examine the contractor’s internal controls, as well as contractor policies and procedures. It also states that in the process of planning an audit, auditors should consider the company’s self governance programs when assessing the adequacy of the internal controls to determine the scope of their audit. Further, the CAM states that audits of individual business systems are to include an evaluation of the internal control activities applicable to that system.guidance for audit procedures states that auditors should consider a company’s internal audit activities to determine the adequacy of its internal controls when performing an audit of the company’s control environment and accounting system. Lastly, DCAA To conduct its audits, DCAA relies on the examination of contractor financial, accounting, and other data. DCAA’s authority to access and audit contractor records in support of DOD contracting and contract payment functions is described in sections 2313 and 2306a of title 10 of the United States Code (U.S.C.) and in the FAR. DCAA’s use of its authority has been addressed in two court decisions involving Newport News Shipbuilding and Dry Dock Company. The decisions are generally known as Newport News I and Newport News II, both decided in 1988. In the first case (Newport News I), the court held that DCAA’s statutory subpoena power could not be used to access internal audits not tied to a specific contract or proposal. In the second case, (Newport News II), the court held that DCAA could subpoena company tax returns and other materials, which were directly relevant to an audit and would allow DCAA to corroborate the company’s computation of direct and indirect costs.For additional information on DCAA’s access authorities and the Newport News cases, see appendix IV. All of the companies we reviewed generally followed the Institute’s standards for organizing their internal audit departments. These organizational standards include maintaining independence and objectivity, constructing a risk-based audit plan, employing and maintaining a skilled, professional audit staff, and completing an external assessment. Similarly, based on our examination of internal audit reports and audit documentation (generally referred to as workpapers), we found that the majority of companies followed the standards for performing individual audits. These standards include assessing risks during audit planning, including the risk of fraud, obtaining evidence for findings to include testing and documenting evidence, and following up on audit issues. However, some companies did not provide sufficient information on how they conduct individual audits for us to determine if the standards for performance were met. Figure 1 shows the applicable Institute standards and the number of companies in our review that followed them. Our analysis indicates that five of the seven companies we evaluated generally conformed to five Institute standards for internal audit organizations. The remaining two companies did not provide for an external quality assurance review as required under the Institute’s standards. The five standards are: Independence and objectivity—According to the organizational charts of the seven selected companies, their Vice Presidents of Internal Audit, also called the Chief Audit Executives (CAE), report directly to the Audit Committees of the Board of Directors for matters related to internal audits. For administrative matters such as payroll and office space, the internal audit departments can be linked to the Chief Financial Officer or another department. This organizational feature allows the internal audit activity to be independent of company management, as called for under the Institute’s standards. To further ensure independence and objectivity, most audit executives we met with stated that they encourage an attitude of objectivity in their staff. For example, one CAE said that if staff from other divisions of the company are assigned to the internal audit department, those staff do not audit their former division’s activities to mitigate conflict of interest risks. Risk-based audit plan—All seven companies we reviewed developed audit plans using risk-based assessments consistent with the Institute’s standards. Audit plans are used by companies’ internal audit departments to schedule their audits throughout the year so that the highest risk issues the company is facing are covered. According to the Institute’s standards, internal audit departments should base audit plans on an annual evaluation of multiple risk factors, prioritized to ensure coverage of the highest risk areas. In reviewing how the companies develop their audit plans, we found that they receive input from management and the board of directors and consider a variety of factors such as changes in government regulations, review of high- risk areas identified in previous risk assessments, the potential for financial misstatement, and external factors facing the company. Once the information is compiled, the seven internal audit departments plan specific audits across company businesses and product lines, taking into account the likelihood of the risk materializing and the damage to the company should the risk materialize. Sometimes companies conduct a follow-up audit for high- risk issues highlighted in a previous year. Follow-up audits allow the internal audit department to track high-risk findings to ensure they are corrected. Proficiency—The Institute’s standards require that internal auditors have sufficient expertise. We found that although internal audit departments’ staff varies in number, the staff are comparable in professional qualifications. Six of the company internal audit departments are staffed by company employees, while the seventh company contracts with an accounting firm to conduct its audits. Based on information provided by the companies, we found that the staff from six companies have a wide range of professional credentials including certified public accountants, certified fraud examiners, certified internal auditors, and certified information systems auditors. In addition, more than half of the staff members have advanced degrees, such as a masters of business administration. Table 1 shows the audit staff experience and the average number of auditors with certifications for six companies. For the seventh company that retains an outside accounting firm to perform its internal audits, the audit directors and the staff of the accounting firm combined have a range of professional certifications and advanced degrees comparable to the other companies. Company officials informed us that their practice enhances the audit function’s independence since the audit staff is not employed by the company and ensures the availability of specialists, if needed. Another company in our review previously outsourced its internal audit function but stopped doing so, according to a senior internal audit official, to save money, provide an in-house talent pool, and enhance the connection between the auditors and the company. Continuing professional development—The Institute’s standards require certified internal auditors to complete 80 hours of continuing professional education (CPE) every 2 years to ensure that they maintain and update their knowledge and skills. We found that the companies take a variety of measures to enhance auditors’ knowledge and skills. For example, one company provides 100 hours of annual training, covers the cost of professional certifications, provides financial incentives for their completion, and expects auditors to obtain an additional 100 hours of training on their own. In addition to CPE requirements and professional certifications, officials at three companies stated they have training programs that allow staff from other departments or business units to rotate through the internal audit department for a limited time. External assessments—Institute standards require that internal audit departments must be subjected to external assessments at least once every 5 years. Five of the selected companies have had external quality assurance reviews of their organization and audit performance within the previous 5 years. These assessments review a company’s conformity with the Institute’s standards and provide comments on the performance of the internal audit function. All five companies received the highest possible rating of “generally conforms.” Officials from the other two companies in our review stated that they do not have an external assessment of their internal audit departments. Our analysis found that five of the companies met the standards for individual audits (see figure 1), including engagement planning, conducting fieldwork and testing, reporting findings, and tracking corrective actions. We were unable to completely assess two companies’ compliance with the standards because the companies did not provide the information needed to do so. Specifically, we found that the 470 audit reports provided by six companies and 25 sets of supporting workpapers provided by five companies followed the Institute’s standards. Planning the audit including assessing the risk of fraud—Workpapers we examined from the five companies that provided them contained documents showing planning steps for each objective consistent with the Institute’s standards. Some companies completed an additional step by noting in the workpapers the evidence associated with each planning step. We also found that some workpapers contained assessments of the fraud risks specific to the audit’s scope. For example, one workpaper set we reviewed reported that the audit team met with the legal department about fraud risks and ethics considerations for that particular audit. Another set of workpapers showed that a risk assessment chart was used to identify areas to be included in the audit’s scope along with a rationale for its inclusion. Conducting fieldwork including testing—The Institute’s standards require internal auditors to conduct sufficient analysis and document information to support the audit. The workpapers we reviewed contained extensive documentation of the fieldwork, such as interviews with company officials, and testing, such as comparing company actions to policies and procedures to determine the extent of compliance. The audit reports we reviewed from the six companies showed evidence of substantive testing and provided analysis of the testing showing the level of compliance with company policies, procedures, business systems, and defense contracts. When testing was conducted, it was cited in the reports as support for reportable issues. Some testing relied on judgmental samples, but for certain audits, such as audits of purchase card transactions, all of the transactions were examined. In addition, we traced identified findings through the workpapers to track the testing and the inclusion of the work in the audit planning. By tracing the findings back to their origin in the audit objectives, we verified that the findings reported were supported by sufficient audit work. Reporting findings—The audit reports we reviewed followed the Institute’s standards for reporting results of the audit work by providing reports to upper management and the audited party. The audit reports provided the objectives and scope of the audit work and the findings or issues discovered through the audit work. While the companies do not follow GAGAS standards, the reports, although brief, contained a clear explanation of the findings often citing criteria, condition, cause, and effect as defined in GAGAS. Audit officials at one company stated that they include only those findings they consider to be the most important in their reports because that is what company management has indicated has the most value to them. Officials said that highlighting the most important issues allows them to prioritize their resources and take appropriate actions to correct them. In contrast, some companies include nearly every finding discovered during the audit work. Illustrative of these different approaches, the company that only reports on the highest risk issues routinely had 2 to 4 findings per report, while other companies had multiple reports with more than 10 findings per report. Tracking corrective actions—The Institute’s standards require that the CAE establish a process for the internal audit department to track corrective actions to ensure they have been implemented or that management has accepted the risk of not taking the corrective action. We found that five companies documented the corrective actions they had taken or intended to take to fix the problems identified in the audit reports. Usually, the responsibility and accountability for implementing the corrective actions were assigned to specific individuals and were generally required to be implemented within a certain time period. According to officials at one company, if corrective actions are not taken or completed in a timely manner internal audit management and company management are notified. In addition to findings that require corrective actions, some companies’ audit reports include suggestions for process enhancements for improving operations, comments that are notable business practices, and observed areas of excellence that are exceptional practices that would benefit other business units within the company. The internal audits conducted by the seven selected defense companies cover a broad spectrum of policies, business systems, and programs. The seven companies conducted 1,125 internal audits from January 1, 2008, through December 31, 2009, with 520—slightly less than half—of these audits relevant to the internal control for defense contracts.defense-related internal audit reports fell into one or more of the following categories: All 520 audits examined some aspect of the companies’ overall control environment. 338 audits related to one or more of the six business systems that DOD audits. 97 audits pertained to a specific DOD program and could include reviews of an entire business system, such as the earned value management system, or one component of a business system, such as purchasing. 96 audits were associated with a company’s compliance with federal laws and regulations, or company policies related to its management and oversight of its defense contracts. Of the 338 audits related to the business systems audited by DOD, we found that most concerned some aspect of the company’s accounting system. In addition, the audits reviewed a wide range of subjects, including purchase cards or earned value management systems to determine if they are compliant with FAR and DFARS standards, and internal controls over accounts payable. For example, an audit from one company assessed a division’s purchase card program and found several issues of non-compliance with policies and procedures and identified control weaknesses related to the administration of the purchase card program. Another company’s audit reviewed the general controls, including the accounting system, for a division within a company and found that controls were not operating effectively to ensure consistent classification of accounting transactions. Figure 2 shows the distribution of internal audits among the six business systems. DCAA’s access to and use of internal audit information were generally limited at the companies we reviewed. Company policies on providing DCAA access to such information varied at the seven companies—from allowing full access on a case-by-case basis to denying access. The extent to which DCAA has requested or been denied access to internal audits is difficult to determine because DCAA does not track its requests or denials. Based on information provided to us by the seven companies, we estimate that DCAA requested access to 115 of the 520 audits we identified as being relevant to internal controls and oversight of defense contracting. We identified a number of factors that affect how frequently DCAA auditors request internal audits, including interpretations of prior legal decisions on DCAA’s access and the limited details DCAA receives from the companies about the contents of the internal audit reports. However, GAGAS and DCAA’s audit manual require an evaluation of internal control, which includes internal audits, to provide a basis for efficiently and effectively planning an audit. The seven companies that we reviewed do not have uniform policies about providing DCAA with access to internal audit reports and workpapers. Of the seven companies: Six companies have policies that provide for DCAA access to at least some internal audits reports upon request. Four of the six, however, provide that access on a “view-only” or “read-only” basis, meaning that DCAA auditors may not have physical or electronic copies of the reports but may view them and take notes in the presence of company staff. Company officials explained to us that they adopted this policy because the reports are sensitive and proprietary. One company provides copies only of the sections of the reports and workpapers that company officials consider relevant to DCAA’s work. Of those six, four companies have policies that provide for DCAA access to the supporting workpapers for their internal audits upon request. Again, one company’s policy is to provide only workpapers for the sections of internal audit reports the company deems relevant to DCAA’s work. The other two companies have policies to not provide DCAA with access to supporting workpapers. One company adopted a policy of not providing DCAA with access to its internal audits or workpapers. Each of the six companies that have policies for providing access to their internal audit reports require approval for specific requests for access on a case-by-case basis, and most require that the requested internal audit information directly relate to a DCAA audit of a specific contract or proposal. When companies determined that such a request is not relevant, the companies have denied DCAA’s requests. For example, one company denied DCAA access to two requested audits because company officials determined that the audits were related to commercial or other activities the company believed were not subject to DCAA’s review. Another company official said that the company would not provide DCAA with access to internal audits related to internal controls for information technology due to the potential threat of unauthorized individuals getting access to networks, critical applications, and confidential company or client data. For the company with the policy of not providing DCAA with access to internal audit reports, DCAA has cited the lack of access as preventing it from obtaining an understanding of the company’s internal controls and reported this as a deficiency in the audit of the company’s overall accounting system. DCAA concluded that without access to the company’s internal audit reports, DCAA could not determine if the company’s monitoring function was operating effectively and whether deficiencies were corrected. The company’s response cited the Newport News I decision to support its position that contractors are not required to provide DCAA with access to internal audit reports that are not tied to a specific DCAA audit. While the company provided DCAA with lists of planned audits as requested by DCAA and a summary of the three requested audits, DCAA noted in its 2010 report that this was not enough information to establish that the company’s internal controls were effective. In another instance, DCAA reported a deficiency in another company’s control environment, citing the company’s policy of limiting access to sections of internal audit reports the company deemed relevant to contract oversight and not providing adequate and timely disclosure of audit reports that identified unallowable costs. The company changed its policy and agreed to provide DCAA with access to all audit reports the company determines to include findings related to government costs. However, auditors at one DCAA office who have requested internal audit reports from the company said that the company has not adhered to the revised policy and has continued to deny DCAA access to reports. Another company we reviewed also changed its policy in recent years in response to discussions with DCAA officials or as the result of DCAA reporting the lack of access as contributing to a control environment deficiency. The company previously had a policy of providing DCAA with no access to internal audit reports, citing the Newport News I court case as support for restricting DCAA’s access. After the CAC sent a letter in 2009 challenging this access policy and discussed the access issue with company officials, the company changed its policy to provide DCAA with read-only access to internal audit reports. DCAA audit teams generally do not coordinate their requests for audit reports among their field audit offices, which limits DCAA’s insight into the extent to which audit teams are requesting or are being denied access to internal audit reports. Within DCAA, one of the responsibilities of the CAC assigned to a company is to serve as a contact point for discussions related to access to contractor information, such as internal audit reports. However, we found only one DCAA audit team that has implemented a system in which the CAC serves as a focal point for all internal audit report requests by all the field offices. For the other companies, the corporate and field offices submit requests directly to the company. As a result, the CAC does not necessarily know how frequently or what type of internal audit information field audit offices are requesting. One of these CACs noted that the CAC is informed when DCAA teams are denied access, but otherwise the CAC does not track requests or company responses. In the case of the one company that has multiple locations but does not have a CAC, the DCAA audit team does not coordinate internal audit requests to the company. As a result, the audit team does not know how many requests for internal audit information are made to company, what type of information is being requested, or whether the requests are fulfilled or denied. Although DCAA does not generally track requests or denials for internal audit reports and, therefore, cannot say how many audit reports it asks for or receives, the companies we reviewed maintain such information with varying degrees of specificity. Based primarily on information from these companies, we determined that for the most part, DCAA audit teams request a small number of company internal audits, even though a significant number of internal audits pertain to internal controls and systems that are subject to DCAA audits. The companies provided us with estimates or specific counts of how many internal audits were requested by DCAA since 2008. In most cases, the number of reports requested was significantly fewer than the number of reports we determined were related to DOD contract oversight. The companies estimated that DCAA requested 115 audit reports over the 2-year period while we determined that 520 audit reports were related to some aspect of oversight of DOD contracts. Information on the number of reports requested from each of the companies and the number of reports we determined to be related to oversight of government contracts is summarized in table 2. DCAA auditors we spoke with identified several factors that could affect the number of internal audits they request. Auditors from four DCAA audit teams told us they have difficulty determining which internal audit reports are relevant to their own audit work because descriptions of internal audits they receive from the companies are often too brief to assess the relevancy to ongoing or planned DCAA audits. Our review of the lists of audits provided to DCAA confirmed that five of the companies provide only brief titles of audits, while two provide more detailed summaries that included the purpose, potential risks, and scope. DCAA auditors stated when they request an internal audit report, the company usually requires them to justify their request by linking it to a planned or ongoing DCAA audit of a particular contract or proposal. As a result, DCAA auditors believe they are limited to requesting only those reports related to a specific planned or ongoing DCAA audit, even if the company has other internal audit reports related to another system or program that DCAA is responsible for auditing. Auditors from three DCAA audit teams stated that they did not believe that access to contractor internal audit information is critical to their own audit work and that the internal audit reports do not have enough detail to be helpful. They also stated that they are restricted by auditing standards in relying on the work of others. However, auditing standards do not restrict auditors from relying on the work of other auditors, including internal audit functions. While not reducing the level of work to be performed by DCAA auditors, consideration of relevant internal audit reports in planning related DCAA audits and performing risk assessments can provide useful information for planning DCAA’s scope of work and audit procedures. DCAA has issued significantly fewer audit reports since 2008. The annual number of DCAA audits of the seven companies selected for this review decreased by almost 50 percent from 2008 to 2010. The number of internal control audits DCAA performed on the companies decreased from 128 to 62 in the same period. A DCAA policy official noted that DCAA decreased its number of control environment audits because it was waiting for a regulatory change that would redefine critical business systems for contractors. As a result of this decrease, the number of internal audits necessary to supplement DCAA’s audit work also decreased during this time period. Auditors from the DCAA audit teams we spoke with confirmed that while they request relatively few internal audits, when they are provided access to the audit reports, they use them primarily to help assess the companies’ internal controls and to determine whether companies took corrective action to address reported issues. Other uses of internal audits that DCAA auditors identified included: assessing the risk associated with a given DCAA audit, identifying the amount of testing needed for a given area, and determining whether company audit report findings identify unallowable costs that affect government contracts. DCAA officials have acknowledged that getting access to internal audit information has been an issue with some of the major defense contractors and, at best, they have access on a case-by-case basis. They also acknowledge that they have not used their subpoena authority to get access to internal audits or other company documents since the Newport News decisions were issued in 1988 in part because the Fourth Circuit Court of Appeals held that the language in the statutes did not generally include internal audit reports unrelated to a specific contract or proposal.They also stated that the court’s decisions may have resulted in some DCAA auditors limiting their requests for internal audit information. A DCAA official noted that they have implemented a pilot program with one major defense contractor that could be a model for how the agency disseminates and coordinates internal information. The pilot program consolidates authority and communication among various field offices throughout the country that are responsible for auditing the contractor into one regional audit team. DCAA auditors and company representatives told us that the pilot provided enhanced communications and efficiency between DCAA and the company. While the pilot does not specifically address requests for internal audits, a senior DCAA official suggested that the model could be applied to the process of requesting and distributing company internal audit information as well. The internal audits conducted by the seven companies we reviewed generally were conducted in accordance with recognized professional organizational standards. For individual company audits, the audit reports and workpapers from five companies demonstrate that they likewise adhere to recognized professional standards. The audit reports assess the controls and systems for managing defense contracts that DCAA is charged with auditing and contain information and analysis that DCAA could find useful as it conducts its own work. However, DCAA is not making full use of internal audits to help accomplish its critical oversight role. This is attributable, in part, to company limits on access to internal audit information based on their interpretations of DCAA’s access authority and related court cases. While the courts have held that DCAA does not have unlimited power to demand access to all internal company materials, the courts have also made it clear that DCAA may demand access to materials that are relevant to carrying out its audit responsibilities. There are other issues that also account for DCAA’s limited use of internal audit reports. Specifically, DCAA auditors do not routinely request access to the reports due to limited visibility into the scope and objectives of internal audits and uncertainty as to how relevant internal audits can be used. DCAA management lacks insight into the limited access and use of internal audits because DCAA does not centrally track requests and denials for access to documents that could improve its ability to carry out its mission. When companies do not provide DCAA with access to internal audits or DCAA auditors do not request them, DCAA auditors do not have information that may be relevant for audit planning and risk assessment. Conversely, greater access to internal audit information could improve DCAA’s efficiency. DCAA auditors could either conduct a full audit of all components of internal control, or in instances in which internal auditors have conducted related work, DCAA auditors could examine the audit reports and workpapers, if needed, and adjust their planning accordingly. Moreover, we believe that by not routinely obtaining access to relevant company internal audits that can inform their audits of the companies’ control environments, as well as audits of specific business systems and contracts, DCAA auditors are hindered in their ability to meet the GAGAS requirement for assessing internal controls. The work of the internal auditors by no means replaces the work of DCAA auditors, but it could provide DCAA auditors with a basis for making a judgment about a company’s internal controls and help inform their audit planning, thereby making more effective and efficient use of DCAA audits. To increase DCAA’s access to and use of internal audits, we recommend that the Secretary of Defense direct that the Director of DCAA take the following three actions: Ensure that DCAA’s central point of contact for each company coordinates issues pertaining to internal audits. For some companies, this would be the Contract Audit Coordinator. For companies without a Contract Audit Coordinator, a point of contact would need to be designated except when DCAA officials have determined that a company does not have an internal audit function that produces reports that may be relevant to DCAA’s audit responsibilities. Coordination responsibilities should include obtaining sufficient information from the companies on their internal audit reports so DCAA auditors can better identify and request relevant audit reports and workpapers and tracking DCAA auditors’ requests for access to internal audit reports and workpapers and the companies’ disposition of those requests. Periodically assess information compiled by the central points of contact regarding the number of requests for internal audits and their disposition to determine whether additional actions are needed. Such additional actions could include senior level engagement with company officials to change company access policies or, as warranted, the issuance of subpoenas. Reaffirm with DCAA staff through guidance and training how and under what circumstances company internal audit reports can be accessed and used to improve the efficiency of audit planning and execution. We requested comments on a draft of this report from DOD. In its written comments, reproduced in appendix II, DOD concurred with two of the recommendations and partially concurred with the recommendation regarding DCAA central points of contact for issues pertaining to internal audits. In its partial concurrence, DOD explained that DCAA would implement the recommendation to establish central points of contact for larger companies to attempt to obtain internal audit information from them and establish processes for tracking auditor’s requests for internal audit reports and workpapers. DOD stated, however, that doing so for smaller companies may not be feasible or beneficial, as some smaller contractors may not have sophisticated internal audit functions. DOD further expressed skepticism that implementing the recommended actions alone would fully ensure that DCAA would have complete and full access to contractor internal audits, citing the limits that companies have placed on DCAA’s access to internal audits and prior legal precedence. We agree that for companies without internal audit functions that produce reports that may be relevant to DCAA’s audit responsibilities, designated coordinators would not be necessary. We, therefore, revised our original recommendation to provide for such an exception. We agree that implementing these recommendations alone may not be sufficient to provide DCAA with full and complete access to internal audit reports in all instances. However, implementation of the recommendations is a necessary step for DCAA to obtain the information needed to determine the extent to which DCAA is or is not getting access and how that is affecting DCAA’s ability to fulfill efficiently its oversight responsibilities. After taking such steps, DOD may be in a better position to identify and pursue other remedies for ensuring DCAA’s access to internal audit reports. We also provided a draft of the report to the Chief Audit Executives of the seven selected companies for their review and comment. In its written comments on the draft, which are reproduced in appendix III, Lockheed Martin Corporation expressed support for providing DCAA with internal audit reports to the extent they can be used by DCAA to satisfy internal control reviews. Lockheed Martin also noted, with regard to the recommendation for DCAA central points of contact, that all DCAA audit requests are already centrally coordinated through the DCAA CAC, which has allowed the company to be responsive to DCAA request for internal audit reports. The other six companies declined to provide official comments, but two provided technical comments, which we incorporated into the final report as appropriate. We are sending copies of this report to the Secretary of Defense, the Director of the Defense Contract Audit Agency, the Director of the Office of Management and Budget, appropriate congressional committees, and other interested parties. We will make this report available to the public at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-4841 or at woodsw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix V. In response to a congressional request to assess the role of defense companies’ internal audit departments and their ability to provide the Defense Contract Audit Agency (DCAA) with information on their control environments, business systems, and policies affecting government contracts, we examined (1) the adherence of selected major defense companies to internal auditing standards for organizations and individual audits, (2) the extent to which the internal audit reports of those companies address internal controls for the management of defense contracts and associated business systems, and (3) DCAA’s ability to examine and use those reports in carrying out its oversight responsibilities. Our review focused on seven selected major defense companies. For purposes of our review we defined a major defense company as having at least $500 million in contracts with the Department of Defense (DOD) and at least $100 million in cost reimbursable contracts. The companies we selected had at least $1 billion in DOD contracts and derived at least 25 percent of their revenue from DOD contracts in fiscal year 2009. We selected the top five major defense companies based on fiscal year 2009 DOD contract obligations—The Boeing Company, Lockheed Martin Corporation, Raytheon Company, Northrop Grumman Corporation, and General Dynamics Corporation. We then judgmentally selected URS Corporation and KBR, Incorporated to obtain insights on how smaller major defense companies carry out their internal audit functions. Collectively these seven companies represent about $106.7 billion (57 percent) of the value of all contracts awarded by DOD to all major defense companies in fiscal year 2009. The results of our review cannot be generalized across major defense companies; instead, they provide insights into how companies have organized their internal audit function, conduct audits, and interact with DCAA. To provide a framework for our assessment of the seven companies’ internal audit organization and engagement performance, we interviewed officials with the Institute of Internal Auditors and reviewed standards promulgated by the Institute for characteristics used in their peer review assessment of internal audit organizations as well as the standards for engagement performance. We also interviewed officials and reviewed documentation pertaining to the Institute’s Certified Internal Auditor examination and its training programs and conferences available to the auditing profession. To develop information on companies’ organizational characteristics, we reviewed documents related to the organization and reporting structure of companies’ internal audit departments. We conducted an initial interview and obtained documents from officials from all seven companies to determine the internal audit department’s organizational standards, including its reporting structure, qualifications of staff, and whether the company participated in a peer review of its organization and engagement performance. We compared company policies, standards, and practices to standards set by the Institute regarding the organization and activities of company internal audit departments and to the standards for engagements. Our work in examining the audit reports was conducted in two phases. First, we requested a list of all audit reports completed by the companies from January 1, 2008, through December 31, 2009—the latest audits completed when we began our assessment. We asked that the lists contain the titles, objectives, and scope of the audits. In total, the seven companies provided information on 1,125 audits. Second, we analyzed the information provided on the 1,125 audits and identified reports that pertained to the oversight of government contracts. We categorized the report as defense-related if the audit report’s scope and objectives identified one or more of the following aspects of company operations that are related to execution of government contracts: The audit’s scope and objectives included review of some aspect of the overall internal control system. The audit’s scope and objectives included review of one of the six business systems DOD is charged with reviewing—accounting system, earned value management system, estimating system, purchasing system, material management and accounting system, and property management system. The audit’s scope and objectives covered one or more DOD programs. The audit’s scope and objectives covered some aspect of the Federal Acquisition Regulation (FAR), Defense Federal Acquisition Regulation Supplement (DFARS), or company policies related to defense contract oversight. In total, we identified 520 audit reports as defense-related and requested those reports from the companies. We also selected a nongeneralizable random sample of five sets of workpapers from each company’s audit reports in order to assess how individual audits adhere to the Institute’s standards for conducting audits. The companies provided us with 470 audit reports and 25 sets of workpapers. Lockheed Martin Corporation, Northrop Grumman Corporation, The Boeing Company, Raytheon Company, and URS Corporation provided us with both audit reports and workpapers for review. General Dynamics Corporation provided only audit reports for review. KBR, Incorporated did not provide audit reports or workpapers for our review. When companies did not provide us with requested audit reports or workpapers, we obtained the rationale for not providing the materials from company officials for documenting purposes. These rationales included the limitations on access to company internal documents discussed in two court cases and ownership of the workpapers by a third party. We do not regard the company decisions as a limitation of our scope since we examined the vast majority of the documents we requested and were fully able to address our audit objectives. To assess how internal auditors applied the standards in conducting their audits, we reviewed 470 audit reports and 25 sets of workpapers. For the audit reports we determined the issues raised by the auditors, distribution of audit findings as well as evidence in the reports of testing conducted and follow-up of corrective actions. For our examination of the workpapers, we looked for evidence of planning for the engagement, risk assessments to include the risk of fraud, testing of company policies and procedures to determine if they are being followed, and whether the work performed supported the findings. For the workpaper reviews, we traced a finding from the conclusion back through the evidentiary materials including testing to the planning and risk evaluation to ascertain whether the finding was supported by the audit evidence and planning. To determine whether the audit finding was followed until it was corrected, we examined documentation in the audit workpapers to identify the person responsible for taking the action, what action was taken, and the date corrective action was completed. To assess DCAA’s access and use of company internal audits, we reviewed DCAA’s audit manual and its audit programs for control environment audits as well as for audits of business systems and incurred costs. We interviewed DCAA officials responsible for audit policy. At the seven companies we selected, we also interviewed the DCAA audit staff to determine their experience in examining internal audit reports. We obtained DCAA documents requesting audit reports and copies of material provided by the companies in response to requests. We discussed actions taken by DCAA to gain material requested and reviewed reports of internal control deficiencies citing a lack of access to company audit reports. We interviewed staff to review their rationale for requesting company audit reports as well as the materiality of those reports to DCAA’s work. We reviewed sections 2313 and 2306a of title 10 of the United States Code concerning DCAA access to records and FAR and DFARS provisions governing DCAA’s responsibilities. We also reviewed two key court decisions regarding DCAA’s ability to enforce a subpoena for company records including internal audits. We conducted this performance audit from September 2010 through December 2011 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The Defense Contract Audit Agency’s (DCAA) authority to access and audit contractor records in support of Department of Defense (DOD) contracting and contract payment functions is described in sections 2313 and 2306a of title 10 of the United States Code (U.S. Code) and in the Federal Acquisition Regulation (FAR). Section 2313 of title 10 of the U.S. Code gives the head of an agency, acting through DCAA as its authorized representative, the authority to inspect the plant and audit the records of a contractor performing a cost-reimbursement, incentive, time and materials, labor hour, or price redeterminable contract for agency. Records are defined as including both documents and data (among other things) whether written or in electronic form. The statute also provides that records may be subpoenaed if not provided by the contractor. Section 2313(i) of title 10 of the U.S. Code defines records to include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of whether such items are in written form, in the form of computer data, or in any other form. Section 2306a of title 10 of the U.S. Code gives the head of an agency, acting through the contracting officer, the authority to require offerors, contractors, and subcontractors to make available cost or pricing data to the government. It also provides the head of an agency, acting through the contracting officer and DCAA, with the authority to review the records provided by the offerors, contractors, and subcontractors for the purpose of evaluating its accuracy, completeness, and currency. The FAR describes the auditor’s contract audit responsibilities such as submitting information and advice to the requesting activity based on the auditor’s analysis of contractor’s financial and accounting records or other related data as to the acceptability of the contractor’s incurred and estimated costs. In addition, the auditor is responsible for reviewing the financial and accounting aspects of contractor cost control systems and performing other analyses and reviews that require access to contractor financial and accounting records supporting proposed and incurred costs. The FAR also provides specific language regarding DCAA role as the responsible government audit agency. DCAA’s use of its access authority has been addressed in at least two court decisions, generally known as Newport News I and Newport News II, both decided in 1988. In both cases, DCAA sought to enforce subpoenas for access to internal documents of Newport News Shipbuilding and Dry Dock Company. In the first case (Newport News I), Newport News challenged the scope of DCAA’s subpoena power as it related to Newport News’ internal audits. The court held that the statutory subpoena power of DCAA extends to cost information related to government contracts but that DCAA does not have unlimited power to demand access to all internal corporate materials of companies performing cost type contracts for the government. Because the materials sought by DCAA were not within the scope of its statutory authority, the court affirmed the district court’s order denying enforcement of the subpoena. In the second case (Newport News II), DCAA subpoenaed the company’s tax returns, financial statements, and supporting schedules.decided to uphold enforcement of the subpoena, concluding that the requested material was relevant to an audit and provided evidence of the consistency of costing methods and the reconciliation of costs claimed for tax purposes. Further, the court decided that access to the documents would allow DCAA to corroborate the company’s computation of direct and indirect costs. The court contrasted the two cases, stating that the subpoena at issue in the first case did not extend to internal audits, which contain the subjective assessments of Newport News’ internal audit staff. In the second case, DCAA requested production of objective financial and cost data and summaries, not the subjective work product of Newport News’ internal auditors. To the extent that the materials subpoenaed would assist DCAA in verifying and evaluating the cost claims of the contractor, the court determined they were within DCAA’s statutory subpoena authority. Principal contributors to this report were Johana R. Ayers, Assistant Director; James Ashley; Lisa M. Brownson; John W. Crawford; Gayle L. Fischer; Laura S. Greifner; Carolyn R. Kirby; John Krump; Jean L. McSween; Carol T. Mebane; John Needham; Matthew M. Shaffer; Robert A. Sharpe; and Roxanna T. Sun.

Summary: The Defense Contract Audit Agency (DCAA) has a critical role in contract oversight. DCAA audits are intended to help provide reasonable assurance that defense company policies for safeguarding assets and complying with contractual requirements are fulfilled. Defense companies also maintain their own internal audit departments to monitor policies, procedures, and business systems related to their government contracts. GAO was asked to assess the role of defense companies' internal audit departments and their ability to provide DCAA with information on their internal controls. GAO assessed (1) selected defense companies' adherence to standards for internal audits, (2) the extent to which those companies' internal audit reports address defense contract management internal controls, and (3) DCAA's ability to examine internal audits and use information from these audits. GAO reviewed a nongeneralizable sample of seven major defense companies including the five largest defense contractors and two smaller contractors; analyzed information on their 2008 and 2009 internal audits, which were the latest available when GAO began its assessment; and reviewed DCAA's ability to examine and use the audits in carrying out its oversight. The seven internal audit departments GAO reviewed generally adhered to Institute of Internal Auditors standards for organizing their internal audit departments. These standards include maintaining independence and having a proficient workforce. For example, all seven companies are organized so that the internal audit department is independent of company management. For performing individual audits, the majority of the companies followed the standards in areas such as planning the audit work and obtaining evidence. In its examination of evidentiary workpapers, GAO found documentation of the internal auditors' testing to show the level of compliance with company policies. The selected companies' internal audit reports cover a broad spectrum of policies, business systems, and programs that are relevant to DCAA audits. Each company performs audits with scope and objectives specific to that company and its individual businesses, such as audits about defense programs or audits that review a company's accounting system. In addition, some audits are common across companies, such as reviews of purchase card transactions or controls over information technology. In 2008 and 2009, the seven companies conducted 1,125 internal audits. GAO determined that of these, 520 were related to the defense contract control environment and one or more areas reviewed by DCAA, such as overall internal control functions and specific business systems. DCAA's access to and use of internal audit information from reports and workpapers is limited, in part, because of company interpretations of court decisions concerning DCAA's access to documents. Consequently, the seven companies GAO reviewed have developed differing policies and procedures for providing internal audit information to DCAA but ultimately provide DCAA access to internal audit reports and workpapers on a case-by-case basis. (1) Six of the companies have policies that provide for DCAA access to at least some internal audits reports upon request. Of the six, four have policies for providing access to supporting workpapers for their internal audits upon request. The other two companies have policies of not providing DCAA with access to supporting workpapers. (2) One company has a policy of not providing DCAA with access to internal audits or workpapers. DCAA's use of its access authority has been addressed in two court decisions. The courts held that DCAA does not have unlimited power to demand access to all internal company materials, but they also held that DCAA may demand access to materials relevant to its audit responsibilities. However, DCAA does not generally track its requests or denials for internal audit reports. GAO found that the number of DCAA requests for internal audit reports is small relative to the number of internal audits GAO identified as relevant to defense contract oversight. In explaining why few reports are requested, DCAA auditors noted obstacles such as not being able to identify internal audits relevant to their work and uncertainty as to how useful those reports could be. By not routinely obtaining access to relevant company internal audits, DCAA auditors are hindered in their ability to effectively plan work and meet auditing standards for evaluating internal controls. GAO recommends that DCAA take steps to facilitate access to internal audits and assess periodically whether other actions are needed. DOD generally agreed to implement GAO's recommendations but expressed skepticism that this alone would fully ensure access to internal audits.