For purposes of this report, we define the Control environment—positive and supportive attitude toward internal controls, conscientious management, and ethics standards. Risk assessment—identification and assessment of risks from internal and external sources and establishment of controls to mitigate them. Control activities—policies, procedures, techniques, and mechanisms that ensure management’s directives to mitigate risk are carried out. Information and communication systems—assurance that information is recorded and communicated to management and others in a form and within a time frame that enables them to carry out internal controls and operational responsibilities. Monitoring—activities that assess the quality of performance over time and ensure that audit and review findings are promptly resolved. As part of their overall governance and control, many companies establish internal audit departments to monitor adherence to management policies and controls, report exceptions to policies and procedures, and track corrective actions. One of the principal authorities on the standards and practices of internal auditing is the Institute of Internal Auditors (the Institute). The Institute is a non-profit professional organization that provides guidance on assessing, maintaining, and improving the quality of internal auditing within the profession. Importantly, the Institute provides guidance for the profession through its International Standards for the Professional Practice of Internal Auditing. These standards include requirements at the organizational level such as independence and objectivity, as well as for conducting audits, including planning, performing fieldwork, communicating results, and following up on corrective actions. The Institute also conducts training and administers the Certified Internal Auditor (CIA) testing and certification program. The CIA certification is acknowledged by auditing professionals as a standard by which individuals demonstrate their competence in internal auditing. In addition to a company’s own internal audit department, companies that provide goods and services to DOD may be audited by DCAA. As required by the Federal Acquisition Regulation (FAR) and the Defense Federal Acquisition Regulation Supplement (DFARS), DCAA’s audits examine internal controls, incurred costs, and business systems used in the execution of government contracts. DCAA’s contract audit services are intended to be a key control that helps ensure that prices paid by the government are fair and reasonable and that companies are charging the government in accordance with applicable laws, regulations, cost accounting standards, and contract terms. At the completion of an audit, DCAA provides the contracting officer with a report to assist in negotiations or in assessing contract costs, as well as in determining compliance with regulations and contractual requirements. DCAA, which employs approximately 4,000 auditors, consists of a headquarters office at Ft. Belvoir, Virginia and six major organizational components—five regional offices across the United States that direct and administer audits for assigned geographical areas and a field detachment office that audits classified contracting activity. The five regional offices manage about 300 field audit offices. Field audit offices can be categorized as branch offices, resident offices, or suboffices. Branch offices are located within each region and have responsibility for all contract audit services within the assigned geographical area. Resident offices are established at company locations where the audit workload justifies assignment of a permanent staff of auditors. Suboffices are established by regional directors as extensions of branch or resident offices when required to furnish audit services. A suboffice depends on its parent field office for release of reports. For larger companies with operations at multiple locations, DCAA assigns a Contract Audit Coordinator (CAC) who serves as a central point of communication between DCAA auditors and company representatives. DCAA audits are governed by generally accepted government auditing standards (GAGAS). These standards require evaluation and testing of the overall internal controls including the work of the contractor’s internal audit activity, specific controls, and business systems. These standards and associated principles govern the audit planning and evidence required to conduct a GAGAS-compliant audit. DCAA’s procedures for adhering to GAGAS in conducting different types of audits, such as audits of internal controls or company business systems, are contained in its Contract Audit Manual (CAM). According to the CAM, DCAA is required periodically to examine the contractor’s internal controls, as well as contractor policies and procedures. It also states that in the process of planning an audit, auditors should consider the company’s self governance programs when assessing the adequacy of the internal controls to determine the scope of their audit. Further, the CAM states that audits of individual business systems are to include an evaluation of the internal control activities applicable to that system.guidance for audit procedures states that auditors should consider a company’s internal audit activities to determine the adequacy of its internal controls when performing an audit of the company’s control environment and accounting system. Lastly, DCAA To conduct its audits, DCAA relies on the examination of contractor financial, accounting, and other data. DCAA’s authority to access and audit contractor records in support of DOD contracting and contract payment functions is described in sections 2313 and 2306a of title 10 of the United States Code (U.S.C.) and in the FAR. DCAA’s use of its authority has been addressed in two court decisions involving Newport News Shipbuilding and Dry Dock Company. The decisions are generally known as Newport News I and Newport News II, both decided in 1988. In the first case (Newport News I), the court held that DCAA’s statutory subpoena power could not be used to access internal audits not tied to a specific contract or proposal. In the second case, (Newport News II), the court held that DCAA could subpoena company tax returns and other materials, which were directly relevant to an audit and would allow DCAA to corroborate the company’s computation of direct and indirect costs.For additional information on DCAA’s access authorities and the Newport News cases, see appendix IV. All of the companies we reviewed generally followed the Institute’s standards for organizing their internal audit departments. These organizational standards include maintaining independence and objectivity, constructing a risk-based audit plan, employing and maintaining a skilled, professional audit staff, and completing an external assessment. Similarly, based on our examination of internal audit reports and audit documentation (generally referred to as workpapers), we found that the majority of companies followed the standards for performing individual audits. These standards include assessing risks during audit planning, including the risk of fraud, obtaining evidence for findings to include testing and documenting evidence, and following up on audit issues. However, some companies did not provide sufficient information on how they conduct individual audits for us to determine if the standards for performance were met. Figure 1 shows the applicable Institute standards and the number of companies in our review that followed them. Our analysis indicates that five of the seven companies we evaluated generally conformed to five Institute standards for internal audit organizations. The remaining two companies did not provide for an external quality assurance review as required under the Institute’s standards. The five standards are: Independence and objectivity—According to the organizational charts of the seven selected companies, their Vice Presidents of Internal Audit, also called the Chief Audit Executives (CAE), report directly to the Audit Committees of the Board of Directors for matters related to internal audits. For administrative matters such as payroll and office space, the internal audit departments can be linked to the Chief Financial Officer or another department. This organizational feature allows the internal audit activity to be independent of company management, as called for under the Institute’s standards. To further ensure independence and objectivity, most audit executives we met with stated that they encourage an attitude of objectivity in their staff. For example, one CAE said that if staff from other divisions of the company are assigned to the internal audit department, those staff do not audit their former division’s activities to mitigate conflict of interest risks. Risk-based audit plan—All seven companies we reviewed developed audit plans using risk-based assessments consistent with the Institute’s standards. Audit plans are used by companies’ internal audit departments to schedule their audits throughout the year so that the highest risk issues the company is facing are covered. According to the Institute’s standards, internal audit departments should base audit plans on an annual evaluation of multiple risk factors, prioritized to ensure coverage of the highest risk areas. In reviewing how the companies develop their audit plans, we found that they receive input from management and the board of directors and consider a variety of factors such as changes in government regulations, review of high- risk areas identified in previous risk assessments, the potential for financial misstatement, and external factors facing the company. Once the information is compiled, the seven internal audit departments plan specific audits across company businesses and product lines, taking into account the likelihood of the risk materializing and the damage to the company should the risk materialize. Sometimes companies conduct a follow-up audit for high- risk issues highlighted in a previous year. Follow-up audits allow the internal audit department to track high-risk findings to ensure they are corrected. Proficiency—The Institute’s standards require that internal auditors have sufficient expertise. We found that although internal audit departments’ staff varies in number, the staff are comparable in professional qualifications. Six of the company internal audit departments are staffed by company employees, while the seventh company contracts with an accounting firm to conduct its audits. Based on information provided by the companies, we found that the staff from six companies have a wide range of professional credentials including certified public accountants, certified fraud examiners, certified internal auditors, and certified information systems auditors. In addition, more than half of the staff members have advanced degrees, such as a masters of business administration. Table 1 shows the audit staff experience and the average number of auditors with certifications for six companies. For the seventh company that retains an outside accounting firm to perform its internal audits, the audit directors and the staff of the accounting firm combined have a range of professional certifications and advanced degrees comparable to the other companies.