In addition to a company’s own internal audit department, companies that  provide goods and services to the Department of Defense may be audited  by DCAA. Required Documentation Is Incomplete for Selected Cases

None of the eight requests for company internal audit reports we selected  in a random, nongeneralizable sample contained all documentation  required by the NDAA provisions and DCAA’s guidance. Guidance Revisions Define Physical Safeguards for Internal Audit Reports, but Not for Unauthorized Use

In accordance with section 832 of the NDAA for Fiscal Year 2013, DCAA  revised its contract audit guidance to include language on safeguarding  companies’ internal audit reports noting that the act states that the  safeguards should prevent the agency from using the reports for  purposes other than evaluating and testing (1) the efficacy of internal  controls and (2) the reliability of business systems. The  revised guidance, for example, outlines physical safeguards such as  identifying and protecting companies’ proprietary information as well as  assigning responsibility for safeguarding companies’ information. Although DCAA’s revisions acknowledge responsibility to  provide physical safeguards, the guidance does not provide examples of  authorized use or describe or define unauthorized use. Second, DCAA officials also said they are exploring an electronic storage  system to maintain copies of companies’ internal audit reports and related  documentation, if provided. However, the  revisions to the Contract Audit Manual alone are not sufficient to assure  that sharing companies’ internal audit reports is necessary to DCAA’s  work and that DCAA will use the reports only in order to evaluate  business systems or to assess risk associated with a particular audit. Recommendations for Executive Action

To help improve the process for requesting company internal audit  reports, we recommend the Secretary of Defense direct the Director,  DCAA, to take the following two actions:  1.  clarify the guidance in the Contract Audit Manual to  further define, with examples, the specific details that should be in  the requests for company internal audits including how such  internal audits are specifically tied to DCAA’s work and provide a definition of authorized use and examples of such use;  2.  establish and monitor internal controls for a reporting cut-off date,   identifying major contractors, and ensuring information has been  reviewed for completeness and accuracy. Appendix I: Scope and Methodology

Section 832 of the National Defense Authorization Act (NDAA) for Fiscal  Year 2013 required that the Comptroller General review the  documentation applicable to the act’s requirement that the Defense  Contract Audit Agency (DCAA) revise its audit guidance to include  directions for appropriate documentation of its requests to contractors for  their internal audit reports. We assessed (1) the extent to which DCAA’s revised guidance  complied with the act and whether selected requests for company internal  audit reports were documented in accordance with the requirements, and  (2) the extent to which DCAA’s revised guidance contains safeguards to  help ensure that internal audit reports obtained from companies are used  only for authorized purposes. To address our objectives, we compared the provisions of the act to the  revised audit guidance to determine whether the revisions included  directions for documenting requests for company internal audits, the  connections to DCAA’s work and the company’s responses and  safeguards for the internal audits.
Why GAO Did This Study

DCAA audits play a critical role in oversight of companies that provide goods and services to the Department of Defense. These defense companies also conduct their own internal audits. Section 832 of the NDAA for Fiscal Year 2013 (Pub. L. No.112-239) required DCAA, among other things, to revise its audit guidance on documenting its requests for defense contractors' internal audit reports and ensuring the reports are used only for evaluating and testing the strength of internal audit controls.
The act required GAO to assess the revised guidance. This report assesses the extent to which DCAA's revised guidance (1) complied with the act, and whether selected requests for company internal audit reports were documented in accordance with requirements, and (2) contains safeguards to help ensure that companies' internal audit reports are used only for authorized purposes. GAO compared DCAA's revised guidance to the provisions of the act and examined a nongeneralizable, random sample of eight recent DCAA requests for companies' internal audits.

What GAO Found

The Defense Contract Audit Agency (DCAA) revised its guidance in the Contract Audit Manual to address the documentation requirements mandated by section 832 of the National Defense Authorization Act (NDAA) for Fiscal Year 2013, but implementation has been inconsistent. The revisions include provisions for DCAA auditors to document (1) that access to company internal audit reports is necessary to an ongoing DCAA audit, (2) the request sent to the company, and (3) the company's response. However, based on GAO's review of selected cases, implementing the changes has been inconsistent across the agency. GAO randomly selected eight requests for companies' internal audits and compared them to the mandated requirements and DCAA instructions provided to its auditors as criteria to test whether or not the three documentation requirements had been properly recorded. None of eight cases sampled had complete records for the three required documents. The figure below shows the results of GAO's examination of the eight requests.
DCAA's revised guidance is specific about physical safeguards for companies' internal audit information. For example, the Contract Audit Manual contains extensive guidance for physically securing proprietary information and specifies that the working papers should not include a copy of the companies' internal audit reports. However, the guidance is less specific about safeguards to prevent unauthorized use of internal audit reports; that is, using the reports for purposes other than evaluating the efficacy of internal controls or the reliability of the business systems. In particular, the guidance does not define authorized use, provide examples of authorized use, or identify a specific approach for implementing safeguards. Officials stated that plans for an electronic storage system for safeguarding companies' internal audits from unauthorized use are in process as well as guidance for using them. The planned electronic storage capability would provide limited access rights to companies' internal audit reports and thus help ensure better tracking and limit the potential for unauthorized use.

What GAO Recommends

GAO recommends that DCAA clarify its guidance and establish and monitor internal controls to help ensure that requests for company internal audits are fully documented in accordance with the act, and that the guidance defines authorized use. DCAA concurred with GAO's recommendations.