DCAA’s use of its  authority has been addressed in two court decisions involving Newport  News Shipbuilding and Dry Dock Company. Internal Audit Departments We Reviewed Generally Adhered to Institute Standards

All of the companies we reviewed generally followed the Institute’s  standards for organizing their internal audit departments. These  organizational standards include maintaining independence and  objectivity, constructing a risk-based audit plan, employing and  maintaining a skilled, professional audit staff, and completing an external  assessment. Similarly, based on our examination of internal audit reports  and audit documentation (generally referred to as workpapers), we found  that the majority of companies followed the standards for performing  individual audits. Internal Audit Reports Contain Information Relevant to DCAA Audits

The internal audits conducted by the seven selected defense companies  cover a broad spectrum of policies, business systems, and programs. The  seven companies conducted 1,125 internal audits from January 1, 2008,  through December 31, 2009, with 520—slightly less than half—of these  audits relevant to the internal control for defense contracts.defense-related internal audit reports fell into one or more of the following  categories:
All 520 audits examined some aspect of the companies’ overall  control environment. DCAA’s Access to and Use of Company Internal Audits Are Limited

DCAA’s access to and use of internal audit information were generally  limited at the companies we reviewed. The  extent to which DCAA has requested or been denied access to internal  audits is difficult to determine because DCAA does not track its requests  or denials. DCAA Obtains Limited Access to Internal Audit Reports and Workpapers

The seven companies that we reviewed do not have uniform policies  about providing DCAA with access to internal audit reports and  workpapers. Of the seven companies:
Six companies have policies that provide for DCAA access to at least  some internal audits reports upon request. Of those six, four companies have policies that provide for DCAA  access to the supporting workpapers for their internal audits upon  request. The other two companies have policies to not  provide DCAA with access to supporting workpapers. One company adopted a policy of not providing DCAA with access to  its internal audits or workpapers. Each of the six companies that have policies for providing access to their  internal audit reports require approval for specific requests for access on  a case-by-case basis, and most require that the requested internal audit  information directly relate to a DCAA audit of a specific contract or  proposal. For the company with the policy of not providing DCAA with access to  internal audit reports, DCAA has cited the lack of access as preventing it  from obtaining an understanding of the company’s internal controls and  reported this as a deficiency in the audit of the company’s overall  accounting system. In most cases, the number of reports  requested was significantly fewer than the number of reports we  determined were related to DOD contract oversight. They  also acknowledge that they have not used their subpoena authority to get  access to internal audits or other company documents since the Newport  News decisions were issued in 1988 in part because the Fourth Circuit  Court of Appeals held that the language in the statutes did not generally  include internal audit reports unrelated to a specific contract or proposal.They also stated that the court’s decisions may have resulted in some  DCAA auditors limiting their requests for internal audit information. However, DCAA is not  making full use of internal audits to help accomplish its critical oversight  role. While the courts have held that DCAA  does not have unlimited power to demand access to all internal company  materials, the courts have also made it clear that DCAA may demand  access to materials that are relevant to carrying out its audit  responsibilities. Moreover, we believe that by not routinely obtaining access to relevant  company internal audits that can inform their audits of the companies’  control environments, as well as audits of specific business systems and  contracts, DCAA auditors are hindered in their ability to meet the GAGAS  requirement for assessing internal controls. Key contributors to this report are listed in  appendix V.

Appendix I: Scope and Methodology

In response to a congressional request to assess the role of defense  companies’ internal audit departments and their ability to provide the  Defense Contract Audit Agency (DCAA) with information on their control  environments, business systems, and policies affecting government  contracts, we examined (1) the adherence of selected major defense  companies to internal auditing standards for organizations and individual  audits, (2) the extent to which the internal audit reports of those  companies address internal controls for the management of defense  contracts and associated business systems, and (3) DCAA’s ability to  examine and use those reports in carrying out its oversight  responsibilities.
Why GAO Did This Study

The Defense Contract Audit Agency (DCAA) has a critical role in contract oversight. DCAA audits are intended to help provide reasonable assurance that defense company policies for safeguarding assets and complying with contractual requirements are fulfilled. Defense companies also maintain their own internal audit departments to monitor policies, procedures, and business systems related to their government contracts. GAO was asked to assess the role of defense companies' internal audit departments and their ability to provide DCAA with information on their internal controls. GAO assessed (1) selected defense companies' adherence to standards for internal audits, (2) the extent to which those companies' internal audit reports address defense contract management internal controls, and (3) DCAA's ability to examine internal audits and use information from these audits. GAO reviewed a nongeneralizable sample of seven major defense companies including the five largest defense contractors and two smaller contractors; analyzed information on their 2008 and 2009 internal audits, which were the latest available when GAO began its assessment; and reviewed DCAA's ability to examine and use the audits in carrying out its oversight.

What GAO Found

The seven internal audit departments GAO reviewed generally adhered to Institute of Internal Auditors standards for organizing their internal audit departments. These standards include maintaining independence and having a proficient workforce. For example, all seven companies are organized so that the internal audit department is independent of company management. For performing individual audits, the majority of the companies followed the standards in areas such as planning the audit work and obtaining evidence. In its examination of evidentiary workpapers, GAO found documentation of the internal auditors' testing to show the level of compliance with company policies. The selected companies' internal audit reports cover a broad spectrum of policies, business systems, and programs that are relevant to DCAA audits. Each company performs audits with scope and objectives specific to that company and its individual businesses, such as audits about defense programs or audits that review a company's accounting system. In addition, some audits are common across companies, such as reviews of purchase card transactions or controls over information technology. In 2008 and 2009, the seven companies conducted 1,125 internal audits. GAO determined that of these, 520 were related to the defense contract control environment and one or more areas reviewed by DCAA, such as overall internal control functions and specific business systems. DCAA's access to and use of internal audit information from reports and workpapers is limited, in part, because of company interpretations of court decisions concerning DCAA's access to documents. Consequently, the seven companies GAO reviewed have developed differing policies and procedures for providing internal audit information to DCAA but ultimately provide DCAA access to internal audit reports and workpapers on a case-by-case basis. (1) Six of the companies have policies that provide for DCAA access to at least some internal audits reports upon request. Of the six, four have policies for providing access to supporting workpapers for their internal audits upon request. The other two companies have policies of not providing DCAA with access to supporting workpapers. (2) One company has a policy of not providing DCAA with access to internal audits or workpapers. DCAA's use of its access authority has been addressed in two court decisions. The courts held that DCAA does not have unlimited power to demand access to all internal company materials, but they also held that DCAA may demand access to materials relevant to its audit responsibilities. However, DCAA does not generally track its requests or denials for internal audit reports. GAO found that the number of DCAA requests for internal audit reports is small relative to the number of internal audits GAO identified as relevant to defense contract oversight. In explaining why few reports are requested, DCAA auditors noted obstacles such as not being able to identify internal audits relevant to their work and uncertainty as to how useful those reports could be. By not routinely obtaining access to relevant company internal audits, DCAA auditors are hindered in their ability to effectively plan work and meet auditing standards for evaluating internal controls.

What GAO Recommends

GAO recommends that DCAA take steps to facilitate access to internal audits and assess periodically whether other actions are needed. DOD generally agreed to implement GAO's recommendations but expressed skepticism that this alone would fully ensure access to internal audits.