On August 14, 2012, the Defense Contract Audit Agency (DCAA) issued guidance that expands DCAA’s plans for obtaining contractors’ internal audit reports and related working papers. DCAA certainly has audit rights, but courts have made it clear that those rights are not unlimited. Under this latest guidance and changes to the Defense Contract Audit Manual, DCAA is attempting to expand its access not only to a company’s internal audit reports but also to thework papers and analyses related to the reports. This new extension of DCAA’s audit powers to work papers is an unprecedented intrusion into corporate decision-making, and perhaps, attorney-client privileged material. As a result, contractors should begin to consider the risks associated with producing these records and revise their policies and procedures to address DCAA’s expected requests for such records.

DCAA is the principal contract audit entity in the federal government and performs audit functions of the Department of Defense, and other agencies, and provides accounting and financial advisory services in connection with the negotiation, administration and termination of government contracts. DCAA often audits contractor records, books and other data as part of proposal evaluations, systems review and operations audits. The DCAA also audits termination settlement proposals, requests for equitable adjustments and whether particular costs are allowable, allocable and reasonable. But DCAA’s audit rights are not unlimited — they are defined by clauses in contracts and other applicable law.

This latest attempt to expand DCAA’s access to records is in response to a December 2011 Government Accountability Office (GAO) report that identified several actions that DCAA should take to use defense contractor internal audit reports. GAO concluded that the number of DCAA requests for contractor audits was relatively small, and although DCAA cannot request unlimited access to all internal company materials, the GAO recommended that DCAA facilitate access to a contractor’s internal audits.

The Senate also recently proposed legislation in the National Defense Authorization Act (NDAA) of 2013 to clarify DCAA access to internal audit reports and supporting materials for assessing the risk and evaluating the efficacy of contractor internal controls and the reliability of contractor business systems. Although the NDAA has not been enacted, and may yet give DCAA the statutory authority to access such reports, DCAA is now revising its policy and audit manual in response to the GAO findings and recommendations to establish a process to request and use contractor internal audit reports.

At major contractor locations, the new policy requires DCAA Contract Audit Coordinator Offices and Field Audit Offices to establish a central point of contact to track requests for internal audit reports, which will include obtaining a semi-annual summary list of all reports, reviewing the summary for adequacy and their affect on government contracts, sending requests to the contractor for copies of the reports and tracking the contractor’s responses. Auditors will review the internal audit reports to determine if sufficient information is contained in the report for use in identifying risk in DCAA audits, including whether there were  reported deficiencies and recommended corrective actions. If there is insufficient information, the DCAA may request the contractor’s audit working papers for review.

For non-major contractors, a formal tracking process is not mandatory. DCAA noted, however, that internal audit reports can still be useful in performance audits and, “when warranted by the audit circumstances,” will review the non major contractor’s listing of internal audits and request access to reports deemed pertinent. If the DCAA auditor believes the report is insufficient, the DCAA may seek the contractor’s audit working papers.

If a contractor denies DCAA access to its internal audit reports, DCAA may seek to subpoena these records. A contractor’s denial of access may also lead to qualified or adverse DCAA audit reports, questioned costs under price proposals and progress payments, findings of an internal control deficiency, suspension of payments and disallowance of certain costs.

DCAA’s prior attempts to institute a policy of broad access to contractor records has been limited by courts. The Fourth Circuit Court of Appeals, for example, concluded in United States v. Newport News Shipbuilding and Dry Dock Co., 837 F.2d 162 (4th Cir. 1988), that internal audits are not documents that fall within the scope of the DCAA’s subpoena power. In that case, the internal audits were not related to any particular contract and contained subjective evaluations of the contractor’s operations and suggestions for changes. The court concluded that this data was beyond the DCAA's subpoena authority, which covers objective data supporting cost charges paid by the government.

Contractors should be aware that they are entitled to protect internal audit reports that are, for example, not related to government contracts or audits covered by the attorney-client or work product privileges. DCAA’s audit rights are prescribed by statute, regulation and contract. Without a statutory, regulatory or contractual basis to request such records, contractors may seek to rely on Newport News and attorney-client privilege to object to DCAA requests for certain internal audit reports and related work papers. Although the NDAA may clarify the DCAA’s authority to request and review such records, major and non-major contractors must now begin to consider how to prepare their organizations in anticipation of DCAA’s impending requests, and how to respond once they are received.