Last month we wrote about a provision in the proposed 2013 National Defense Authorization Act (“NDAA”) that would have given the Defense Contract Audit Agency (“DCAA”) statutory authority to demand a company’s internal audit reports in order to audit the efficacy of a company’s internal business systems. Surprisingly, the authorization, as originally proposed, was modified in the final legislation. While Congress directed DCAA to issue new guidance regarding auditor access to internal audit reports, Congress stopped short of giving DCAA actual authority to demand such reports. As such, contractors will remain at loggerheads with DCAA auditors who try to exceed their statutory authority.

The Proposed Legislation 

The Senate version of the 2013 NDAA (S. 3254, 112th Congress, § 843) included a provision that would have amended 10 U.S.C. § 2313(a)(2) to give DCAA access to internal audit reports in order to assess “the efficacy of contractor or subcontractor internal controls and the reliability of contractor or subcontractor business systems.” This proposed change would have given DCAA statutory authority to demand internal audit reports – authority that the courts have long recognized does not exist. See also United States v. Newport News Shipbldg. & Dry Dock Co., 862 F.2d 464, 468-69 (4th Cir. 1988). Contractors have long relied on theNewport News line of cases to resist DCAA demands for internal audit reports, but the proposed change would have effectively overruled theNewport News decisions.

The Final Legislation

Surprisingly, the final legislation took a different approach. Section 832 of the final 2013 NDAA (Pub. L. No. 112-239) directed the DCAA to issue new guidance regarding auditors’ limited access to internal audit reports. Congress set forth the general policy as follows:

A determination by the Defense Contract Audit Agency that a contractor has a sound system of internal controls shall provide the basis for increased reliance on contractor business systems or a reduced level of testing with regard to specific audits, as appropriate. Internal audit reports provided by a contractor pursuant to this section may be considered in determining whether or not a contractor has a sound system of internal controls….

Congress emphasized that DCAA should use these internal audit reports only for the limited purpose of assessing a company’s internal business systems (not as a basis for expanding the scope of the audit), responding to concerns raised by industry. But Congress declined (or perhaps simplyforgot) to give DCAA any actual authority to implement this new policy. The final Act did not amend 10 U.S.C. § 2313(a)(2) and did nothing to override the Newport News decisions. As such, while Congress may have stated an opinion as to what DCAA should do with regard to internal audit reports, Congress provided no basis by which DCAA could actually do it.

Anticipating Contractor Difficulties

DCAA will no doubt be emboldened by Section 832 and auditors will continue to demand internal audit reports. But even though auditors may claim that the use of the audit reports will be limited, contractors will still be wary of volunteering such reports. Particularly where Section 832 does nothing more than direct DCAA to issue new guidance – doing nothing to give DCAA actual authority to request such documentation – contractors should still be able to rely on the Newport News decisions to resist DCAA’s demands. Contractors may choose to work cooperatively with DCAA auditors, and contractors should be prepared to respond to DCAA claims that Section 832 now gives them statutory authority to review internal audit reports, but contractors should be aware of the fact that the new Section 832, on its face, does nothing to change the fact that DCAA continues to lack any real authority to demand internal audit reports.