Smash & Grab Redux - Congress Seems to Give DCAA Permission But Forgets to Give It Authority


Last month we wrote about a provision in the proposed 2013 National Defense Authorization Act (“NDAA”) that would have given the Defense Contract Audit Agency (“DCAA”) statutory authority to demand a company’s internal audit reports in order to audit the efficacy of a company’s internal business systems. Surprisingly, the authorization, as originally proposed, was modified in the final legislation. While Congress directed DCAA to issue new guidance regarding auditor access to internal audit reports, Congress stopped short of giving DCAA actual authority to demand such reports. As such, contractors will remain at loggerheads with DCAA auditors who try to exceed their statutory authority.

The Proposed Legislation 

The Senate version of the 2013 NDAA (S. 3254, 112th Congress, § 843) included a provision that would have amended 10 U.S.C. § 2313(a)(2) to give DCAA access to internal audit reports in order to assess “the efficacy of contractor or subcontractor internal controls and the reliability of contractor or subcontractor business systems.” This proposed change would have given DCAA statutory authority to demand internal audit reports – authority that the courts have long recognized does not exist. See also United States v. Newport News Shipbldg. & Dry Dock Co., 862 F.2d 464, 468-69 (4th Cir. 1988). Contractors have long relied on the Newport News line of cases to resist DCAA demands for internal audit reports, but the proposed change would have effectively overruled the Newport News decisions.

The Final Legislation

Surprisingly, the final legislation took a different approach. Section 832 of the final 2013 NDAA (Pub. L. No. 112-239) directed the DCAA to issue new guidance regarding auditors’ limited access to internal audit reports. Congress set forth the general policy as follows:

A determination by the Defense Contract Audit Agency that a contractor has a sound system of internal controls shall provide the basis for increased reliance on contractor business systems or a reduced level of testing with regard to specific audits, as appropriate. Internal audit reports provided by a contractor pursuant to this section may be considered in determining whether or not a contractor has a sound system of internal controls….

Congress emphasized that DCAA should use these internal audit reports only for the limited purpose of assessing a company’s internal business systems (not as a basis for expanding the scope of the audit), responding to concerns raised by industry. But Congress declined (or perhaps simply forgot) to give DCAA any actual authority to implement this new policy. The final Act did not amend 10 U.S.C. § 2313(a)(2) and did nothing to override the Newport News decisions. As such, while Congress may have stated an opinion as to what DCAA should do with regard to internal audit reports, Congress provided no basis by which DCAA could actually do it.

Anticipating Contractor Difficulties

DCAA will no doubt be emboldened by Section 832 and auditors will continue to demand internal audit reports. But even though auditors may claim that the use of the audit reports will be limited, contractors will still be wary of volunteering such reports. Particularly where Section 832 does nothing more than direct DCAA to issue new guidance – doing nothing to give DCAA actual authority to request such documentation – contractors should still be able to rely on the Newport News decisions to resist DCAA’s demands. Contractors may choose to work cooperatively with DCAA auditors, and contractors should be prepared to respond to DCAA claims that Section 832 now gives them statutory authority to review internal audit reports, but contractors should be aware of the fact that the new Section 832, on its face, does nothing to change the fact that DCAA continues to lack any real authority to demand internal audit reports.

Written by:

Published In:

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Sheppard Mullin Richter & Hampton LLP | Attorney Advertising

Don't miss a thing! Build a custom news brief:

Read fresh new writing on compliance, cybersecurity, Dodd-Frank, whistleblowers, social media, hiring & firing, patent reform, the NLRB, Obamacare, the SEC…

…or whatever matters the most to you. Follow authors, firms, and topics on JD Supra.

Create your news brief now - it's free and easy »

All the intelligence you need, in one easy email:

Great! Your first step to building an email digest of JD Supra authors and topics. Log in with LinkedIn so we can start sending your digest...

Sign up for your custom alerts now, using LinkedIn ›

* With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name.