Smash & Grab - DCAA Poised to Gain Access to Contractor Internal Audit Reports

by Sheppard Mullin Richter & Hampton LLP

The Defense Contract Audit Agency (“DCAA”) has long sought access to contractors’ internal audit reports in connection with the routine audit of contractors’ business systems. Contractors have, in most cases, successfully resisted requests for such access on the grounds that DCAA has no statutory authority to request such documents. But that may soon change. Section 843 of the Senate version of the 2013 National Defense Authorization Act (S. 3254) would grant DCAA broad access to contractor internal audit information.

No Statute, No Access, No Problem

DCAA has long coveted contractors’ internal audit reports, apparently in the hope that candid admissions within the reports and the associated work papers might give DCAA additional leverage in negotiating reductions with contractors. But the Court of Appeals for the Fourth Circuit held in two separate decisions in 1988 that DCAA did not have the authorization to obtain, via subpoena or otherwise, contractors’ internal audit reports. See U.S. v. Newport News Shipbuilding & Dry Dock Co., 837 F.2d 162, 170 (4th Cir. 1988). The Fourth Circuit observed that, under 10 U.S.C. § 2313(a)(1), DCAA is only permitted to “review cost and financial data…[and] only material related to the performance of that contract.” Under 10 U.S.C. § 2313(a)(2), DCAA’s right to seek information is also limited, most notably, to material necessary to review or verify the “accuracy, completeness, and currency of cost or pricing data” – objective factual information concerning contract costs, “such as invoices, vouchers, and time logs,” not the type of subjective assessments included in internal audit reports. See also United States v. Newport News Shipbldg. & Dry Dock Co., 862 F.2d 464, 468-69 (4th Cir. 1988) (noting that the statutes “intended to provide DCAA access to objective financial and cost information, contained in a defense contractor’s books, records, and other documents, that reflects upon the accuracy of cost charges submitted to the government”). Accordingly, the Fourth Circuit rejected the notion that DCAA had the authority to request internal audit reports, concluding that DCAA was not operating within its statutory authority when it sought such materials. However, and as every defense contractor knows, DCAA has persisted in its efforts to obtain access to contractor internal audit information (albeit without success in most cases).

In December 2011, the Government Accountability Office (“GAO”) criticized DCAA for its failure to access internal audit reports, noting that generally accepted government auditing standards require evaluation and testing of contractor internal controls (including the work of the contractor’s internal audit activity). See GAO-12-88, “Actions Needed to Improve DCAA’s Access to and Use of Defense Company Internal Audit Reports” (Dec. 8, 2011). GAO did recognize, however, that a contractors’ refusal to provide internal audit reports and work papers would be consistent with the holdings of the Newport News decisions.

Emboldened by the GAO report, DCAA submitted its first annual report to Congress in March 2012, requesting statutory authority to access a wide range of internal audit information and arguing as follows:

It is essential for DCAA to have access to contractor reviews, inquiries, investigations, and internal audits in order to evaluate contractor business systems. DCAA audits contractor accounting systems before and after contract award to assess whether the systems are adequate for accumulating and billing costs that comply with contract requirements. For major contractors, DCAA audits contractor business systems as a basis for relying on those systems during other DCAA audits.

See U.S. Department of Defense, “Report to Congress on FY 2011 Activities at the Defense Contract Audit Agency” (March 30, 2012), at 11.

In August 2012, DCAA followed up its report to Congress by issuing a Memorandum for Regional Directors (“MRD”) setting out the procedures by which DCAA auditors should continue to demand internal audit reports. See DCAA MRD No. 12-PPS-019(R), “Audit Guidance on Access to Contractor Internal Audit Reports” (Aug. 14, 2012). Notably, the MRD did not cite to any additional authority that would allow DCAA access to internal audit reports, merely directing Field Audit Offices to monitor all requests for internal audit reports, as well as contractor refusals to cooperate. The MRD was accompanied by another Memorandum reminding auditors how to respond to contractor claims of privilege on work papers. See DCAA MRD No. 12-PPS-018(R), “Audit Guidance – Denial of Access to Records Due to Contractor Assertion of Attorney Work Product Doctrine or Attorney-Client Privilege” (Jul. 25, 2012). In issuing this guidance, DCAA appears to have anticipated favorable Congressional action on its request for access to contractor internal audit information.

New Statute, If Enacted, Will Mean New Access and New Problems

As noted above, Congress is now considering DCAA’s request for authority that it has long desired. The Senate version of the 2013 National Defense Authorization Act (“NDAA”) includes a provision that would amend 10 U.S.C. § 2313(a)(2) to give DCAA access to documents relating to “the efficacy of contractor or subcontractor internal controls and the reliability of contractor or subcontractor business systems.” See S. 3254 (112th Congress), § 843. Specifically, the purpose of the amendment is “to ensure that the Defense Contract Audit Agency has sufficient access to contractor internal audit reports and supporting materials.”

Of course, the Senate version of the 2013 NDAA must still be reconciled with the House version (H.R. 4310) and, for reasons unrelated to the access provision, the White House has threatened to veto the 2013 NDAA if the Senate version is passed without certain changes. That said, the protections afforded to internal audit reports by the Newport News decisions are plainly in peril. It may only be a matter of time, and time may be running short.


DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Sheppard Mullin Richter & Hampton LLP | Attorney Advertising

Written by:

Sheppard Mullin Richter & Hampton LLP

Sheppard Mullin Richter & Hampton LLP on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at:

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.