By David Gallacher 

The Defense Contract Audit Agency (“DCAA”) has long sought access to contractors’ internal audit reports in connection with the routine audit of contractors’ business systems. Contractors have, in most cases, successfully resisted requests for such access on the grounds that DCAA has no statutory authority to request such documents. But that may soon change. Section 843 of the Senate version of the 2013 National Defense Authorization Act (S. 3254) would grant DCAA broad access to contractor internal audit information.

No Statute, No Access, No Problem

DCAA has long coveted contractors’ internal audit reports, apparently in the hope that candid admissions within the reports and the associated work papers might give DCAA additional leverage in negotiating reductions with contractors. But the Court of Appeals for the Fourth Circuit held in two separate decisions in 1988 that DCAA did not have the authorization to obtain, via subpoena or otherwise, contractors’ internal audit reports. See U.S. v. Newport News Shipbuilding & Dry Dock Co., 837 F.2d 162, 170 (4th Cir. 1988). The Fourth Circuit observed that, under 10 U.S.C. § 2313(a)(1), DCAA is only permitted to “review cost and financial data…[and] only material related to the performance of that contract.” Under 10 U.S.C. § 2313(a)(2), DCAA’s right to seek information is also limited, most notably, to material necessary to review or verify the “accuracy, completeness, and currency of cost or pricing data” – objective factual information concerning contract costs, “such as invoices, vouchers, and time logs,” not the type of subjective assessments included in internal audit reports. See also United States v. Newport News Shipbldg. & Dry Dock Co., 862 F.2d 464, 468-69 (4th Cir. 1988) (noting that the statutes “intended to provide DCAA access to objective financial and cost information, contained in a defense contractor’s books, records, and other documents, that reflects upon the accuracy of cost charges submitted to the government”). Accordingly, the Fourth Circuit rejected the notion that DCAA had the authority to request internal audit reports, concluding that DCAA was not operating within its statutory authority when it sought such materials. However, and as every defense contractor knows, DCAA has persisted in its efforts to obtain access to contractor internal audit information (albeit without success in most cases).

In December 2011, the Government Accountability Office (“GAO”) criticized DCAA for its failure to access internal audit reports, noting that generally accepted government auditing standards require evaluation and testing of contractor internal controls (including the work of the contractor’s internal audit activity). See GAO-12-88, “Actions Needed to Improve DCAA’s Access to and Use of Defense Company Internal Audit Reports” (Dec. 8, 2011). GAO did recognize, however, that a contractors’ refusal to provide internal audit reports and work papers would be consistent with the holdings of the Newport News decisions.

Emboldened by the GAO report, DCAA submitted its first annual report to Congress in March 2012, requesting statutory authority to access a wide range of internal audit information and arguing as follows:

It is essential for DCAA to have access to contractor reviews, inquiries, investigations, and internal audits in order to evaluate contractor business systems. DCAA audits contractor accounting systems before and after contract award to assess whether the systems are adequate for accumulating and billing costs that comply with contract requirements. For major contractors, DCAA audits contractor business systems as a basis for relying on those systems during other DCAA audits.

See U.S. Department of Defense, “Report to Congress on FY 2011 Activities at the Defense Contract Audit Agency” (March 30, 2012), at 11.

In August 2012, DCAA followed up its report to Congress by issuing a Memorandum for Regional Directors (“MRD”) setting out the procedures by which DCAA auditors should continue to demand internal audit reports. See DCAA MRD No. 12-PPS-019(R), “Audit Guidance on Access to Contractor Internal Audit Reports” (Aug. 14, 2012). Notably, the MRD did not cite to any additional authority that would allow DCAA access to internal audit reports, merely directing Field Audit Offices to monitor all requests for internal audit reports, as well as contractor refusals to cooperate. The MRD was accompanied by another Memorandum reminding auditors how to respond to contractor claims of privilege on work papers. See DCAA MRD No. 12-PPS-018(R), “Audit Guidance – Denial of Access to Records Due to Contractor Assertion of Attorney Work Product Doctrine or Attorney-Client Privilege” (Jul. 25, 2012). In issuing this guidance, DCAA appears to have anticipated favorable Congressional action on its request for access to contractor internal audit information.

New Statute, If Enacted, Will Mean New Access and New Problems

As noted above, Congress is now considering DCAA’s request for authority that it has long desired. The Senate version of the 2013 National Defense Authorization Act (“NDAA”) includes a provision that would amend 10 U.S.C. § 2313(a)(2) to give DCAA access to documents relating to “the efficacy of contractor or subcontractor internal controls and the reliability of contractor or subcontractor business systems.” See S. 3254 (112th Congress), § 843. Specifically, the purpose of the amendment is “to ensure that the Defense Contract Audit Agency has sufficient access to contractor internal audit reports and supporting materials.”

Of course, the Senate version of the 2013 NDAA must still be reconciled with the House version (H.R. 4310) and, for reasons unrelated to the access provision, the White House has threatened to veto the 2013 NDAA if the Senate version is passed without certain changes. That said, the protections afforded to internal audit reports by the Newport News decisions are plainly in peril. It may only be a matter of time, and time may be running short.