Institute of Management Accountants SarbanesOxley Act The DCAA Perspective

1
Institute of Management Accountants
Sarbanes-Oxley Act The DCAA Perspective
Darleen Wall Supervisory Auditor Rainier Branch
Office Richland Suboffice December 12, 2006
2
Topics

• DCAA Organization and Mission
• Sarbanes-Oxley Act Section 404
• Potential for Coordinated Audit
• Potential for Relying on Work of Others
• Benefits
• Resources

3
DCAA History

• Military Branches Separate Contract Audit
  Functions
• 1939 Army and Air Corps Joined Forces
• 1942 Joint Navy, Army Air Corps, Ordinance Dept
• 1952 Established Contract Audit Manual
• 1962 Project 60 Feasibility Study
• 1965 DCAA Established

4
Defense Contract Audit Agency Mission

• DCAA Charter - DoD Directive 5105.36
• Mission -- DCAA shall
• Perform all necessary contract audit for the
  Department of Defense and provide accounting and
  financial advisory services regarding contracts
  and subcontracts to all Department of Defense
  components responsible for procurement and
  contract administration. These services will be
  provided in connection with negotiation,
  administration and settlement of contracts and
  subcontracts.
• Provide contract audit services, to other
  Government Agencies as appropriate.
• (Over 35 civilian agencies received 570,300
  hours of contract audit financial advisory
  services in FY 2004. Represents 12 of DCAAs
  428 million budget.)

5
DCAA in the Department of Defense
6
Defense Contract Audit Agency
7
DCAA Structure

• Headquarters Ft. Belvoir, VA
• Regional Offices
• Irving, Texas
• Smyrna, Georgia,
• Philadelphia, Pennsylvania,
• Lowell, Massachusetts,
• La Mirada, California

8
Western Region

• Field Audit Offices - FAO
• Resident Office Contractor On-Site
• Branch Strategically Placed Within Region
• Suboffice Satellite Office of Branch Office
• Rainier Branch Office Richland Suboffice

9
Commitment to Excellence
9
10
Section 404 Management Assessment of Internal
ControlsWhat Does It Require?

• Requires annual report to SEC that contains an
  internal control report which must include
• Statement that management is responsible for
  establishing and maintaining an adequate internal
  control structure and procedures for financial
  reporting for the company
• Managements assessment of the effectiveness of
  the internal control structure and procedures for
  financial reporting
• Independent auditors attestation on managements
  assessment

11
Sarbanes-Oxley Act Section 404Managements
Self Assessment

• When implementing Section 404, public companies
  and their independent auditors may perform
  additional audit and documentation effort to
  support the managements report on the companys
  internal control over financial reporting
• Company management may express increased interest
  in the FAOs audit plan, accomplished audit work
  related to internal controls, opportunities for
  coordinated audits, and in identifying and
  resolving significant internal control
  deficiencies cited during our previous audits

12
Impact on DCAA

• While the Sarbanes-Oxley Act does not affect
  DCAA directly, the intent of DCAA involvement is
  to determine the potential availability of
  additional contractor information that may
  enhance the quality of our audits or to avoid
  performing duplicative efforts that the
  contractors internal or external auditors may
  already have performed in complying with the new
  requirements.

13
DCAA Audit Guidance on Sarbanes Oxley Act of
2002

• DCAA guidance requires auditors to review the
  contractors documentation supporting its
  compliance with Sarbanes-Oxley and consider the
  impact on the scope of DCAA audits (e.g.,
  internal control audits). Auditors may consider
  the potential for
• relying on the work of others, and
• coordinated audits.
• DCAA auditors at the corporate office are
  required to review documentation supporting SEC
  filings and accompanying notes. Corporate
  auditors will communicate results to applicable
  field audit offices.

14
Determine Potential for Relying on the Work of
Others and Coordinated Audits

• DCAA contractor assess the relevancy of the
  planned or performed audit work to support
  managements report on internal controls to the
  objectives of the DCAA internal control audits
• For example, DCAA contractor review the
  following Sarbanes-Oxley internal control
  documentation for relevancy/impact on DCAA
  internal control audits
• System descriptions
• Internal control component documentation (CAM
  5-102)
• Control objectives and activities identified by
  each system
• Key controls tested for each system

15
Determine Potential for Coordinated Audit Planning
DCAA currently performs audits on the
effectiveness of company internal controls over
financial reporting, compliance, and operations
related to 10 specific systems (Internal Control
Audit Planning Summaries ICAPS) that impact
Government contracts on a cyclical basis,
including

• Control Environment Overall Accounting Controls
• Information Technology System General Controls
• Budget and Planning System Internal Controls
• Purchasing System Internal Controls

16
Determine Potential for Relying on the Work of
Others and Coordinated Audit Planning

• Internal Control Systems (Cont)
• Billing System Internal Controls
• Material Management
• Labor System Internal Controls
• Compensation System Internal Controls
• Indirect/ODC Internal Controls
• Estimating System Internal Controls

17
Key Initial Step for Determining Potential for
Relying on the Work of Others and Coordinated
Audit Planning

• Contractor provides DCAA a copy of the company
  system descriptions (narratives, flowcharts,
  etc.) of the relevant processes and
  sub-processes, including the control objectives
  and control activities, identified by the company
  during its Sarbanes-Oxley assessment at corporate
  and other Government business units

18
Key Steps for Determining Potential for Relying
on the Work of Others and Coordinated Audit
Planning

• Based on understanding the companys systems of
  internal control
• Compare the companys process/systems
  descriptions with the accounting and management
  systems identified by DCAA and determine where
  any common control objectives exist (e.g.,
  accounting system and controls)
• Where common objectives exist, DCAA and the
  contractor jointly determine areas for potential
  reliance and coordinated audits
• DCAA must follow Agency policy for relying on the
  work of others (CAM 4-1000)

19
Criteria for Relying on the Work of OthersCAM
4-1000

• Personnel performing the work are
• Competent
• Independent
• Objective
• Work product is sufficient
• Scope of work is appropriate
• Working papers adequately document
• Conclusions are appropriate

20
Criteria for Relying on the Work of OthersCAM
4-1000

• Evaluation of Work Product
• Work of External Auditors
• Consider whether to conduct additional tests such
  as reviewing audit procedures they followed and
  the results of audits they conducted
• Should review their audit program and/or working
  papers, tests of compliance, and conclusions
  reached
• May review documentary evidence in the external
  auditors working papers or make supplemental
  tests of the work conducted

21
Criteria for Relying on the Work of OthersCAM
4-1000

• Evaluation of Work Product (cont.)
• Work of Non-auditors, consider whether to -
• Conduct additional testing
• Review the work program
• Review the working papers
• Make supplemental tests of the work conducted,
  and
• Consider the methods or assumptions used

22
Criteria for Relying on the Work of OthersCAM
4-1000

• Evaluation of Work Product (cont.)
• Work of Internal Auditors
• Should examine, on a test basis, documentary
  evidence of the work performed
• Should consider such factors as whether the scope
  of work is appropriate, audit programs are
  adequate, working papers adequately document work
  performed, conclusions reached are appropriate,
  reports are consistent with the results of the
  work performed.
• Should perform tests of some of the work of
  internal auditors

23
What are the Benefits?

• For the company
• Less time spent supporting DCAA audits of
  internal control systems
• Provides the company a vehicle to demonstrate the
  effectiveness of its internal controls and
  highlight controls or compensating controls
• For the Government
• Reduced audit effort
• Provides a comprehensive picture and
  understanding of the companys complex system of
  internal control facilitating a more efficient
  and effective audit

24
Experiences-to-date on Sarbanes Oxley

• Generally, the larger DoD contractors are
  currently performing efforts to meet the
  Sarbanes-Oxley requirements and have briefed DCAA
  on their Sarbanes-Oxley implementation plans.
• Some contractors have provided DCAA access to
  internal audits and/or other data supporting its
  Sarbanes Oxley requirement. DCAA reviewed this
  data and considered the impact on the scope of
  DCAA audits (e.g., internal control audits) and
  the potential for relying on the contractors
  work.

25
Experiences-to-date on Sarbanes Oxley

• In some instances, with a release from DCAAs
  customers, DCAA has provided contractors
  internal audit staff access to its audits and
  working papers. In addition, we have provided
  copies of flow charts and narratives developed
  within the scope of our internal control reviews
  (ICAPS) so that the contractor did not have to
  recreate this information. Contractors could
  review this data and consider the impact on the
  scope of its self assessment narratives.

26
More Information on DCAA

• DCAA pamphlet to assist contractors in
  understanding applicable requirements and to help
  ease the contract audit process is available at
• http//www.dcaa.mil/DCAAP_7641.90.pdf
• DCAA audit guidance memos and Contract Audit
  Manual (CAM) are available on DCAAs web site at
• http//www.dcaa.mil

27
Resources for Contractors

• DCAA Regional Audit Guidance
• FAR Revisions
• Allowability Issues
• DCAA Interpretations
• Cost Accounting Standards
• Cost of Money Interest Rate

28
Resources for Contractors

• DCAA Audit Programs
• Systems (110XX 120XX, 130XX)
• Major Incurred Cost (10100)
• Non-major Incurred Cost (10100)
• CAS (191XX 194XX)
• Proposals (210XX)
• Postaward Reviews (420XX)

29
Questions?