On December 19, 2008, the Defense Contract Audit Agency (DCAA) issued new audit guidance to "clarify" what constitutes a significant deficiency or material weakness and to establish new guidance on reporting audit opinions on contractors' internal control systems. MRD 08-PAS-043(R). Effective immediately, audit reports on contractors' internal control systems that report any significant deficiencies or material weaknesses will include an opinion that the system is inadequate—DCAA will no longer report inadequate in part opinions. In addition, DCAA audit reports will no longer include suggestions to improve the system. Id.
The DCAA had previously issued guidance advising that a "significant deficiency/material weakness is an internal control deficiency that (1) adversely affects the contractor's ability to initiate, authorize, record, process or report government contract costs in accordance with applicable government contract laws and regulations; (2) that results in a reasonable possibility that unallowable costs will be charged to the government; and (3) where the potential unallowable cost is not clearly immaterial." MRD 08-PAS-011(R), Audit Guidance on Reporting Internal Control Deficiencies, dated March 3, 2008. The December 19 guidance, however, "clarifies" that even when the control objective does not have a direct relationship to charging costs to Government contracts, the contractor's failure to accomplish any control objective will automatically be deemed to create a possibility of unallowable costs being charged to Government contracts, and therefore, will be considered a "significant deficiency/material weakness." DCAA explained that by limiting internal control audits to major contractors, it performs audits only of contractor systems that are material to government contract costs; therefore, any potential unallowable cost that could ultimately result from the identified deficiency is not clearly immaterial. As an example, the Audit Guidance highlights the control objective related to ethics and integrity, which is not directly related to charging costs to Government contracts, but could result in mischarging to Government contracts if the contractor's system fails to meet the objective tested by DCAA. See Standard Audit Programs, Activity Code 11070, Control Environment and Overall Accounting System Controls, Version 6.2, dated March 2008, available at http://www.dcaa.mil/.
Thus, the Audit Guidance instructs auditors to report any internal control deficiencies as a significant deficiency/material weakness, and to issue an opinion that the system is inadequate. The report should also identify the areas of the system that are related to control objectives that were not accomplished due to the identified deficiencies and recommend that the contracting officer disapprove the system (if applicable) and pursue suspension of a percentage of progress payments or reimbursement of costs in accordance with the procedures in the DFARS. The report, however, will no longer include suggestions to improve the system, which, according to the Audit Guidance "caused confusion in the past."