NDAA for Fiscal Year 2012

*How To Use the NDAA Pages*	Back to NDAA Contents
TITLE VIII--ACQUISITION POLICY, ACQUISITION MANAGEMENT, AND RELATED MATTERS Subtitle C—Amendments to General Contracting Authorities, Procedures, and Limitations
P. L. 112-	House Conference Report 112-705
SEC. 832. DEPARTMENT OF DEFENSE ACCESS TO, USE OF, AND SAFEGUARDS AND PROTECTIONS FOR CONTRACTOR INTERNAL AUDIT REPORTS. (a) Revised Guidance Required- Not later than 180 days after the date of the enactment of this Act, the Director of the Defense Contract Audit Agency shall revise guidance on access to defense contractor internal audit reports (including the Contract Audit Manual) to incorporate the requirements of this section. (b) Documentation Requirements- The revised guidance shall ensure that requests for access to defense contractor internal audit reports are appropriately documented. The required documentation shall include, at a minimum, the following: (1) Written determination that access to such reports is necessary to complete required evaluations of contractor business systems. (2) A copy of any request from the Defense Contract Audit Agency to a contractor for access to such reports. (3) A record of response received from the contractor, including the contractor's rationale or justification if access to requested reports was not granted. (b) Safeguards and Protections- The revised guidance shall include appropriate safeguards and protections to ensure that contractor internal audit reports cannot be used by the Defense Contract Audit Agency for any purpose other than evaluating and testing the efficacy of contractor internal controls and the reliability of associated contractor business systems. (c) Risk-based Auditing- A determination by the Defense Contract Audit Agency that a contractor has a sound system of internal controls shall provide the basis for increased reliance on contractor business systems or a reduced level of testing with regard to specific audits, as appropriate. Internal audit reports provided by a contractor pursuant to this section may be considered in determining whether or not a contractor has a sound system of internal controls, but shall not be the sole basis for such a determination. (d) Comptroller General Review- Not later than one year after the date of the enactment of this Act, the Comptroller General of the United States shall initiate a review of the documentation required by subsection (a). Not later than 90 days after completion of the review, the Comptroller General shall submit to the congressional defense committees a report on the results of the review, with findings and recommendations for improving the audit processes of the Defense Contract Audit Agency.	*Department of Defense access to, use of, and safeguards and protections for contractor internal audit reports (sec. 832)* The Senate amendment contained a provision (sec. 843) that would clarify the access of the Defense Contract Audit Agency (DCAA) to contractor internal audit reports and supporting materials. The House bill contained no similar provision. The House recedes with an amendment that would clarify the limited purposes for which such audit access is provided and establish safeguards and protections to ensure that audit materials are not used for any other purposes. Subsection (b) of the provision would establish documentation requirements for DCAA requests of internal audit reports or supporting materials. The conferees direct the Director of DCAA to provide the required documentation to the congressional defense committees, upon request. The conferees understand that the documentation provided to the congressional defense committees would not include copies of any contractor internal audit reports or supporting materials.
	Senate Report 112-173
	Department of Defense access to and use of contractor internal audit reports (sec. 843) The committee recommends a provision that would clarify Defense Contract Audit Agency (DCAA) access to defense contractor internal audit reports and supporting materials for the purpose of assessing risk and evaluating the efficacy of contractor internal controls and the reliability of associated contractor business systems. Under the provision, a contractor's refusal to permit access to internal audit reports and supporting materials could be taken into account in any assessment of the adequacy of contractor business systems pursuant to section 893 of the Ike Skelton National Defense Authorization Act for Fiscal Year 2011 (Public Law 111-383). In December 2011, the Government Accountability Office (GAO) reported on a review of DCAA access to and use of defense contractor internal audit reports. GAO reported that generally accepted government auditing standards require evaluation and testing of contractor internal controls, including the work of the contractor's internal audit activity. However, GAO found that DCAA access to internal audits was uneven, and that one contractor refused to provide DCAA with any access to such audits at all. The report states: `DCAA does not generally track its requests or denials for internal audit reports. GAO found that the number of DCAA requests for internal audit reports is small relative to the number of internal audits GAO identified as relevant to defense contract oversight. In explaining why few reports are requested, DCAA auditors noted obstacles such as not being able to identify internal audits relevant to their work and uncertainty as to how useful those reports could be. By not routinely obtaining access to relevant company internal audits, DCAA auditors are hindered in their ability to effectively plan work and meet auditing standards for evaluating internal controls.' GAO recommended that DCAA issue guidance on how and under what circumstances company internal audit reports can be accessed; establish a central point of contact for each company to coordinate issues pertaining to internal audits; and track and assess information regarding access to such audits. On March 30, 2012, the Director of DCAA issued the Agency's first annual report to Congress. The report requests that Congress clarify DCAA's access to contractor internal controls and business systems to assess whether the systems and controls are adequate to ensure the reliability of contractor data. The report states: `It is essential for DCAA to have access to contractor reviews, inquiries, investigations, and internal audits in order to evaluate contractor business systems. DCAA audits contractor accounting systems before and after contract award to assess whether the systems are adequate for accumulating and billing costs that comply with contract requirements. For major contractors, DCAA audits contractor business systems as a basis for relying on those systems during other DCAA audits.'

SEC. 832. DEPARTMENT OF DEFENSE ACCESS TO, USE OF, AND SAFEGUARDS AND PROTECTIONS FOR CONTRACTOR INTERNAL AUDIT REPORTS.