Conducting Audits of Contractors During Lockdown
By: John Ford | Senior Consultant
On April 10, 2020, the Defense Contract Audit Agency (“DCAA”) issued Memorandum for Regional Directors (“MRD”) 20-PAS-001(R), Audit Alert on Limited Contractor Access Due to Coronavirus Disease (“COVID-19”). This MRD provides guidance on conducting audits during contractor closures and limited access to contractor records and personnel due to the COVID-19 national emergency. Before discussing this MRD, a brief reminder of DCAA’s audit authority is necessary.
There are several standard Federal Acquisition Regulation (“FAR”) clauses that give DCAA the right to audit contractors. The clause that provides the most extensive audit rights is the general audit clause, FAR 52.215-2. That clause states that:
“an authorized representative of the Contracting Officer, shall have the right to examine and audit all records and other evidence sufficient to reflect properly all costs claimed to have been incurred or anticipated to be incurred directly or indirectly in performance of this contract. This right of examination shall include inspection at all reasonable times of the Contractor’s plants, or parts of them, engaged in performing the contract. The Contractor shall make available at its office at all reasonable times the records, materials, and other evidence described in . . . this clause, for examination, audit, or reproduction.”
With this background in mind, the MRD states that if the auditor is unable to obtain sufficient evidence (e.g., the auditor receives electronic documents from the contractor via e-mail and is unable to validate to original records), the auditor should continue with the audit and validate the electronic documents to original records when DCAA and/or contractor resumes normal operations. When normal operations resume, the auditor should validate the electronic data previously accepted and then issue the audit report.
On the other hand, the MRD recognizes that for priority audits that must be issued before this selective testing to original records can take place (e.g., forward pricing assignments, incurred cost assignments subject to the National Defense Authorization Act one-year requirement), and advises that the auditor should assess the impact on the audit opinion and issue the audit report by the original agreed-to date. The lack of access to original documents, lack of access to contractor personnel, or the inability to validate the source of original documents will generally result in a reservation about the engagement (i.e., scope limitation). In most cases, this scope limitation will result in a qualified opinion.
When an audit report is issued with a COVID-19 scope limitation, the auditor should perform those procedures that the auditor was previously unable to perform (e.g., selective testing of the electronic documents to original records) within approximately 90 days of resuming normal operations. A supplemental audit report should be issued if it would serve a useful purpose.
DCAA’s concern about the need to “validate” records is that the records it receives electronically may have been altered. Therefore, the auditor will need to validate the electronic records to original records to lessen the potential of fraud against the government. However, the MRD does not mention, and appears to ignore, FAR 4.703(c) which states, “original records need not be maintained or produced in an audit if the contractor or subcontractor provides photographic or electronic images of the original records and meets the” three criteria listed there. Further, the MRD does not mention FAR 4.703(d), which allows contractors to maintain records on computers. Such a practice facilitates the government policy, expressed in FAR 4.502, to use electronic commerce whenever practical. In furtherance of this policy, FAR 4.502(d) states “[a]gencies may accept electronic signatures and records in connection with Government contracts.” Thus, it appears that the guidance in this MRD needs further amplification.
