As the COVID-19 pandemic continues with no real end in sight, the performance of traditional on-site audits by the Defense Contract Audit Agency (DCAA) becomes a significant safety issue. In response, DCAA issued a Memorandum for Regional Directors (MRD) entitled “Audit Alert on Limited Contractor Access Due to Coronavirus Disease (COVID-19)”. This MRD addresses what DCAA is to do if direct access to contractor records is not possible due to contractor facility closures or contact with contractor personnel is limited or non-existent due to teleworking.
Basically, if the audit cannot be postponed and DCAA only has access to electronic documentation, no matter how received (email, Zoom, WebEx, etc.), they must, when normal operations resume, validate the electronic data received against the original documentation provided before issuing the subject audit findings.
For priority audits (forward pricing assignments, incurred cost assignments subject to the NDAA one-year requirement) that require the issuance of an audit report prior to selective testing to the original documentation, the audit team should assess the potential impact on the opinion and issue the report at the original agreed to time. The lack of access to the original documentation, the lack of access to contractor personnel, or the inability to validate the source of the original documents will most likely result in a scope limitation and a qualified opinion being issued. When a qualified audit report is issued additional testing against the original documentation is to be performed within approximately 90 days of resuming normal operations.
In some cases, DCAA management may use their professional judgment and determine that the audit effort should be postponed until normal operations resume.
Generally, receiving electronic copies of a contractor’s records will result in a scope limitation being issued. Electronic copies provide lower quality audit evidence and reviewing electronic copies alone does not sufficiently mitigate the risk that the documents may have been altered.
Prior testing of original documents to electronic records will generally not replace the need to validate the accuracy of current electronic data provided and will, again, result n a qualified audit report.
Audits such as floor checks and business systems should be postponed until original documentation can be reviewed.
To make the best of a bad situation it is imperative that you work with the auditors to establish what is needed to ensure a favorable and timely audit conclusion. Discuss the virtual audit process, including what platform(s) will be used to transmit the required data, what data can be virtually provided, how will audit requests be received and how will you keep track of requests and the data provided. Establish favorable audit timing/scheduling – when to begin and when to complete. Answers to these questions and thorough planning, upfront before the audit process begins will help ensure a successful audit. DCAA is to inform the contractor when the audit process being established will result in a qualified audit report.
