On Nov. 12 and 13, CohnReznick’s Government Contracting practice presented “The Role of Internal Audit: Addressing Risk Areas for Government Contractors” as the November installment of the Lunch & Learn series. If you missed the event, or want a recap, read on for the top insights discussed.

Business systems oversight

- There are six systems covered in the DFARS 252.242-7005 “Contractor Business Systems” clause, each with its own complexities and nuances. Internal Audit should have a plan to know which systems are applicable to its organization and when, and take a proactive approach to compliance and oversight.

- Internal Audit needs to set up a framework to monitor the business systems that goes beyond routine internal controls and dives into the controls specific to each criterion of the business systems clause. Without appropriate oversight, contracts covered by the Cost Accounting Standards (CAS) are subject to payment withholds of 5% for one system and 10% for two or more systems with significant deficiencies.

- Don’t wait until the last moment to look at your systems. Internal Audit should test and monitor the systems and related controls routinely to ensure that they are working as intended. Each system requires annual internal review, policy review, and training.

- To ensure compliance with the business systems criteria, consider implementing a three-prong approach to include 1) updating policies to address specific system criteria, 2) listing procedures related to the criteria to document the overall process, and 3) specifically identifying the key controls both in the policies and in procedures.

Subcontract management compliance

- Internal Audit can also help ensure that strong controls exist and are being consistently applied in various aspects of subcontracting, including:

o Monitoring controls to ensure that subcontractors are meeting their contractual requirements, including those related to compliance with contract terms and federal regulations. 

o Closeout controls that allow the prime contractor to close its subcontracts in a timely and compliant manner.

o Audit practices that recognize that the government expects the prime contractor to ensure that subcontract audits are performed, when necessary.

o Flowdown clause compliance controls that recognize that certain prime contract clauses must be flowed down to subcontractors, and that the company should have consistent practices with regards to inclusion of FAR clauses in subcontracts.

 For more information about Internal Audit and controls, consult our 2019 GAUGE Report.