Here’s the thing, dear readers. DCAA is getting serious about forcing contractors to turn over records and other information that its auditors believe they need to perform their audits.

If you’ve been reading this blog for any length of time, you ought to have several problems with the declarative sentence above. Let’s elaborate, shall we?

First, you might take issue with the assertion that DCAA auditors actually perform audits. Indeed, it has been our experience, and the finding of other knowledgeable sources, that the average DCAA auditor spends more time “on the administrative aspects of the audit rather than on conducting the audit.” As a result, DCAA is decades behind in performing audits of contractors’ incurred costs. The only way the audit agency will ever catch up is to “risk waive” the lower dollar audits from the smaller contractors. We predict that practice will last until POGO documents the amount of costs that are not being audited, and then DCAA will try another tack.

Second, you might take issue with the concept that DCAA is just now “getting serious” about access to contractor records and information. On December 18, 2008, the audit agency reemphasized its focus on contractor responsiveness and handling “denial of access to records” situations by issuing MRD 08-PAS-042(R). So DCAA has been “serious” about this issue for at least three years—what’s changed?

Finally, you might have a problem, as we do, with DCAA’s plans to put pressure on contractors to turn over records that have been protected from audit either by judicial decision and precedent, or by the time-honored concept of attorney-client privilege. Which is what the good folks at DCAA HQ are directing the auditors to do.

We are talking about MRD 12-PPS-018(R), dated July 25, 2012. The MRD provided audit guidance for situations where the auditors are asserting a “denial of access to records” situation, solely because the contractor asserts attorney-client privilege. This is not the first time that DCAA has asserted a right to examine protected documents. We’ve discussed the issue right here, and also here, and we noted that DCAA was going to insist on auditing confidential employee hotline allegations and the resulting investigations (many performed under privilege)—and that was going to cause problems. (NOTE: the second link leads to our published article on DCAA audits of contractor codes of ethics and business conduct. You can’t access the article unless you’re a member. Sorry about that.)

The MRD stated—

… if a contractor denies access to the requested information and does not provide alternative, non-privileged information, the FAO should pursue access to records until such time as a high-level executive from the company asserts the privilege, in writing. Upon receipt of the written assertion, the issue should be elevated to the Regional office for coordination with top-level contractor management. …

If the efforts outlined in CAM 1-504.4g prove unsuccessful for obtaining the data needed to establish allowability, allocability or reasonableness, coordinate with This e-mail address is being protected from spambots. You need JavaScript enabled to view it so that Policy may review the access to records issue with DCAA counsel.

So, essentially, DCAA is throwing down the gauntlet with respect to the lawful assertion of attorney-client privilege. We predict this is going to be barrels of fun for audit liaison and in-house counsel alike.

But that’s not all. We were privileged to receive an advance copy of MRD 12-PPS-019(R), dated August 14, 2012. Here’s a link to the new MRD. (Sorry, you have to be a member to access the MRD. Membership has privileges, after all.) The new MRD discusses obtaining access to contractor internal audit reports.

Look, we all knew this was coming. We wrote about a GAO report that recommended that DCAA work harder to obtain contractors’ internal audit reports. (We also noted that DCAA auditors interviewed by GAO asserted that “they did not believe that access to contractor internal audit information is critical to their own audit work and that the internal audit reports do not have enough detail to be helpful.”) We also noted that DCAA has been trying to obtain expanded subpoena power for some time.

With that in mind, let’s not be overly surprised that the new MRD had this to say—

… DCAA Contract Audit Coordinator (CAC) offices and Field Audit Offices (FAOs) at major contractor locations must establish a process and a central point of contact to obtain and monitor DCAA’s access to and use of internal audits. This process will include a method for tracking requests for internal audit reports and working papers, when needed, and the contractor’s disposition of these requests. …

When access to internal audit reports is denied by the contractor, the CAC or FAO manager will implement Access to Records procedures per DCAA Instruction 7640.17, dated December 19, 2008. If the efforts of the FAO, Administrative Contracting Officer and regional office prove unsuccessful, the Regional Director should review the matter and determine if a subpoena should be requested in accordance with DCAA Regulations No. 5500.5, Subpoenas of Contractor Records, dated October 10, 2006.

While we don’t believe that contractor internal audit reports are going to be helpful to DCAA auditors at all, we also think that contractors need to think long and hard about whether or not they provide those internal audit reports to DCAA—especially those prepared under attorney-client privilege. (See how the two MRDs link together?)

As we told readers just over a year ago, contractors disclose internal audit reports at their own risk. In that article, we quoted distinguished attorney Karen Manos, who had written—

A U.S. Magistrate Judge ruled from the bench that Oracle’s disclosure of a privileged report in response to a General Services Administration Inspector General subpoena resulted in a broad subject matter waiver of all communications related to the report. … Oracle provided the IG a copy of the report of its outside counsel’s compliance review [related to compliance with the GSA Price Reductions clause]. … The Judge [found that] 'Defendants attorney-client privilege is waived with respect to all communications between defendants and [outside law firm] relating in any way to the contract in issue and/or the review performed.' ..

So this is a serious issue. DCAA is getting serious about it, and we think you should, too.