5._Accounting_System_and_System_of_Internal_Controls_(ICQ).docx

Version No. 2.4 October 2014

Survey of Contractor’s Organization, Accounting System and System of Internal Controls (ICQ) Contractors with CCFY Dollars Between $15 Million and $100 Million

PURPOSE. This questionnaire provides the basis for documenting the auditor’s understanding of the entity’s internal control components and is used to plan the audit. Five components of internal control are applicable to the audit of every entity: Control Environment; Contractor’s Risk Assessment; Information and Communications; Monitoring; and Accounting System Control Objectives and Activities.

APPLICABILITY. This questionnaire is designed to assist the auditor in obtaining an understanding of internal controls and assessing control risk at non-major contractors with ADV between $15 million and $100 million.

PROFESSIONAL REQUIREMENTS. GAGAS Chapter 6 requires the auditor to follow the field work standard on Internal Control which states “Auditors should obtain a sufficient understanding of the internal control that is material to the subject matter or assertion to plan the engagement and design procedures to achieve the objectives of the attestation engagement.” Although not applicable to DCAA audits, the AICPA standard Consideration of the Internal Control Structure in a Financial Statement Audit may provide useful guidance related to internal control. GAGAS Chapter 6 also requires auditors who are performing an examination, to design the audit to provide reasonable assurance of detecting fraud, illegal acts, or violations of provisions of contracts that could have a material effect on the subject matter or assertion.

COMPLETION REQUIREMENTS. The ICQ should be completed/updated as part of the auditor’s periodic visits to non-major contractors with ADV between $15 million and $100 million. A new ICQ should be completed every year if a field visit is required as part of a current audit.

INSTRUCTIONS FOR COMPLETION OF THE ICQ

The ICQ is composed of Parts A through D. Part A, Basic Organization, allows the auditor to obtain a general understanding of the contractor’s structure, size, and complexity. Parts B through D incorporate the five components of internal control that are applicable to the audit of every entity: Control Environment; Contractor’s Risk Assessment; Information and Communications; Monitoring; and Accounting System Control Objectives and Activities. The ICQ questions or control activities were selectively obtained from the DIIS Internal Control Matrices (ICMs) to assist us in documenting the internal controls at non-major contractors.

PROCEDURES FOR OBTAINING UNDERSTANDING. In obtaining an understanding of controls that are relevant to audit planning, the auditor should perform procedures to obtain sufficient knowledge about the design of the relevant controls pertaining to each of the five internal control components and determine whether they have been placed in operation. This knowledge is ordinarily obtained through previous experience with the contractor and through procedures such as inquiries of appropriate management, supervisory, and staff personnel; inspection of the contractor’s documents and records; and observation of contractor activities and operations. The form and extent of this documentation is influenced by the size and complexity of the contractor, the auditor’s previous experience with the contractor, the nature of the particular controls, and the nature of the contractor’s documentation of specific controls (AU 319.58).

RELATIONSHIP BETWEEN THE ICQ AND THE CONTROL RISK ASSESSMENT. The purpose of the ICQ is to document the auditor’s understanding of the contractor’s system of internal controls to plan the audit. Frequently, at nonmajor contractors, the auditor assesses control risk at the maximum (high) because it is more efficient to perform substantive tests for significant and sensitive accounts than to test the effectiveness of the contractor’s internal controls (CAM 5-111.2a.). If the auditor decides that it is more efficient to test the controls, the ICAPS internal control program for the specific system (e.g., accounting, estimating, billing, etc.) must be used. In this case, the auditor should also use the ICAPS form(s) to summarize the results of the ICAPS internal control audit(s) performed and the ICQ to document the understanding of the internal controls system(s) not tested.

DEFENSE CONTRACT AUDIT AGENCY

OFFICE

Survey of Contractor’s Organization, Accounting System and System of Internal Controls Contractor’s with CCFY Dollars Between $15 Million and $100 Million

PART A – BASIC ORGANIZATION

(Prepare a Part A for each Division)

Date Prepared:

Auditor:

1. Contractor’s Name

2. Division name, if applicable

CAGE Code(s)

DUNS Code(s)

3. Address

4. Telephone No.

5. FAX No.

6. Point of Contact (Accounting)

7. Position Description

8. E-mail address

9. Point of Contact (Contracts/Proposals)

10. Position Description

11. E-mail address

12. Type of Organization:

a. Corporation

Closely Held

Family, or

Publicly Held

State of Incorporation

Date

Listed on the

Stock Exchange

Stock Issued:

Total Shares of Stock Issued

Major Stockholders and Number of Shares

Shares of Stock Held by Officers of the Corporation b.

Partnership

(1) Partners’ Names

(2) Basis for Distribution of Profits and the Amount of Profit

(3) Sharing for Each Partner c.

Division of d.

Recent Business Combinations, e.g., Mergers, Acquisition, Divestiture e.

Other

13. Does the contractor have off-balance sheet arrangements and/or related party transactions (e.g., wholly owned subsidiaries, intercompany, etc.) for the fiscal year under review? If so determine the materiality related to the off-balance sheet arrangements and related party transactions. Note: Publicly held companies are required to disclose details regarding off-balance sheet arrangements under a separately captioned subsection of the “Management’s Discussion and Analysis” section of the quarterly and annual U.S. Securities and Exchange Commission (SEC) filings.

14. Is any portion of this division’s records maintained at other locations?

a. Identify locations(s)

b. Identify cognizant audit office(s). (Include corporate HQ)

15. Contractor’s fiscal year under review

Fiscal Year End

16. Major Product or Services

Manufacturing

Service

Construction

Other

17. Brief Description of Products Manufactured or Service

18. Breakdown of Sales - % or $ - for fiscal year ending (FYE)

Percent

DoD-Domestic

CPFF / CPAF

DoD-FMS

T&M / Labor Hour

NASA

FFP

Other Govt.

FPIF / FPAF

Commercial

Other

Totals

Totals

19. Outside Auditors:

a. Name of Auditors

b. Service(s) Provided

20. Internal Auditors:

a. Functionally Independent?

Yes

No

b. Recent audits performed by internal auditors:

c. Are internal audits available for DCAA review?

Yes

No d.

e. Internal audits reviewed by DCAA?

21. Cost Accounting Standards (CAS)

Modified Coverage

b. CASB Disclosure Statement? Yes No Date

c. D/S considered adequate? Yes No Date

22. Earned Value Management (EVM) and Other Program Management System Reporting Requirements

a. Number of contracts with EVM requirements (DFARS 252.234-7001)

b. Number of contracts requiring Contract Performance Reports (CPR) (DD Form 2734) or equivalent:

c. Number of contracts requiring Cost/Schedule Status Reports (C/SSR) (DD Form 2735) or equivalent:

d. Number of contracts requiring Contract Fund Status Reports (CFSR) (DD Form 1586) or equivalent:

e. Number of contracts requiring Contractor Cost Data Summary Reports (CCDR) (DD Forms 1921, 1921-1 and 1921-2) or equivalent:

23. Location of current Contractor Organization and System Appendix

24. Plant and Facilities Owned Leased Other

a. If leased, is there any relationship between the lessee and lessor? Yes No

b. If Yes, identify lessor and explain the relationship

25. Contractor employees and Government sales (in $000) for on site and off site locations for

FYE

NO. OF

EMPLOYEES TYPE OF GOVERNMENT CONTRACTS CPFF/

LOCATION DIR. INDIR.

CPAF FFP T & M OTHER

26. If the contractor has a Work At Home (WAH) program, indicate:

a. the number of employees participating in the program

b. the dollar amount of WAH labor for the most recent complete fiscal year

27. Names and titles of Principal Executives, Time Devoted to Business and Salary

NAME TITLE % OF TIME SALARY

28. Does the contractor maintain a defined benefit pension plan? Yes No

If yes, the annual reporting requirement in DCAA Instruction 7600.3 applies. Auditor should consider the information from that report in planning applicable audits; e.g., incurred cost, forward pricing and compliance with CAS 412 and 413 and obtain technical specialist or regional assistance necessary.

(A defined benefit pension plan is one in which benefits are established in advance (e.g., $100 per month for each year of service) and contributions are meant to provide the stated benefit, vs. a defined contribution plan (e.g., a 401(k)) in which contributions are established in advance and benefits are based on contributions and any earnings.)

29. Information on contracts/subcontracts (commercial and government) awarded during the previous fiscal year.

PART B - CONTROL ENVIRONMENT AND OVERALL ACCOUNTING SYSTEM

1. Does management promptly correct deficiencies noted in external CPA's management letter on internal controls and in DCAA internal control audits?

2. Does the contractor maintain written policies and procedures to describe:

a. The assignment of authority and areas of responsibility so that there is adequate segregation of duties.

b. The general accounting system.

c. Identification and exclusion of unallowable costs.

d. Direct/Indirect charge practices.

e. Preparation of incurred cost submissions and forward pricing proposals.

f. Allocation of indirect costs to final cost objectives.

g. Approval and documentation of journal entries.

h. Establishment of account numbers.

i. Approvals for establishing contract charge numbers.

j. Allocation of income, rebates, refunds, allowances or other miscellaneous credits.

3. Are the contractor’s cost accounting records reconciled to and controlled by the general accounting system on a current basis, i.e., postings are made at least monthly?

4. Does the contractor’s system identify costs by contract (e.g., job cost ledger)?

PART C - CONTRACTOR’S RISK ASSESSMENT, INFORMATION AND COMMUNICATIONS, AND MONITORING

CONTRACTOR’S RISK ASSESSMENT

1. Does the contractor have a risk assessment process for identification, analysis, and management of risks relevant to the preparation of submissions to the Government in accordance with Federal Government regulations?

2. Has any current or previous assignment identified the contractor’s failure to properly assess the risk of having noncompliant submissions?

3. Has any significant change in accounting for costs within the contractor’s current and preceding two years?

1. Allocation of indirect costs --Structure of the indirect overhead rates (pool or base costs)?

1. Accounting for direct costs?

INFORMATION AND COMMUNICATIONS

1. Does the contractor have written policies and procedures for the IT system that include appropriate manual and computerized control procedures to:

· initiate, record, process, and report the contractor’s transactions and journal entries (as well as events and conditions) from their occurrence to their inclusion in the accounting records;

· enter transaction totals into the general ledger;

· record recurring and nonrecurring adjustments or reclassifications if they are not recorded through formal journal entries?

· convert hard-copy documents to electronic medium (if applicable)?

2. Do the contractor s policies and procedures address the individual roles and responsibilities pertaining to internal controls over accounting information?

3. Does the contractor disseminate its policies and procedures to its employees?

4. Has any current or previous assignments identified the contractor’s failure to properly implement any of these internal control procedures?

MONITORING

1. Does the contractor have ongoing monitoring procedures and/or separate internal control reviews/audits to ensure that internal controls are operating as intended and that they are modified as appropriate for changes in conditions?

2. Has any current or previous assignment identified the contractor’s failure to monitor the effectiveness of internal control procedures?

PART D. ACCOUNTING SYSTEM CONTROL OBJECTIVES AND ACTIVITIES

1. Does the contractor have a training program to reasonably assure that all employees are aware of the importance of proper time charging?

2. Do the contactor’s written policies and procedures provide labor documentation/work descriptions that identify the work to be performed, and are labor charges tracked to a final cost objective, whether allowable or unallowable/direct or indirect?

3. Does the contractor maintain written timekeeping policies and procedures to reasonably assure that labor hours are accurately recorded and corrections are documented, including authorizations and approvals?

Does the contractor maintain written policies and procedures to describe the major manual and automated systems that comprise the material management and accounting system?

Does the contractor have written estimating policies and procedures to address employee training, assignment of authority and responsibilities, cost estimate development, and the estimating system process, activities, and functions?

Does the contractor have and disseminate written billing policies and procedures which address employee training, contract briefing to identify special billing provisions and limitations, and management review of billings?

Does the contractor have written policies and procedures for the planning and budgeting system, which include the formal assignment of duties and responsibilities and a description of the system?

Do written policies and procedures for compensation exist to include:

· a salary structure and administration;

· a description of fringe benefits provided to employees; and

· a system for determining pay increases, bonuses, and promotions?

Has any current or previous assignment identified the contractor’s failure to properly implement any of its internal written control procedures in Part D above?