The new DFARS business system rule requires audits by CPA’s, with DCAA approving the risk assessment and the audit program and reviewing the working papers afterwards.
The obvious reason for this proposal is that DCAA is unable to perform the audits themselves. At least not on a timely basis. When DCAA was performing the audits, it was taking over 2 years to perform 1 system audit. This rule requires it to be done within 6 months after the close of the contractor’s fiscal year. In contrast, DCAA was not completing the risk assessment in that length of time.
So now let’s take CPA firms that are used to performing financial statement reviews in a timely manner and handcuff them to DCAA, an Agency that is notorious for missing due dates.
And THEN let that same Agency, in essence, audit the audit. And furthermore, there are no provisions to limit DCAA to a reasonable time frame for approval of the risk assessment and audit program.