DFARS 252.242-7006(c)(8) specifically requires management reviews or internal audits of the system to ensure compliance with the contractor’s established policies, procedures.
One of the first things a DCAA auditor looks at when auditing a contractor’s accounting system is its policies and procedures. Policies and procedures represent control activities that are essential for an adequate system of internal controls. Good policies and procedures help ensure consistent operations in accordance with management objectives. DCAA cites policy and procedure inadequacies or the failure to comply with policies and procedures in virtually every deficiency report it issues related to internal controls.