May 10, 2018 —
We reviewed the system of quality control for the Missile Defense Agency (MDA) Internal Review (IR) Office in effect for September 30, 2017. A system of quality control encompasses MDA IR’s organizational structure and policies adopted and procedures established to provide it with reasonable assurance of conforming to Government Auditing Standards (GAS). The elements of quality control are described in GAS. The MDA IR office is responsible for establishing and maintaining a system of quality control that is designed to provide it with reasonable assurance that the organization and its personnel comply with professional standards and applicable legal and regulatory requirements in all material respects. Our responsibility is to express an opinion on the design of the system of quality control and the MDA IR’s compliance with standards and requirements based on our review.
We conducted our review in accordance with GAS and the Council of the Inspectors General on Integrity and Efficiency Guide for Conducting Peer Reviews of the Audit Organizations of Federal Offices of Inspector General. During our review, we interviewed MDA IR personnel and obtained an understanding of the nature of the MDA IR’s organization and the design of its system of quality control sufficient to assess the risks implicit in its organization. We selected audits and administrative files to test for conformity with professional standards and compliance with the MDA IR’s system of quality control. Before concluding the peer review, we discussed the results of the peer review with MDA IR management. We believe that the procedures we performed provide a reasonable basis for our opinion.
In performing our review, we obtained an understanding of the system of quality control for the audit organization. In addition, we tested compliance with the MDA IR organization’s quality control policies and procedures to the extent that we considered appropriate. These tests covered the application of the MDA IR organization’s policies and procedures on the audits we selected to review. Our review was based on selected tests; therefore, it would not necessarily detect all weaknesses in the system of quality control or all instances of noncompliance with it.
Inherent limitations exist in the effectiveness of any system of quality control. Therefore, noncompliance with the system of quality control may occur and not be detected. Projection of any evaluation of a system of quality control to future periods is subject to the risk that the system of quality control may become inadequate because of changes in conditions, or because the degree of compliance with the policies and procedures may deteriorate.
In our opinion, the system of quality control for MDA IR in effect for the year ending September 30, 2017, has been suitably designed and complied with to provide MDA IR with reasonable assurance of performing and reporting in conformity with applicable professional standards in all material aspects. Audit organizations can receive a rating of pass, pass with deficiencies, or fail. MDA IR has received a rating of pass.
Finding 1: Auditors Did Not Document all Required Independence Assessments.
Finding 2: Auditors Did Not Document the Competence of an Project Team Member.
Finding 3: Auditors Did Not Perform Timely Supervisory Reviews.
Finding 4: Auditors Did Not Include an Evaluation of Management Comments for All Recommendations.
Recommendation 1: We recommend that the Director, Missile Defense Agency Internal Review, clarify guidance to ensure that auditors include all required independence statements in the project files to comply with MDA IR-AU-TM-001.
Recommendation 2: We recommend that the Director, Missile Defense Agency Internal Review, require auditors to document the competence and qualifications of all project team members assigned to audits.
Recommendation 3: We recommend that the Director, Missile Defense Agency Internal Review, emphasize to audit staff that they need to include an evaluation of management comments for all recommendations in the summary of management comments.