Dec. 13, 2018 —
We reviewed the system of quality control for the internal audit organization Defense Commissary Agency (DeCA) Internal Review (IR) in effect for the period ending January 31, 2018. The system of quality control includes DeCA IR’s organizational structure and policies adopted and procedures established to provide it with reasonable assurance of conforming to Government Auditing Standards (GAS). The elements of quality control as described in GAS 3.83 include the audit organization’s leadership, emphasis on performing high quality work, and policies and procedures designed to provide reasonable assurance of complying with professional standards and applicable legal and regulatory requirements.
We conducted our review in accordance with GAS and the Council of the Inspectors General on Integrity and Efficiency Guide for Conducting Peer Reviews of Audit Organizations of Federal Offices of Inspector General. During our review, we interviewed DeCA IR personnel and obtained an understanding of the nature of DeCA IR’s organization and the design of its system of quality control sufficient to assess the risks implicit in its organization. We selected audits and administrative files to test for conformity with professional standards and compliance with DeCA IR’s system of quality control. Our review period for audits was February 1, 2017 through January 31, 2018. We selected the only two audit reports that were issued during that time frame. Before concluding the peer review, we discussed the results of the peer review with DeCA IR management. We believe that the procedures we performed provide a reasonable basis for our opinion.
In our opinion, as a result of the significant deficiencies described in the report, the system of quality control for DeCA IR in effect for the period ending January 31, 2018, was not suitably designed and complied with to provide DeCA IR with reasonable assurance of performing and reporting in conformity with applicable professional standards in all material respects. Audit organizations can receive a rating of pass, pass with deficiencies, or fail. DeCA IR has received a rating of fail.