1. Sandia National Laboratories is a multi-program laboratory managed and operated by Sandia Corporation, a wholly owned subsidiary of Lockheed Martin Corporation, for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-AC04-94AL85000. Contractor Internal Audit Directors (CIAD) Conference Nancy Davis, Director Audit, Ethics, and Business Conduct July 16, 2015

2. Risk Assessment Process Slide 2  Our primary risk analysis tool is the Accounting System Review (ASR)  Helps determine the nature, timing and extent of audits  The purpose is to obtain information about a contractor’s accounting system, policies, procedures, internal controls, and financial position.  Borrows heavily from the COSO model  Over 100 questions  Risk assessment is scored on:  Internal controls  Each cost category (labor, ODC’s, Travel, Materials, etc.)  Financial capability (Z Score)  Risk is assessed at the contractor level, not at the contract level

3. Process for Conducting Audits 3  Utilize TeamMate  Annual planning:  Relies heavily on the ASR (risk assessment scores)  Takes into account prior audit findings, number of employees, size of the contracts assigned to the contractor and the Z score.  We assign audits based on risk. High risk contractors are assigned first  We audit contractors on a three year cycle  We audit ~$300M of subcontractor costs a year  15 auditors, each auditor is assigned between 12-20 audits a year, roughly 1,400 hours of audits (# of audits assigned depends on dollar value of contracts, complexity of audit and the number of PO’s to be audited)

4. Incorporating A-133 Audits 4  We are modifying our procedure steps to include a review of the universities A-133 and Financial Statement reports.  The purpose of the review will be to determine if there is increased risk associated with level of effort labor.  We will also review the other cost categories to include in the audit, but the primary purpose will be to determine if we can rely on the A-133 and F/S for purposes of testing level of effort reports.  Due to the fact that there is still risk associated with hourly employees, travel, subcontractors, materials and other ODCs, we will not rely on the reports for these cost categories.

5. Risk Assessment Process Slide 5 ASR Risk Rank Score Supplier Performance Evaluation ASR Probability of Bankruptcy # EmployeesPrior Audit Adjustment High risk with a “High” score High risks with a Blank, Poor or Unacceptable rating High risk with a “High” score High risk if less than or equal to 10 employees High risk if more than $10k in findings Low risk if greater than 100 employees Low risk if less than $2k in findings

6. Slide 6 Most Common Findings (Continued) Top 10 Findings by Year FY2011 FY2012 FY2013 FY2014 Billing Error $ (99,192) $ $ (24,085) $ (14,114) Incorrect Billing Rates (16,421) (188,353) (68,067) (11,008) Incorrect/Unallowable/Inconsistent Labor Categories (125,215) (20,254) (7,818) Overcharged/Undercharged Hours Labor and other Categories (3,652) 11,099 189 Unallowable Per Terms & Conditions (22,595) (13,485) (205,306) (53,551) Unsupported or No Documentation (9,065) (462,345) (214,885) (45,393) Amount Claimed / Incurred Differs from Supporting Documents invoiced (117,065) Application of final rates to audited costs/charges (30,938) (56,727) (50,156) (39,814) Charges / Costs Outside Period of Performance (5,296) (7,526) Charges / Costs Not Billed at Actual (53,097) Subcontractor claimed or billed at Prime's Labor Rates (10,329) Unreasonable (25,285) Not In Accordance with Per Diems (8,912) (18,516) (9,335) (33,703) Application of Rates to Final Per Audit Costs (Due to audit adjustment) 414,073 * (34,024) G&A not per Account System (8,132) Cost Transfers from non-SNL Contract/Unallocable to SNL (4,323) Sum of Error in Calculating Indirect Rates and Applied to Final Costs 495,698 * Total $ (213,559) $ 30,944 $ (684,505) $ (329,803)

7. QUESTIONS? 7