The Defense Contract Audit Agency is only good at one thing: covering their collective asses, and I'll bet you could say the same about every audit agency in the public sector.
During my CPA days, it took me one week to audit a nonprofit agency with 25 different federal funding sources. At DCAA, the risk assessment alone would take over a month. It was ridiculous, considering SOP was to establish risk at the highest level for every audit.
I made a living auditing for the DOJ IG (when America was still America-long before Obama). All that is needed is the actual will to audit these suspect agencies. There are plenty of excellent government auditors and they WILL find criminality where it exists.