What DCAA Is and Who Gets Audited
The Defense Contract Audit Agency (DCAA) is the federal government's primary watchdog for contractor accounting. It operates under the Department of Defense but also supports other agencies like NASA, DHS, and the Department of Energy when requested. Its core job: verify that costs charged to the government are allowable, allocable, and reasonable under FAR Part 31 — the federal cost principles that govern what the government will actually pay for.
If you only pursue firm-fixed-price contracts, DCAA rarely touches you. The agency's primary mandate covers cost-reimbursable contracts, time-and-materials (T&M) contracts, and labor-hour contracts — anywhere the final cost to the government isn't locked in up front. The government takes on more risk under these contract types, so it requires more visibility into how you spend its money.
That said, DCAA can and does audit contractors pursuing cost-type work even before a contract is awarded. A pre-award accounting system audit is a standard part of the procurement process for many cost-reimbursable contracts above the simplified acquisition threshold. If your system doesn't pass, the contracting officer may not award you the contract — full stop.
DCAA FY2024 by the numbers
In fiscal year 2024, DCAA examined $599.8 billion in contract costs, identified $15.9 billion in audit exceptions, and achieved $5.1 billion in net savings for the government — a return of $7.20 for every dollar the agency spent on audits. DCAA issued 2,465 audit reports and supported 421 fraud cases that recovered $227.3 million. The forward pricing audit alone generated an $11.70:$1 ROI. These numbers explain why the government invests heavily in this audit function.
Small businesses often assume DCAA only chases the large defense primes. That's wrong. DCAA has specific audit programs targeting smaller contractors, particularly those receiving SBIR/STTR awards, cost-type contracts under DARPA, NIH, or DoD programs, and contractors moving from fixed-price to cost-reimbursable work. If you're growing your federal footprint and adding cost-type contracts, DCAA is coming eventually. Prepare now, not after the notification letter arrives.
The Four Types of DCAA Audits
DCAA doesn't run one kind of audit. There are four distinct types, each triggered at a different point in the contract lifecycle. Knowing which one applies to your situation tells you exactly what to prepare for.
Pre-Award Accounting System Audit (SF 1408)
Triggered before a cost-reimbursable or T&M contract is awarded. DCAA evaluates whether your accounting system is designed to track government contract costs in compliance with FAR Part 31 and DFARS 252.242-7006. This is a pass/fail review — the contracting officer uses the result to determine if you're eligible for the award at all.
Incurred Cost Audit
Happens after the fiscal year ends. If you have cost-reimbursable contracts, you must submit an Incurred Cost Submission (ICS) within six months of your fiscal year-end under FAR 52.216-7. DCAA then audits this submission to reconcile your provisional billing rates against your actual costs and determine final rates. The incurred cost audit ROI for the government is $3.50:$1.
Forward Pricing Audit
Performed before a contract is awarded or modified when the proposed cost exceeds certain thresholds. DCAA evaluates whether your cost estimates for future work are current, accurate, and complete. Direct labor rates, overhead rates, fringe benefits — all of it gets scrutinized. The government uses this audit to negotiate a fair price. Its ROI is the highest of any audit type: $11.70 for every dollar spent.
Labor Floor Check (Real-Time Labor Audit)
DCAA auditors show up — sometimes unannounced — and interview employees about their time charges. They're verifying that the hours billed to government contracts match what employees actually worked. Previously called MAARS 6 audits, these floor checks can happen at any time during contract performance. A poor result can put your entire contract portfolio at risk.
You won't necessarily face all four. Your exposure depends on which contract types you hold and how much risk the government is taking on. But the accounting system requirements that support you through all of them are essentially the same — so building the right foundation once covers you across the board.
The SF 1408 Pre-Award Audit
Standard Form 1408 is the checklist DCAA uses to evaluate your accounting system before you're awarded a cost-type contract. It's not a financial audit in the traditional sense — auditors aren't reconciling your books. They're determining whether your system design is capable of producing the data the government needs to oversee the contract.
Three regulatory sources define what "adequate" means: DFARS 252.242-7006 (which lists 18 specific criteria for DoD contracts), SF 1408 itself (the pre-award design checklist), and FAR Part 31 (the cost principles governing what costs are allowable, allocable, and reasonable). You need to satisfy all three frameworks simultaneously.
The SF 1408 evaluates six broad areas:
| SF 1408 Area | What Auditors Are Checking |
|---|---|
| Cost segregation | Direct vs. indirect costs clearly separated; no commingling |
| Job cost accumulation | Costs tracked by individual contract, project, or task order |
| Indirect rate identification | Overhead, G&A, and fringe benefit pools clearly defined and consistently applied |
| Accounting basis | Accrual-based accounting (cash basis fails this requirement) |
| Labor distribution | Daily timesheets with supervisor review and employee certification |
| Audit trail | Complete, traceable documentation from source to ledger |
The 'DCAA approved' myth
DCAA does not "approve" accounting systems. What DCAA does is issue an audit opinion — adequate or inadequate — to the contracting officer. The contracting officer then decides whether to award. If your system is found inadequate, you can fix the deficiencies and request a follow-up review. But a negative opinion can delay or kill an award while your competition waits. Don't confuse a vendor claiming "DCAA approved" software with your system actually being audit-ready. The software is a tool. Your documented processes, written policies, and consistent execution are what DCAA actually evaluates.
One critical point about cash-basis accounting: if you're currently tracking income and expenses on a cash basis (when money actually moves), you must convert to accrual before you can pass SF 1408. Accrual accounting records revenue when earned and expenses when incurred — not when cash changes hands. This is a non-negotiable DCAA requirement and frequently surprises small businesses that have used cash-basis bookkeeping since day one.
Incurred Cost Submissions
If you hold a cost-reimbursable contract with the FAR clause 52.216-7 (Allowable Cost and Payment), you're required to file an Incurred Cost Submission (ICS) each year — within six months of your fiscal year end. Miss that deadline and you're technically in contract noncompliance, which can trigger a demand for reimbursement of all provisional payments until final rates are established.
The ICS reconciles the provisional billing rates you used during the year (what you billed the government month-to-month) against your actual costs. If your actual overhead rate was lower than what you provisionally billed, you owe the government a refund. If it was higher, the government owes you more. The ICS is how that settlement happens.
DCAA uses the ICS adequacy checklist to determine if your submission is complete enough to audit. An inadequate submission gets kicked back — and the clock doesn't restart. You've still burned time while your submission sat in a queue. The checklist requires schedules covering direct costs by contract, indirect cost pools and bases, fringe benefit costs, subcontract costs, and a reconciliation of total costs to your general ledger. It's not simple, but it's predictable. Run the checklist before you submit.
Voluntary deletions: a smart move
In FY2024, contractors submitted voluntary deletions totaling $4.2 billion across 1,229 incurred cost submissions — costs that contractors themselves identified as unallowable and removed before DCAA had to flag them. This matters for two reasons. First, DCAA views voluntary deletions favorably — they signal an adequate internal control environment. Second, if DCAA finds unallowable costs you missed, you're subject to penalties of up to 100% of the disallowed amount under FAR 42.709. Proactively removing unallowable costs protects both your relationship with the agency and your wallet.
Not sure if you're DCAA-ready?
CapturePilot's Quick Checker reviews your certifications, contract history, and compliance readiness in minutes. Know where you stand before a contracting officer asks.
Check your eligibility free2025 Rule Changes That Affect You
Two significant changes took effect in 2025 that every government contractor with cost-type work needs to understand.
The material weakness change. On January 17, 2025, a final rule amending DFARS took effect, implementing Section 806 of the National Defense Authorization Act for FY2021. The rule formally replaced the term "significant deficiency" with "material weakness" in contractor business system audits. This isn't just a terminology tweak. A material weakness is defined as a deficiency, or combination of deficiencies, that represents a substantial probability that a material misstatement of contract costs won't be prevented or detected on a timely basis.
The practical effect: DCAA issued a memorandum on May 13, 2025 providing revised audit guidance aligned with this new standard. Auditors are now moving detailed procedures into risk assessment sections, signaling a more deliberate risk-based approach. High-risk areas get more scrutiny; lower-risk areas may get less. For small businesses with adequate systems, this can mean faster audits. For businesses with gaps, the focus is now sharper.
The staffing reality. DCAA headcount has been declining despite investments in audit automation and AI tools. The practical consequence: incurred cost audit backlogs persist, which can mean your ICS sits unaudited for years. That may sound like a relief, but it creates a different risk — open years with unsettled indirect rates create accounting uncertainty that can complicate future proposals, line of credit applications, and M&A due diligence. Getting audited and having rates finalized is actually in your interest.
Risk-based auditing: what it means for you
DCAA's shift to risk-based auditing means your audit experience depends heavily on your compliance history. Contractors with documented deficiencies, late ICS submissions, or previous adverse findings will attract more scrutiny. Contractors with clean records, timely submissions, and strong internal controls may find audits faster and less invasive. The investment in building a solid compliance program pays forward — each clean audit makes the next one easier.
The Most Common Deficiencies
DCAA deficiencies cluster around a handful of recurring problems. Knowing the pattern lets you fix these before an auditor finds them.
Timekeeping violations
Timekeeping irregularities have led to more DCAA criminal investigations than any other accounting system anomaly. The issues are almost always the same: employees completing timesheets days or weeks after the fact rather than daily, supervisors making unauthorized corrections to subordinates' timesheets, employees not recording uncompensated overtime, and no written timekeeping policy. DCAA wants daily completion, employee certification, and a documented correction process with supervisor authorization and reason codes.
Inadequate direct/indirect cost segregation
Many small businesses — especially those that started with commercial work — don't maintain a clear separation between costs that are direct to a specific contract and costs that benefit multiple contracts (indirect). When these get lumped together, your billing is inaccurate, your indirect rates are wrong, and you're in violation of FAR Part 31. The fix requires a chart of accounts redesigned around the direct/indirect distinction, not commercial cost categories.
Unallowable costs buried in overhead
FAR Part 31 lists specific costs the government will not reimburse: entertainment, certain marketing costs, fines and penalties, alcohol, lobbying expenses, and more. When these costs flow through overhead pools without being identified and excluded, they get billed to government contracts — and that's a material finding. The solution is a consistent process for flagging and segregating unallowable costs before they enter your indirect pools.
No written policies and procedures
DCAA doesn't just evaluate what you do — it evaluates whether you can prove what you do consistently. If your timekeeping practices, cost classification rules, and indirect rate calculation methods only exist in someone's head, the audit will find them inadequate. You need written procedures for every key compliance area, and those procedures need to match your actual practice.
Cash-basis accounting
Using cash-basis accounting is an automatic failure on SF 1408. Accrual accounting is required. Small businesses that started on QuickBooks with cash-basis settings and never converted often discover this problem only when they're deep into the proposal process for their first cost-type contract.
Building a DCAA-Ready Accounting System
A DCAA-compliant accounting system isn't a single piece of software — it's a combination of the right software, a properly structured chart of accounts, documented policies, and consistent employee behavior. Here's what you need to build.
Restructure your chart of accounts
Create distinct account codes for each direct cost category (labor, materials, subcontracts, ODCs) and each indirect cost pool (fringe, overhead, G&A). Every transaction should code to one and only one account. The government needs to be able to trace any cost from your invoice back through your records to a source document — receipt, timesheet, subcontract invoice — without ambiguity.
Implement a job costing structure
Every contract — and every contract line item number (CLIN) if required — needs its own job code. Costs accumulate at the job level. This lets you produce contract-level cost reports that reconcile directly to what you've billed the government. If your accounting system can't produce a cost report by contract showing direct labor, materials, and applied indirect costs, it's not ready.
Establish and document indirect rate pools
Define your indirect cost pools (fringe benefits, overhead, G&A), what costs belong in each, and the allocation base for each pool. Apply these pools consistently. Your written indirect rate plan should describe the pools, bases, and calculation methodology — and it should match exactly what your accounting system is actually doing. Inconsistency between your documented methodology and your actual practice is a DCAA finding.
Build a daily timekeeping process
Every employee who charges time to government contracts must complete a timesheet daily — not weekly, not at month-end. Each timesheet must be certified by the employee, reviewed and approved by a supervisor, and any corrections must be made using an authorized process with a reason code, not by overwriting the original entry. This is the single highest-risk area in any DCAA audit. Build the process before you have your first cost-type contract.
Identify and exclude unallowable costs
Create a written policy listing FAR Part 31 unallowable costs. Train the people who code transactions. Set up specific general ledger accounts for unallowable costs so they can never be swept into indirect pools. Review these accounts regularly. When you submit your ICS, proactively exclude these costs as voluntary deletions — it signals compliance and avoids penalties.
Software That Passes the Test
No software is inherently "DCAA compliant." DCAA audits your practices, not your software. But some accounting platforms are built with government contracting requirements in mind, making compliance significantly easier to maintain. Here's how the major options stack up for small businesses:
| Software | Best For | Key Consideration |
|---|---|---|
| Deltek Costpoint | Mid-to-large contractors ($10M+ revenue) | Full-featured, high cost, significant implementation effort |
| Unanet GovCon | Growing small businesses ($1M–$20M) | Cloud-based, good balance of features vs. complexity |
| WrkPlan | Early-stage small contractors | Purpose-built for small GovCon, lower cost entry point |
| eFAACT | QuickBooks users who need a bridge solution | Integrates with QuickBooks, adds GovCon-specific reporting |
| QuickBooks (alone) | Not suitable as a standalone solution | Meets some SF 1408 criteria but requires significant add-ons and policy infrastructure to pass |
QuickBooks is the most common accounting system for small businesses, but it doesn't pass an SF 1408 pre-award audit on its own. It lacks job cost accumulation by contract line item, doesn't enforce daily timekeeping, and doesn't natively identify unallowable costs. You can make QuickBooks work with the right add-ons, documented policies, and a GovCon-savvy accountant — but it requires meaningful setup and ongoing discipline. If you're planning to pursue cost-type contracts with any regularity, a purpose-built platform is a better long-term investment.
The software conversation is also a distraction from what actually matters: your people and your processes. DCAA auditors interview employees. They ask whether your timekeeping policy is followed in practice. They look for evidence that your written procedures match your actual behavior. No software vendor can give you that. Training, enforcement, and culture do.
Track your compliance readiness alongside your pipeline
CapturePilot's pipeline and intelligence tools help you track which opportunities require DCAA-compliant accounting, so you know exactly which contracts will trigger an audit — before you submit a proposal.
Your Pre-Audit Action Checklist
Whether you're preparing for a pre-award SF 1408 review or getting ready to submit an incurred cost proposal, this checklist covers the essentials. Work through it before any DCAA contact, not during.
Accounting basis
Confirm you're on accrual-based accounting. If on cash basis, initiate conversion before any cost-type proposal.
Chart of accounts
Verify direct and indirect cost accounts are clearly separated. No mixed accounts that serve both purposes.
Job cost structure
Every contract has its own job code. Cost accumulation is tracked by contract, not just by cost category.
Indirect rate pools
Document fringe, overhead, and G&A pools. Confirm the pools, bases, and methodology are in writing and match the system.
Unallowable cost accounts
Review FAR Part 31.205 for the unallowable cost list. Confirm you have accounts for these costs and they're excluded from indirect pools.
Timekeeping policy
Written policy exists requiring daily timesheet completion. Correction procedures are documented. Employees have been trained.
Timekeeping practice
Verify employees actually complete timesheets daily. Pull a sample from the last 30 days and confirm dates of completion.
Written procedures manual
You have documented procedures for labor charging, cost classification, billing, and indirect rate calculation.
ICS readiness (if applicable)
If you hold cost-type contracts, know your ICS due date. Build the required schedules from your accounting system before the deadline.
Voluntary deletion review
Before submitting an ICS, run a review of indirect pool costs for unallowable items. Remove them as voluntary deletions.
Employee awareness
Employees who charge time to government contracts understand why daily timekeeping is required and what happens in a floor check.
Outside advisor review
A GovCon CPA or compliance consultant has reviewed your system in the last 12 months. Fresh eyes catch what internal reviews miss.
A professional mock audit — where a GovCon accountant or consultant walks through your system the same way a DCAA auditor would — is worth doing at least once before your first real DCAA engagement. It will surface gaps that look invisible from inside and cost far less than a failed pre-award review or a material weakness finding on a live contract.
Related Reading
FFP, T&M, IDIQ: What These Contract Types Mean for You
Understanding which contract types trigger DCAA requirements and how to think about the tradeoffs.
Government Contract Pricing: Strategies to Win Without Losing Money
How indirect rates, cost pools, and overhead affect your pricing — and why DCAA compliance makes pricing more accurate.
Past Performance in Government Contracts
How to build a track record that supports future proposal submissions, including cost-type work.
The Capture Management Process
How to qualify opportunities earlier — including knowing which ones require DCAA-ready accounting before you bid.
Know what's coming before DCAA does
CapturePilot helps you track the opportunities in your pipeline — including which contract types will trigger DCAA requirements, which certifications keep you in the running, and what your compliance posture looks like against the contracts you're pursuing.