DCAA Audit Preparation: A Complete Guide for Government Contractors

Understanding DCAA audits is not just about compliance — it is one of the most practical ways to learn how to win government contracts. Agencies awarding cost-reimbursement or Time-and-Materials (T&M) work need confidence that your accounting system can track costs accurately. A clean audit history is a competitive differentiator that contracting officers notice.

At its core, a DCAA audit asks one question: Can this contractor accurately track, allocate, and bill costs in a way that complies with federal rules? Those rules live primarily in two places: Federal Acquisition Regulation (FAR) Part 31, which defines which costs are allowable (recoverable from the government) and which are not ^[1], and the Cost Accounting Standards (CAS) at 48 CFR 9903, which govern how costs are measured, assigned, and allocated consistently ^[8]. If you are new to allowable versus unallowable costs, our deep dive into FAR 31 allowable and unallowable costs breaks down the rules in plain language.

DCAA does not perform a single type of audit. The two most common are the pre-award accounting system survey and the post-award incurred cost audit, but the agency also audits proposals, forward pricing rates, estimating systems, and compliance with Truthful Cost or Pricing Data requirements (formerly known as the Truth in Negotiations Act, or TINA). Each audit type has a different trigger, but they all trace back to the same question: are your numbers trustworthy?

Before a contracting officer awards you a cost-reimbursement or T&M contract, they will typically ask DCAA to evaluate whether your accounting system meets minimum standards. The evaluation uses Standard Form 1408 (SF 1408), a checklist of criteria your system must satisfy ^[9]. Think of it as a pass/fail exam for your financial infrastructure. The criteria include:

For a detailed walkthrough of each SF 1408 criterion and how to set up your system to pass, see our SF 1408 accounting system checklist. If you are preparing for a pre-award survey and need to present your company’s qualifications clearly, GovBidLab’s free Capability Statement Generator can help you articulate your controls and differentiators in a format contracting officers expect.

Once you hold a DoD contract, your accounting system falls under the Defense Federal Acquisition Regulation Supplement (DFARS) 252.242-7006, which sets more detailed criteria than SF 1408 and is administered by your Administrative Contracting Officer (ACO) ^[5]. This clause is part of a broader framework under DFARS 252.242-7005 (Contractor Business Systems), which covers six systems total: accounting, estimating, earned value management, material management, property, and purchasing ^[6].

Here is the part that gets experienced contractors’ attention: if DCAA or the ACO identifies a significant deficiency in your accounting system, the government can withhold up to 5% of your payments. If multiple business systems are found deficient, withholding can reach 10% ^[6]. For a company running on tight cash flow — which describes most small and mid-size contractors — a 5% or 10% payment withhold can be devastating. Our article on DFARS business systems and accounting requirements explains how the withhold mechanism works and how to respond if you receive a deficiency notice.

If you performed any work under a cost-reimbursement or other flexibly priced contract during a fiscal year, you are required to file an Incurred Cost Submission (ICS) within six months after your fiscal year ends ^[4]. For a contractor on a calendar fiscal year, that means a June 30 deadline. Miss it, and you risk payment suspension, adverse audit findings, and damaged credibility with your ACO.

The ICS is essentially a detailed accounting of every dollar you spent, organized so the government can verify that your claimed costs are allowable, allocable (properly assigned to the contracts that benefited from them), and reasonable. Most contractors prepare their ICS using the DCAA Incurred Cost Electronically (ICE) model, a standardized Excel workbook that DCAA provides ^[10]. The model includes a series of schedules, and understanding their purpose is critical:

Before DCAA even begins an incurred cost audit, they run an adequacy checklist against your submission ^[10]. If your ICS is incomplete — missing schedules, inconsistent totals, or lacking required certifications — it will be returned as inadequate, and the clock keeps ticking on potential penalties. For a step-by-step walkthrough of the ICS process and common adequacy failures, see our incurred cost submission ICS guide.

Passing a DCAA audit is not something you cram for the week before the auditor arrives. It is the result of systems, policies, and habits that run year-round. Here is how to build that infrastructure, layer by layer.

DCAA auditors expect to see written policies — not just practices you follow informally, but documented procedures for timekeeping, labor corrections, indirect rate development, unallowable cost identification, and billing. Desktop procedures (step-by-step instructions for how staff actually execute these policies) are equally important. If your policy says “employees must record time daily,” your desktop procedure should specify the system used, the deadline for daily entry, how corrections are initiated and approved, and what happens when someone misses a day.

A common mistake among newer contractors is treating policy documentation as a one-time exercise. Policies need to be reviewed and updated annually — and whenever your accounting system, organizational structure, or contract portfolio changes materially.

If there is one area where DCAA audits are relentless, it is timekeeping. The logic is straightforward: labor is typically the largest cost on a government contract, and the integrity of every other number — indirect rates, contract profitability, billing accuracy — depends on labor being recorded correctly. The rules are specific: employees must enter time daily, charges must reflect actual work performed on specific contracts or indirect activities, corrections must be employee-initiated, dated, and approved by a supervisor, and the system must prevent retroactive changes that cannot be traced ^[9].

DCAA also conducts floor checks — unannounced visits where auditors compare what employees say they are working on with what their timesheets show. Smart contractors conduct their own internal floor checks periodically to catch problems before an auditor does. If you find discrepancies, document them and the corrective action taken. That paper trail demonstrates a culture of compliance, which matters enormously to auditors.

Your chart of accounts (the master list of categories in your accounting system) should be designed to natively segregate expressly unallowable costs. FAR 31.205 identifies specific cost categories that cannot be recovered from the government, including entertainment (FAR 31.205-14), lobbying (FAR 31.205-22), bad debts (FAR 31.205-3), and fines and penalties (FAR 31.205-15) ^[1]. Rather than hoping someone remembers to flag these at billing time, set up dedicated accounts so these costs are captured and excluded automatically. This also directly feeds Schedule N of your ICS.

Practitioners take note: the distinction between expressly unallowable costs (specifically named in FAR 31.205) and costs that are simply not allocable to a government contract matters for penalty exposure. If an expressly unallowable cost is included in a claim, penalties under FAR 42.709 can apply — even if the amount is small. The safe harbor is to identify and segregate these costs proactively.

If you bill the government using indirect rates — fringe, overhead, G&A — you need to understand two parallel rate concepts. Your actual rates are calculated after the fiscal year closes and reported in your ICS. Your Provisional Billing Rates (PBRs) are the rates you use during the year to submit interim vouchers (invoices), established or adjusted by your ACO under FAR 42.704 to prevent substantial over- or underbillings ^[3].

A common pitfall is using stale PBRs — rates from a prior year that no longer reflect your current cost structure. If your business grew significantly (diluting indirect rates) or shrank (concentrating them), billing at outdated rates can produce systematic overbillings that raise red flags, or underbillings that strain your cash flow. Monitor your actual indirect rates monthly and request PBR adjustments when reality diverges materially from provisional rates. Our guide to indirect rate structures for overhead and G&A covers how to select allocation bases, structure pools, and document the rationale — all of which auditors will test.

Two regulatory frameworks frequently intersect with DCAA audits and deserve specific attention.

Cost Accounting Standards (CAS) apply when your CAS-covered contract awards reach certain thresholds. Modified CAS coverage generally applies to contracts of $7.5 million or more but less than $50 million. Full CAS coverage applies if your business unit received $50 million or more in net CAS-covered awards in the preceding cost accounting period ^[8]. Under modified coverage, you must follow CAS 401 (consistency in estimating, accumulating, and reporting costs) and CAS 402 (consistency in allocating costs for the same purpose). Full coverage adds substantially more standards. To verify your industry classification and check whether small-business exemptions might apply, GovBidLab’s free NAICS Code Lookup tool lets you confirm your NAICS code and associated SBA size standard quickly.

Truthful Cost or Pricing Data requirements (FAR 15.403-4) kick in when a contract action is expected to exceed $2,000,000 (threshold effective July 1, 2018) and no exception applies ^[2]. When triggered, you must certify that the cost or pricing data you submit is accurate, complete, and current. DCAA frequently audits proposals and forward pricing submissions associated with this requirement. Our article on Truthful Cost or Pricing Data thresholds explains the exceptions and what certification actually means.

For DoD contractors, DCAA audits do not exist in a vacuum. Your cybersecurity posture under the Cybersecurity Maturity Model Certification (CMMC) framework may also be reviewed alongside your business systems. GovBidLab’s free CMMC Calculator can help you assess where you stand.

When a DCAA auditor arrives, they will request a Prepared By Contractor (PBC) package — a set of documents you compile in advance so the audit can proceed efficiently. A well-organized PBC package signals competence and reduces the auditor’s inclination to dig deeper. A disorganized one signals risk and invites expanded testing. Your PBC should include:

Before providing audit correspondence, confirm that your entity data is current in the System for Award Management (SAM.gov). GovBidLab’s free UEI Lookup tool lets you quickly verify that your Unique Entity Identifier (UEI) and registration details are accurate and consistent with what auditors will see.

Experienced practitioners will recognize these, but if you are newer to government contracting, understanding these common failures will help you know where to focus your preparation. Missing or inconsistent timecard approvals remain the single most frequent finding — one unapproved timesheet in a sample can cast doubt on your entire labor system. Payroll not reconciling to the general ledger suggests your accounting system cannot reliably track labor costs. Failure to exclude expressly unallowable costs from indirect pools is both a common finding and a penalty risk. Weak or undocumented rationale for allocation bases — why you use direct labor dollars instead of total cost input for overhead, for example — invites the auditor to substitute their own judgment. Unsupported intercompany transfers (charges between related entities) are scrutinized heavily because they present opportunities for cost manipulation. Stale provisional billing rates that have not been updated for the current year often produce systemic overbillings. And incomplete ICS schedules, particularly Schedules H, I, and J, will get your submission returned as inadequate before an audit even begins.

The most effective mitigation is a self-assessment program. At least annually, evaluate your accounting system against the SF 1408 criteria and DFARS 252.242-7006 requirements. Conduct mock floor checks. Run your ICS through the DCAA adequacy checklist before submission. These steps materially reduce the risk of findings and demonstrate to auditors — and to contracting officers evaluating you for future awards — that your systems are trustworthy. In the world of cost-reimbursement contracting, that trust is how to win government contracts over competitors who may offer lower rates but cannot demonstrate reliable cost controls.

If you are a subcontractor, DCAA can still audit you — particularly if you hold cost-reimbursement subcontracts or if your prime contractor’s ACO requests an audit of your costs. Your obligations under FAR Part 31 and CAS (if applicable) do not change simply because you are not the prime. The prime contractor is also responsible for ensuring that the costs they pass through from subcontractors are allowable, allocable, and reasonable, which means they will scrutinize your invoices and may request supporting documentation that mirrors a PBC package.

If you are a prime contractor managing subcontractors, your ICS Schedule J must detail subcontract costs, and you should maintain files that demonstrate you evaluated those costs for compliance before including them in your billings. Weak subcontract oversight is a growing area of DCAA focus.

Everything in this article — the policies, the timekeeping discipline, the rate logic, the unallowable cost segregation — serves a purpose beyond audit survival. When a Source Selection Evaluation Board reviews your proposal for a cost-reimbursement contract, one of the evaluation factors is often accounting system adequacy. An approved accounting system is frequently a pre-condition for award. Understanding how to win government contracts in the cost-reimbursement space means understanding that your back office is part of your competitive advantage. A clean audit history, a well-documented rate structure, and a system that can withstand DCAA scrutiny all signal to the government that you are a low-risk partner — and that signal wins awards.

For firms looking to expand into cost-type work, learning how to win government contracts starts with building the infrastructure described in this article before you submit your first proposal — not after you receive your first audit notification.

Start with a self-assessment. Download the SF 1408 form and score your current accounting system against each criterion, noting gaps honestly. If you have never filed an ICS, download the DCAA ICE model and begin mapping your chart of accounts to its schedules — even before you have a cost-type contract. Fixing gaps now, when the stakes are low, is far cheaper and less stressful than fixing them under audit. If your system has gaps you cannot close internally, bring in a government contract accounting consultant to help you build the infrastructure right the first time. Visit our free tools page to verify your entity data, NAICS codes, and cybersecurity readiness as part of your overall compliance posture.