Your Accounting System Failed a DCAA Audit: What Happens Next

The email from your Administrative Contracting Officer arrives on a Tuesday afternoon. Subject line: Initial Determination of Material Weakness, Accounting System. The attachment lists nine deficiencies across your cost accumulation, labor distribution, and indirect rate allocation processes. Your accounting system, the one your team built over three years and two contract wins, has been found inadequate.

Panic is normal. Shutting down is not an option. The clock starts the moment you open this notice, and every day without a response moves you closer to payment withholding, contract restrictions, and the kind of scrutiny most contractors never recover from quickly.

Recovery follows a specific regulatory process with defined deadlines, required documentation, and measurable benchmarks. Contractors who understand this process and act within the first two weeks have a measurably different outcome than those who wait.

A DCAA audit failure triggers a formal determination process under DFARS 252.242-7006 and DFARS 252.242-7005. The Administrative Contracting Officer (ACO) issues an initial determination of material weakness. The contractor then has a defined window to respond with corrections or a corrective action plan. Amerifusion Bookkeeping helps government contractors build corrective action plans the ACO will approve and implements the accounting system changes needed to pass the follow-up review.

What “Inadequate” Actually Means Under DFARS

An accounting system determination of inadequacy means the ACO has concluded your system contains one or more material weaknesses as defined by DFARS 252.242-7005. A material weakness is a deficiency, or combination of deficiencies, in internal controls over contractor business system information where a reasonable possibility exists of a material misstatement going undetected or uncorrected.

Before January 2025, DFARS used the term “significant deficiency” for this threshold. The DoD finalized a rule change replacing “significant deficiency” with “material weakness” to align with Generally Accepted Auditing Standards (GAAS) [DFARS Case 2021-D006]. The practical effect: the bar for what triggers payment withholding and corrective action now uses the same language your external auditors use.

DFARS 252.242-7006 lists the specific criteria your accounting system must satisfy. The clause contains 18 adequacy criteria covering everything from segregation of direct and indirect costs to timely recording of costs, exclusion of unallowable charges, and proper billings reconciled to cost accounts [DFARS 252.242-7006(c)]. Failure on any criterion where the deficiency rises to a material weakness triggers the formal process.

One distinction matters: not every audit finding equals a material weakness. An auditor might note a procedural gap without concluding it creates a reasonable possibility of material misstatement. The ACO makes the final call on whether findings cross the material weakness threshold, sometimes disagreeing with the DCAA auditor’s recommendation.

The Recovery Timeline: Day 1 Through System Re-Approval

The formal process follows a specific sequence with regulatory deadlines. Missing any deadline weakens your position and accelerates withholding. Here is the step-by-step timeline from initial notice to system re-approval.

1. Day 0: Initial Determination Received. The ACO issues a written initial determination identifying specific material weaknesses. This is not a final decision. You have the right to respond.
2. Days 1-30: Contractor Response Period. You submit a written response to the ACO addressing each identified weakness. This response should acknowledge valid findings, dispute any you believe are incorrect (with evidence), and outline your intended corrective approach.
3. Day 30-45: ACO Reviews and Issues Final Determination. The ACO considers your response and issues a final determination. If the ACO sustains the material weakness findings, the final determination triggers the 45-day corrective action clock.
4. Days 45-90: Corrective Action Plan Submission. Within 45 days of the final determination, you must either correct all material weaknesses or submit an acceptable corrective action plan (CAP) with milestones and completion dates [DFARS 252.242-7005(e)].
5. Days 90-180+: Implementation and Monitoring. The ACO monitors your progress against the CAP milestones. You provide evidence of completed corrective actions.
6. Verification Review. The ACO, often with DCAA or DCMA support, conducts a verification review to confirm corrections are implemented in both policy and practice.
7. System Re-Approval. The ACO issues a written determination approving the previously disapproved system. Payment withholding stops.

Typical end-to-end duration from initial determination to re-approval: 90 to 180 days for contractors who act immediately. Contractors who delay responses or submit weak corrective action plans face timelines stretching past 12 months.

Payment Withholding: The Financial Pressure Point

Payment withholding is not theoretical. DFARS 252.242-7005 gives the ACO authority to withhold 5 percent of progress payments and performance-based payments when a contractor business system contains unresolved material weaknesses. This withholding begins after the final determination if the contractor has not corrected the weaknesses or submitted an acceptable CAP within 45 days.

The withholding drops to 2 percent once the contractor submits an acceptable corrective action plan and the ACO confirms the plan is being effectively implemented [DFARS 252.242-7005(e)]. The total withholding across all six contractor business systems (accounting, estimating, EVMS, MMAS, property, purchasing) is capped at 10 percent.

For a contractor billing $500,000 per month, 5 percent withholding means $25,000 per month held back. Over a six-month remediation period, $150,000 sits in government hands instead of your operating account. For small contractors already managing tight cash flow on cost-reimbursable contracts, this creates a secondary crisis on top of the compliance problem.

Withheld amounts are released after system re-approval. They are not forfeited. But the cash flow gap during remediation forces many small contractors to draw on credit lines or delay vendor payments, creating downstream problems unrelated to the original audit finding.

What a Corrective Action Plan Must Contain

A corrective action plan is not a letter promising to do better. The ACO expects a structured document addressing each material weakness individually, with specific actions, responsible parties, evidence of completion, and target dates. A vague CAP gets rejected, and the 5 percent withholding continues.

Every effective CAP contains these elements for each material weakness:

1. Root Cause Analysis. Identify why the deficiency exists, not what the deficiency is. “Timekeeping entries are not recorded daily” describes the symptom. “No automated daily reminder system, no supervisor review queue, and no written policy requiring same-day entry” identifies the root cause.
2. Specific Corrective Actions. List each action required to eliminate the weakness. “Implement DCAA-compliant timekeeping software with daily lockout” is specific. “Improve timekeeping procedures” is not.
3. Responsible Party. Name the person accountable for each action. Titles alone are insufficient. The ACO wants to know who owns the fix.
4. Milestone Dates. Assign a realistic completion date to each action. Milestone dates should be aggressive enough to show urgency but achievable enough to hold. Missing your own milestones damages credibility with the ACO.
5. Evidence of Completion. Define what proof you will provide for each corrective action: revised written policy, system screenshot, training sign-off sheet, sample transaction report, or updated chart of accounts.
6. Interim Controls. Describe what manual controls you will put in place while permanent corrections are being implemented. The ACO needs to know costs are being properly tracked during the remediation period.

We see contractors submit CAPs that address symptoms instead of root causes. An auditor who finds unallowable costs in the overhead pool does not want a promise to “review costs more carefully.” The auditor wants a documented review process, a segregated unallowable cost account in the chart of accounts, a quarterly reconciliation procedure, and training records showing staff understand FAR 31.205 cost categories [FAR 31.205, CAS 405].

The Five Material Weaknesses DCAA Reports Most Often

Knowing the most common findings helps you anticipate what your CAP must address. DCAA auditors test against the 18 criteria in DFARS 252.242-7006(c), but certain criteria generate findings far more frequently than others.

1. Timekeeping deficiencies. Employees not recording labor daily. Missing supervisor approvals. No after-the-fact correction policy. No written timekeeping procedures. DCAA treats timekeeping as the foundation of labor cost reliability, and it is the first area tested in almost every accounting system audit.
2. Failure to segregate unallowable costs. Entertainment [FAR 31.205-14], alcohol [FAR 31.205-51], lobbying [FAR 31.205-22], and fines mixed into indirect cost pools instead of identified and excluded. CAS 405 requires contractors to identify and exclude unallowable costs. The fix requires dedicated accounts in the chart of accounts and a documented review process.
3. Inconsistent indirect cost allocation. Costs charged to the wrong pool (overhead vs. G&A), allocation bases changing year-to-year without disclosure, or methods shifting between contracts. CAS 402 and CAS 418 govern consistency requirements.
4. Missing or inadequate written policies. DCAA expects written accounting policies covering cost accumulation, timekeeping, compensation, travel, direct and indirect charging, and unallowable cost identification before contract performance begins. Verbal policies are not policies.
5. Labor mischarging. Direct labor charged to wrong contracts, indirect labor classified as direct, or engineering hours billed to contracts receiving no benefit. Proper labor distribution requires job-cost tracking at the individual employee level with regular reconciliation between timesheets and the general ledger.

A contractor with three or more of these findings faces a longer remediation path because the deficiencies are interconnected. Fixing timekeeping without fixing written policies leaves the root cause unresolved. Fixing indirect allocation without fixing unallowable cost segregation means the corrected pools still contain tainted costs.

How to Request and Prepare for the Follow-Up Review

The follow-up review is not automatic. Once you have completed all corrective actions in your CAP, you must formally notify the ACO in writing and request a verification review. Include the evidence of completion for each milestone: updated policies, system configurations, sample reports, training records, and reconciliation documentation.

The ACO decides whether to conduct the review using DCAA auditors, DCMA functional specialists, or both. Preparation for this review requires the same discipline as preparing for the original audit, with one addition: you must demonstrate the corrective actions are embedded in daily operations, not performed once for the review.

Three practices separate contractors who pass the follow-up review from those who face a second round of findings:

1. Run your own internal audit first. Before requesting the verification review, test every corrective action against the original findings. Pull sample transactions. Review timesheets from the past 60 days. Reconcile indirect cost pools. Find your own gaps before the ACO’s team finds them.
2. Document the operating history. A new written policy dated last week proves nothing. Three months of transactions processed under the new policy, with supervisor sign-offs and reconciliation reports, proves the correction is real. The ACO distinguishes between “implemented” and “sustained.”
3. Brief your staff. During the original audit, DCAA auditors interview employees about timekeeping procedures, cost charging practices, and policy awareness. The follow-up review includes the same interviews. Your employees need to know the corrected procedures before the auditor arrives, not during the visit.

Requesting the follow-up review too early is worse than waiting an extra month. A failed verification review resets the process and signals to the ACO that your corrective actions were cosmetic. Wait until you have at least 60 to 90 days of clean operating history under the new procedures before requesting the review.

After Re-Approval: Preventing the Next Finding

System re-approval does not mean the scrutiny ends. Contractors whose systems were previously disapproved face heightened audit attention for the next two to three audit cycles. The ACO and DCAA auditors revisit the corrected areas specifically to confirm the fixes held.

Build three permanent safeguards into your operations:

• Quarterly self-assessments. Review your accounting system against the 18 criteria in DFARS 252.242-7006(c) every quarter. A two-hour internal review prevents a six-month remediation cycle.
• Annual policy updates. Written policies grow stale. Compensation benchmarks change. FAR thresholds adjust. Review and update every written accounting policy at least annually, and document the review even when no changes are needed.
• CPA-supervised monitoring. A qualified CPA with GovCon experience reviews your indirect rate structures, cost pool allocations, and unallowable cost segregation on a recurring basis. Internal staff often miss the same patterns an outside reviewer catches immediately. Amerifusion provides this as part of our DCAA compliance services.

The contractors who never face a second inadequacy determination are not the ones with the best software. They are the ones with documented processes, trained staff, and regular oversight by someone who understands what DCAA tests and why.

Frequently Asked Questions

Key Takeaways

• Respond within the first two weeks. The initial determination gives you time to respond before the final determination. Use this window to acknowledge valid findings, gather evidence to dispute incorrect ones, and begin drafting your corrective action plan.
• Submit a CAP within 45 days of the final determination to reduce payment withholding from 5 percent to 2 percent. Every day past the deadline costs money.
• Address root causes, not symptoms. A CAP listing “improved procedures” without specific actions, named owners, milestone dates, and defined evidence of completion will be rejected.
• Wait for 60 to 90 days of clean operating history before requesting the verification review. A failed follow-up is worse than a delayed one.
• Build quarterly self-assessments into your operations. The contractors who avoid repeat findings are the ones testing their own systems against DFARS 252.242-7006(c) criteria before the auditor does.

A DCAA audit failure is a recoverable event when you treat it as a systems problem, not a paperwork exercise. The regulatory process is defined. The deadlines are published. The corrective action plan structure is known. What separates contractors who recover in 90 days from those still fighting at 18 months is the speed and specificity of their response. Take our Compliance Readiness Check to identify gaps before the auditor does, or book a discovery call to discuss your corrective action plan with a CPA who has done this before.