DCAA Audit Preparation: The 90-Day Playbook

You cannot prepare for a DCAA audit in the days between the notification letter and the deadline it sets. The work has to be done before the letter arrives, and this playbook lays it out across ninety days in the order an auditor will look at it. The letter itself is short: DCAA letterhead, your company name, a contract number, and a list of records due in three business days. Your accounting manager is on vacation. Your timesheets live in three different spreadsheets. The last time anyone reconciled your labor distribution report was seven months ago.

DCAA audit preparation follows a structured approach: self-assessment of your accounting system against DFARS 252.242-7006 criteria, remediation of identified gaps, and readiness testing against DCAA’s own SF 1408 checklist. DCAA identified over $18 billion in audit exceptions in FY2025, though only a small share of that came from incurred cost audits. Contractors who self-audit and correct deficiencies before fieldwork begins experience shorter audits, fewer findings, and reduced risk of payment withholding under DFARS 252.242-7005.

This withholding only applies to CAS-covered contracts. Small businesses are exempt from CAS at any contract value under 48 CFR 9903.201-1(b)(3), so if you qualify as a small business, this withholding does not reach you. An inadequate accounting system still matters, because FAR 16.301-3(a)(3) blocks new cost-reimbursement awards until your system is adequate.

The most predictable finding is the timesheet-to-labor-distribution reconciliation gap. DCAA uses that comparison as its first audit step, and when the numbers do not tie, even by a small amount, the scope expands. Reconciling monthly, as part of the close, keeps it from becoming a fieldwork issue at all.

Treated as a weekend project, preparation is a folder-tidying exercise: pull some files, organize some folders, hope for the best.

DCAA identified $18.8 billion in total audit exceptions in FY2025 across 9,527 engagements covering $788 billion in contract costs [DCAA Annual Report to Congress FY2025, Table 1]. That headline gets quoted a lot. Read the breakdown before you take fright at it.

Forward pricing produced $10.6 billion of it. Incurred cost audits produced $1.01 billion, against $302.9 billion examined [Table 1]. That is roughly a third of one percent. The number that frightens contractors is dominated by pre-award pricing work, not by the post-award audit this playbook prepares you for.

Two more figures set the odds honestly. Only 42.6% of incurred cost exceptions were sustained by contracting officers [Table 6], so an exception is an opening position rather than a bill. And the deterrent works before anyone arrives: in FY2025 contractors voluntarily removed over $3.8 billion in unallowable costs from their submissions before the audits even began.

Preparation that starts after the audit notice is damage control. The 90-day framework below is designed for contractors who want to resolve compliance gaps before an auditor discovers them, because the cost of voluntary remediation is a fraction of the cost of a questioned-cost finding, a penalty assessment, or a system disapproval determination.

DCAA audit preparation follows a 90-day phased approach: 30 days of self-assessment, 30 days of remediation, and 30 days of readiness testing. It addresses the root cause of audit failures, which is discovering a problem at the same moment the auditor does.

What Is the First Test in a DCAA Audit?

DCAA auditors follow a predictable opening sequence when they arrive at your office or request initial records. The first comparison is almost always timesheets against the labor distribution report (LDR). If recorded hours on individual timesheets do not match the summary hours on your LDR, the auditor flags your entire labor charging system for expanded review. Accurate labor distribution is required under FAR 52.216-7, which mandates reconciliation of payroll records to labor cost distribution as part of your incurred cost submission.

This matters because labor is the largest cost category for most GovCon contractors. A timesheet showing 6 hours on Contract A while the LDR shows 8 hours tells the auditor your internal controls have a gap. One discrepancy triggers sampling. Sampling triggers a full labor audit covering months or years of charges.

The fix is a monthly step, not a project: reconcile every employee’s timesheet total against the LDR before closing the accounting period. Run it every month and the auditor’s first test becomes your strongest evidence of compliance. Skip it and a small discrepancy sits in the record until sampling finds it, by which point the scope covers every month you did not check.

Days 1 to 30: Self-Assessment Phase

DCAA audit preparation starts with finding problems before the auditor does. Pull three months of records and test them against the same standards DCAA applies. This phase produces the highest return on preparation time because voluntary corrections cost nothing, while DCAA findings can trigger significant penalty exposure.

For expressly unallowable costs that appear in a final indirect cost rate proposal, FAR 52.242-3 establishes the penalties clause.

Under FAR 42.709-1(b), these penalties apply to contracts over $1 million, excluding fixed-price contracts without cost incentives and firm-fixed-price contracts for commercial products or services. The penalty equals the disallowed costs allocated to covered contracts, plus interest on the paid portion if any [FAR 42.709-2(a)(1)]. Where the cost had already been determined unallowable for that contractor before the proposal went in, the penalty doubles [FAR 42.709-2(a)(2)].

Separate False Claims Act exposure under 31 U.S.C. 3729 adds civil penalties per false claim, plus up to three times actual government losses. Those per-claim amounts are adjusted for inflation under 28 CFR Part 85, and they did not move in 2026: DOJ published no adjustment, because the October to November 2025 lapse in appropriations stopped the Bureau of Labor Statistics producing the October 2025 CPI-U the statute requires [91 FR 43405]. Check the current figure with GovCon legal counsel before relying on one.

Start with these six steps:

1. Reconcile timesheets to labor distribution reports. Pull every employee’s timesheets for the past quarter. Match total hours per contract against the LDR. Flag discrepancies over 0.25 hours.
2. Test expense reports against FAR 31.205. Pull 90 days of expense reports. Check each line item against the allowability rules. Entertainment [FAR 31.205-14], alcohol [31.205-51] and lobbying [31.205-22] are expressly unallowable, meaning FAR 31.001 treats them as costs “specifically named and stated to be unallowable.” Premium airfare is a different animal: FAR 31.205-46(b) makes fares above the lowest priced fare unallowable subject to six named exceptions, so it is conditional rather than expressly unallowable, and the FAR 42.709 penalty does not reach it on that basis.
3. Verify unallowable cost segregation. Confirm every unallowable cost sits in a segregated account. FAR 31.201-6 requires all contractors to identify and exclude unallowable costs from any billing, claim, or proposal. CAS-covered contractors have the additional obligation under CAS 405 to track unallowable costs in separately identifiable accounts. If unallowable costs are mixed into indirect pools, the entire pool is at risk.
4. Test indirect rate calculations. Recompute your fringe, overhead, and G&A rates from the general ledger. Compare against the rates on your most recent incurred cost submission.
5. Review written accounting policies. Read every policy document. If the policy says you allocate overhead on direct labor dollars but your system allocates on direct labor hours, your written practice is inconsistent with your accounting practice. For CAS-covered contractors, this creates a CAS 401 consistency issue. For all contractors, DCAA auditors will flag the inconsistency as evidence that your accounting system does not conform to your own written procedures, which is one of the 18 adequacy criteria under DFARS 252.242-7006.
6. Document compensation reasonableness. Pull salary data for your five highest-paid employees. Compare against the FAR 31.205-6(p) annual compensation cap and benchmark against market surveys for your geography and industry. The cap is set by the Administrator of the Office of Federal Procurement Policy under 41 U.S.C. 1127 and reaches contractors through a DCAA memorandum rather than originating there. For costs incurred in calendar year 2025 it is $671,000 per person [DCAA memorandum 24-PSP-009(R)]. No 2026 figure had been published as of 18 August 2026.

Days 31 to 60: Remediation Phase

The second phase fixes what the self-assessment found. Every discrepancy from Days 1 to 30 needs a documented correction, a root cause explanation, and a process change to prevent recurrence. DCAA auditors view corrective actions favorably when they are documented, dated, and systematic.

Corrections made during an active audit look like reactions, not controls. Complete your remediation before the auditor arrives.

1. Reclassify misallocated costs. Move unallowable costs out of indirect pools with journal entries. Date them, explain them, and keep the backup documentation. Voluntary reclassifications before an audit are evidence of good faith.
2. Update written policies to match actual practices. If your business has outgrown a policy, rewrite the policy to reflect current operations. Never change your practice to match an outdated policy during audit season: the auditor will notice the sudden change.
3. Build document response packages. Organize records by the categories DCAA requests most often: labor, indirect costs, direct costs, unallowable costs, and timekeeping procedures. Stage them for three-day turnaround.
4. Brief employees on timekeeping procedures. Every direct-charge employee should know three things: which contract they are charging to, what task they are performing, and how to correct a timesheet error. Do this training NOW, not after a floor check notification arrives.
5. Reconcile provisional rates to actual rates. Calculate the gap between what you billed and what you actually incurred. If your provisional overhead rate is 120% but your actual is 105%, the government will recover the 15-point difference during audit.

Days 61 to 90: Readiness Phase

The final phase of DCAA audit preparation shifts from fixing problems to testing your ability to survive the audit process itself. DCAA does not grade on preparation alone. The audit tests your ability to produce records quickly, answer questions accurately, and demonstrate consistent practices between your written policies and daily operations.

1. Conduct a mock audit. Assign someone outside the accounting department (or your external CPA) to play the auditor role. Give them a list of 10 records to request and a 3-day deadline. If your team misses the deadline, fix the retrieval process before the real audit.
2. Designate a single point of contact. One person handles all auditor communication. This prevents conflicting answers, controls document flow, and protects employees from informal questioning that produces unintended admissions.
3. Review prior audit findings. Pull every previous DCAA audit report. Verify each finding has a documented corrective action. Repeat findings on the same issue signal systemic failure and escalate the audit scope.
4. Stage documents for three-day turnaround. In practice, auditors request records with a three-business-day standard turnaround. Slow responses trigger “access to records” findings under DFARS 252.242-7006. Organize your files so any requested document is retrievable in under four hours.
5. Run final rate calculations. Recompute every indirect rate one last time. Verify the math ties to the general ledger, the schedules tie to each other, and the totals tie to your accounting system. Mathematical errors in rate computations are the most preventable and most embarrassing audit findings.

How Does DCAA Audit Preparation Differ by Audit Type?

Not all DCAA audits examine the same records or follow the same timeline. A contractor preparing for a pre-award survey focuses on system design, while a contractor facing an incurred cost audit focuses on transaction-level evidence.

Effective DCAA audit preparation requires matching your effort to the specific audit type. Preparing for the wrong one wastes time and leaves actual vulnerabilities exposed.

The notice periods above are practitioner observation rather than published policy, so treat them as rough. What DCAA does publish is how long the audits themselves run. In FY2025 the average incurred cost audit took 208 elapsed days, forward pricing 92, systems and CAS and TINA work 264, claims and terminations 148 [DCAA Annual Report to Congress FY2025, Table 3].

That 208-day average sits comfortably inside the one-year limit that 10 U.S.C. 3842 places on incurred cost audits. The limit is real and it is rarely stretched: in FY2025 the Comptroller granted extensions for five audits in total, four of them a single contractor’s FY2020 submissions held up by active litigation and one an FY2024 submission delayed by a bankruptcy [Table 4].

Floor checks deserve special attention because they allow zero preparation time. The 90-day playbook builds standing readiness for floor checks through the employee briefings in Days 31 to 60. One critical rule: never coach employees on what to say when an auditor arrives. Train employees on timekeeping procedures, not on specific answers. If DCAA auditors identify coached or scripted responses, those responses expand audit scope and damage credibility with the ACO. Train employees on procedures, not on answers.

The Voluntary Deletion Strategy

DCAA reported over $3.8 billion in voluntary contractor deletions in FY2025 (DCAA Annual Report to Congress, FY2025). These are costs contractors identified and removed from their claims before DCAA examined them. The number reveals something competitors never discuss: the most effective DCAA audit preparation strategy is removing the costs you know will be questioned.

Voluntary deletions work because they eliminate the finding before it exists. A $50,000 entertainment expense left in your indirect pool becomes a questioned cost, a penalty risk, and a credibility problem with the auditor. Remove it during your Days 1 to 30 self-assessment, and it becomes evidence of a functioning internal control system.

Run this test quarterly, not annually. Pull your general ledger, filter for the FAR 31.205 unallowable categories (entertainment, alcohol, donations, lobbying, first-class travel, interest, bad debts), and verify every dollar is in a segregated account. The contractors who produced those billions in FY2025 voluntary deletions did not wait for an audit notification. They built this review into their monthly close process.

Frequently Asked Questions

Key Takeaways

• Start with the first test. Reconcile timesheets against labor distribution reports monthly. This is the comparison DCAA auditors run before examining anything else, and a mismatch escalates the entire audit scope.
• Build voluntary deletions into your monthly close. FY2025 voluntary deletions prove self-auditing works at scale. Review FAR 31.205 unallowable categories quarterly and reclassify costs before an auditor finds them.
• Stage records for three-day turnaround. Organize documents by audit category so any requested record is retrievable in under four hours. Slow responses create findings independent of the underlying accounting quality.
• Floor check readiness requires standing procedures, not last-minute preparation. Train employees on timekeeping rules continuously. Never coach them on what to say to an auditor.
• Take the Compliance Readiness Check to identify preparation gaps before starting your 90-day timeline.

DCAA audit preparation is not a project with a deadline. The discipline belongs inside your monthly accounting cycle. Stop treating an audit as a surprise, and it stops behaving like one.

If your firm needs help building a 90-day preparation timeline or improving audit readiness, explore Amerifusion’s DCAA compliance services or start with our DCAA compliance guide.