DCAA issues thousands of audit reports each year and questions billions in contractor costs [DCAA Annual Report to Congress]. The majority of those questioned costs come from incurred cost audits and forward pricing reviews, not the dramatic fraud investigations contractors fear.
Here is what matters for your business: DCAA runs seven distinct DCAA audit types, and each one examines different records, triggers at different points in your contract lifecycle, and produces different consequences when findings surface. A contractor who prepares for a floor check the same way they prepare for a CAS compliance review will fail both.
Amerifusion Bookkeeping prepares government contractors for all seven audit types, from pre-award surveys to special investigations. Each audit has a distinct trigger, examination focus, timeline, and preparation strategy. Treating them as interchangeable is how contractors get caught off guard.
Pre-Award Survey (SF 1408): The Gatekeeper Audit
The SF 1408 pre-award accounting system survey determines whether your accounting system qualifies you for cost-type contract awards. DCAA evaluates your system against the criteria in DFARS 252.242-7006, covering direct/indirect cost segregation, timekeeping, labor distribution, and unallowable cost identification. Fail any critical criterion, and the contracting officer moves to the next bidder.
This audit triggers when you bid on a cost-reimbursable, time-and-materials, or labor-hour contract. The contracting officer requests the survey through DCAA before making the award decision. Firm-fixed-price contracts rarely trigger an SF 1408.
The auditor reviews your written accounting policies, chart of accounts, timekeeping system, and indirect rate structure. They do not require a fully operational system at the time of the survey. Your design, policies, and procedures must be in place before you incur costs on the new contract.
Typical timeline: 30 to 90 days from the contracting officer’s request. The largest risk is not the audit itself. It is the contractor who has never separated direct from indirect costs and needs to rebuild their entire chart of accounts in 60 days. For a detailed walkthrough of all the criteria, see our SF 1408 pre-award survey guide.
Incurred Cost Audit: The Annual Reckoning
The incurred cost audit is DCAA’s examination of your actual costs for a completed fiscal year against your claimed indirect rates. Every contractor with a flexibly-priced contract containing the Allowable Cost and Payment clause [FAR 52.216-7] must file an Incurred Cost Submission (ICS) within six months after their fiscal year ends. The audit follows the filing.
DCAA compares your provisional billing rates to your actual indirect rates. If you billed at 120% overhead but your actual rate was 110%, you owe the government the difference on every dollar of direct labor. If your actual rate exceeded the provisional rate, the government owes you. Neither scenario is optional.
Auditors pull your general ledger, labor distribution reports, indirect expense accounts, and Schedules A through O from your ICS. They test individual transactions for allowability under FAR Part 31. Common findings include unallowable costs left in indirect pools, entertainment expenses [FAR 31.205-14] misclassified as business development, and executive compensation exceeding the annual cap [FAR 31.205-6(p)].
Typical timeline: 12 to 36 months after submission. Contractors who file late face decrement factors, and DCAA establishes unilateral rates almost never favoring the contractor. Our incurred cost submission guide covers the preparation process and common rejection reasons.
Floor Check: The Unannounced Visit
Floor checks are unannounced DCAA visits to verify employees are recording time accurately and labor charges match the work being performed. DCAA Activity Code 13500 governs these visits. The auditor arrives without warning, interviews employees about their current work assignments, and compares their answers to the timesheets on file.
Floor checks trigger through two paths: random selection from DCAA’s scheduling system, or a specific concern raised by a contracting officer or whistleblower. Every contractor with direct-charge employees on government contracts is a candidate. There is no threshold, no minimum contract value, and no advance notice.
The auditor looks for three things. First: are employees recording time before the visit, or are they backfilling hours after the fact? Second: do employees know which contracts they are charging to and what tasks they are performing? Third: does the recorded time match the physical or virtual presence of the employee?
A single timekeeping discrepancy during a floor check flags the entire labor charging system for further review. That “further review” often escalates into a full labor audit covering months or years of timesheets.
Typical floor check duration: 2 to 4 hours on site. The consequences last much longer. For remote and hybrid workforce procedures, see our guide to DCAA floor checks for remote teams.
Forward Pricing Audit: Before You Sign
The forward pricing audit examines your cost estimates and proposed rates on a new contract or contract modification before the government agrees to the price. DCAA reviews your proposed direct costs, indirect rates, and fee to determine whether your pricing reflects current, accurate, and complete cost data [FAR 15.404].
This audit triggers whenever a contracting officer requests a cost or pricing review on a proposal. Contracts above the Truth in Negotiations Act (TINA) threshold (currently $2.5 million, rising to $10 million under NDAA 2026) require certified cost or pricing data. Below the TINA threshold, the contracting officer still has discretion to request DCAA support for price reasonableness analysis.
DCAA compares your proposed rates against your most recent actual rates from the incurred cost audit. If you propose a 130% overhead rate but your last three years averaged 115%, the auditor will question the 15-point gap. They also test proposed labor rates against your actual compensation records and verify proposed direct costs against historical spending patterns.
Typical timeline: 30 to 120 days, depending on proposal complexity. The most common finding is inflated indirect rates lacking historical support. Contractors who maintain clean ICS records and consistent rate histories face far fewer questioned costs during forward pricing reviews.
Business System Audit: The Infrastructure Test
The business system audit evaluates whether your accounting system, estimating system, or other DFARS-defined business systems meet the adequacy criteria established in DFARS 252.242-7006. Six business systems fall under this framework: accounting, estimating, earned value management (EVMS), material management and accounting (MMAS), property management, and purchasing.
For most small GovCon contractors, the accounting system audit is the relevant one. DCAA evaluates your system against specific criteria: proper segregation of direct and indirect costs, timekeeping controls, labor distribution procedures, billing system accuracy, and compliance with CAS and FAR cost principles.
A “significant deficiency” finding triggers a corrective action plan requirement and payment withholding of 5% of interim payments per deficient system, up to a 10% aggregate cap across all business systems [DFARS 252.242-7005]. The contracting officer, not DCAA, makes the final determination on system adequacy. DCAA provides the audit opinion.
Typical timeline: 3 to 12 months. Business system audits often overlap with other audit types. A contractor undergoing an incurred cost audit might receive a concurrent business system review if the incurred cost audit reveals systemic issues.
CAS Compliance Audit: Consistency Under the Microscope
The CAS compliance audit tests whether your cost accounting practices match your Disclosure Statement (DS-1) and comply with applicable Cost Accounting Standards. Contractors with modified CAS coverage (aggregate CAS-covered awards exceeding $35 million under NDAA 2026, up from $7.5 million) must file a Disclosure Statement and follow CAS 401, 402, 405, and 406. Full CAS coverage (single contract over $100 million, up from $50 million) adds all 19 standards.
DCAA triggers CAS compliance audits on a scheduled basis for covered contractors and whenever a contractor reports a change in cost accounting practice. A practice change without proper disclosure and contracting officer approval is a CAS 401 violation, and DCAA specifically tests for undisclosed changes during every CAS review.
The auditor compares your actual accounting practices to the methods described in your Disclosure Statement. They test allocation base selections for consistency [CAS 418], verify unallowable cost exclusion procedures [CAS 405], and check your fiscal year and cost accumulation periods align with CAS 406. Indirect rate “shopping” (selecting different allocation bases to minimize rates on specific contracts) is a red flag auditors are trained to detect.
Typical timeline: 6 to 18 months. CAS noncompliance findings require contractors to calculate the increased costs to the government and repay the difference. Willful noncompliance risks contract termination.
Special Audit: When Something Goes Wrong
The special audit (also called an investigative audit) is not a routine examination. DCAA initiates special audits in response to fraud allegations, whistleblower complaints, contracting officer referrals, or patterns discovered during other audits. These investigations involve DCAA’s Investigative Support Division and often coordinate with the Department of Justice or the Inspector General.
Triggers include: a hotline complaint, a qui tam (whistleblower) lawsuit, suspicious billing patterns found during an incurred cost audit, or a tip from a current or former employee. Contractors rarely receive advance warning.
The scope is unlimited. Auditors examine whatever records the investigation requires: emails, contracts, subcontractor agreements, bank statements, and personnel files. False Claims Act exposure is real. Penalties include treble damages plus $13,946 to $27,894 per false claim (adjusted annually for inflation).
Preparation for a special audit is different from every other type on this list. The contractor’s immediate obligation is to preserve all records and cooperate fully. Destroying or altering documents after an investigation begins converts a billing dispute into obstruction. Typical timeline: 12 to 48 months or longer, depending on investigation complexity and DOJ involvement.
DCAA Audit Types at a Glance
The table below compares all seven DCAA audit types across trigger events, focus areas, timelines, and risk levels. Use it as a quick reference for identifying which audit your business is likely to face next.
| Audit Type | Trigger | What DCAA Examines | Typical Timeline | Top Finding |
|---|---|---|---|---|
| Pre-Award Survey (SF 1408) | Bid on cost-type contract | Accounting system design per DFARS 252.242-7006 | 30-90 days | No direct/indirect cost segregation |
| Incurred Cost | ICS filing (annual) | Actual costs vs. billed rates, FAR Part 31 allowability | 12-36 months | Unallowable costs in indirect pools |
| Floor Check | Random or tip-off, unannounced | Timekeeping accuracy, labor charging | 2-4 hours (on site) | Employees backfilling timesheets |
| Forward Pricing | New proposal or modification | Proposed rates vs. historical actuals | 30-120 days | Inflated indirect rates without support |
| Business System | DFARS clause in contract | System adequacy, controls, procedures | 3-12 months | Timekeeping control deficiencies |
| CAS Compliance | Scheduled or practice change | Disclosure Statement vs. actual practice | 6-18 months | Undisclosed practice changes |
| Special/Investigative | Fraud allegation, whistleblower, referral | Unlimited scope based on investigation | 12-48+ months | False Claims Act violations |
Desk Audit vs. Field Audit: What the Difference Means for You
A desk audit happens at the DCAA office. The auditor requests your records electronically, reviews them remotely, and sends follow-up questions by email or phone. A field audit happens at your location. The auditor sits in your office, reviews physical records, interviews employees, and observes operations firsthand.
Low-risk incurred cost audits on small contracts often proceed as desk audits. Floor checks are always field audits by definition. Business system audits and CAS compliance audits almost always require field work because the auditor needs to observe your procedures in practice, not read about them on paper.
A desk audit converting to a field audit mid-stream is a warning sign. It means the auditor found something in your records requiring closer examination. When this happens, the scope and timeline both expand.
How to Prepare for Any DCAA Audit Type
Preparation starts before the audit notification arrives. Every contractor on a flexibly-priced government contract should maintain audit-ready records at all times. Waiting until DCAA calls is how questioned costs multiply.
Five steps cover the fundamentals across all audit types:
- Maintain written accounting policies. DCAA expects documented procedures for timekeeping, compensation, travel, direct/indirect charging, unallowable cost identification, and material accounting. No written policy means no defense when the auditor questions your practice. See our guide on written accounting policies DCAA expects you to have.
- Reconcile monthly. Compare your labor distribution report to your timesheets every month. Match your indirect expense accounts to your general ledger. A $500 discrepancy in March becomes a $50,000 finding in June if left unreconciled.
- Segregate unallowable costs at the point of entry. Entertainment [FAR 31.205-14], alcohol [FAR 31.205-51], lobbying [FAR 31.205-22], and fines [FAR 31.205-15] must post to designated unallowable accounts. Mixing them into indirect pools and removing them later is not sufficient under CAS 405.
- File your ICS on time. Six months after your fiscal year ends. Late filings trigger decrement factors and unilateral rate determinations. DCAA’s unilateral rates almost never favor the contractor.
- Train your employees on timekeeping. Floor checks test employees, not your accounting team. Every person who charges time to a government contract must know which contract they are working on, how to record corrections, and what to do when an auditor shows up unannounced.
For a full breakdown of DCAA compliance requirements, read our DCAA compliance guide for government contractors.
Frequently Asked Questions
What are the main types of DCAA audits?
The seven types are: pre-award survey (SF 1408), incurred cost audit, floor check, forward pricing audit, business system audit, CAS compliance audit, and special/investigative audit. The incurred cost audit generates the most questioned costs. Floor checks carry the highest surprise factor because they arrive unannounced.
How long does a DCAA audit take?
Timelines vary by audit type. Floor checks last 2 to 4 hours on site. Pre-award surveys take 30 to 90 days. Incurred cost audits run 12 to 36 months after filing. Special audits stretch 12 to 48 months or longer depending on investigation scope and Department of Justice involvement.
What triggers a DCAA audit?
Triggers depend on the audit type. Bidding on a cost-type contract triggers a pre-award survey. Filing your annual incurred cost submission triggers an incurred cost audit. Floor checks are random or tip-driven. Special audits follow fraud allegations, whistleblower complaints, or suspicious patterns identified during other reviews.
What is the difference between a desk audit and a field audit?
A desk audit happens at DCAA’s office using electronically submitted records. A field audit takes place at your location, where the auditor reviews physical records, interviews staff, and observes operations. Field audits indicate broader scope. A desk audit converting to a field audit signals the auditor found issues requiring closer examination.
How do I prepare for a DCAA floor check?
Train all employees to record time daily before any visit occurs. Every direct-charge worker must know their current contract assignment and task. Post correction procedures visibly. Do not coach employees during the visit. DCAA auditors interview workers individually and compare answers to timesheets on file.
Key Takeaways
- DCAA runs seven distinct audit types, each with different triggers, examination areas, and timelines. Preparation is not one-size-fits-all.
- The incurred cost audit generates the highest dollar volume of questioned costs. File your ICS on time and scrub your indirect pools for unallowable expenses before submission.
- Floor checks are the only audit type with zero advance notice. Your employees’ daily timekeeping habits are your only defense.
- A desk audit converting to a field audit is a red flag. Respond quickly and provide complete documentation.
- Written accounting policies are your foundation for every audit type. Without documented procedures, DCAA has nothing to evaluate except raw transactions.
Not sure which audit type your business faces next? Run our free Compliance Readiness Check to identify gaps in your preparation, or explore Amerifusion Bookkeeping’s DCAA compliance services for audit-ready accounting support.
