DCAA Compliance Guide for Small GovCon Firms

You won the contract. The funding is flowing. Then an email arrives from DCAA requesting access to your accounting records, timekeeping system, and indirect rate calculations.

DCAA compliance means your accounting system meets the adequacy criteria in DFARS 252.242-7006: segregated direct and indirect costs, compliant timekeeping with daily employee entry, documented indirect cost pools, and job costing by contract. The Defense Contract Audit Agency evaluates these criteria against FAR Part 31 allowability, allocability, and reasonableness standards. Contractors with cost-reimbursable or T&M contracts face the highest audit risk.

For small government contractors without the right financial infrastructure, that moment is when months of revenue become months of risk.

DCAA compliance is not optional for government contractors. It is the baseline expectation for any firm that bills the federal government for costs incurred. Yet most small contractors, particularly those in the $1M to $20M revenue range, run accounting systems, timekeeping practices, and cost allocation methods that would not survive a DCAA audit.

The gap between “good enough for commercial work” and “adequate for federal contracting” is where contracts get questioned, costs get disallowed, and firms get sidelined from future awards. What follows are the core requirements, in practical terms you act on this quarter.

Why DCAA Compliance Has More Weight in 2026 Than It Did in 2024

Three forces converged between 2024 and 2026 to make compliance gaps more expensive and more visible. Contractors who treated compliance as a yearly cleanup are finding the new environment less forgiving.

• The DOGE-era oversight cycle. Federal contract spending faces tighter scrutiny across procurement reviews, contract closeouts, and indirect rate proposals. Accounting systems that produce data slowly, with reconciliation gaps, draw attention. DOGE’s impact on government contractors covers the operational changes contractors are seeing.
• Threshold inflation realigned the audit map. The simplified acquisition threshold rose to $350,000 in October 2025, the Truth in Negotiations Act threshold rose to $2.5 million, and the FY2026 NDAA raised CAS coverage thresholds. These shifts move the line between “audit-light” and “audit-heavy” status. Contractors who were below thresholds in 2023 are likely above them now. See NDAA 2026 CAS threshold changes for the full updates.
• The audit backlog is shifting in the contractor’s direction. Incurred cost audits historically took 12 to 36 months. DCAA’s recent staffing model and risk-based selection means more contractors get a low-risk memo and fewer face full audits. The flip side: when audits do happen, they target contractors with deficiency patterns, and the findings are deeper.

The practical implication: a system that was “adequate enough” in 2023 is unlikely to be in 2026. The fundamentals have not changed. The cost of being slightly below them has.

What DCAA Actually Audits (and Why It Matters)

The Defense Contract Audit Agency exists to protect the government’s financial interests. DCAA auditors verify that contractors are charging the government only for costs that are allowable, allocable, and reasonable: the three pillars defined under FAR Part 31. Every audit circles back to these three questions:

• Allowable: Is this cost permitted under FAR 31.205? Certain costs are expressly unallowable, including entertainment, alcohol, lobbying, bad debts, and fines. If your books do not segregate unallowable costs, DCAA will question your entire cost pool.
• Allocable: Can you demonstrate a clear, beneficial relationship between the cost and the contract being charged? A cost that benefits multiple contracts must be allocated proportionally using a consistent methodology.
• Reasonable: Would a prudent business person have incurred this cost at this amount? FAR 31.201-3 applies the prudent-person standard, and it is more subjective than contractors expect.

DCAA conducts several types of audits, but the ones most relevant to small contractors are accounting system audits (evaluating whether your system meets the standards in DFARS 252.242-7006), incurred cost audits (verifying actual costs claimed on flexibly-priced contracts), and pre-award audits (assessing your proposed rates and cost estimates before contract award). Each one examines the same underlying data from a different angle. The full inventory is in our DCAA audit types overview, which covers all seven distinct DCAA audit categories. Most small contractors face only a subset (typically incurred-cost reviews and pre-award surveys); larger or fully CAS-covered contractors face all seven.

2026 Compliance Reference Values

Several FAR thresholds were adjusted between October 2025 and the FY2026 National Defense Authorization Act. These values determine which contractors face which audits, which contracts require certified cost or pricing data, and where compensation caps apply. Verify the most current values at acquisition.gov before relying on them in proposals.

The Five Pillars of a DCAA-Compliant Accounting System

DCAA evaluates your accounting system against specific adequacy criteria. If you are using QuickBooks or any commercial accounting package, the software itself is not the issue. The configuration and the processes surrounding it are.

Here is what your system must demonstrate:

1. Segregation of Direct and Indirect Costs

Your chart of accounts must cleanly separate direct costs (labor, materials, subcontractor costs, and travel charged to specific contracts) from indirect costs (overhead, fringe benefits, and general and administrative expenses). Commingling direct and indirect costs in the same accounts is the most common deficiency DCAA finds in small contractor systems. The QuickBooks chart of accounts for government contractors walks the exact account structure this segregation requires.

2. Proper Indirect Cost Pooling and Allocation

Indirect costs must be accumulated in logical, homogeneous cost pools [FAR 31.203(c)], typically fringe, overhead, and G&A, and allocated to final cost objectives using appropriate bases. Fringe is typically allocated over direct labor dollars. Overhead is allocated over a direct labor or total direct cost base.

G&A is allocated over total cost input or value-added. The allocation base must be consistent and must reflect the beneficial or causal relationship between the pool and the contracts it supports. Inconsistent or arbitrary allocation is a finding waiting to happen.

If you need to understand how your current rates compare, our indirect rate calculator provides a useful starting point. The indirect rate calculation guide walks the math step by step, and fringe, overhead, and G&A rates explained covers what belongs in each pool.

3. DCAA-Compliant Timekeeping

Timekeeping is the area where DCAA applies the most scrutiny, because labor is usually the largest direct cost on a government contract. Your timekeeping system must meet these non-negotiable requirements:

• Employees record their own time daily (not weekly, not retroactively)
• Time is recorded by specific project, contract, or indirect account
• Supervisors review and approve timesheets
• Corrections follow a documented audit trail. No erasures, no overwritten entries.
• Total hours recorded equal total hours compensated

A spreadsheet-based timekeeping system technically satisfies these requirements, but it creates significant audit risk. Any system where an employee alters a prior entry without a visible correction trail is a liability. The DCAA timekeeping requirements guide walks every rule and the documentation each one expects, including the unannounced floor check protocol for remote and hybrid teams.

4. Job Cost Accounting by Contract

Every dollar of direct cost must be traceable to the specific contract it benefits. Where applicable, costs must also trace to the specific Contract Line Item Number (CLIN). Your accounting system must support job costing at the contract level, with the ability to generate reports showing costs incurred by contract, by cost element (labor, materials, travel, subcontracts, other direct costs), by period.

5. Unallowable Cost Identification

FAR 31.205 lists specific cost categories that are unallowable when charging the government. Your accounting system must identify and exclude these costs from any billing, indirect rate calculation, or cost claim.

This is not a year-end exercise. Unallowable costs must be flagged at the point of entry, when the expense is recorded, not discovered later during audit preparation. Common unallowable costs include entertainment [FAR 31.205-14], alcoholic beverages [FAR 31.205-51], and lobbying costs [FAR 31.205-22]. The unallowable costs under FAR 31.205 guide walks every category and the screening procedure that keeps them out of indirect pools.

FAR Compliance Beyond the Accounting System

A compliant accounting system is necessary but not sufficient. FAR compliance extends into your policies, procedures, and business practices. DCAA expects to see written policies governing:

• Compensation: A compensation policy that documents how you determine employee pay and demonstrates it is reasonable for your labor market [FAR 31.205-6]
• Travel: A travel policy that establishes reimbursement limits, approval requirements, and documentation standards, typically tied to the Federal Travel Regulation or Joint Travel Regulations
• Purchasing: A procurement/purchasing policy that demonstrates a consistent method for obtaining competitive pricing on materials and subcontracts
• Timekeeping: A written timekeeping policy covering all the requirements noted above

The written accounting policies DCAA expects guide walks each policy with templates and the audit-trail expectations that go with them.

For contractors subject to Cost Accounting Standards (CAS), there is an additional layer. CAS 401 requires consistency in estimating, accumulating, and reporting costs. CAS 402 requires consistency in allocating costs incurred for the same purpose.

Most small contractors fall under modified CAS coverage rather than full CAS (the thresholds are periodically updated by Congress, so verify the current figures with your CPA or contracting officer). For contractors with modified CAS coverage, CAS 401 and 402 apply and are actively audited [48 CFR 9903.201-2(b)]. Contractors below the CAS threshold have no CAS coverage, though FAR 31.203(c) independently requires logical cost groupings regardless of CAS applicability.

The DCAA Audit Lifecycle: From Pre-Award Through Closeout

Compliance is not a one-event preparation. DCAA touches your business at every stage of the contract lifecycle, and each touchpoint examines a different aspect of your accounting system. Understanding the lifecycle map is what separates contractors who treat compliance as continuous from those who scramble each time.

The seven distinct DCAA audit types and their triggers are documented in our DCAA audit types overview. The map below shows where each one fits in the contract lifecycle.

Every audit type traces back to the same underlying capability: an accounting system that segregates costs correctly, distributes labor reliably, excludes unallowable expenses at the point of entry, and produces reconciliations on demand. Build that foundation, and every audit type becomes a procedural exercise. Skip it, and each audit becomes a triage event.

Preparing for a DCAA Audit: What to Do Before They Call

The best time to prepare for a DCAA audit is before you need to. Contractors who treat compliance as a year-end cleanup exercise consistently fare worse than those who build it into their monthly operations. Here is a practical audit-readiness checklist:

• Monthly close discipline: Reconcile all accounts monthly. Review indirect cost pool balances. Confirm that job cost reports tie to the general ledger. A monthly close that takes three weeks is a symptom of a system that will not survive audit scrutiny.
• Incurred Cost Submission readiness: If you have flexibly-priced contracts (cost-reimbursement, time-and-materials, or cost-plus), you are required to submit an adequate Incurred Cost Submission (ICS) within six months of your fiscal year end [FAR 52.216-7(d)(2)(i)]. The ICS is the document DCAA uses to audit your actual costs and final indirect rates. Build the schedules as you go. Do not wait until month five to start. The ICS guide walks every required schedule, the month-by-month preparation checklist spreads the work across six months, and what DCAA does next covers the post-submission cycle through final rate agreement.
• Document everything: DCAA operates on a “if it isn’t documented, it didn’t happen” standard. Every cost allocation methodology, every rate calculation, every policy decision should be in writing and accessible.
• Test your own system: Run internal audits using DCAA’s own SF 1408 checklist (the Pre-Award Survey of Prospective Contractor Accounting System). If your system would not pass your own review, it will not pass theirs. The SF 1408 pre-award survey guide walks all 14 evaluation criteria, and the DCAA accounting system checklist covers the 18 DFARS 252.242-7006 criteria the same system has to satisfy post-award.

The Four Compliance Maturity Levels

Most small contractors fall into one of four maturity levels. Identifying yours is the fastest way to know what to fix first.

Level 1: Commercial Books, Federal Contract

You won a federal contract while running a chart of accounts designed for commercial work. Direct and indirect costs are commingled. Timekeeping is whatever your payroll system tracks. There are no written accounting policies. This is where most first-time contractors land. The risk: the next audit (SF 1408 or floor check) exposes the gap, and the contract goes conditional or is denied. The fix path runs 60 to 90 days.

Level 2: DFARS-Aware

You know what DFARS 252.242-7006 requires. The chart of accounts has been restructured. Timekeeping is daily-recorded with supervisor approval. But written policies are thin or missing, and reconciliations happen quarterly instead of monthly. This system passes a calm SF 1408 review but produces findings during an incurred cost audit because the reconciliations do not hold up to transaction-level testing.

Level 3: DFARS-Adequate

The system meets all 18 DFARS criteria. Written policies exist for timekeeping, compensation, travel, and unallowable costs. Monthly closes are routine. Indirect rate calculations are documented. The annual ICS files on time. This level passes audits with minimal questioned costs. The remaining work is incremental: tightening reconciliations, strengthening documentation habits, and building an audit-response playbook.

Level 4: Audit-Ready

The system meets DFARS criteria and produces documentation faster than DCAA requests it. Self-assessments run quarterly using the SF 1408 checklist. The compliance maturity report is formally reviewed by the CFO each quarter. Policy changes are version-controlled. Cost trend analyses identify rate variances before DCAA does. Few small contractors operate at Level 4. The ones who do typically hold prime contracts above $25 million or have been audited multiple times and built the muscle.

The honest answer about where most $1M to $20M contractors land: between Level 1 and Level 2, with a few in Level 3. Moving up one level reduces audit risk by an order of magnitude. The investment is real but the payback is faster than most contractors expect.

Key Takeaways

• Segregate direct and indirect costs from day one. Retrofitting a chart of accounts after a DCAA finding is exponentially harder than building it correctly upfront.
• Timekeeping is the highest-risk area. Daily recording, supervisor approval, and an unalterable audit trail are non-negotiable. Fix this first.
• Written policies are not optional. DCAA expects documented policies for compensation, travel, purchasing, and timekeeping, and expects you to follow them consistently.
• Build compliance into your monthly operations. Monthly closes, ongoing unallowable cost segregation, and real-time job costing prevent the year-end scramble that leads to findings.
• Get CPA-level oversight on your government contractor bookkeeping. Bookkeepers record transactions. A CPA-managed engagement means your entire system, from structure to policies to reporting, is built to withstand federal scrutiny.

Frequently Asked Questions

Is Your Accounting System Audit-Ready?

Most small government contractors have gaps they do not know about until DCAA points them out. Our Compliance Readiness Check takes 30 seconds and identifies where your system stands today. No obligation, no sales pitch.

If you already know you need help, book a discovery call and we will walk through your specific situation with CPA-level guidance.