DCAA Compliance Guide for Small GovCon Firms

You won the contract. The funding is flowing. Then an email arrives from DCAA requesting access to your accounting records, timekeeping system, and indirect rate calculations.

DCAA compliance means your accounting system meets the adequacy criteria in DFARS 252.242-7006: segregated direct and indirect costs, compliant timekeeping with daily employee entry, documented indirect cost pools, and job costing by contract. The Defense Contract Audit Agency evaluates these criteria against FAR Part 31 allowability, allocability, and reasonableness standards. Contractors with cost-reimbursable or T&M contracts face the highest audit risk.

For small government contractors without the right financial infrastructure, that moment is when months of revenue become months of risk.

In the accounting system reviews we conduct for small GovCon firms, the gap we see most consistently is not a missing policy or a wrong account. It is a system that was configured for commercial work and never rebuilt for federal contracting. The chart of accounts is wrong, the timekeeping is weekly, and the unallowable costs are buried in overhead.

DCAA compliance is not optional for government contractors. It is the baseline expectation for any firm that bills the federal government for costs incurred. Yet most small contractors, particularly those in the $1M to $20M revenue range, run accounting systems, timekeeping practices, and cost allocation methods that would not survive a DCAA audit.

The gap between “good enough for commercial work” and “adequate for federal contracting” is where contracts get questioned, costs get disallowed, and firms get sidelined from future awards. What follows are the core requirements, in practical terms you act on this quarter.

Why DCAA Compliance Has More Weight in 2026 Than It Did in 2024

Three forces converged between 2024 and 2026 to make compliance gaps more expensive and more visible. Contractors who treated compliance as a yearly cleanup are finding the new environment less forgiving.

• The DOGE-era oversight cycle. Federal contract spending faces tighter scrutiny across procurement reviews, contract closeouts, and indirect rate proposals. Accounting systems that produce data slowly, with reconciliation gaps, draw attention. DOGE’s impact on government contractors covers the operational changes contractors are seeing.
• Threshold inflation realigned the audit map. The simplified acquisition threshold rose to $350,000 in October 2025. The certified cost or pricing data threshold split in two, and if you sell to DoD the number you have probably been quoted is the wrong one: FAR 15.403-4 sets $2.5 million for civilian agencies, while 10 U.S.C. 3702(a)(1) now reads $10 million for a DoD prime contract entered into after 30 June 2026, against $2 million for one entered on or before that date. That change is in the statute itself, already in force. The FY2026 NDAA also raised the CAS applicability threshold, not full coverage, but treat that one differently: the statute was amended directly while the implementing regulations are overdue and 48 CFR 9903.201-1 still shows the old cross-reference, so do not assume it governs your next award. These shifts move the line between “audit-light” and “audit-heavy” status, and they move it in the contractor’s favor. See NDAA 2026 CAS threshold changes for the full updates.
• The old audit backlog is gone, and the clock is now statutory. If you have heard that DCAA takes years, that stopped being true. 10 U.S.C. 3842 gives DCAA 60 days for the adequacy review and one year to complete an incurred cost audit, and DCAA’s own reporting puts the average incurred cost audit at 204 elapsed days. Your submission often sits a year or two before an audit is opened, which is a different thing from how long one takes once it starts. DCAA’s risk-based selection also means more contractors get a low-risk memo and fewer face full audits. The flip side: when audits do happen, they target contractors with deficiency patterns, and the findings are deeper.

The practical implication: a system that was “adequate enough” in 2023 is unlikely to be in 2026. The fundamentals have not changed. The cost of being slightly below them has.

What DCAA Actually Audits (and Why It Matters)

The Defense Contract Audit Agency exists to protect the government’s financial interests. DCAA auditors verify that contractors are charging the government only for costs that are allowable, allocable, and reasonable: the three pillars defined under FAR Part 31. Every audit circles back to these three questions:

• Allowable: Is this cost permitted under FAR 31.205? Certain costs are expressly unallowable, including entertainment, alcohol, lobbying, bad debts, and fines. If your books do not segregate unallowable costs, DCAA will question your entire cost pool.
• Allocable: Can you demonstrate a clear, beneficial relationship between the cost and the contract being charged? A cost that benefits multiple contracts must be allocated proportionally using a consistent methodology.
• Reasonable: Would a prudent business person have incurred this cost at this amount? FAR 31.201-3 applies the prudent-person standard, and it is more subjective than contractors expect.

DCAA conducts several types of audits, but the ones most relevant to small contractors are accounting system audits (evaluating whether your system meets the standards in DFARS 252.242-7006), incurred cost audits (verifying actual costs claimed on flexibly-priced contracts), and pre-award audits (assessing your proposed rates and cost estimates before contract award). Each one examines the same underlying data from a different angle. The full inventory is in our DCAA audit types overview, which covers all seven distinct DCAA audit categories. Most small contractors face only a subset (typically incurred-cost reviews and pre-award surveys); larger or fully CAS-covered contractors face all seven.

2026 Compliance Reference Values

Several FAR thresholds were adjusted between October 2025 and the FY2026 National Defense Authorization Act. These values determine which contractors face which audits, which contracts require certified cost or pricing data, and where compensation caps apply. Verify the most current values at acquisition.gov before relying on them in proposals.

Four of those thresholds carry a condition the value column cannot hold:

• TINA at $10 million. The $2.5 million figure is the civilian one, and the one the FAR still states for everyone. For DoD prime contracts entered after June 30, 2026, 10 U.S.C. 3702(a) as amended by FY2026 NDAA Section 1804(c) sets $10 million. That amendment is already law. FAR 15.403-4 and DFARS have not been updated to match it.
• CAS applicability at $35 million. FY2026 NDAA Section 1806(d)(1) amended 41 U.S.C. 1502(b)(1)(B) directly, so the law now reads $35,000,000. Paragraph (3) of that same subsection gave the Administrator for Federal Procurement Policy 180 days to issue implementing regulations, and none have issued. 48 CFR 9903.201-1 still points to the $2.5 million TINA threshold.
• The first CAS test to run. Small businesses are exempt from every CAS requirement regardless of value under 48 CFR 9903.201-1(b)(3). Most practitioner commentary treats the increase as taking effect through the overdue rulemaking, so confirm your status with the contracting officer rather than relying on the statute alone. The old $7.5 million trigger-contract exemption was struck from the statute by Section 1806(d)(1)(B)(iv) and survives in 9903.201-1(b)(7) only until the rule catches up.
• Full CAS coverage at $50 million. FY2026 NDAA Section 1806(a) directs the Administrator for Federal Procurement Policy to raise it to $100 million, but that takes a rulemaking and the rule is overdue. The only document filed under RIN 0348-AB85 is the proposed rule of March 20, 2026.

The Five Pillars of a DCAA-Compliant Accounting System

DCAA evaluates your accounting system against specific adequacy criteria. If you are using QuickBooks or any commercial accounting package, the software itself is not the issue. The configuration and the processes surrounding it are.

Here is what your system must demonstrate:

1. Segregation of Direct and Indirect Costs

Your chart of accounts must cleanly separate direct costs (labor, materials, subcontractor costs, and travel charged to specific contracts) from indirect costs (overhead, fringe benefits, and general and administrative expenses). Commingling direct and indirect costs in the same accounts is the most common deficiency DCAA finds in small contractor systems. The QuickBooks chart of accounts for government contractors walks the exact account structure this segregation requires.

2. Proper Indirect Cost Pooling and Allocation

Indirect costs must be accumulated in logical, homogeneous cost pools [FAR 31.203(c)], typically fringe, overhead, and G&A, and allocated to final cost objectives using appropriate bases. Fringe is typically allocated over direct labor dollars. Overhead is allocated over a direct labor or total direct cost base.

G&A is allocated over total cost input or value-added. The allocation base must be consistent, and it must distribute each grouping on the basis of the benefits accruing to the cost objectives it serves [FAR 31.203(c)]. If your contracts are CAS-covered the wording is stricter: pooled costs must be allocated in reasonable proportion to the beneficial or causal relationship between the pool and the cost objectives [48 CFR 9904.418-40(c)]. Most small contractors are exempt from CAS and are held to the FAR standard. Inconsistent or arbitrary allocation is a finding waiting to happen.

If you need to understand how your current rates compare, our indirect rate calculator provides a useful starting point. The indirect rate calculation guide walks the math step by step, and fringe, overhead, and G&A rates explained covers what belongs in each pool.

3. DCAA-Compliant Timekeeping

Timekeeping is the area where DCAA applies the most scrutiny, because labor is usually the largest direct cost on a government contract. Your timekeeping system must meet these non-negotiable requirements:

• Employees record their own time daily (not weekly, not retroactively)
• Time is recorded by specific project, contract, or indirect account
• Supervisors review and approve timesheets
• Corrections follow a documented audit trail. No erasures, no overwritten entries.
• Total hours recorded equal total hours compensated

A spreadsheet-based timekeeping system technically satisfies these requirements, but it creates significant audit risk. Any system where an employee alters a prior entry without a visible correction trail is a liability. The DCAA timekeeping requirements guide walks every rule and the documentation each one expects, including the unannounced floor check protocol for remote and hybrid teams.

4. Job Cost Accounting by Contract

Every dollar of direct cost must be traceable to the specific contract it benefits. Where applicable, costs must also trace to the specific Contract Line Item Number (CLIN). Your accounting system must support job costing at the contract level, with the ability to generate reports showing costs incurred by contract, by cost element (labor, materials, travel, subcontracts, other direct costs), by period.

5. Unallowable Cost Identification

FAR 31.205 lists specific cost categories that are unallowable when charging the government. Your accounting system must identify and exclude these costs from any billing, indirect rate calculation, or cost claim.

This is not a year-end exercise. Unallowable costs must be flagged at the point of entry, when the expense is recorded, not discovered later during audit preparation. Common unallowable costs include entertainment [FAR 31.205-14], alcoholic beverages [FAR 31.205-51], and lobbying costs [FAR 31.205-22]. The unallowable costs under FAR 31.205 guide walks every category and the screening procedure that keeps them out of indirect pools.

FAR Compliance Beyond the Accounting System

A compliant accounting system is necessary but not sufficient. FAR compliance extends into your policies, procedures, and business practices. DCAA expects to see written policies governing:

• Compensation: A compensation policy that documents how you determine employee pay and demonstrates it is reasonable for your labor market [FAR 31.205-6]
• Travel: A travel policy that establishes reimbursement limits, approval requirements, and documentation standards, typically tied to the Federal Travel Regulation or Joint Travel Regulations
• Purchasing: A procurement/purchasing policy that demonstrates a consistent method for obtaining competitive pricing on materials and subcontracts
• Timekeeping: A written timekeeping policy covering all the requirements noted above

The written accounting policies DCAA expects guide walks each policy with templates and the audit-trail expectations that go with them.

For contractors subject to Cost Accounting Standards (CAS), there is an additional layer. CAS 401 requires consistency in estimating, accumulating, and reporting costs. CAS 402 requires consistency in allocating costs incurred for the same purpose.

Most small contractors fall under modified CAS coverage rather than full CAS (the thresholds are periodically updated by Congress, so verify the current figures with your CPA or contracting officer). For contractors with modified CAS coverage, CAS 401 and 402 apply and are actively audited [48 CFR 9903.201-2(b)]. Contractors below the CAS threshold have no CAS coverage, though FAR 31.203(c) independently requires logical cost groupings regardless of CAS applicability.

What does the DCAA audit lifecycle look like from pre-award to closeout?

Compliance is not a one-event preparation. DCAA touches your business at every stage of the contract lifecycle, and each touchpoint examines a different aspect of your accounting system. Understanding the lifecycle map is what separates contractors who treat compliance as continuous from those who scramble each time.

The seven distinct DCAA audit types and their triggers are documented in our DCAA audit types overview. The map below shows where each one fits in the contract lifecycle.

Every audit type traces back to the same underlying capability: an accounting system that segregates costs correctly, distributes labor reliably, excludes unallowable expenses at the point of entry, and produces reconciliations on demand. Build that foundation, and every audit type becomes a procedural exercise. Skip it, and each audit becomes a triage event.

What should you do before a DCAA audit call arrives?

The best time to prepare for a DCAA audit is before you need to. Contractors who treat compliance as a year-end cleanup exercise consistently fare worse than those who build it into their monthly operations. Here is a practical audit-readiness checklist:

• Monthly close discipline: Reconcile all accounts monthly. Review indirect cost pool balances. Confirm that job cost reports tie to the general ledger. A monthly close that takes three weeks is a symptom of a system that will not survive audit scrutiny.
• Incurred Cost Submission readiness: If you have flexibly-priced contracts (cost-reimbursement, time-and-materials, or cost-plus), you are required to submit an adequate Incurred Cost Submission (ICS) within six months of your fiscal year end [FAR 52.216-7(d)(2)(i)]. The ICS is the document DCAA uses to audit your actual costs and final indirect rates. Build the schedules as you go. Do not wait until month five to start. The ICS guide walks every required schedule, the month-by-month preparation checklist spreads the work across six months, and what DCAA does next covers the post-submission cycle through final rate agreement.
• Document everything: DCAA operates on a “if it isn’t documented, it didn’t happen” standard. Every cost allocation methodology, every rate calculation, every policy decision should be in writing and accessible.
• Test your own system: Run internal audits using DCAA’s own SF 1408 checklist (the Pre-Award Survey of Prospective Contractor Accounting System). If your system would not pass your own review, it will not pass theirs. The SF 1408 pre-award survey guide walks all 15 evaluation criteria, and the DCAA accounting system checklist covers the 18 DFARS 252.242-7006 criteria the same system has to satisfy post-award.

The Four Compliance Maturity Levels

Most small contractors fall into one of four maturity levels. Identifying yours is the fastest way to know what to fix first.

Level 1: Commercial Books, Federal Contract

You won a federal contract while running a chart of accounts designed for commercial work. Direct and indirect costs are commingled. Timekeeping is whatever your payroll system tracks. There are no written accounting policies. This is the usual starting point for a first-time contractor. The risk: the next audit (SF 1408 or floor check) exposes the gap, and the contract goes conditional or is denied. The fix path runs 60 to 90 days.

Level 2: DFARS-Aware

You know what DFARS 252.242-7006 requires. The chart of accounts has been restructured. Timekeeping is daily-recorded with supervisor approval. But written policies are thin or missing, and reconciliations happen quarterly instead of monthly. This system passes a calm SF 1408 review but produces findings during an incurred cost audit because the reconciliations do not hold up to transaction-level testing.

Level 3: DFARS-Adequate

The system meets all 18 DFARS criteria. Written policies exist for timekeeping, compensation, travel, and unallowable costs. Monthly closes are routine. Indirect rate calculations are documented. The annual ICS files on time. This level passes audits with minimal questioned costs. The remaining work is incremental: tightening reconciliations, strengthening documentation habits, and building an audit-response playbook.

Level 4: Audit-Ready

The system meets DFARS criteria and produces documentation faster than DCAA requests it. Self-assessments run quarterly using the SF 1408 checklist. The compliance maturity report is formally reviewed by the CFO each quarter. Policy changes are version-controlled. Cost trend analyses identify rate variances before DCAA does. Few small contractors operate at Level 4. The ones who do typically hold prime contracts above $25 million or have been audited multiple times and built the muscle.

The honest answer about where a $1M to $20M contractor usually sits: between Level 1 and Level 2, with a few in Level 3. Moving up one level reduces audit risk by an order of magnitude. The investment is real but the payback is faster than it looks.

Key Takeaways

• Segregate direct and indirect costs from day one. Retrofitting a chart of accounts after a DCAA finding is exponentially harder than building it correctly upfront.
• Timekeeping is the highest-risk area. Daily recording, supervisor approval, and an unalterable audit trail are non-negotiable. Fix this first.
• Written policies are not optional. DCAA expects documented policies for compensation, travel, purchasing, and timekeeping, and expects you to follow them consistently.
• Build compliance into your monthly operations. Monthly closes, ongoing unallowable cost segregation, and real-time job costing prevent the year-end scramble that leads to findings.
• Get CPA-level oversight on your government contractor bookkeeping. Bookkeepers record transactions. In a CPA-managed engagement as we run it, your entire system, from structure to policies to reporting, is built to withstand federal scrutiny.

Frequently Asked Questions

Is Your Accounting System Audit-Ready?

Most small government contractors have gaps they do not know about until DCAA points them out. Our Compliance Readiness Check takes 30 seconds and identifies where your system stands today. No obligation, no sales pitch.

If you already know you need help, book a discovery call and we will walk through your specific situation with CPA-level guidance.