DCAA Timekeeping Requirements: The Complete Guide for Government Contractors

DCAA timekeeping requirements mandate that every employee on a government contract record their own time daily, classify hours by specific contract or indirect account, and submit timesheets with a complete audit trail. Labor is the area DCAA tests most often and the hardest to reconstruct after the fact. One deficiency here flags your entire labor billing for review.

Timekeeping is the DCAA finding category that blindsides small contractors most often because the violation looks invisible until the audit. Employees are recording time. Supervisors are approving timesheets. The charge codes are correct. But if every entry was submitted on Friday for the full week, the audit log proves reconstruction, and that single pattern turns a compliance posture into a system-wide finding.

The mechanism is always the same, and it does not require anyone to lie. Timesheets look complete. Charge codes are right. Then the auditor pulls the system log and every entry for the week carries a Friday afternoon timestamp. No confession is needed, because the submission times sit next to the work dates in the contractor’s own system and the comparison takes minutes. Once the labor record for a period is unreliable, every labor dollar billed in that period is exposed.

Labor is typically the largest direct cost on government service contracts. Across the small service contractors we work with, it runs 60 to 70 percent of total cost on cost-reimbursement and time-and-materials work. When DCAA questions your timekeeping, it questions the majority of your billings.

DCAA timekeeping requirements come from two places. DFARS 252.242-7006 sets 18 accounting system criteria, of which criterion (c)(9) requires a timekeeping system identifying employee labor by intermediate or final cost objectives and (c)(10) requires a labor distribution system. The operational detail sits in DCAA Manual 7641.90, Enclosure 3, Section 3.c, which lists nine timesheet controls. Auditors test them under DCAM 6-405.2, Procedures for Evaluating Timekeeping Controls.

The Regulatory Foundation for DCAA Timekeeping

DCAA timekeeping requirements flow from three sources, and it is worth being precise about which one says what, because published guidance on this topic frequently cites the wrong section.

FAR 31.201-2 requires contractors to maintain records adequate to demonstrate that costs claimed are incurred, allocable, and comply with applicable cost principles.

DFARS 252.242-7006 sets the accounting system criteria. Paragraph (c) contains 18 criteria, of which exactly one addresses timekeeping directly. Criterion (c)(9) requires “a timekeeping system that identifies employees’ labor by intermediate or final cost objectives.” Criterion (c)(10) requires “a labor distribution system that charges direct and indirect labor to the appropriate cost objectives.” That is the whole of the regulatory timekeeping mandate: two sentences.

The operational detail lives in DCAA guidance, not in the regulation. Two documents matter:

• DCAA Contract Audit Manual (DCAM) 6-405.2, Procedures for Evaluating Timekeeping Controls. This is the section that instructs auditors how to test your timekeeping, and it sits inside DCAM 6-405, Floorcheck Procedures. It is the auditor-facing standard.
• DCAA Manual 7641.90, Information for Contractors, Enclosure 3, Section 3. This is the contractor-facing document, and it contains the only enumerated list of timesheet controls DCAA publishes for contractors to follow.

A note on citations, because this matters if you are going to look any of it up. DCAM 6-406 is Evaluation of Payroll Preparation and Payment, and DCAM 6-410 is Evaluating Uncompensated Overtime. Neither is the timekeeping standard, though both are widely cited as though they were. The timekeeping section is 6-405.2.

Auditors apply these criteria directly when they judge whether your accounting system is adequate. A system that fails receives an inadequacy determination under DFARS 252.242-7006. That determination triggers payment withholding under DFARS 252.242-7005, the Contractor Business Systems clause. The clause sets ceilings rather than flat rates: withholding on any contract “shall not exceed” 5 percent for one or more material weaknesses in a single business system, or 10 percent across multiple systems [DFARS 252.242-7005(e)(3)(i)].

The provision that gets missed: submit an acceptable corrective action plan within 45 days of the notice and keep to it, and the contracting officer reduces the withholding to 2 percent [DFARS 252.242-7005(e)(2)]. Fall off the plan and it goes back up.

Separately, an inadequate accounting system closes the door on new cost-reimbursement work, because a cost-reimbursement contract is permitted only when the contractor’s accounting system is adequate for determining costs applicable to that contract [FAR 16.301-3(a)(3)].

DFARS 252.242-7005 applies only to contracts subject to the Cost Accounting Standards, and small businesses are exempt from CAS at any contract value [48 CFR 9903.201-1(b)(3)]. If you qualify as a small business, this payment withholding does not apply to you. That exemption does not touch the accounting-system requirement above: a cost-reimbursement contract still requires an adequate accounting system regardless of business size [FAR 16.301-3(a)(3)].

When we assess timekeeping systems during compliance engagements, the documentation gap we find almost universally in small firms is a missing written timekeeping policy. The daily recording practice is often sound. But DCAA’s standard is documented practice, not observed practice. A contractor without a written policy fails the DFARS 252.242-7006 adequacy test regardless of what employees are actually doing.

The Nine Timesheet Controls Behind DCAA Timekeeping Requirements

You will see this list rendered as six requirements, eight requirements, or ten. Those counts are editorial, not regulatory. DCAA itself publishes nine, in DCAA Manual 7641.90, Enclosure 3, Section 3.c, under the heading Timesheet Preparation, introduced with a single line: “Internal controls over timesheet preparation should include the following policies or procedures.” What follows are the nine, with what each one means in practice.

1. Written Timesheet Instructions

DCAA’s first control is documentation: detailed instructions for timesheet preparation established through a timekeeping manual or company procedure. A two-page document signed by the owner, distributed to every employee with an acknowledgment sheet, satisfies this. Informal practice does not. “Everyone knows to enter their time daily” fails the audit, and it is the single most common gap we find.

2. The Work Determines the Charge, Not the Funding

This is the control most published summaries omit, and it is the one that separates a bookkeeping error from a fraud referral. DCAA states that the instructions “should state that the nature of the work determines the proper distribution of time, not availability of funding, type of contract, or other factors.”

That sentence matters if you have ever been asked to move hours to a contract that still had budget. Charging by where money remains rather than by where the work happened is the definition of labor mischarging. Your written policy needs to say so explicitly, because DCAA looks for that sentence.

3. Charge Codes Provided to the Employee

A listing of project numbers and their descriptions must be provided to the employee and maintained in the work authorization system, electronically or on paper, so the employee refers to it as needed. Time entries must reference the specific contract, task order, CLIN, or indirect account where the labor cost belongs. Generic codes like “overhead” or “admin” without further classification are insufficient.

The charge code structure must match your accounting system’s job cost structure. If your chart of accounts tracks cost by contract number, your charge codes use the same contract numbers. Mismatches between timekeeping and accounting are a routine audit finding.

4. Daily Recording by the Employee

“Employees record their time on a timesheet on a daily basis.” Not weekly. Not at the end of the pay period. Daily. Weekly reconstruction from memory is the most common timekeeping violation DCAA identifies, and system logs expose it immediately.

DCAA does account for reality here: employees at offsite locations, in secure facilities, or in a war zone will not always have daily access to an electronic system, and for those circumstances the company must provide procedures that mitigate the risk of mischarging. That exception is documented and narrow, rather than a general grace period.

The practical standard: employees enter time before leaving each day, or by the start of the next business day at the latest.

5. Supervisors Do Not Fill In Timesheets

The supervisor is prohibited from completing an employee’s timesheet unless the employee is absent for a prolonged period on some form of authorized leave. On the employee’s return, the employee submits a timesheet replacing the one the supervisor prepared.

Only the person doing the work is authorized to create that initial entry. An audit trail showing a manager’s credentials creating entries for direct reports is a finding on its face.

6. Documented Corrections With Employee Concurrence

Changes to the timesheet must be documented and supported through procedures that identify the original time charge, the corrected time charge, and documentation from the employee indicating concurrence with the change.

The third element is the one that gets dropped. Files routinely record what changed and who changed it. The employee’s agreement to the change is the part DCAA asks for. Whatever changes, the original entry must remain visible. Overwriting or deleting original entries without preserving history creates an immediate finding, because a system without a correction trail cannot distinguish an honest fix from deliberate cost shifting.

7. Total Time Accounting, Paid or Not

“All hours worked should be recorded whether they are paid or not.” Labor costs and associated overheads are driven by total hours worked, not paid hours, so rate computations must reflect every hour. Unpaid hours worked are termed uncompensated overtime, and solicitations over the simplified acquisition threshold carry FAR 52.237-10, Identification of Uncompensated Overtime, which sets disclosure requirements.

Salaried exempt employees are where this breaks. An exempt employee recording exactly 8.0 hours every day for six months is a red flag, and DCAA checks for exactly that pattern against badge and email records.

8. Employee Certification and Supervisor Cosignature

Employees sign their timesheet certifying that the hours recorded reflect the hours worked and the appropriate cost objective, at the end of each work period. The supervisor approves and cosigns all timesheets.

Approval must be documented and it must be real. A verbal confirmation is not compliance, and approving twenty timesheets in one click without review is rubber-stamping. The supervisor needs direct knowledge of the work performed, and the review has to happen close enough to the work period for that knowledge to be meaningful. Neither DFARS 252.242-7006 nor DCAA Manual 7641.90 sets a deadline for the supervisor’s signature. Within one business day is the standard we set for clients, not a figure DCAA publishes.

9. Accuracy Is the Employee’s Stated Responsibility

Company policy must state that accurate and complete preparation of the timesheet is the employee’s responsibility, and that careless or improper preparation leads to disciplinary action under company policy as well as applicable federal statutes.

DCAA is explicit that the individual employee is the key link in labor charging control, because labor, unlike materials, has no external document to check it against. Your policy has to place the responsibility on the employee in writing, and your training has to say it out loud.

Two System Requirements That Sit Outside the Timesheet

The nine controls above govern timesheet preparation. Two further requirements come from DFARS 252.242-7006(c) and apply to the system rather than the sheet.

Segregation of direct and indirect labor. The system must distinguish direct labor charged to specific contracts from indirect labor charged to overhead, G&A, B&P, and IR&D. Employees splitting time between direct and indirect work record the split daily, not as a monthly percentage estimate. This is criterion (c)(10).

Audit trail retention. The system must retain a complete, tamper-evident record of all entries, modifications, approvals, and corrections. DCAA pulls the audit log during fieldwork and compares it against approved timesheets. This is how weekly reconstruction gets caught.

DCAM 6-405.2 adds one more control that small contractors routinely miss: a division of responsibility between the people preparing time and attendance records and the people preparing and distributing payroll, and a second division between timekeeping staff and anyone accountable for operating within a budget. DCAA acknowledges that the smallest companies will not always achieve full separation, but the expectation scales with headcount.

Does DCAA Require Electronic Timekeeping Systems?

No. DCAA timekeeping requirements do not mandate electronic systems, and DCAA does not certify, approve, or require any specific product. Paper timesheets and spreadsheets remain compliant if they satisfy the nine controls above.

The practical calculation is different from the compliance one. A 15-person contractor on Excel timesheets faces a fundamentally different audit from one running a system with enforced controls, because the electronic system produces the audit trail automatically and the spreadsheet does not. Once you are past about ten employees, or holding any cost-reimbursement or T&M work at all, a compliant system at roughly $5 to $15 per employee per month is trivial next to a single adverse finding that runs into six figures. That headcount is our rule of thumb, not a regulatory line.

Timekeeping Software for Government Contractors

The right software makes compliance easier. No software substitutes for discipline. A free spreadsheet meeting all nine controls is more compliant than expensive software configured without audit trails. Several products are widely used in the GovCon community. Pricing symbols below are relative tiers only; confirm current pricing directly with each vendor.

The common mistake is choosing on price or interface without confirming the product supports correction audit trails and supervisor approval workflows. Those two features are what the auditor tests. See our comparison of QuickBooks and Deltek for government contractors for the accounting-system side of the same decision.

DCAA Floor Checks: The Unannounced Audit

Floor checks are DCAA’s primary tool for verifying that timekeeping matches actual work performed. Auditors arrive unannounced, observe who is present, and compare what they see against timesheets for that day. No advance notice. No preparation window. DCAM 6-405 governs the procedure.

During a floor check, auditors will:

1. Interview employees individually. What are you working on right now? What charge code are you using? When do you enter your time? What happens if you make a mistake? The answers must align with both the timesheet record and the written policy.
2. Verify physical presence. Employees are at work, performing in their assigned job classification.
3. Compare timesheet entries to observed work. If an employee says Contract A and the timesheet shows Contract B, that is a finding. If an employee says they entered time this morning and the system shows nothing for today, that is a finding.
4. Review correction history. Auditors look for patterns. Repeated corrections moving hours from an indirect code to one specific direct contract suggest mischarging.
5. Test policy awareness. Employees who cannot describe the timekeeping policy indicate a training failure, which DCAA treats as systemic rather than individual.

Floor checks are unannounced by design. DCAA wants normal operations, not a performance. The only preparation that works is making compliance the daily standard. Remote and work-from-home employees are covered too, under DCAM 6-405.5; interviews happen by phone instead of in person, and the same nine controls apply. Our guide to DCAA floor checks for remote employees covers that case in depth.

Setting Up Your System: Step by Step

If you are building a DCAA-compliant timekeeping system from scratch, follow this sequence. Each step builds on the one before it.

1. Define your charge code structure. List every active contract, every indirect pool (fringe, overhead, G&A, IR&D, B&P), leave categories, and uncompensated overtime. Map these to your chart of accounts.
2. Select your software. Verify it supports daily entry enforcement, supervisor approval workflows, correction audit trails with employee concurrence, and total time accounting. Configure charge codes to match the accounting system.
3. Write your timekeeping policy. Cover all nine controls. Two to three pages is enough. State that the nature of the work determines the charge, and state the consequences of improper preparation.
4. Train every employee. Walk through the policy, demonstrate the software, and practice entering time against real charge codes. Document the training with sign-off sheets.
5. Set up automated reminders. End-of-day entry prompts, weekly supervisor reminders for unapproved timesheets, monthly management reports flagging missing entries.
6. Run a 30-day pilot. Monitor daily for the first month and address issues immediately. Then review the data for patterns: missing entries, late approvals, charge code errors.
7. Establish ongoing monitoring. Monthly reports tracking daily entry rates, approval timeliness, and correction frequency. Any metric below 95 percent needs attention that month.

Setup takes two to three weeks for a small contractor. The pilot adds another month. By day 45 the system should be producing clean, auditable data. Our year-end close guide covers how that data feeds the rest of the compliance calendar.

Common Timekeeping Violations and How to Prevent Them

These are the failures we see most often when we take over a contractor’s books, and every one of them is visible in a system log.

Cross-charging and charging to available funding deserve separate attention. Unlike the other entries, which stem from weak process, these two raise fraud concerns and trigger referral to the Office of Inspector General.

What Happens When Timekeeping Fails an Audit

A timekeeping failure does not stay contained. It spreads across every contract, because labor costs flow into indirect rate pools and indirect rates touch every billable dollar.

The Cost of Timekeeping Non-Compliance

The consequences above have a price. Working through it in dollars tends to settle the question of whether to fix the system now or later.

• Questioned labor costs. If DCAA determines timekeeping is unreliable, it questions the labor charged during the non-compliance period. A contractor billing $80,000 per month in direct labor with six months of exposure is looking at $480,000 in questioned costs.
• Payment withholding. A material weakness determination under DFARS 252.242-7006 triggers withholding under DFARS 252.242-7005 until corrected. At the 5 percent ceiling for a single deficient system, a contractor billing $200,000 per month sees up to $10,000 a month held back. An accepted corrective action plan inside 45 days drops that to 2 percent, or $4,000 a month, which is the cheapest paperwork in this article.
• Remediation cost. Fixing a non-compliant system after a finding means software, policy documentation, employee training, the corrective action plan, and the verification review, all compressed into the window DCAA gives you. Actual cost varies with firm size and scope, and is a fraction of a single lost or withheld award.
• Lost future work. An inadequate system finding appears in your contractor performance record, which primes and contracting officers read before awarding.

Against that, standing a compliant system up in the first place runs roughly $2,000 to $5,000 plus two to three weeks of effort, based on our implementation work with small contractors. Fixing one after a finding costs five to ten times more and takes three to six months depending on severity. Every contractor who waits pays the premium.

Building a DCAA-Compliant Timekeeping System

Meeting DCAA timekeeping requirements is a system problem, not a tool problem. A compliant system has four layers.

1. Written timekeeping policy. Document your requirements for daily recording, charge code assignment, the work-determines-the-charge rule, supervisory approval, corrections with employee concurrence, and record retention. Reference FAR 31.201-2 and your specific contract clauses.
2. Technical controls. Configure your software to enforce daily entry deadlines, prevent backdating without supervisor override, log changes automatically, and restrict access by role.
3. Employee training. Annual training is the minimum and new-hire training within the first week is not optional. Check whether FAR 52.203-13 is in your contract before relying on it here: its business ethics awareness and internal control requirements in paragraph (c), which include the reporting mechanism, expressly do not apply to a contractor that represented itself as a small business concern for that award. Where the clause does apply, DCAA auditors ask employees during floor checks whether they know how to use the mechanism. Where it does not, a written channel for reporting suspected mischarging is still the practice we recommend, because DCAA treats the employee as the key control in labor charging.
4. Management oversight. Monthly labor distribution reviews comparing charged hours to contract staffing plans catch problems before DCAA does. Internal audits using DCAA’s own criteria from DCAM 6-405.2 find gaps while they are still fixable.

Record retention rounds out the system. Maintain all timesheets, corrections, and supporting documentation for a minimum of three years after final contract payment [FAR 4.703]. Experienced GovCon contractors retain for six years as a buffer against delayed audits.

Key Takeaways

• The count is ours, not DCAA’s. DCAA publishes nine timesheet controls in DCAA Manual 7641.90, Enclosure 3, Section 3.c. Articles citing six or eight requirements are summarizing that list, not quoting a different one.
• Cite 6-405.2, not 6-406 or 6-410. DCAM 6-405.2 is Procedures for Evaluating Timekeeping Controls. DCAM 6-406 is payroll preparation and payment; 6-410 is uncompensated overtime.
• The work determines the charge. Not available funding, not contract type. This is DCAA’s own language and it needs to appear in your written policy.
• Daily recording is the line in the sand. Weekly reconstruction is the most common finding DCAA reports. Fix it first.
• Corrections need the employee’s concurrence. Most systems capture what changed and who changed it. DCAA also asks for documentation that the employee agreed.
• Failures cascade. An adverse finding does not stay in one contract. It reaches indirect rates, provisional billing, and eligibility for future awards.
• Retain records for six years. The regulatory minimum is three years after final payment [FAR 4.703], but delayed audits make six the practical standard.

Frequently Asked Questions

Protect Your Timekeeping Before DCAA Tests It

Most timekeeping deficiencies are straightforward to fix when caught early. They become expensive when DCAA catches them first. Take the Compliance Readiness Check to see where your system stands today, or book a discovery call for a CPA-level review of your timekeeping practices and DCAA compliance posture.