Top 10 DCAA Audit Findings and How to Prevent Them

DCAA’s most recent report to Congress documented tens of billions in audit recommendations across thousands of completed audits. Not all of those dollars represent contractor error. Many reflect pricing disagreements, estimating differences, and scope interpretations. But buried in the aggregate number is a pattern: the same deficiencies appear in audit after audit, contractor after contractor, year after year.

We track the findings from every DCAA engagement our clients receive. The distribution is not uniform. Ten categories account for the vast majority of all questioned costs and system deficiency citations our clients face. A contractor who prevents these ten findings eliminates most audit risk before an auditor opens a file.

These are the ten most common DCAA audit findings, ranked by how frequently they appear in audit reports, with the specific controls preventing each one. Every finding traces back to a FAR requirement, a CAS standard, or a DFARS adequacy criterion. The regulatory citation tells you where DCAA found the deficiency. The prevention control tells you how to close the gap before they look.

The 10 Most Common DCAA Audit Findings

1. Unallowable Costs Charged to Government Contracts

The single most frequent DCAA audit finding: costs prohibited under FAR 31.205 included in indirect cost pools or charged directly to contracts. FAR Part 31 contains 51 subsections defining specific cost categories and their allowability. DCAA auditors test every indirect cost pool for contamination by unallowable expenses.

The usual suspects: entertainment [FAR 31.205-14], alcoholic beverages [FAR 31.205-51], charitable donations [FAR 31.205-8], lobbying [FAR 31.205-22], and fines or penalties [FAR 31.205-15]. These costs must be segregated into an unallowable cost account, excluded from every indirect rate calculation, and excluded from the incurred cost submission.

Prevention: Maintain a dedicated unallowable cost account in your chart of accounts. Code every transaction against the FAR 31.205 subsections at the point of entry. Run a monthly scan of all expense accounts for terms like ‘entertainment,’ ‘club,’ ‘gift,’ ‘donation,’ ‘penalty,’ and ‘alcohol.’

A single unallowable expense in an allowable pool contaminates the entire pool’s claimed costs.

2. Inadequate or Missing Timekeeping System

DCAA’s timekeeping requirements go beyond recording hours. The system must support daily time recording to specific cost objectives, supervisor review and approval, a documented amendment process for corrections, and separation between direct and indirect time. DCAA floor checks test these controls without warning.

The finding: employees record time weekly (not daily), corrections overwrite original entries instead of using an auditable amendment process, supervisors batch-approve timesheets without reviewing individual entries, or no mechanism exists to verify time charged to a specific contract matches work performed. Each deficiency individually triggers a system adequacy finding under DFARS 252.242-7006.

Prevention: Require daily time entry. Every correction must show the original entry, the reason for change, the employee’s initials, and the supervisor’s approval. Supervisors must review and sign timesheets within one pay period. Conduct quarterly internal floor checks to verify the system operates as documented.

3. Direct and Indirect Cost Misclassification

CAS 402 requires consistency in classifying costs as direct or indirect. A cost classified as direct on one contract must be direct on all contracts of similar type. A cost classified as indirect in one period must remain indirect in subsequent periods unless a formal change in accounting practice occurs.

DCAA tests this by comparing cost classifications across contracts and across periods. Common violations: a project manager’s salary coded direct on one contract and indirect on another, travel costs direct on cost-type contracts but indirect on fixed-price contracts, and computer equipment direct on large contracts but expensed to overhead on small ones. The inconsistency itself is the finding, regardless of whether either classification is reasonable.

Prevention: Document your direct vs. indirect cost classification criteria in a written policy. The policy must define which cost categories are always direct, always indirect, and what criteria determine classification for costs with characteristics of both. Review all new cost types against the policy before first classification.

Once classified, maintain consistency.

4. Indirect Rate Calculation Errors

DCAA verifies indirect rates against the contractor’s disclosed allocation methodology. The three most common rate calculation errors: using the wrong allocation base (total cost input vs. value-added vs. direct labor dollars), including unallowable costs in the pool, and miscalculating the base by excluding or double-counting cost elements.

A 2% error in the G&A allocation base on $5 million in direct costs creates $100,000 in questioned indirect charges across every CAS-covered contract. The error compounds because DCAA recalculates rates for the entire fiscal year, not the single period where the mistake occurred.

Prevention: Verify indirect rate calculations monthly against your established allocation methodology. Compare the base used in the calculation to the base described in your written accounting policies. Run a separate calculation using the prior year’s base definition to catch methodology drift. Flag any variance exceeding 2% for immediate investigation.

5. Missing or Inadequate Written Accounting Policies

DCAA expects written accounting policies covering five core areas: compensation, travel, timekeeping, cost allocation methodology, and unallowable cost segregation. The absence of a written policy is itself a finding, separate from whether the contractor’s actual practices are sound.

The practical impact: without a documented policy, DCAA has no benchmark to audit against. The auditor applies their own interpretation of FAR requirements to every transaction. A contractor with a written travel policy stating ‘$75/day meal maximum’ and a $74 meal receipt gets a pass. A contractor without a written policy and a $74 meal receipt gets a reasonableness finding because the auditor applies a different standard.

Prevention: Write the five core policies. Review annually. Update when practices change. The policies do not need to be lengthy. A two-page travel policy referencing FTR and GSA per diem rates, with firm-specific exceptions documented, satisfies the requirement.

The key: actual practice must match the documented policy. A policy stating one thing while the books reflect another is worse than no policy.

6. Incurred Cost Submission Deficiencies

The annual incurred cost submission requires 20+ schedules reconciling claimed costs to the general ledger. DCAA’s adequacy review rejects submissions missing schedules, containing internal inconsistencies, or failing to reconcile to the trial balance. A rejected ICS restarts the review clock and delays final rate settlement.

Common deficiencies: Schedule H (home office allocation) omitted for multi-segment contractors, Schedule I cumulative allowable costs not reconciled to prior year ICS, claimed indirect rates not reconciled to provisional billing rates, and the certificate of final indirect costs not signed by an authorized officer. The ICS deadline is six months after fiscal year end. Late submissions carry their own consequences separate from adequacy issues.

Prevention: Use the DCAA-provided ICE model or equivalent. Cross-check every schedule total against the general ledger trial balance. Reconcile claimed rates to billed rates. Have a CPA review the complete package before submission.

One round of DCAA adequacy comments costs 60 to 90 days. A clean first submission saves a quarter of elapsed time.

7. Compensation Reasonableness Deficiencies

Compensation reasonableness under FAR 31.205-6 requires contractors to demonstrate their compensation costs (salaries, bonuses, benefits) are reasonable for the work performed. DCAA tests executive compensation against the statutory cap ($671,000 for 2025, adjusted annually by the Employment Cost Index per OFPP) and tests all other compensation against market surveys and BLS data.

The finding: no compensation study on file, executive salaries exceeding the cap without proper segregation of the excess, bonus structures without documented criteria linking payments to performance, or fringe benefit costs allocated inconsistently across employee categories.

Prevention: Conduct or obtain a compensation study every two to three years benchmarking all positions against market data (BLS, salary.com, or equivalent). Document the methodology. For executives, track the annual compensation cap and segregate any excess as unallowable.

Document bonus criteria in writing before the performance period begins.

8. Accounting System Adequacy Deficiencies

DFARS 252.242-7006 lists 18 criteria the accounting system must satisfy. Failure on any single criterion results in system disapproval, halting payment on all cost-type contracts until remediation and DCAA reverification. The most frequently failed criteria: inability to segregate direct from indirect costs, inability to segregate unallowable costs, no timekeeping system meeting DCAA standards, and inability to accumulate costs by contract.

System disapproval is the most severe DCAA finding outside of fraud referral. A disapproval on a firm with three cost-type contracts and $200,000 in monthly billings creates a $600,000 cash flow gap during the typical 90-day remediation period. The finding is preventable. The accounting system checklist covers all 18 criteria.

Prevention: Self-assess against all 18 DFARS criteria annually. Test each criterion with sample transactions. For QuickBooks users, confirm the chart of accounts supports cost segregation by contract, by direct/indirect classification, and by allowable/unallowable status.

Fix deficiencies before DCAA requests a system audit, which often comes during pre-award survey or within the first year of a cost-type contract.

9. Inadequate Cost Proposal Support

When DCAA audits a cost proposal, the primary test is whether each cost element has adequate documentation supporting the proposed amount. Labor rates must trace to actual payroll records or compensation studies. Material costs must tie to vendor quotes or historical purchase data. Indirect rates must reconcile to the most recently established rates (forward pricing rates, provisional rates, or actual rates from the last settled year).

The finding: ‘basis of estimate inadequate’ or ‘cost element unsupported.’ DCAA questions the entire unsupported cost element, not the portion lacking documentation. A $500,000 labor proposal with one unsupported labor category of $50,000 results in $50,000 in questioned costs, not a proportional adjustment.

Prevention: Build a basis-of-estimate file for every cost proposal. Each cost element gets a tab or folder with: the proposed amount, the source document (payroll records, vendor quotes, rate agreements), the methodology (engineering estimate, historical actuals, catalog pricing), and the person responsible for the estimate. DCAA auditors test the file, not the proposal document.

10. Provisional Billing Rate Mismanagement

Contractors bill cost-type contracts at provisional billing rates approved by the contracting officer. DCAA tests whether the contractor’s actual incurred rates align with the billed rates. Significant variances in either direction create findings.

Overbilling (actual rates lower than provisional rates) creates a liability the contractor must repay. Underbilling (actual rates higher than provisional rates) creates cash flow stress and complicates the incurred cost settlement. Both result from the same root cause: the contractor does not track actual rates against provisional rates during the year and does not request rate adjustments when the variance grows.

Prevention: Compare actual incurred rates to provisional billing rates quarterly. When the variance exceeds 10%, submit a rate adjustment request to the contracting officer. Document the calculation. A proactive rate adjustment prevents year-end billing surprises and demonstrates to DCAA the contractor actively monitors its rate structure.

Frequently Asked Questions

Key Takeaways

• Ten DCAA audit findings account for the vast majority of questioned costs and system deficiency citations. Unallowable cost contamination leads the list, followed by timekeeping deficiencies and direct/indirect misclassification. Each finding traces to a specific FAR, CAS, or DFARS requirement with a documented prevention control.
• System adequacy disapproval under DFARS 252.242-7006 is the most severe finding short of fraud. It halts all cost-type contract payments until remediation and reverification. Annual self-assessment against the 18 criteria is the single highest-value prevention activity a small GovCon firm performs.
• Written accounting policies are the cheapest compliance control and the most commonly missing. Five policies covering compensation, travel, timekeeping, cost allocation, and unallowable cost segregation eliminate an entire category of findings. Two pages each. Reviewed annually.
• Prevention cadence matters more than prevention intensity. Monthly unallowable cost scans, quarterly rate comparisons, and annual system assessments catch deficiencies at the point of origin, not at the point of audit. Every finding discovered internally costs a fraction of the same finding discovered by DCAA.

DCAA audits test systems, not intentions. A contractor with excellent intentions and poor controls faces the same findings as one who never considered compliance. The difference between the two is the accounting infrastructure in place before the audit begins. Run the Compliance Readiness Check to evaluate your controls against the ten most common findings. Ready to close the gaps before DCAA arrives? Book a discovery call with our CPA-managed team.