What DCAA Compliance Means for Government Contractors

What DCAA Compliance Means for Government Contractors

The first time a contracting officer asks if your accounting system is "DCAA compliant," most founders say yes. Then they Google it and panic.

Here is DCAA compliance explained without the acronym soup. The Defense Contract Audit Agency (DCAA) audits the accounting systems and cost claims of companies that bill the federal government on certain contract types. It does not approve your QuickBooks setup, hand you a certificate, or wish you well. It checks whether your books can prove that every dollar you bill the government is real, allowable, and allocated correctly.

Get that wrong and the consequence is not a fine. It is a held invoice, a withheld award, or a contract you can no longer keep.

DCAA compliance explained: who they are and what they actually check

DCAA is the audit arm that works on behalf of contracting agencies, most often the Department of Defense. They do not write contracts. They examine the cost data behind them.

The reference point for "is this system good enough" is the SF 1408 Pre-Award Accounting System Adequacy checklist. Despite the name, the pre-award survey is a review of your system's design, not an audit of actual spending. It asks one question: if you won a cost-reimbursement contract tomorrow, could your books track the costs correctly?

The criteria trace back to FAR Part 31, the cost principles that define what the government will and will not pay for. An adequate system, under SF 1408, runs on GAAP, accumulates costs under general-ledger control, and produces cost data at least monthly.

That is the bar. Most off-the-shelf bookkeeping does not clear it by default.

An adequate accounting system splits costs into three buckets

This is the foundation, and it is where most non-compliant systems break.

A DCAA-ready accounting system separates every dollar into three categories:

• Direct costs — tied to a specific contract. The engineer's hours on Contract A, materials for that job.
• Indirect costs — real costs you cannot pin to one contract, so you spread them. Rent, your accountant, HR, the office internet.
• Unallowable costs — expenses FAR Part 31 says the government will never reimburse, like entertainment, lobbying, or alcohol. These have to be tracked and walled off, not deleted.

The mistake founders make is treating "unallowable" as "delete it." You do not. You record it and exclude it from anything you bill. An auditor who finds unallowable costs buried in a billed pool does not just remove that line. They start wondering what else is hiding.

GovCon indirect rates are where the real money math happens

Direct costs are easy. The fight is over indirect costs, and that fight is the entire game of GovCon indirect rates.

You cannot bill rent to a specific contract. So you pool indirect costs and apply them as a rate against a base. A common structure: a fringe rate on labor, an overhead rate, and a general and administrative (G&A) rate on total cost.

Consider an illustrative example. Say your overhead pool is $400,000 and your direct labor base is $1,000,000. Your provisional overhead rate is 40%. Bill $100,000 of direct labor on a cost contract and you add $40,000 of overhead on top.

Now the catch. Those are provisional rates set at the start of the year. At year end you calculate the actual rates from real numbers. If your actual overhead came in at 35%, you over-billed and you owe the government money back. If it came in at 45%, you under-billed and left cash on the table. Reconciling provisional to actual is not optional housekeeping — it is the difference between a clean invoice and a clawback.

Timekeeping is the part auditors love and contractors fear

If there is one place a DCAA audit goes from routine to ugly, it is timekeeping.

Labor is usually the biggest cost on a government contract, and it is the easiest to fake, so it gets the closest look. The standard expects daily time entry, total-time accounting (every hour of the day charged somewhere, billable or not), supervisor approval, and a clear audit trail for any correction.

"I'll fill out my timesheet on Friday" is a finding waiting to happen. Reconstructed time is not contemporaneous time, and an auditor can tell the difference. Weak timekeeping records do not just generate a comment — they can call your billed labor into question across the whole contract.

The incurred cost submission is the annual exam you cannot skip

Every year, contractors with cost-reimbursement work file an incurred cost submission, often called the ICE submission after DCAA's Incurred Cost Electronically model.

It is generally due six months after your fiscal year ends and is required under the Allowable Cost and Payment clause (FAR 52.216-7), with DFARS 252.242-7006 governing the accounting-system criteria for defense work. The submission reports your actual costs and actual indirect rates for the year, and it is what reconciles everything you billed provisionally against what you actually spent.

Get it right and you settle the year and stay eligible for future awards. File it late, file it inadequate, and you risk decremented rates, withheld payments, and a reputation problem that follows you into the next bid.

Get DCAA compliance right before the audit, not during it

DCAA compliance is not a software you buy. It is a way of structuring your books so that every billed dollar can survive a stranger reading it line by line. That is a specialist skill, not a generalist one.

Steady Co is a mid-sized firm that blends Big 4 audit pedigree with real industry operating experience, offered through a fractional CFO model — the same financial leadership a prime contractor keeps in-house, without the full-time hire. For a GovCon owner staring at an SF 1408 survey or a looming incurred cost submission, that is the exact gap to close.

Read Steady Co's verified reviews on Sam's List, then book an intro call before your next audit, not during it. The cheapest time to fix an accounting system is before a contracting officer asks you to prove it works.