It isn't a black box
Ask a contractor's controller how they feel about an upcoming DCAA audit, and the honest answer is usually some version of dread mixed with uncertainty — not necessarily because anything is wrong, but because it isn't always clear exactly what an auditor is going to look at, or why.
In practice, a DCAA audit isn't random. It works through a fairly consistent, well-documented set of checks, built around the Federal Acquisition Regulation's cost principles and the agency's own audit guidance. Knowing what those checks actually are — and running them yourself before the audit notice arrives — is the single biggest difference between a contractor who walks into a review calmly and one who spends the weeks before it in a scramble.
This isn't a substitute for legal or compliance advice specific to your contracts — audit scope and applicable requirements vary by contract type, contractor size and CAS coverage. What follows is a practical map of the ten things that come up again and again, in one form or another, across a typical incurred cost audit or accounting system review.
What follows works through each check individually, then looks at what actually reduces the stress and duration of an audit — which turns out to be a smaller, more specific set of habits than most people expect once the ten checks are separated out from each other.
Whether timekeeping is contemporaneous and daily
DCAA timekeeping expectations are specific: time recorded daily, by the employee themselves, as work actually happens — not reconstructed at the end of the week from memory, and not entered in large undifferentiated blocks. An auditor reviewing timesheets is checking for exactly this pattern, and a system that allows or encourages block entry, or entry well after the fact, is one of the first things that draws scrutiny.
Corrections matter here too — a legitimate timesheet correction should be visible as a correction, with both the employee and a supervisor signing off, rather than a silent edit to a number that already went into a labor distribution report.
Whether labor distribution matches the timesheets
Payroll and labor distribution reports need to trace directly back to the underlying timesheets they summarize. An auditor comparing a sample of payroll periods against the timesheets behind them is checking for exactly this consistency — a labor charge that doesn't match its supporting timesheet is a specific, documentable finding, not a judgment call.
Unallowable costs buried in an indirect pool
FAR 31.205 identifies specific categories of cost that are expressly unallowable on government contracts — entertainment, alcohol, certain lobbying costs, fines and penalties, among others. An auditor sampling invoices in an indirect pool is checking, invoice by invoice, whether any of these categories slipped through uncaught.
Consistency in how the same cost is treated
Cost Accounting Standards, where they apply, require the same type of cost to be treated consistently — as direct or indirect, in the same pool — across similar circumstances. An auditor checking for consistency is looking for a cost treated as direct on one contract and indirect on another with no documented reason for the difference, which is a specific pattern that draws attention regardless of whether either individual treatment was itself wrong.
Direct costs double-counted as indirect
A cost that's already charged directly to a specific contract shouldn't also sit inside an indirect pool that gets allocated back to that same contract — doing so effectively bills the government twice for the same cost. An auditor reviewing pool composition against direct-charged contract costs is checking specifically for this kind of overlap.
Uncompensated overtime for salaried staff
A salaried, exempt employee working extra hours without additional pay still needs those hours tracked and factored into the effective hourly labor rate used for cost-type contract billing — otherwise labor is effectively undercosted for the hours actually worked. An auditor reviewing exempt-employee timekeeping specifically checks whether total hours worked are captured, not just the standard 40-hour week.
Whether the accounting system segregates costs adequately
Before a cost-type contract is even awarded, an accounting system review — often against SF-1408 criteria — checks whether the system is structurally capable of segregating direct costs by contract, separating direct from indirect costs, and accumulating costs under general ledger control. An auditor here is checking system design and consistent use, not any single transaction.
Related-party and intercompany transactions
A cost billed from a related company or an affiliate needs to be supported at the actual cost to the related party, not marked up as though it were an arm's-length vendor transaction. An auditor reviewing intercompany charges is checking specifically for markup that shouldn't be there and for documentation showing the underlying cost basis.
Executive compensation reasonableness
FAR 31.205-6 caps the allowable amount of compensation for certain senior executive positions at specific contractors, and this has been a specific focus area in recent DCAA audit guidance. An auditor reviewing compensation is checking the amount claimed against the applicable benchmark and the supporting justification for how compensation was set.
Whether the final rate matches what was actually billed
At year-end, the actual indirect cost rate calculated from real pool and base totals should reasonably tie to what was billed during the year using the provisional rate, with any variance explained. An auditor reviewing the final incurred cost submission checks this reconciliation specifically, since an unexplained large variance is itself a signal worth a closer look, regardless of which direction it moved.
The ten checks at a glance
| Check | Fixable proactively? |
|---|---|
| Timekeeping contemporaneity | Yes — process and system discipline |
| Labor distribution vs. timesheets | Yes — reconciliation before submission |
| Unallowable costs in pools | Yes — a documented screening step |
| Consistent cost treatment | Yes — a documented cost accounting policy |
| Direct/indirect double-counting | Yes — a reconciliation check |
| Uncompensated overtime tracking | Yes — total time accounting |
| Accounting system adequacy | Partially — may need a system change |
| Related-party transactions | Yes — documented cost-basis support |
| Executive compensation caps | Yes — a documented benchmark comparison |
| Final rate vs. billed reconciliation | Yes — a year-end variance analysis |
Nine of the ten are directly addressable with process discipline and documentation, well before an audit notice ever arrives. Only accounting system adequacy sometimes requires a genuine system change rather than a process fix — and even that is far cheaper to address proactively than to discover during a pre-award review that's holding up a contract.
A sample invoice, traced through a review
An auditor pulls a sample of forty invoices from an overhead pool as part of an incurred cost audit. One is a facility services invoice split between overhead and G&A per the contractor's established square-footage allocation.
| Check | Result |
|---|---|
| Traceable to a source document | Yes — original invoice attached with page reference |
| Split methodology documented | Yes — square-footage basis noted and consistent with prior periods |
| Any unallowable line items | No — routine facility services only |
| Consistent with similar invoices that year | Yes — same vendor, same split, prior months |
This single invoice clears in minutes because every element of the check had a ready answer. The same sample pulled from a contractor without documented split methodology or source-document traceability turns into a multi-day back-and-forth reconstructing the same answers from scratch.
What a floor check specifically looks for
A floor check is an unannounced visit — the auditor arrives, picks a sample of employees, and confirms in person that each one is where their timesheet for that day says they are, doing what it says they're doing. It's a direct verification of timekeeping accuracy, distinct from a document review, and it specifically targets the gap between what a timesheet claims and what's actually happening.
Preparing for a floor check isn't about a special one-time effort right before it happens — since it's unannounced, the only real preparation is a timekeeping process that's genuinely followed every day, not tightened up only when an audit is expected.
Why this isn't designed to catch you out
It's easy to read a list like this and feel like the whole system is built to trip contractors up. In practice, every one of these ten checks exists because it maps to a specific, well-known failure mode that costs the government real money when it goes unchecked at scale across thousands of contractors — the checks are consistent and knowable precisely because they're not designed to be a surprise.
A contractor that documents its process the same way every year, consistently, isn't gaming the system by being prepared — it's doing exactly what the regulations are built to encourage.
It helps to remember that the auditor reviewing your submission is working through a standard checklist across many contractors, not building a case against any one of them specifically. A well-organized response that answers each check cleanly moves an audit toward its close faster for everyone involved, auditor included — there's no advantage on either side to a review that drags on longer than the underlying facts require.
Preparing before the audit notice arrives
None of the ten checks above require waiting for an audit notice to start addressing. Reading and organizing the source documents behind your indirect cost pools — with every figure traceable to its invoice, payroll register or timesheet — is a process choice available to any contractor today, whether that reading is done by hand or with software that reads and organizes each document automatically the moment it's uploaded. See the step-by-step rate-schedule guide for exactly how that process fits together across a fiscal year.
The audit itself may never fully disappear as a recurring event for an active government contractor. What's genuinely reducible is how much scrambling it takes to answer each sampled question when it comes, and that's where most of the stress in a typical audit actually comes from.
The documentation habit that matters most
Of the ten checks in this article, the single habit that separates a contractor who moves through an audit smoothly from one who doesn't is keeping every cost pool figure traceable to its source document as the year goes, rather than reconstructing that trail only once an audit notice arrives. Everything else in this article is refinement on top of that one habit — get it right, and every individual sampled check above becomes a quick lookup rather than a research project.
Does this apply to a small contractor too
Yes, though scope and depth typically scale with contract size and risk profile. A small contractor with a single cost-reimbursement contract still needs contemporaneous timekeeping, a documented unallowable-cost screen, and a traceable rate schedule — the underlying requirements don't relax for a smaller operation, even though the audit team may sample fewer transactions or apply a lighter-touch review than it would for a large, CAS-covered contractor with a much bigger contract portfolio.
A small contractor without a dedicated compliance department often benefits the most from a consistent documented process, precisely because there's less institutional redundancy to catch a gap before an auditor does.
Reactive vs. audit-ready
| Reactive | Audit-ready |
|---|---|
| Source documents gathered only once an audit notice arrives | Every document traceable from the day it's processed |
| Unallowable-cost screening done once, retroactively, under deadline | Screened as each invoice is coded through the year |
| Timekeeping tightened up right before an expected review | The same daily process followed year-round |
| A sampled question means a multi-day search | A sampled question is a lookup |
What happens after a finding
A finding isn't automatically the end of the story. Most audit reports propose findings, which then go through a contracting officer review and often a contractor response before anything becomes final — a proposed unallowable cost with a strong documented justification is a genuinely different conversation than one with no supporting rationale at all.
What matters most in that conversation is exactly the kind of documentation this article keeps returning to — a clear record of what was done, why, and when, rather than a reconstruction built under pressure after the fact to explain a decision nobody wrote down at the time.
What a corrective action plan actually requires
When a finding is sustained, a contracting officer will often require a corrective action plan describing specifically how the underlying gap will be fixed and, where relevant, how similar issues will be prevented going forward — not just an acknowledgment that the finding is accepted. A vague plan that says a process will be “reviewed and improved” tends to draw a follow-up request for specifics; a plan that names the exact control being added, who owns it, and by what date, tends to close the loop faster.
The strongest corrective action plans are the ones that can point to something already in motion by the time the plan is submitted — a documented unallowable-cost screening step already added to the coding process, for instance, rather than a promise to add one eventually. Contractors that treat an audit finding as a prompt to fix the underlying process, not just the specific flagged transaction, are the ones least likely to see the same finding recur in a future review.
Where an outside CPA fits into audit prep
Many contractors, particularly smaller ones without a dedicated in-house compliance function, lean on an outside CPA firm familiar with government contract accounting to help prepare for and respond to a DCAA audit. That relationship works best when the CPA is brought in well before an audit notice arrives — reviewing pool structure, sampling a handful of invoices against the unallowable-cost policy, and confirming the rate schedule ties to the general ledger — rather than only engaged reactively once a sample request has already landed.
An outside CPA's time is generally best spent on the judgment calls that genuinely need professional expertise — a borderline allowability question, an unusual related-party arrangement, interpreting a specific FAR clause — rather than on the mechanical work of locating and organizing source documents, which is exactly the kind of task that's faster and less expensive to have already done before that expertise is needed.
What raises audit risk beyond routine selection
Beyond the general risk-based selection DCAA applies across its contractor population, a handful of specific events tend to raise the likelihood or scope of a closer review for a given contractor: a significant jump in contract value or a new contract type the contractor hasn't billed under before, a prior finding that was sustained and is being checked for recurrence, or a whistleblower complaint or referral from a contracting officer. None of these guarantee an audit, and their exact weight in any specific selection decision isn't something a contractor can fully predict — but they're worth being aware of as circumstances that plausibly raise scrutiny.
A contractor going through any of these transitions — a new contract type, a first CAS-covered award, a recent merger bringing a new entity's books into the fold — benefits from treating that transition as a natural prompt to double-check documentation practices, rather than waiting for an audit notice to reveal a gap the transition itself introduced.
How this flows down to subcontractors
A prime contractor on a cost-reimbursement contract is generally responsible for flowing certain cost principles and documentation requirements down to its subcontractors, and for being able to demonstrate that a subcontractor's billed costs meet the same allowability standards the prime itself is held to. A prime that can't produce a subcontractor's supporting documentation on request faces the same kind of finding it would for its own undocumented cost — the audit doesn't stop at the prime's own books.
In practice, this means a prime contractor benefits from confirming, early in a subcontract relationship, that the subcontractor can actually produce timesheets, invoices and cost support on a reasonable timeline if a sample request eventually reaches down that far — a conversation worth having before a subcontract is signed, not after an audit notice surfaces a gap neither party anticipated.
Questions worth asking your own team
A short set of questions, asked once, tends to surface most of where a specific contractor's audit risk actually sits: is timekeeping genuinely daily and contemporaneous, or does it slip into weekly batches under deadline pressure. Is there a documented, consistently applied unallowable-cost screen, or does it depend on whoever happens to be coding invoices that week. Can last year's rate schedule be traced back to source documents today, in minutes, or would it take days to reconstruct.
The answers rarely require a major process overhaul to act on — often the single highest-leverage change is simply making source-document traceability a habit through the year, rather than a scramble that starts only once an audit notice lands.
The one-sentence takeaway
A DCAA audit checks a consistent, knowable set of things — timekeeping accuracy, cost pool integrity, consistency of treatment, and whether the final numbers tie together — and every one of them is addressable proactively with a documented process followed the same way every fiscal year, rather than assembled retroactively once the audit notice arrives.
None of the ten checks in this article are unique to any one industry or contract vehicle — the same underlying principles apply whether the contract is a research grant, a defense production award, or a professional services engagement with a civilian agency. What changes across those contexts is emphasis, not substance: a services-heavy contractor tends to draw more scrutiny on timekeeping and labor distribution, while a contractor with heavier material and subcontract costs tends to see more attention on cost segregation and related-party transactions.