DCAA Audit Readiness Checklist for Small Business Contractors

Most small contractors fail Defense Contract Audit Agency (DCAA) audits before the auditor walks through the door. The accounting system was never designed for government contracting. Time gets recorded in lump sums at the end of the week. Indirect costs flow wherever they fit at month-end. Nobody flagged these practices as problems until a pre-award survey came back adverse and a contract award stalled indefinitely.

This DCAA audit readiness checklist covers all four systems DCAA examines: your accounting system, timekeeping records, indirect cost structure, and incurred cost submissions. If you maintain all four continuously, an audit visit becomes a documentation exercise, not a crisis.

Does DCAA Apply to Your Business?

DCAA audit oversight focuses on cost-reimbursable contracts, time-and-materials (T&M) contracts, and labor-hour contracts. These are the contract types where the government pays your actual costs, so it has a direct interest in how you record and report those costs.

If your business only holds firm-fixed-price (FFP) contracts, DCAA is not auditing your accounting system in the same way. On an FFP contract, the price is set at award. Your internal costs are your business. You still need to comply with FAR Part 31 cost principles if you ever certify costs in a proposal, but a pre-award accounting system survey typically is not required.

The key question: do you hold or are you pursuing a cost-reimbursable or T&M contract? If yes, keep reading. If you are strictly FFP today, this guide is still useful preparation for when you pursue your first cost-type award. See our guide to cost-plus vs. fixed-price contracts if you are not sure which contract types you hold.

The 4 Types of DCAA Audits Small Contractors Face

DCAA operates a network of field audit offices across the United States and overseas. Its authority comes from FAR 42.101, which designates DCAA as the cognizant contract audit agency for most commercial contractors across federal agencies (educational institutions are cognizant to HHS and nonprofits to ONR). Small contractors face four primary audit types, each with a different trigger and focus.

Pre-Award Survey (SF 1408)

The pre-award survey is the first DCAA encounter for most small contractors. It happens before your first cost-reimbursable contract is awarded. DCAA reviews your accounting system using Standard Form 1408 (SF 1408), a structured checklist covering accounting principle compliance, cost segregation by contract, identification and exclusion of unallowable costs, billing support, timekeeping integration, and written policies. SF 1408 is the pre-award form; the post-award contract clause at DFARS 252.242-7006 lists eighteen system criteria that govern an acceptable accounting system once the contract is in place. The two instruments are related but distinct.

An adverse SF 1408 finding does not slow an award. It can block it entirely. The contract sits on hold until the accounting system deficiencies are corrected and DCAA re-surveys. Contractors who discover this after winning a competition often lose months and sometimes lose the award entirely.

Floor Check (Unannounced Employee Interviews)

Floor checks are unannounced visits where DCAA auditors go directly to your employees, not management. Auditors review timecards and interview employees at their workstations. DCAA’s labor floor-check audit programs cover both nonmajor and major contractor labor verification. The goal is to confirm that employees are present, working on the contracts they charge time to, and recording time accurately.

Three questions DCAA floor-check auditors typically ask your employees:

1. Are you working on the contracts you charge time to? If an employee is coding time to Contract A but working on a task that belongs to Contract B, that is a labor mischarge finding.
2. Can you explain the basis for your time charges? Employees need to know which contract number or indirect account they charged to that day and why. Blank stares are a red flag.
3. When did you last complete this timecard? DCAA is checking for contemporaneous recording. A timecard filled in on Friday for the whole week fails this test. Daily recording is the standard.

Prepare your team before any audit. Every employee who charges to government contracts should know these three answers cold.

Incurred Cost Audit

After your fiscal year closes, you file an Incurred Cost Submission (ICS) reconciling actual indirect rates against billing rates. DCAA reviews the submission for adequacy, then audits the actual costs claimed. The six-month filing deadline under FAR 52.216-7 is firm. Contractors who miss it appear on DCAA’s overdue submission list, which contracting officers (COs) review before awarding new contracts.

Forward Pricing Audit

When you submit a cost proposal on a contract above the TINA threshold, DCAA may audit your proposed rates, cost estimating system, and basis of estimate. Forward Pricing Rate Agreements (FPRAs) under FAR 42.1701 establish pre-negotiated billing rates that can reduce audit friction on future proposals. Most small contractors do not have FPRAs, but they become worth pursuing once you have stable indirect rates.

System 1: Your Accounting System (Table Stakes)

Your accounting system is the foundation. If it cannot segregate direct from indirect costs, accumulate costs by contract, and produce billing-supporting reports, nothing else in your compliance program matters.

The SF 1408 criteria fall into five buckets: cost segregation by contract, unallowable cost identification and exclusion, billing procedure support, timekeeping integration, and written policies. FAR 31.201-2 defines the four tests any cost must pass to be allowable: reasonable in amount, allocable to the contract, consistent with Generally Accepted Accounting Principles (GAAP) or Cost Accounting Standards (CAS), and compliant with contract terms. FAR 31.201-6 requires unallowable costs to be identified and excluded from every billing and every proposal.

The accounting-system setup tutorial, including chart-of-accounts design, QuickBooks configuration, and the 12 most common SF 1408 deficiencies, lives in our dedicated guide: DCAA Compliant Accounting System: Setup Guide. Read that guide for the full walkthrough. The checklist table later in this article covers the key requirements at a glance.

System 2: Timekeeping (The Highest-Risk Area)

Timekeeping is the single highest-risk area in DCAA audits. A floor check finding on timekeeping can trigger a broader labor audit or pull the entire incurred cost year under review.

What DCAA Wants to See

The timekeeping standard flows from FAR 31.201-2 and DCAA’s Contract Audit Manual (CAM) Chapter 6 labor procedures. Time must be recorded daily, or at a frequency that lets you reconstruct actual hours by contract or indirect account. Employees record their own time. Supervisors approve every timecard. Corrections require an audit trail: the original entry, the correction, and the reason. Supervisors cannot direct employees to charge time to a different contract to avoid overrunning a budget. That practice is labor mischarging and creates False Claims Act exposure.

Electronic timekeeping systems reduce risk significantly compared to spreadsheets. A compliant system captures: the contract number or indirect account, the date, the employee, and the hours. It requires employee certification before payroll runs. And it locks timecard corrections behind a reason-code field that preserves the original entry.

The 3 Questions Floor-Check Auditors Ask Your Employees

Run a practice floor check with your team every quarter. Have a manager visit each employee’s workstation and ask the same three questions DCAA auditors ask:

1. What contract are you working on right now, and is that what your timecard shows for today?
2. Can you walk me through why you charged time the way you did this week?
3. When did you last enter time in the system?

If any employee hesitates, that is a training gap to close before an auditor finds it.

System 3: Indirect Cost Rate Structure

Indirect cost rates determine how much overhead, fringe benefits, and general and administrative (G&A) expense you can recover on government contracts. The structure you build early shapes your profitability on every cost-reimbursable contract you win.

FAR 31.203 defines indirect costs as costs incurred for a common or joint objective that cannot be tied to a specific contract. These costs accumulate in pools and allocate to contracts using a base that reflects the proportion of benefit each contract receives.

Practice, not mandate: FAR 31.203 prescribes that indirect costs be accumulated by logical cost groupings, not a specific pool count or structure. The common practice for small services contractors holding cost-reimbursable contracts is to use three pools, but other groupings are permitted when they reflect the way costs are actually incurred and benefit the work. Some very small firms collapse to two pools; some larger firms split overhead further. The three pools commonly used:

• Fringe benefits (common practice pool): Payroll taxes, health insurance, paid time off, and retirement contributions. Fringe rate is commonly calculated as total fringe costs divided by total labor dollars (direct plus indirect), though other bases are permitted under FAR 31.203 when they better reflect benefits accrued.
• Overhead (common practice pool): Costs tied to doing the work: facility costs, equipment depreciation, project management support. Overhead is commonly allocated on direct labor, though FAR 31.203 does not mandate this base.
• G&A (common practice pool): Corporate-level costs: executive salaries, accounting fees, legal fees, and business development. G&A is commonly allocated on total cost input; CAS 410 (48 CFR 9904.410-50) permits total cost input, value-added cost input, or single-element cost input depending on circumstances. Non-CAS small businesses have similar discretion under FAR 31.203.

Contractors subject to full Cost Accounting Standards (CAS) coverage with $50 million or more in net CAS-covered awards in the prior cost accounting period must file a Disclosure Statement on Form CASB DS-1 under 48 CFR 9903.202-1 (the threshold rises to $100 million for contracts entered after June 30, 2026 per Section 1806 of the FY2026 NDAA). Modified-coverage contractors generally do not file DS-1.

Section 1806 of the FY2026 NDAA also raises the contract-level CAS coverage threshold from $2.5 million to $35 million for contracts entered after June 30, 2026. CAS 401, CAS 402, and CAS 418 govern consistency in estimating, accumulating, and allocating costs for CAS-covered contractors. Small businesses are categorically exempt from CAS under 48 CFR 9903.201-1(b)(3) regardless of contract size, so the NDAA threshold changes do not change the small-business exemption. FAR Part 31 allowable cost principles still apply to every cost-reimbursable contract regardless of CAS status.

For the complete indirect cost rate guide, including how to model forward pricing rates before a proposal: Indirect Cost Rates for Government Contracting. For a plain-language walkthrough of every allowability test under FAR 31.205, see our FAR Part 31 Allowable Costs Guide.

System 4: Incurred Cost Submission (ICE Model)

Every contractor on a flexibly-priced contract must file an Incurred Cost Submission within six months of fiscal year-end, per FAR 52.216-7. The submission reconciles actual indirect rates for the year against the provisional billing rates used on invoices during the year.

The 6-Month Deadline

The six-month clock runs from your fiscal year-end, not the contract end date. If your fiscal year closes December 31, your ICS is due June 30. Contractors who miss the deadline appear on DCAA’s outstanding submissions list. Administrative Contracting Officers (ACOs) review that list before approving new awards. A two-year-old overdue submission is a real obstacle to winning new cost-type work.

The 15 Schedules and What DCAA Looks For

The ICE model is a structured spreadsheet package DCAA developed for contractors to report actual cost data. Download the current version from dcaa.mil each year before you start. The ICE model contains fifteen core schedules, letter-designated A through O, covering direct costs, indirect cost pools, rate calculations, compensation analysis, subcontractor management, and more. Optional schedules continue through T for contractors with additional reporting needs.

The three most common ICS adequacy failures among small contractors:

1. Missing schedules. Every schedule must be complete even if the amounts are zero. A blank schedule is an adequacy failure.
2. Incomplete compensation data. FAR 31.205-6(b) requires compensation to be reasonable. In practice, DCAA typically benchmarks against Bureau of Labor Statistics (BLS) Occupational Employment and Wage Statistics for comparable positions in your geographic area, supplemented by published commercial salary surveys (such as ERI, Mercer, or Radford) for executive and specialized roles. Run this analysis before you submit.
3. Unreconciled differences between the general ledger and ICS totals. Every number in the ICE model must tie back to your general ledger. If the ICS total for direct labor differs from your GL by one dollar, DCAA will flag it as inadequate.

How 2026 Threshold Changes Affect Who Gets Audited

Two threshold changes took effect or are taking effect in 2026 that reshape audit exposure for non-small contractors. Section 1806 of the FY2026 NDAA raises the contract-level CAS coverage trigger from $2.5 million per contract to $35 million, and full CAS coverage from $50 million to $100 million, for contracts entered after June 30, 2026. These changes reduce CAS Disclosure Statement obligations for non-small contractors who previously crossed the legacy thresholds. Small businesses are categorically exempt from CAS under 48 CFR 9903.201-1(b)(3) regardless of NDAA thresholds. FAR Part 31 cost principles still apply to all cost-reimbursable contracts.

The Truth in Negotiations Act (TINA) threshold rises from $2.5 million to $10 million for prime contracts and subcontracts entered after June 30, 2026, per Section 1804 of the FY2026 NDAA (codified at 10 U.S.C. 3702(a)). The new threshold is statutorily fixed by the NDAA, not contingent on DoD discretion. Once a contract is awarded on or after that date, contractors with proposals below $10 million no longer need to certify cost or pricing data. This reduces forward pricing audit exposure for many contractors, though DCAA can still audit incurred costs regardless of TINA status.

For a full breakdown of how these threshold shifts affect your compliance obligations, see the FAR 2.0 Overhaul Guide. For the cost principles that DCAA tests regardless of thresholds, see the FAR Part 31 Allowable Costs Guide. If you are unsure whether your business qualifies as a small business under FAR Part 19, see the FAR Part 19 Small Business Guide.

Full DCAA Audit Readiness Checklist

Use this table to assess where your systems stand today. A gap in any row is something to fix before you pursue your next cost-type award or before the auditor arrives.