DCAA Compliance for Small Contractors: Setting Up Your Accounting System

The first time a contracting officer asked if my accounting system was “DCAA adequate,” I nodded like I knew what that meant. I didn’t. Most new contractors don’t. The good news: building a compliant system is not as hard as the acronym makes it sound.

The Defense Contract Audit Agency (DCAA) exists to make sure contractors charge the government fairly. In FY2024, DCAA examined $599.8 billion in contractor costs and issued 2,465 audit reports. Those numbers sound intimidating. But DCAA compliance is really just good accounting with a few extra rules on top. This guide shows you how to build a DCAA compliant accounting system from scratch, in plain English.

What Is DCAA and Why Should You Care?

DCAA stands for Defense Contract Audit Agency. It’s a Department of Defense agency that audits contractor accounting systems, costs, and billing. Their job is to verify that every dollar a contractor charges is allowable, allocable, and reasonable under federal cost principles.

In FY2024, DCAA found $15.9 billion in audit exceptions: costs that contractors claimed but couldn’t properly support. The government also recovered $6.8 billion through the False Claims Act that year, a record, with 1,297 qui tam (whistleblower) lawsuits filed.

The critical question most guides skip: does DCAA even apply to you?

Does Your Contract Type Trigger DCAA Oversight?

DCAA compliance matters most for cost-reimbursement contracts and time-and-materials (T&M) contracts. These types require the government to reimburse your actual costs, so the government needs assurance those costs are legitimate.

Firm fixed price (FFP) contracts are different. The government pays a set price regardless of your actual costs. DCAA generally does not audit FFP contractors unless there’s a specific reason to investigate. If you only hold FFP contracts, you probably don’t need a DCAA-adequate system right now. But if you plan to grow into cost-type work, building the system early saves you from a painful retrofit later.

Our guide on cost-plus vs. fixed price contracts explains the differences. For the broader regulatory framework, see our FAR compliance guide.

The “Big 3” Requirements: Start Here

Before you worry about software or SF 1408, get three things right. Every other requirement builds on these.

1. Separate Direct Costs from Indirect Costs

A direct cost is any expense you can trace to a specific contract. The salary of an engineer working on Contract A is a direct cost. The materials you buy for that contract are direct costs too.

An indirect cost benefits more than one contract or your business as a whole. Rent, utilities, your CEO’s salary, office supplies: these are indirect costs. You can’t charge them to one contract because they support everything.

Your accounting system must keep these two categories cleanly separated. Mixing them is the fastest way to fail a DCAA review. This concept forms the backbone of government contract accounting.

2. Keep Daily Timekeeping Records

Timekeeping is the number one deficiency DCAA finds. Every employee who charges time to a government contract must record their hours each day, broken down by contract or cost objective. The rules:

• Employees record their own time (no supervisor filling it in for them)
• Time is recorded daily, not reconstructed at the end of the week
• Each entry shows which contract or indirect cost pool the hours apply to
• Corrections require a documented audit trail showing who changed what and when
• Supervisors review and approve timesheets

Paper timesheets work. Spreadsheets work. Dedicated software works. The method doesn’t matter as much as the discipline. Pick a system your team will actually use every day.

3. Identify and Exclude Unallowable Costs

Federal Acquisition Regulation (FAR) Part 31 defines which costs are allowable and which are unallowable. FAR 31.205 lists specific categories that are always unallowable:

• Entertainment expenses
• Alcohol
• Lobbying costs
• Fines and penalties
• Bad debts
• Charitable donations
• Advertising (except for recruiting and certain other narrow exceptions)
• First-class airfare (the government pays for coach)

Your accounting system must flag these costs so they never end up on a government invoice. You can still incur them for your business. You just can’t bill the government. The penalty is steep: FAR 42.709 allows the government to assess a penalty equal to the full amount of the unallowable cost, on top of making you return the money.

SF 1408 Explained: The Six Elements DCAA Actually Checks

Standard Form 1408 is the government’s checklist for evaluating your accounting system before awarding a cost-type contract. It references the Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.242-7006 (Accounting System Administration). A contracting officer or DCAA auditor walks through six elements and determines whether your system is adequate. Here’s what each one means.

Element 1: Segregation of Direct and Indirect Costs

The auditor checks that your general ledger has separate accounts for direct costs (by contract) and indirect costs (by cost pool). A direct charge on Contract A should never land in your overhead pool, and vice versa.

What your system needs: a chart of accounts with distinct account numbers for direct costs per contract and separate account numbers for each indirect cost pool (fringe benefits, overhead, general and administrative).

Element 2: Accumulation of Direct Costs by Contract

The auditor checks that you can pull a report showing every direct cost charged to a specific contract. Not a grand total. They want line-item detail: labor hours, materials, travel, subcontractor costs, all traceable to the individual contract.

What your system needs: a job costing or project tracking setup where every direct expense includes a contract identifier. When someone asks “show me all costs on Contract DAAA09-25-C-0012,” you produce that report in minutes.

Element 3: Logical and Consistent Indirect Cost Allocation

Indirect costs must be grouped into pools and allocated to contracts using a logical method. Overhead costs might be allocated based on direct labor dollars. General and administrative (G&A) costs might be allocated based on total cost input.

The key word is consistent. CAS 402 (Cost Accounting Standards) requires you to use the same allocation method from period to period. You can’t switch methods to make one contract look cheaper. Pick a method, document it, and apply it the same way every time.

What your system needs: written policies defining each indirect cost pool, the allocation base, and the calculation method. Your software must apply those rates consistently.

Element 4: General Ledger Control

The auditor checks that your books balance. Your general ledger must tie to your subsidiary ledgers (accounts receivable detail, contract cost detail). They also verify that you close your books regularly and can produce accurate financial statements.

What your system needs: a standard double-entry accounting system with monthly close procedures. General ledger totals must match subsidiary ledger totals.

Element 5: Timekeeping System

The auditor reviews your timekeeping policies, checks a sample of timesheets, and verifies that employees record time daily by contract. They also look for an approval process and an audit trail for corrections.

What your system needs: a written timekeeping policy, daily time entry by employees, supervisor approval, and a system that tracks all changes to time records with timestamps and user IDs.

Element 6: Billing System for Interim Invoices

Cost-type contracts allow you to bill the government periodically (usually monthly) for costs incurred. The auditor checks that your invoices match your accounting records. Invoice totals must tie directly to the costs recorded in your general ledger for that contract.

What your system needs: the ability to generate a monthly invoice pulling actual costs from your accounting system, broken down by cost category (direct labor, materials, other direct costs, indirect cost allocations). The invoice must exclude unallowable costs.

All Six Elements at a Glance

Setting Up Your Chart of Accounts

Your chart of accounts is the skeleton of your accounting system. A DCAA-adequate setup needs four things a standard small business chart doesn’t: contract-level direct cost tracking, organized indirect cost pools, clearly flagged unallowable cost accounts, and enough detail to generate compliant invoices.

Direct Cost Accounts (One Set per Contract)

For each government contract, you need a way to track these cost categories separately:

• Direct labor (by labor category if your contract specifies different rates)
• Direct materials
• Subcontractor costs
• Travel
• Other direct costs (ODCs)

Most accounting software handles this through job codes, classes, or project modules. The method doesn’t matter as long as you can pull a complete cost report for any single contract on demand.

Indirect Cost Pools

Indirect costs get grouped into pools. Each pool collects a specific type of shared cost, then gets allocated to contracts using a logical base. Here are the three pools most small GovCon contractors use:

• Fringe benefits pool: Payroll taxes, health insurance, retirement contributions, paid time off, workers’ comp. Allocated based on direct labor dollars or hours.
• Overhead pool: Rent, utilities, office supplies, IT costs, equipment depreciation. Allocated based on direct labor dollars or total direct costs.
• General and administrative (G&A) pool: Executive salaries, accounting fees, legal fees, business insurance, marketing. Allocated based on total cost input (all direct costs plus fringe and overhead).

Unallowable Cost Accounts

Create separate accounts for every unallowable cost category your business incurs. Many contractors add “UNALLOW” to the account name or use a dedicated range (like 9000-9999). These accounts track real business expenses that can never be billed to the government.

Sample Chart of Accounts Structure

This structure gives you clean separation between cost types. When DCAA asks to see your indirect cost pools or unallowable cost detail, you pull the reports instantly. For how business size affects Cost Accounting Standards (CAS) thresholds, see our guide on SBA size standards. Full CAS coverage applies at $100 million in CAS-covered contracts. Modified CAS coverage kicks in on individual contracts exceeding $35 million (FY2026 NDAA thresholds).

Choosing Accounting Software

There is no single “DCAA compliant” software package. No software makes you compliant. Your processes do. The software just makes following those processes easier. Here’s a vendor-neutral breakdown by revenue tier.

Under $500,000: Keep It Simple

QuickBooks with a thoughtful chart of accounts handles most DCAA requirements at this stage. Use the class or project tracking feature to separate costs by contract. Track time on a simple daily spreadsheet with employee signatures. The key risk: outgrowing QuickBooks without realizing it. If you win a cost-type contract over $500,000, start evaluating GovCon-specific tools immediately.

$500,000 to $5 Million: Add GovCon-Specific Features

At this level, you need automated indirect rate calculations, contract-level reporting, and integrated timekeeping. A GovCon add-on for QuickBooks can bridge the gap. Unanet’s entry-level product is purpose-built for this range.

$5 Million and Above: Purpose-Built Systems

Deltek Costpoint is the industry standard for mid-to-large government contractors. Unanet ERP and Procas are strong alternatives. These systems handle timekeeping, expense reporting, indirect rate calculations, incurred cost proposal generation, and compliant billing.

Our guide on scaling your GovCon business covers the operational changes that come with growth into larger contracts.

The 12 Most Common Audit Deficiencies

Knowing what DCAA looks for is like getting the exam questions before the test. Here are the 12 issues that trip up contractors the most.

1. Inadequate timekeeping. Employees don’t record time daily, or supervisors fill in timesheets for their staff. This is the most frequent finding.
2. No segregation of direct and indirect costs. The contractor’s general ledger doesn’t separate costs that belong to specific contracts from costs that benefit the whole company.
3. Billing unallowable costs. Entertainment, alcohol, lobbying, or other FAR 31.205 prohibited costs end up on government invoices. FAR 42.709 penalty: 100% of the unallowable amount.
4. Inconsistent cost allocation. Changing how indirect costs are allocated between periods without documentation. Violates CAS 402.
5. Missing written policies. No documented accounting policies, timekeeping procedures, or indirect rate structure. If it’s not written down, it doesn’t count.
6. Executive compensation above the cap. The cap for calendar year 2025 is $671,000 per executive. Compensation above that is unallowable.
7. No audit trail for accounting changes. Corrections don’t show who changed what, when, and why.
8. Indirect rates not supported by actual data. Using provisional rates but never reconciling them against actuals at year end.
9. Commingled contract funds. Government and commercial revenue flowing through the same accounts with no way to tell them apart.
10. Late or missing incurred cost submissions. FAR 52.216-7(d) requires submission within six months after fiscal year end. Missing this raises red flags.
11. Inadequate subcontractor oversight. Not verifying that subcontractor costs are allowable before passing them to the government.
12. Travel costs exceeding government rates. Billing hotel and per diem above federal travel regulation limits without justification.

Every one of these deficiencies is preventable with written policies and consistent follow-through. For more on building a compliance mindset, see our guide on CMMC certification, which covers a similar discipline for cybersecurity.

When DCAA Actually Shows Up

DCAA doesn’t audit every contractor every year. They use a risk-based approach, focusing on the contracts and contractors most likely to have problems. Small contractors with small contracts are generally low priority. That said, there are four scenarios where you’ll encounter DCAA.

Pre-Award Survey

Before awarding a cost-type contract, the contracting officer may request a DCAA review of your accounting system using SF 1408. This is the most common first encounter for small contractors. The auditor reviews your system against the six elements described above and issues an opinion: adequate or inadequate. If you’re preparing for your first cost-type government contract bid, expect this step.

Interim Billing Rate Review

If you’re billing using provisional (estimated) indirect rates, DCAA may review them for reasonableness. This is a desk review, not a full audit. The auditor compares your provisional rates to historical actuals and industry norms.

Incurred Cost Audit

After you submit your annual incurred cost proposal (due six months after your fiscal year ends, per FAR 52.216-7(d)), DCAA may audit it. They review your actual costs, indirect rate calculations, and billing accuracy for the entire year. The backlog for these audits has historically been long, sometimes several years. That’s not a reason to skip the submission.

Floor Check

A DCAA auditor can show up at your office unannounced to observe timekeeping in real time. They watch employees record time, check that the process matches your written policy, and verify daily completion. Floor checks are uncommon for very small contractors, but they do happen.

None of these situations should be scary if your system is set up correctly. DCAA auditors are checking boxes against known criteria. If you’ve built your system to the SF 1408 standard, an audit is a verification exercise.

Your First 90 Days: Action Plan

You don’t need to build a perfect system overnight. Here’s a 90-day plan to get DCAA-ready.

Days 1 to 30: Build the Foundation

• Set up your chart of accounts with direct cost, indirect pool, and unallowable cost groups (use the table above)
• Start daily timekeeping immediately, even with a simple spreadsheet
• Write three policies: timekeeping, cost charging (direct vs. indirect), and unallowable cost
• Open a separate bank account for government contract payments

Days 31 to 60: Set Up Your Indirect Structure

• Define your indirect cost pools (fringe, overhead, G&A)
• Calculate provisional indirect rates based on your budget
• Set up your accounting system to apply those rates to contracts
• Create a process for flagging unallowable costs as they’re incurred
• Review FAR 31.205 and mark every unallowable category that applies to your business

Days 61 to 90: Test and Refine

• Run a mock SF 1408 review using the DCAA Pre-Audit Readiness Checklist
• Fix every gap the mock review finds
• Set up a quarterly self-audit: sample timesheets, check unallowable cost accounts, verify indirect rate calculations
• Contact your local APEX Accelerator for a free system review

After 90 days, you should have a system that can withstand a pre-award survey. The government doesn’t expect perfection. They expect a system showing you understand the rules and have processes to follow them.

Frequently Asked Questions

Do I need a DCAA compliant accounting system for a firm fixed price contract?

Generally, no. DCAA oversight focuses on cost-reimbursement and time-and-materials contracts where the government reimburses your actual costs. On a firm fixed price (FFP) contract, the price is set at award and your internal costs are your own business. If you plan to bid on cost-type contracts later, building the system now is easier than retrofitting.

Can I use QuickBooks for government contracting?

Yes. QuickBooks can support a DCAA-adequate system for small contractors, especially under $500,000 in GovCon revenue. Use project or class tracking for contract-level cost separation, set up distinct account groups for each indirect cost pool, and maintain separate unallowable cost accounts. Contractors in the $500,000 to $5 million range often add a GovCon-specific plug-in.

How much does it cost to set up a DCAA compliant accounting system?

It depends on your starting point. Restructuring an existing QuickBooks file and writing policies costs $2,000 to $5,000 with a GovCon accounting consultant. A full setup from scratch with GovCon-specific software runs $5,000 to $25,000 for the first year. Larger contractors moving to Deltek or Unanet can spend $50,000 or more on implementation.

What happens if I fail a DCAA audit?

A failed audit doesn’t automatically end your business. For a pre-award survey, an “inadequate” finding means the contracting officer may not award the contract until you fix the deficiencies. For an incurred cost audit, DCAA may question specific costs, and you respond with supporting documentation. In serious cases involving intentional mischarging, the government can pursue False Claims Act penalties. Routine deficiencies are typically resolved through corrective action plans.

How often does DCAA audit small contractors?

DCAA uses a risk-based selection model. Small contractors with contracts under a few million dollars are generally low priority. Your first encounter will likely be a pre-award survey when you bid on a cost-type contract. After that, incurred cost audits happen periodically, but DCAA has a years-long backlog. Being low priority doesn’t mean you can skip compliance. It means you have time to get it right.

What is the executive compensation cap for government contractors?

For calendar year 2025, the cap is $671,000 per executive. You can pay your executives whatever the market supports, but you can only charge up to $671,000 per person to government contracts. Any compensation above that goes into your unallowable cost accounts. The cap is updated annually in the Federal Register.

Do I need a separate bank account for government contracts?

There’s no FAR requirement for a separate bank account, but it’s a strong best practice. A dedicated account makes it easier to track government payments, reconcile billing, and demonstrate you’re not commingling funds during an audit. It takes 30 minutes to open and eliminates an entire category of audit risk.

When do I need to submit an incurred cost proposal?

Per FAR 52.216-7(d), you must submit within six months after the end of your fiscal year. If your fiscal year ends December 31, the submission is due by June 30. This applies to every fiscal year in which you charged costs to a cost-reimbursement or T&M contract. The submission goes to your cognizant auditor (usually DCAA) and includes your actual indirect rates, a schedule of direct costs by contract, and supporting documentation.

Next Steps

1. Assess where you stand. Download the DCAA Pre-Audit Readiness Checklist and walk through each element honestly. Mark what you have and what’s missing.
2. Set up your chart of accounts this week. Use the sample structure in this guide. If you already use QuickBooks, restructure your account groups to separate direct costs, indirect pools, and unallowable costs.
3. Start daily timekeeping tomorrow. Not next month. A spreadsheet with date, employee name, contract number, hours, and task description is enough. Build the habit before you buy the software.
4. Call your local APEX Accelerator. Find your nearest location. They provide free counseling on DCAA compliance and will review your accounting system at no cost. Many have CPAs who specialize in government contractor support.