If you're a small government contractor — especially one moving from fixed-price work into cost-reimbursable, T&M, or labor-hour contracts — you've probably heard the term "DCAA compliance" thrown around like an existential threat. "You need to be DCAA compliant." "Our system is DCAA approved." "They'll DCAA us if we don't have this."
Most of what's said is partly wrong, and the parts that are right are often presented in a way that makes compliance sound impossible without expensive software and full-time accounting staff. It isn't. This guide walks through what DCAA compliance actually means for a small contractor, the four systems that matter, and the realistic compliance posture for a firm under $30M in revenue.
What DCAA actually is — and isn't
DCAA is the Defense Contract Audit Agency. They're the audit arm primarily for the Department of Defense, but their work is also used by NASA, DOE, GSA, and many civilian agencies under cross-servicing agreements. DCAA conducts audits of contractors' accounting systems, incurred costs, business systems, and pricing proposals.
Important distinction: there is no "DCAA-approved" or "DCAA-certified" accounting software. Vendors who advertise this are using marketing language. DCAA audits the contractor's system — the combination of software, processes, controls, and policies — not the software alone. You can be "DCAA compliant" using QuickBooks if your processes around it are right; you can fail an audit using expensive enterprise accounting software if your processes are wrong.
When you actually need DCAA compliance
The trigger isn't "working with the federal government." Plenty of contractors operate for years on FFP contracts without ever encountering DCAA. The trigger is cost-type work — contracts where the government reimburses your costs (cost-plus-fixed-fee, cost-plus-incentive-fee, T&M with material reimbursement) or where the government wants visibility into your cost structure (negotiated indirect rates, SF-1408 pre-award accounting system survey).
Specifically, you encounter DCAA when:
- You're proposing on a cost-reimbursable contract over the simplified acquisition threshold
- You're submitting a cost proposal that requires certified cost or pricing data (TINA threshold currently $2M)
- You're requesting forward pricing rate agreements or provisional billing rates
- You're being audited for incurred cost on an existing cost-type contract
- The contracting officer requests a pre-award accounting system review
If your business is entirely fixed-price commercial-item work, you may never encounter DCAA. If you're moving into LH/T&M or cost-type work, you'll need at minimum a system that produces auditable timekeeping and cost data.
The four systems that matter
DCAA evaluates contractors across multiple "business systems" — but for small contractors, four matter most:
1. Timekeeping system
This is the foundation. DCAA's timekeeping requirements include:
- Daily time entry. Employees record their time daily, not weekly or monthly.
- Total time accounting. All hours worked are recorded, not just billable hours.
- Charge code accuracy. Time is charged to the correct contract, task, or indirect pool.
- Employee certification. The employee certifies their time is accurate (typically through electronic signature).
- Supervisor approval. The supervisor reviews and approves before invoicing.
- Audit trail. Changes after submission are tracked and require justification.
- Training and policy. The contractor has documented timekeeping policies and trains employees on them.
Many small contractors run afoul here by allowing time to be entered weekly or letting supervisors enter time on behalf of employees. Both are audit findings waiting to happen.
2. Accounting system
Your accounting system needs to:
- Segregate direct costs from indirect costs
- Identify costs to specific contracts (job costing)
- Maintain accurate indirect cost pools (fringe, overhead, G&A)
- Allocate indirect costs in a consistent, documented way
- Distinguish between allowable and unallowable costs (FAR 31.205)
- Reconcile timekeeping to labor costs in the books
This is where vendor confusion is highest. "DCAA-compliant" software bundles like Unanet, Deltek Costpoint, Deltek Vantagepoint, and Procas are purpose-built for federal contractor accounting and make compliance significantly easier. QuickBooks can also work with the right configuration and discipline — but you'll spend more on processes and controls to get there.
3. Indirect rate structure
Federal cost accounting requires a documented, consistent indirect rate structure. Most small contractors use a three-pool structure: Fringe, Overhead, G&A. The pool definitions, allocation bases, and the rates themselves need to be documented in writing and applied consistently across all contracts.
Once you have cost-type contracts, you'll typically negotiate provisional billing rates with the cognizant administrative contracting officer (ACO) — these are rates you bill at during the year. After the fiscal year closes, you submit an incurred cost submission (ICS) showing your actual costs and rates. The ACO compares actuals to provisionals and adjusts.
4. Estimating system
Your pricing methodology — how you build cost estimates for proposals — needs to be documented and consistent. DCAA's pre-award reviews look at your estimating system to verify that the prices you propose are based on a defensible methodology, not pulled from thin air.
The pre-award accounting system survey
For cost-reimbursable work, the contracting officer typically requests a pre-award accounting system survey using SF-1408. This is a checklist DCAA uses to verify your accounting system is adequate for cost-type work. The 13 elements include:
- Proper segregation of direct and indirect costs
- Identification and accumulation of direct costs by contract
- Logical and consistent method to allocate indirect costs
- Accumulation of costs under general ledger control
- Timekeeping system that identifies labor by intermediate or final cost objective
- Labor distribution system that charges direct and indirect labor to appropriate cost objectives
- Interim (e.g., monthly) determination of costs charged to a contract
- Exclusion of costs unallowable under FAR 31.205
- Identification of costs by contract line item
- Segregation of preproduction costs from production costs
- Adequate cost-by-contract reporting
- Reliability of data
- Accounting practices in accordance with applicable acquisition regulations
Most small contractors pass SF-1408 with the right software and basic discipline. The failures we see are typically in timekeeping (daily entry, employee certification) and in indirect cost segregation (mixing direct and indirect labor in the same pools).
The realistic compliance posture for a small contractor
If your firm is under $5M in revenue, doing primarily fixed-price commercial-item work, you don't need DCAA-grade systems. Standard accounting software with reasonable processes is fine.
If your firm is moving into LH/T&M work on vehicles like OASIS+, SeaPort-NxG, or GSA MAS, you need:
- A real timekeeping system with daily entry and supervisor approval
- Clean segregation of direct vs indirect costs
- A documented indirect rate structure with at least Fringe, OH, and G&A pools
- Job costing by contract
- Written accounting policies that define your practices
You can achieve this with QuickBooks plus a tracking system (like Replicon, Harvest, or BigTime configured carefully) and disciplined processes — total annual cost roughly $10-25K including software and external accounting support.
If your firm is moving into cost-reimbursable work or contracts with negotiated indirect rates, the math changes. Purpose-built government contracting software (Unanet GovCon, Deltek, Procas) starts in the $15-50K/year range but produces audit-ready outputs and reduces compliance risk significantly. For most firms over $10M in cost-type revenue, this investment is unambiguously worth it.
What DCAA audits actually look at
The two most common audits for small contractors:
Incurred cost audits. After fiscal year-end, contractors with cost-type contracts submit an Incurred Cost Submission (formerly the ICE model, now the ICS) detailing their actual indirect rates and contract costs. DCAA samples and audits these. Common findings: unallowable costs in indirect pools (entertainment, alcohol, certain executive compensation), inconsistent indirect rate application, missing supporting documentation.
Floor checks. Unannounced visits where DCAA auditors visit the contractor's site, observe employees, and verify that people charging time to specific projects are actually working on those projects. The questions are basic: "What are you working on?" "What contract are you charging?" "What's your job role?" Mismatches between answers and timekeeping records are findings.
Common compliance traps
Mixing direct and indirect labor. If your project managers spend 60% on billable contracts and 40% on internal management, they need to charge time accordingly — not 100% direct.
Unallowable costs in pools. FAR 31.205 lists costs that cannot be billed to the government — including alcohol, entertainment, certain types of advertising, lobbying, and bad debts. These need to be tracked separately and excluded from indirect pools.
Inconsistent indirect rate methodology. Once you've defined your indirect rate structure, you need to apply it consistently. Allocating overhead one way for proposal pricing and a different way for incurred cost reporting is a problem.
Sloppy timekeeping. Time entered weekly. Time entered by supervisors on behalf of employees. Time entered without certification. Each is an audit finding waiting to happen.
Bottom line
DCAA compliance is not a black box, and it doesn't require expensive enterprise software. For small contractors moving into LH/T&M work, the foundational requirement is disciplined timekeeping, clean segregation of direct vs indirect costs, and a documented indirect rate structure. Standard accounting software with the right processes can support this.
For contractors moving into cost-reimbursable work, the bar gets higher and purpose-built government contracting software typically pays for itself within the first audit cycle. Either way, the goal isn't to be perfect — it's to be auditable. Documentation, consistency, and discipline matter more than software brand.
For broader context on how compliance interacts with your bid/no-bid decisions and proposal strategy, see our guides on building a bid/no-bid framework, how to evaluate an RFP in under 10 minutes, and the hidden cost of manual RFP triage.
This guide is general information, not accounting or legal advice. Your specific compliance obligations depend on your contract types, customer agencies, and the specific requirements in your contracts. Consult a qualified government contract accountant for advice on your situation.