A first-time SBIR winner does everything right on the science. The prototype works, the milestones are hit, the Phase II proposal gets funded. Then, eighteen months later, a program officer flags the award for a Defense Contract Audit Agency (DCAA) pre-award survey — and the company discovers its QuickBooks file, with one general ledger and no timesheets, doesn't meet the bar. The check gets held. The next tranche of funding stalls. None of it has anything to do with the technology.
This happens more often than founders expect. Federal R&D grants — Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) awards — are widely regarded as the best non-dilutive funding a deep-tech startup can get: no equity given up, no repayment required, and a built-in signal of credibility to future investors. But the money comes with an accounting rulebook that most startups have never had to follow, and the rules are enforced retroactively. Getting them wrong doesn't just risk an audit finding — it can mean returning funds you've already spent.
Here's what actually matters: indirect cost rates, time tracking, and fund segregation, in plain language, with the mistakes that trip up first-time awardees.
Why SBIR/STTR Accounting Is Different From Normal Startup Bookkeeping
Most early-stage companies track money the way any small business does: revenue in, expenses out, maybe a rough sense of burn rate by department. SBIR and STTR awards require something stricter, because you're spending federal funds under a contract or grant that specifies exactly what the money can be used for.
Eleven federal agencies run SBIR/STTR programs — including NIH, NSF, DOE, DOD, and NASA — each with its own award instrument (grant, cooperative agreement, or contract) and its own accounting expectations. But the underlying framework is consistent: costs must be allowable, allocable, and reasonable, and you must be able to prove it with records, not estimates.
That's the core shift. A startup that has been tracking expenses loosely in a single Xero or QuickBooks file, with founder salaries and R&D spend all mixed together, is not equipped to defend a federal award on audit. You need a system that can isolate award-specific costs from the rest of the business, on demand, with a paper trail.
Indirect Cost Rates: The Number Most Founders Get Wrong
Every SBIR/STTR budget splits spending into two buckets:
- Direct costs — expenses you can tie to the specific funded project: the researcher's salary for hours worked on the grant, materials consumed in the experiment, equipment dedicated to the work.
- Indirect costs — the overhead that keeps the company running but can't be attributed to one project: rent, utilities, general accounting, admin salaries, insurance.
Indirect costs are reimbursed as a percentage of direct costs — your indirect cost rate. This is where the largest first-time mistake happens: founders borrow a rate from a competitor, an advisor, or a university tech-transfer office, because deriving your own feels intimidating. Agencies explicitly warn against this. Your indirect rate has to reflect your actual cost structure, calculated from your books, because on audit you'll be asked to reconcile it back to your general ledger.
If you don't have a federally negotiated indirect cost rate agreement (NICRA) on file, you'll typically propose a provisional rate for your application, then true it up later based on actual costs. Some agencies now cap what they'll reimburse — the Department of Energy, for example, has moved to a maximum indirect cost reimbursement of 15% of the total award for for-profit recipients, regardless of what your calculated rate comes out to. NIH's small business default indirect rate ceiling is commonly cited around 40%, though your negotiated or provisional rate governs what you can actually claim. Check the specific agency's current guidance before you build your budget — these caps move, and building a Phase II budget around a rate the agency won't honor is a fast way to blow a hole in your project math.
Practically: budget your available R&D dollars by subtracting the fee (most agencies allow roughly 7–11% profit) and your indirect costs from the total award ceiling first, then scope the technical work to what's left. Startups that scope the science to the full award amount and back into the overhead later routinely come up short.
Time Tracking: The Requirement That Catches Everyone
If there's one compliance failure that shows up in nearly every SBIR/STTR audit finding, it's timekeeping. The rule is simple to state and easy to get wrong in practice: every employee who touches the award must record actual hours worked, daily, against the specific project.
A few things trip up first-time awardees:
- Percentages aren't good enough. "Maria spends 60% of her time on the grant" is not a defensible record. You need actual hours logged per day, per project — not a monthly estimate applied backward.
- All hours count, not just billable ones. Labor distribution has to reflect total hours worked, including time spent on other projects, general admin, and even unpaid overtime for salaried staff. If someone works 50 hours in a week and 20 went to the SBIR project, the record needs to show 20 out of 50 — not 20 out of a nominal 40-hour week.
- Contemporaneous means contemporaneous. Timesheets filled in weeks later, reconstructed from memory during audit prep, are a classic finding. Daily or same-week entry is the expected standard, especially for DOD-funded awards.
- Principal Investigator involvement has floors, not just ceilings. Several agencies set minimum PI effort requirements — for example, a specific minimum number of hours over a Phase I period — precisely to stop companies from naming a qualified scientist on the proposal for credibility and then not actually involving them in the work. Falling short of the committed PI effort is its own compliance problem, separate from timekeeping accuracy.
The fix is almost always the same: put time tracking on a real system — even a simple, dedicated timesheet tool tied to your accounting records — from the day the award starts, not from the day someone mentions an audit. Retrofitting six months of timesheets after the fact is exactly the kind of gap a DCAA reviewer is trained to find.
Fund Segregation: Keep the Award's Money Separate From Everything Else
The first rule of managing federal award funds is segregation: award money and its associated costs need to be trackable separately from the rest of the company's operations, not commingled in one undifferentiated bucket. In practice this means:
- A chart of accounts structured so award-related direct costs, indirect cost pools, and other company spending are distinguishable at the transaction level — not something you reconstruct at year-end with a spreadsheet.
- The ability to produce, on request, a clean accounting of exactly what was spent against the award, separate from unrelated company expenses.
- Clear exclusion of unallowable costs — items like entertainment, alcohol, lobbying, or certain marketing expenses — from anything charged to the award, direct or indirect.
For Phase II awards structured as cost-reimbursement contracts, agencies may require a formal pre-award accounting system survey before releasing funds — most non-NIH, non-NSF agencies rely on DCAA to run this review, using the Standard Form 1408 adequacy checklist. That checklist evaluates whether your system properly segregates direct and indirect costs, tracks labor accurately, excludes unallowable costs, and maintains an audit trail back to source documents. Companies that treat this as a formality — rather than building the system before they need it — are the ones who fail the survey and watch their funding timeline slip.
Building the System Before You Need It
The pattern across all three of these requirements — indirect rates, time tracking, fund segregation — is the same: agencies aren't asking you to be perfect, they're asking you to be provable. Every dollar charged to the award needs a record that traces back to an actual hour worked or an actual invoice paid, organized so it can be pulled apart from the rest of the business on demand.
This is exactly where plain-text, version-controlled accounting earns its keep for a deep-tech startup juggling grant funds alongside equity or product revenue. With a double-entry ledger in Beancount, you can define separate accounts for each award, tag every transaction and payroll entry to the specific project, and generate an auditable trail — in a Git history, no less — showing exactly when a cost was recorded and by whom. That's a meaningfully stronger audit story than a shared spreadsheet or a single QuickBooks file with no cost segregation.
Simplify Your Financial Management
Federal grant compliance shouldn't require an enterprise ERP system before your Phase I check even clears. Beancount.io gives founders plain-text, version-controlled accounting that makes it straightforward to segregate award funds, tag direct and indirect costs by project, and produce a clean audit trail when a program officer — or DCAA — comes asking. Get started for free and see why technical founders are managing grant-funded R&D the same way they manage their codebase.