The first time a small contractor reads the words "your accounting system has been deemed inadequate," the company is usually thirty days from a contract award and several months away from being able to fix the problem. That sentence is the single most expensive piece of mail in federal contracting, because it can disqualify a winning bid, freeze interim payments on an active cost-reimbursable contract, or trigger a withhold on every invoice you submit until the Defense Contract Audit Agency (DCAA) is satisfied.
DCAA does not write checks, sign contracts, or pick winners. It is the audit arm of the Department of Defense that gives contracting officers an opinion on whether the costs you charge the government are allowable, allocable, and reasonable. But its findings are binding in practice. A "no" from DCAA on an SF 1408 review or an Incurred Cost Submission can quietly cost a small business more than the contract was worth, especially when 2026 brings tighter deadlines, a reorganized agency footprint, and renewed focus on long-standing audit backlogs.
This guide walks owners, controllers, and program managers through the three audits that touch nearly every cost-reimbursable, time-and-materials, or cost-plus contractor: the pre-award accounting system survey (SF 1408), ongoing timekeeping and labor compliance, and the annual indirect cost rate / Incurred Cost Submission (ICS) cycle.
What DCAA Actually Does — And Why "DCAA Compliant" Is a Marketing Phrase
DCAA does not certify accounting systems. There is no badge, no logo, and no official list of approved software. The term "DCAA compliant" used by vendors describes systems designed to satisfy DCAA criteria; it does not mean DCAA has blessed your specific installation.
What DCAA does issue is an opinion — typically "adequate" or "inadequate" — on whether your accounting system, your timekeeping practices, and your cost submissions meet three governing standards:
- FAR Part 31 (allowability, allocability, reasonableness of costs).
- DFARS 252.242-7006 (the eighteen accounting system criteria that defense contractors must satisfy).
- SF 1408 (the pre-award checklist used to evaluate the design of your system before contract award).
The opinion travels through the contracting officer, who has the final authority to approve or reject. Practically, contracting officers rarely overrule DCAA on technical audit findings. So while the agency is not the decision-maker on paper, treating its checklist as the operating standard is the only safe assumption.
The SF 1408 Pre-Award Accounting System Survey
If you are bidding on your first cost-reimbursable contract, this is the audit you will encounter before you sign anything. The contracting officer asks DCAA to examine the design of your accounting system against SF 1408, the standard form that defines the elements of an "acceptable" system. It is not a financial audit — DCAA is asking whether your system can do certain things, not whether you have done them perfectly yet.
The checklist boils down to a small number of capabilities. Each of them sounds obvious until you try to demonstrate it in QuickBooks Online over a screen share.
Direct vs. indirect cost segregation. Every dollar of cost in your general ledger must be classifiable as direct (specific to a contract or project) or indirect (overhead, fringe, general and administrative). You need a chart of accounts and a project structure that automatically routes labor, materials, subcontracts, and ODCs to the right side of that line. If your bookkeeping today has a single "Office Supplies" account and you charge it to whatever project the partner is thinking about that morning, you will fail this criterion.
Job cost ledger by contract. You must be able to produce a report that shows, for any contract, all direct costs incurred to date and the indirect costs allocated to it. Spreadsheets exported quarterly are not enough; DCAA expects the system itself to maintain the data.
Pre-contract cost identification. Costs incurred before contract award generally cannot be billed unless the contract authorizes them. Your system must isolate those costs.
Unallowable cost segregation. FAR 31.205 lists specific costs that the government will not reimburse — entertainment, alcohol, lobbying, most fines and penalties, certain executive compensation above statutory caps, advertising, and others. You must record these in dedicated accounts so they can be removed cleanly from any cost pool, billing, or rate calculation. The single most common SF 1408 finding for small contractors is "unallowable costs not segregated."
Logical, consistent indirect cost allocation. You must commit to an allocation method (typically pools and bases such as fringe on direct labor, overhead on direct labor plus fringe, G&A on total cost input) and apply it consistently. Switching methods mid-year, or pretending your method is "judgment based," will end the conversation.
Time charging at the employee level. Labor must be reported by individual employees, by day, against specific cost objectives. This is the gateway to the timekeeping discussion in the next section.
Monthly accumulation tied to the general ledger. Your job cost reports must reconcile to your general ledger every month. If they only tie once a quarter, you are running two systems.
Adequate internal controls and written policies. DCAA will ask for your timekeeping policy, your indirect rate policy, and your unallowable cost policy, in writing. "We've always done it this way" is not a control.
The audit is performed at a moment in time, and you can pass an SF 1408 with three projects, four employees, and a clean QuickBooks file — but only if the configuration is right and your written procedures match what the system actually does.
Timekeeping: The Single Most-Cited Audit Finding
If there is one DCAA topic that has ended more government contracts than any other, it is timekeeping. The standard is unusually specific:
- Every employee, including owners, must record time daily.
- Time must be recorded at least once per day, against specific cost objectives (contract, task, or indirect account).
- Corrections must be documented with the reason, the date, the original entry, and the corrected entry. Pencils, white-out, and overwriting are non-starters; electronic systems must keep an audit trail.
- Supervisors must approve each timesheet, with evidence of independent review.
- Total recorded time must equal total paid time. You cannot charge eight hours to a contract while paying for ten on the timesheet, or vice versa.
- Uncompensated overtime — exempt employees working more than forty hours without additional pay — must be tracked and allocated consistently, not selectively. The "salary cap" method, the "total time accounting" method, or the "effective rate" method each have implications for billing; you must pick one and apply it.
A written timekeeping policy distributed to every employee at hire, plus annual training with documented attendance, is what auditors expect to find before they look at a single timesheet. Floor checks — unannounced visits where the auditor asks employees how they record time — are a real and current technique. An employee who answers "I usually fill it in on Friday" or "my manager does it for me" is an audit finding even if the underlying time is correct.
For software, the practical bar is: every entry has a user, a timestamp, an account, hours, and an immutable audit trail. Excel sheets emailed to the bookkeeper rarely survive the first floor check.
Indirect Cost Rates and the Incurred Cost Submission
For cost-reimbursable, T&M, and labor-hour contracts, you bill the government during the year using provisional billing rates — your best estimate of what your fringe, overhead, and G&A rates will be by year-end. After the fiscal year closes, you submit actual rates in an Incurred Cost Submission, which DCAA audits and the contracting officer eventually settles. The settlement reconciles what you billed (at provisionals) to what you should have billed (at actuals), and one side pays the other.
The submission deadline is in FAR 52.216-7, the Allowable Cost and Payment clause: an adequate proposal is due within six months after the end of your fiscal year. For contractors with a December 31, 2025 fiscal year-end, the 2025 ICS is due June 30, 2026.
DCAA's preferred format is the ICE model — Incurred Cost Electronically — a workbook of fifteen-plus schedules covering claimed costs, indirect rate calculations, executive compensation, subcontracts, and reconciliations. Submissions that omit schedules, miscalculate pools and bases, or fail the adequacy checklist are returned as "inadequate" and restart the clock — without extending the deadline. A late or inadequate ICS gives the contracting officer authority to unilaterally determine your rates, which is almost always worse than negotiating from your own numbers.
The Five Most Common ICS Findings
After two decades of audits, the failure modes are remarkably consistent:
- Stale provisional billing rates. Contractors continue billing at last year's provisionals even though current-year costs have shifted. The result is over- or under-billing that compounds for months and creates large true-up balances at year-end, plus pointed auditor questions about why nobody noticed.
- Unallowable costs in the pools. Holiday parties, executive perks, lobbying retainers, or interest on late payments slip into overhead or G&A. The auditor disallows them, your rates drop, and your settled costs come down with them.
- Inconsistent allocation methods. A cost that was overhead in 2023 becomes G&A in 2024. Without a written justification and a consistency analysis, DCAA cites FAR 31.203(d) and you lose.
- Executive compensation above the cap. The statutory cap on allowable executive compensation has risen, but the rule still applies. Total cash compensation above the cap — for any employee, not just C-suite — is unallowable for the portion above the cap and must be removed from the pools.
- Subcontract documentation gaps. Subcontractor cost claims must be supported by their own incurred cost submissions, certifications, or, for fixed-price subs, the executed agreement and proof of performance. "We sent them a PO and they invoiced us" is not enough on cost-type subs.
The 2026 Climate
DCAA has been working through a long incurred-cost backlog while reorganizing its field offices. For 2026, contractors should expect:
- Tighter ICS adequacy review. Submissions that pass the math check but skimp on schedules will be returned more aggressively.
- More scrutiny on Truth in Negotiations Act (TINA) compliance. Forward pricing audits and post-award TINA defective pricing reviews are getting renewed attention.
- Sharper focus on government-furnished property. The "Financial Improvement and Audit Readiness" initiative is making GFP accountability a regular audit area.
- Cognizant office changes. Verify the DCAA office assigned to your company; reassignments under the new structure have already disrupted submission routing.
What an "Adequate" Accounting System Looks Like in Practice
The auditors' checklist is long, but the operating reality is short. A small contractor running a clean system is doing these things, every week, without thinking about them:
- Time is entered daily by every employee, into a system that distinguishes direct from indirect labor and that locks closed periods.
- Every dollar that hits the general ledger has a project code (for direct costs) or an indirect account (for fringe, overhead, G&A, or unallowable).
- A monthly closing routine produces (a) a job cost report tied to the GL, (b) a calculation of actual indirect rates year-to-date, (c) a comparison to provisional billing rates, and (d) an adjustment if the gap is material.
- Unallowable expenses are caught at entry — credit card statements are coded line by line, with a "U-" prefix or a dedicated account for things like meals over the per diem cap, business gifts, or fines.
- Subcontractor invoices are reviewed against the executed agreement and tagged to the contract.
- Provisional billing rates are updated mid-year if actuals diverge by more than a few points.
- A clean audit trail exists for every timesheet correction, every reclass, and every rate calculation.
You do not need a five-figure ERP to do this. You do need a chart of accounts that mirrors your cost pools and bases, a project structure that maps to your contracts, a labor distribution that flows from time entry to the GL, and a controller (or fractional one) who closes the books to the same standard every month.
Why Plain-Text Books Help Government Contractors
Accurate, transparent bookkeeping is not optional in this world — it is the deliverable. Every audit finding above is downstream of one of two failures: a transaction was coded wrong, or a transaction cannot be traced from the source document to the general ledger to the contract.
That tracing requirement is where many contractors get stung by black-box accounting platforms. When DCAA asks why a credit card charge ended up in overhead instead of unallowable, the answer "the software learned to categorize it that way" is not a defense. You need the audit trail to be readable, the categorization rules to be inspectable, and the data to be portable so that a successor controller — or an auditor — can reconstruct any number from primary records.
Plain-text accounting solves this directly. Every transaction is a few lines of structured text in version control, every account is explicit, every rule is in a file you can read, and every change is traceable to a commit. For a small contractor preparing for SF 1408 or an ICS, that auditability is the same property that DCAA is trying to verify.
A 90-Day Plan to Prepare for an SF 1408 or ICS
You do not need a year to clean up. You need a structured sprint.
Weeks 1–2. Inventory your current state. Pull your chart of accounts, your last three months of timesheets, your most recent provisional rates, and any government contract clauses you operate under. Identify the gaps against the SF 1408 checklist.
Weeks 3–4. Rebuild the chart of accounts. Separate direct and indirect, segregate unallowables (use a dedicated parent account with sub-accounts for each FAR 31.205 category), and define your cost pools and allocation bases in writing.
Weeks 5–6. Implement (or replace) timekeeping. Choose a system that enforces daily entry, supervisor approval, and an audit trail. Issue a written policy. Train every employee. Document the training.
Weeks 7–8. Set up project accounting. Map each contract to a job code, configure labor distribution, and run a parallel month-end close that produces a job cost report tied to the GL.
Weeks 9–10. Calculate provisional rates and submit them to the contracting officer. Build the ICS template (the ICE workbook) and populate it with year-to-date actuals as a dry run.
Weeks 11–12. Run a mock audit. Have an experienced government accounting consultant walk through SF 1408 with your system. Fix what they find. Document the policies. Train the team on what to say during floor checks.
A small contractor with a motivated controller can hit this timeline. The companies that miss it are usually the ones that started ninety days after the contracting officer asked for an SF 1408 review.
Common Mistakes to Avoid
Some failures show up so often they are worth naming.
- Treating "DCAA compliant" software as a substitute for written policies and trained people.
- Letting owners and senior staff skip timesheets because "they know what they did."
- Charging unallowable costs (alcohol at a client dinner, sponsorship of a charity gala) to overhead and hoping nobody notices.
- Using a single overhead pool when you have multiple business lines with very different cost structures, which violates the consistency requirement.
- Failing to update provisional billing rates when actuals diverge, then absorbing a large adjustment at year-end.
- Submitting the ICS in a custom format instead of the ICE template. Auditors are not obliged to adapt.
- Ignoring the cognizant DCAA office reassignment notices that have circulated in late 2025 and early 2026.
Keep Your Government Contracting Books Audit-Ready
DCAA compliance is, at its core, a discipline of clear, traceable, version-controlled financial records — exactly what plain-text accounting was designed for. Beancount.io gives you a transparent ledger where every transaction, every rule, and every change is inspectable and reproducible, which is the same property an auditor is looking for when they open your SF 1408 review. Get started for free and explore the docs to see why developers, finance teams, and federal contractors are moving to plain-text accounting.