This article explains what DCAA audits are, why they happen, and how to navigate the most common audit types — from accounting system reviews to incurred cost audits.
Why it matters: A failed DCAA audit can delay payments, trigger contract disputes, or disqualify a contractor from future federal work — making audit readiness a core business requirement, not a compliance afterthought.
Key Takeaways
- DCAA audits are initiated by contracting officers: The Defense Contract Audit Agency (DCAA) conducts independent audits of DoD contractors to verify that government funds are spent in accordance with applicable laws, regulations, and contract terms.
- Business system audits are the most demanding: A full DCAA Business System Audit can involve 15 or more auditors and take 12 to 18 months to complete, making preparation well in advance of notification essential.
- Purpose-built GovCon ERP reduces audit risk: Accounting systems like Deltek Costpoint are purpose-built for government contractors, with built-in controls and audit trails that align with DCAA requirements out of the box.
What is a DCAA Audit, and What are They Looking For?
A DCAA audit is a comprehensive review conducted by the Defense Contract Audit Agency (DCAA). The DCAA audit process includes examining the contractor's accounting system, contracts, subcontracts, invoices, time records, travel vouchers, and other documents. The DCAA will also evaluate compliance with the Federal Acquisition Regulations (FAR) and the Truth In Negotiations Act (TINA)—the audit results in a report to the contracting officer with findings and recommendations.
A full DCAA Business System Audit can be the longest and one of the most difficult audits a government contractor can experience. To provide some perspective, at a recent audit of one of our clients, DCAA sent 15 auditors to perform the audit. In general, our experience is that these audits take 12 months to over 18 months for DCAA to perform.#
Free Guide
Your Guide to Understanding DCAA Compliance
Learn what the DCAA does, what types of audits it carries out, and how to get and stay compliant.
DCAA Audit Risk Assessment
Understanding the contractor's compliance with DFARS 252.242-7006(c) is basically the risk assessment stage of the audit.
In the first stage of the risk assessment, DCAA will request that the contractor complete the "Description of System and Controls Designed to Comply with DFARS 252.242-7006" form. The form is 20+ pages long before the contractor provides any information. It is broken into subsystems:
- System/IT Overview and Internal Audit
- Organizational Structure
- General Accounting
- Labor – Timekeeping & Payroll
- Indirect Costs
- Direct Material and Subcontracts & ODCs
- Billing
Each of these subsystems is then broken down further into additional sub-areas that align with the above-mentioned subsystems, where DCAA requests the contractor to provide the following data for each sub-area:
- Summary narrative on how the contractor follows specific system criteria
- ERP/applications and org structure
- Key process flows
- Key controls
- Key policies, procedures, and desk instructions (formal and informal)
- Key personnel
The preparation of the required information and the completion of this form/request by DCAA are resource-intensive and time-consuming. By the time this form is completed, the final document to be delivered to DCAA can easily be 75 to 100 pages long. Once the form is received and reviewed by DCAA, the auditors will then expect a complete walkthrough of every area of the accounting system, as described in the request form.
DCAA Audit Detailed Procedures
Once the risk assessment is completed, DCAA will then review your policies, procedures, and practices and compare those to DCAA's expectations for compliance with each of the 18 specific DFARS criteria for an adequate accounting system. This step will likely involve significant data requests and interviews/discussions with accounting and management personnel.
While the DCAA will work with you to some extent on the timeline for receipt of requested information, they are not known for having significant concern about the level of effort required over and above your normal activities.
Also, the term "specific" regarding what constitutes compliance with the DFARS criteria is a bit of a misnomer. Most of the criteria are stated in relatively broad terms, allowing DCAA to exercise significant judgment in their application. Be proactive in understanding the criteria for yourself and provide substantive information that supports your interpretation and compliance with the specific criteria.
Finally, it is essential to note that the DCAA audit process is part of an overall assessment of the DoD contractor's performance. The DCAA audit results are reported to contracting officers and used as evidence in any legal proceedings.
DCAA Audit Results
The final phase of the audit is for the auditor to determine whether there are significant deficiencies under any of the criteria that require corrective action.
Although the DCAA will discuss the issues with you to some extent during the audit, nothing is final until it goes through DCAA supervision. You can't assume that because nothing was brought to your attention by the auditor during the detailed audit procedures, there won't be significant findings.
In addition, the term "significant" has a large judgmental component, and DCAA's definition may be quite different from your understanding of what is significant. Significant findings will result in significant withholdings on government contract payments to contractors until corrective action is taken.
If significant findings are identified in the report, a whole new phase of contractor effort will be required to respond to the findings, prepare corrective action plans, implement corrective actions, and have the DCAA back in to determine whether the corrective actions were sufficient to correct the deficiency.
What are the Different Types of DCAA Audits?
DCAA audits can arise from various reasons based on reviews from the inspector general offices, cybersecurity audits, voucher verifications checks (VVC), internal controls reviews (ICR), and financial statement audit requests. Each type of audit carries specific criteria that must be successfully addressed for compliance to be achieved and to work as a government contractor.
The DCAA supports several types of audits designed to help the different areas of contracting and payment for goods or services. These include pre-award surveys, which review existing internal controls before awarding contracts; forward pricing rate agreements, which identify fair price allocations among various pricing involved in a contract; submitted cost/price proposals which obtain agreed rates between buyer and seller; incurred costs which assess billed costs after delivery of services or goods; and finally past performance reviews which examine a vendor's current work performance to determine qualification for future contracts.
Prospective contractors need to understand these different types of DCAA audits to avoid unexpected interruptions or financial losses caused by inadequate preparation or understanding.
1. Pre-Award Audit
The DCAA conducts a pre-award audit before a contract award. This review will determine if the contractor's proposed cost and price are reasonable. Additionally, this type of audit includes reviewing the accuracy of financial information and evaluating internal accounting controls.
Free Guide
The Contractor’s Guide to DCAA Pre-Award Surveys
Discover what to expect and the steps you’ll need to take to ensure your accounting system will pass muster.
2. Post-Award Audit
After a contract award, a post-award audit will ensure that the contractor complies with the contract's requirements. This audit includes examining contracts, subcontracts, invoices, time records, travel vouchers, and other documents.
3. Progress Payment Audit
Progress payment audits are performed at various stages of a contract to verify that payments submitted by the contractor are accurate and in line with the contract details. The DCAA will also evaluate the contractor's use of funds for labor and materials.
4. Cost Allowability Audit
A cost allowability audit confirms that all costs charged to the government are reasonable, allocable, and allowable under the contract terms and conditions. This type of audit includes examining invoices, time records, travel vouchers, and other documents.
5. Closeout Audit
A closeout audit is conducted after a contract is finalized. This process inspects the final costs to ensure that all expenses charged to the government are reasonable and allowable under the contract. The DCAA will also review any claims submitted by the contractor and recommend how to properly close out the contract.
6. Incurred Cost Audit
These reviews assess a contractor's accounting system for compliance with FAR Part 31 requirements and determine whether all claimed costs were incurred and complied with applicable laws. This incurred cost audit focuses on the propriety of contractors' requests for payment from federal agencies by examining records such as timesheets, cost elements, overhead rates, and other accounts.
7. Procurement System Audits
This contractor procurement system review evaluates a contractor's procurement system processes and internal controls for acquiring property/supplies. This type of audit assesses performance in areas such as source selection, price/cost analysis, negotiation techniques, amount purchased at each procurement level, and administrative practices related to purchasing documents.
8. Forward Pricing Rate Proposals (FPRPs) Reviews
The DCAA reviews forward pricing rate proposals submitted by certain contractors concerning contracting officers' cost negotiations with them. Such reviews range from detailed examinations of accounting systems to limited studies of specific elements of cost proposals.
9. Additional Audits and Reviews
The DCAA also conducts a wide range of reviews, including performance audits to evaluate the effectiveness and efficiency of a contractor's operations, systems audits to assess the adequacy of internal controls, and compliance audits to ensure contractors meet their obligations under the contract. Additionally, the DCAA may investigate potential fraud or wrongdoing by contractors.
How to Prepare for a DCAA Audit
Preparing for a DCAA audit can be intimidating, but critical to ensuring your business complies with the requirements of FAR Part 31 and other applicable regulations.
Organizations should ensure they have the necessary documentation to pass the audit successfully. This documentation must include accurate and up-to-date records of all financial transactions, contracts, pricing estimates, labor charges, and other areas related to government contracting.
Before the actual audit, firms should implement their own internal audits to identify any areas of weakness or room for improvement before the official DCAA review. Additionally, it's vital to seek advice from a Certified Public Accountant (CPA) or tax attorney who can advise on any applicable laws that may have changed since the last audit or answer pertinent questions about potential outcomes.
To prepare for an impending audit, contractors must ensure that all accounting systems, policies, procedures, and records are up to date and accurate. This inspection includes guaranteeing adequate segregation of duties between departments within your organization and ensuring that all necessary supporting documentation is readily available.
By ensuring your business is organized and that you have a clear plan for responding to DCAA audit processes, you will have a better chance of passing the audit effectively and avoiding costly penalties or errors due to improper recordkeeping.
By taking proactive steps to prepare for a DCAA audit early, organizations can reduce their risk of adverse outcomes during an audit by a governmental agency.
A DCAA Compliance Checklist for Government Contractors
Using a DCAA compliance checklist is essential to ensure that your business meets all the requirements to pass a DCAA audit.
Your DCAA compliance checklist should include the following steps:
- Ensure that your accounting systems, policies, and procedures are up to date and accurate.
- Make sure your organization has adequate segregation of duties between departments.
- Make sure all required documents and information are readily available upon request.
- Ensure subcontractors and vendors comply with the contract's regulations.
- Have a plan for responding to DCAA audit processes in clear terms.
- Train staff on government contracting regulations to ensure everyone can answer any questions during the review.
- Connect with other government contractors who have undergone similar audits to gain insight into potential areas of scrutiny.
- Conduct regular internal audits and seek advice from knowledgeable accounting professionals.
- Review all FAR Part 31 requirements and ensure your business meets them.
By following this checklist, businesses can be better prepared for their DCAA audit and reduce the chances of any negative outcomes.
